From 325c930839223695c895959aeb45eb15b4dbcdc0 Mon Sep 17 00:00:00 2001
From: Jakob Wennberg <jakob.wennberg@gmail.com>
Date: Wed, 4 Mar 2026 21:56:27 +0100
Subject: [PATCH] fix: support production Enable Banking credentials and key
 format

- Read _PRODUCTION env var variants for APP_ID, private key, and API URL
- Handle raw base64 DER key format (production) in addition to
  base64-encoded PEM (sandbox) by auto-wrapping in PEM headers
- Make API URL configurable (sandbox: api.tilisy.com, prod: api.enablebanking.com)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .../general/enable-banking/lib/api-client.ts  |  6 +++++-
 extensions/general/enable-banking/lib/jwt.ts  | 19 +++++++++++++------
 2 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/extensions/general/enable-banking/lib/api-client.ts b/extensions/general/enable-banking/lib/api-client.ts
index 99582fb4..b74d988a 100644
--- a/extensions/general/enable-banking/lib/api-client.ts
+++ b/extensions/general/enable-banking/lib/api-client.ts
@@ -14,7 +14,11 @@
 
 import { getAuthorizationHeader } from './jwt'
 
-const ENABLE_BANKING_API_URL = 'https://api.enablebanking.com'
+// Prefer _PRODUCTION variant; sandbox uses api.tilisy.com, production uses api.enablebanking.com
+const ENABLE_BANKING_API_URL =
+  process.env.ENABLE_BANKING_API_URL_PRODUCTION ||
+  process.env.ENABLE_BANKING_API_URL ||
+  'https://api.enablebanking.com'
 
 // Types
 
diff --git a/extensions/general/enable-banking/lib/jwt.ts b/extensions/general/enable-banking/lib/jwt.ts
index dcf814ce..b5fd5dfd 100644
--- a/extensions/general/enable-banking/lib/jwt.ts
+++ b/extensions/general/enable-banking/lib/jwt.ts
@@ -7,8 +7,9 @@
 
 import * as crypto from 'crypto'
 
-const APP_ID = process.env.ENABLE_BANKING_APP_ID
-const PRIVATE_KEY_BASE64 = process.env.ENABLE_BANKING_PRIVATE_KEY
+// Prefer _PRODUCTION variants when available (Vercel production deploys)
+const APP_ID = process.env.ENABLE_BANKING_APP_ID_PRODUCTION || process.env.ENABLE_BANKING_APP_ID
+const PRIVATE_KEY_RAW = process.env.ENABLE_BANKING_PRIVATE_KEY_PRODUCTION || process.env.ENABLE_BANKING_PRIVATE_KEY
 
 interface JWTHeader {
   typ: string
@@ -29,13 +30,19 @@ function base64UrlEncode(data: Buffer | string): string {
 }
 
 function getPrivateKey(): string {
-  if (!PRIVATE_KEY_BASE64) {
+  if (!PRIVATE_KEY_RAW) {
     throw new Error('ENABLE_BANKING_PRIVATE_KEY environment variable is not set')
   }
 
-  // Decode base64 to get PEM format private key
-  const privateKeyPem = Buffer.from(PRIVATE_KEY_BASE64, 'base64').toString('utf-8')
-  return privateKeyPem
+  // Try decoding as base64-encoded PEM (sandbox format: base64 wrapping a PEM string)
+  const decoded = Buffer.from(PRIVATE_KEY_RAW, 'base64').toString('utf-8')
+  if (decoded.startsWith('-----BEGIN')) {
+    return decoded
+  }
+
+  // Otherwise treat as raw base64 DER key material — wrap in PEM headers
+  const lines = PRIVATE_KEY_RAW.match(/.{1,64}/g) || []
+  return `-----BEGIN PRIVATE KEY-----\n${lines.join('\n')}\n-----END PRIVATE KEY-----`
 }
 
 /**