fix(settings-proxy): prefer SMS shared secret for product push auth

src/settings-proxy/settings-proxy.service.ts

@@ -22,9 +22,9 @@ export class SettingsProxyService {
 
   async getSettings(tenantId: string) {
     const tenant = await this.requireTenant(tenantId);
-    const auth = this.buildAuthHeaders(tenant, 'GET');
+    const authModes = this.buildAuthAttempts(tenant, 'GET');
 
-    if (!auth) {
+    if (!authModes.length) {
       return {
         stub: true,
         message:
@@ -39,13 +39,17 @@ export class SettingsProxyService {
     }
 
     try {
-      const { data } = await axios.get(this.resolveSettingsUrl(tenant.nodeServer), {
+      const { data } = await this.requestWithAuthFallback(
+        authModes,
+        async (auth) =>
+          axios.get(this.resolveSettingsUrl(tenant.nodeServer), {
             headers: {
-          ...auth,
+              ...auth.headers,
               Accept: 'application/json',
             },
             timeout: 15000,
-      });
+          }),
+      );
       return { stub: false, settings: data };
     } catch (error) {
       throw new BadGatewayException(
@@ -60,9 +64,9 @@ export class SettingsProxyService {
     userId?: string,
   ) {
     const tenant = await this.requireTenant(tenantId);
-    const auth = this.buildAuthHeaders(tenant, 'POST');
+    const authModes = this.buildAuthAttempts(tenant, 'POST');
 
-    if (!auth) {
+    if (!authModes.length) {
       await this.audit.log({
         action: 'settings.proxy.stub_update',
         entityType: 'tenant_settings',
@@ -82,17 +86,17 @@ export class SettingsProxyService {
     }
 
     try {
-      const { data } = await axios.post(
-        this.resolveSettingsUrl(tenant.nodeServer),
-        payload,
-        {
+      const { data, authMode } = await this.requestWithAuthFallback(
+        authModes,
+        async (auth) =>
+          axios.post(this.resolveSettingsUrl(tenant.nodeServer), payload, {
             headers: {
-            ...auth,
+              ...auth.headers,
               Accept: 'application/json',
               'Content-Type': 'application/json',
             },
             timeout: 20000,
-        },
+          }),
       );
 
       await this.audit.log({
@@ -103,7 +107,7 @@ export class SettingsProxyService {
         userId,
         after: payload as Prisma.InputJsonValue,
         meta: {
-          authMode: auth.Authorization ? 'bearer' : 'hmac',
+          authMode,
         } as Prisma.InputJsonValue,
       });
 
@@ -116,12 +120,14 @@ export class SettingsProxyService {
   }
 
   /**
-   * Auth to product:
-   * 1) Tenant remoteApiToken as Bearer (per-tenant)
-   * 2) Else SMS shared secret as Bearer (CDN-safe; same secret as SMS)
-   *    + optional HMAC headers for non-CDN installs
+   * Auth to product (order matters):
+   * 1) SMS shared secret as Bearer (+ optional HMAC) — matches production installs
+   * 2) Tenant remoteApiToken as Bearer fallback (only if product SUPERADMIN_REMOTE_TOKEN matches)
+   *
+   * Preferring remoteApiToken first caused HTTP 401 when SA had a stale/mismatched token
+   * while the product only accepted SUPERADMIN_SMS_SHARED_SECRET.
    */
-  private buildAuthHeaders(
+  private buildAuthAttempts(
     tenant: {
       remoteApiToken: string | null;
       domain: string | null;
@@ -129,19 +135,16 @@ export class SettingsProxyService {
       nodeServer: string | null;
     },
     method: 'GET' | 'POST',
-  ): Record<string, string> | null {
-    const token = String(tenant.remoteApiToken || '').trim();
-    if (token) {
-      return { Authorization: `Bearer ${token}` };
-    }
+  ): Array<{ mode: 'shared_secret' | 'remote_token'; headers: Record<string, string> }> {
+    const attempts: Array<{
+      mode: 'shared_secret' | 'remote_token';
+      headers: Record<string, string>;
+    }> = [];
 
     const shared = String(
       this.config.get<string>('SMS_REMOTE_SHARED_SECRET') || '',
     ).trim();
-    if (!shared) {
-      return null;
-    }
-
+    if (shared) {
       // Bearer with shared secret survives CDNs that strip custom X-* headers.
       const headers: Record<string, string> = {
         Authorization: `Bearer ${shared}`,
@@ -159,7 +162,49 @@ export class SettingsProxyService {
         headers['X-Abshode-Signature'] = signature;
       }
 
-    return headers;
+      attempts.push({ mode: 'shared_secret', headers });
+    }
+
+    const token = String(tenant.remoteApiToken || '').trim();
+    if (token) {
+      attempts.push({
+        mode: 'remote_token',
+        headers: { Authorization: `Bearer ${token}` },
+      });
+    }
+
+    return attempts;
+  }
+
+  private async requestWithAuthFallback<T>(
+    attempts: Array<{
+      mode: 'shared_secret' | 'remote_token';
+      headers: Record<string, string>;
+    }>,
+    request: (auth: {
+      mode: 'shared_secret' | 'remote_token';
+      headers: Record<string, string>;
+    }) => Promise<{ data: T }>,
+  ): Promise<{ data: T; authMode: 'shared_secret' | 'remote_token' }> {
+    let lastError: unknown;
+
+    for (let i = 0; i < attempts.length; i++) {
+      const auth = attempts[i];
+      try {
+        const { data } = await request(auth);
+        return { data, authMode: auth.mode };
+      } catch (error) {
+        lastError = error;
+        const status = axios.isAxiosError(error) ? error.response?.status : undefined;
+        const canRetry =
+          i < attempts.length - 1 && (status === 401 || status === 403);
+        if (!canRetry) {
+          throw error;
+        }
+      }
+    }
+
+    throw lastError ?? new Error('settings proxy auth failed');
   }
 
   private resolveTenantDomain(tenant: {