Fix: hosted bank demo registration stalled after QR1 on prod

The demo-portal three-QR signup renders QR2/QR3 by peeking the plaintext
codes the server minted for the phone, from an in-memory cache. That
cache was gated `NODE_ENV !== 'production'`, so on the hosted prod box it
stayed empty: the SPA never got QR2/QR3, the phone could never commit, no
tenant_user was created, and sign-in returned pairing_did_unknown.

Gate the cache tenant-scoped instead (shouldCacheDemoCode): populate for
the demo-portal tenant in any env (+ all non-prod envs for local dev).
Real production tenants still never populate it — their codes stay
private to the phone, exactly as the module's doc comment always claimed.

Tests missed this because they run under NODE_ENV=test (gate was true).
Added regression tests pinning the demo tenant caches under prod and a
real tenant does not.

Gate: tsc + eslint + jest (54 suites, 626 passed) green.

Author: Pulkit Pareek

src/routes/demo-portal.ts

@@ -1485,9 +1485,10 @@ router.post('/sessions/:id/claim', async (req: Request, res: Response) => {
 // below are thin wrappers around the existing /v1/registrations
 // service, plus a peek endpoint that lets the SPA see each freshly
 // minted plaintext code so it can re-render the next QR. The peek
-// only reads from the in-memory demo cache (registration.ts) which
-// is populated only in non-production NODE_ENVs — production tenants
-// remain unaffected.
+// only reads from the in-memory demo cache (registration.ts), which is
+// populated for the demo-portal tenant (any env) + all non-prod envs —
+// see registration.ts::shouldCacheDemoCode. Real production tenants
+// never populate it, so their codes stay private to the phone.
 //
 import {
   startRegistration,

src/services/registration.ts

@@ -73,6 +73,7 @@ import {
   sha256Hex,
 } from './device-enrollment';
 import { recordAuditEvent } from './platform';
+import { DEMO_PORTAL_TENANT_ID } from './demo-portal-seed';
 import {
   ApiKeyEnvironment,
   Device,
@@ -135,6 +136,25 @@ export function clearPendingDemoCode(sessionId: string): void {
   demoPendingCodes.delete(sessionId);
 }
 
+/**
+ * Whether to populate the demo-code peek cache for [tenantId].
+ *
+ * The peek cache lets the demo-portal SPA render QR2/QR3 by reading the
+ * plaintext codes the server minted for the phone. It must NOT be
+ * populated for real tenants (they host their own signup page and never
+ * peek), so historically it was gated on `NODE_ENV !== 'production'`.
+ *
+ * That gate broke the HOSTED bank demo: the demo-portal tenant runs on a
+ * `NODE_ENV=production` box, so the cache stayed empty, the SPA couldn't
+ * show QR2/QR3, and registration stalled after QR1 (no commit → no user
+ * → sign-in `pairing_did_unknown`). The correct gate is tenant-scoped —
+ * exactly what this module's doc comment always claimed: cache only for
+ * the demo-portal tenant (plus all non-prod envs for local dev).
+ */
+export function shouldCacheDemoCode(tenantId: string): boolean {
+  return process.env.NODE_ENV !== 'production' || tenantId === DEMO_PORTAL_TENANT_ID;
+}
+
 /**
  * Length of the challenge nonce baked into QR3. 62 hex chars = 31 bytes.
  *
@@ -333,7 +353,7 @@ export async function startRegistration(
   }).catch(err => logger.warn('Failed to record audit event', { error: (err as Error).message }));
 
   const pairDeeplink = `zeroauth://reg?step=pair&session=${session.id}&code=${encodeURIComponent(code)}`;
-  if (process.env.NODE_ENV !== 'production') {
+  if (shouldCacheDemoCode(tenantId)) {
     cachePendingDemoCode(session.id, { step: 'pair', code, deeplink: pairDeeplink });
   }
 
@@ -449,7 +469,7 @@ export async function pairDeviceForRegistration(input: {
     }).catch(err => logger.warn('Failed to record audit event', { error: (err as Error).message }));
 
     const enrollDeeplink = `zeroauth://reg?step=enroll&session=${session.id}&code=${encodeURIComponent(nextCode)}`;
-    if (process.env.NODE_ENV !== 'production') {
+    if (shouldCacheDemoCode(session.tenant_id)) {
       cachePendingDemoCode(session.id, { step: 'enroll', code: nextCode, deeplink: enrollDeeplink });
     }
     return {
@@ -555,7 +575,7 @@ export async function submitCommitmentForRegistration(input: {
     }).catch(err => logger.warn('Failed to record audit event', { error: (err as Error).message }));
 
     const verifyDeeplink = `zeroauth://reg?step=verify&session=${session.id}&code=${encodeURIComponent(nextCode)}&challenge=${challengeNonce}`;
-    if (process.env.NODE_ENV !== 'production') {
+    if (shouldCacheDemoCode(session.tenant_id)) {
       cachePendingDemoCode(session.id, { step: 'verify', code: nextCode, deeplink: verifyDeeplink, challengeNonce });
     }
     return {

tests/registration-flow.test.ts

@@ -36,10 +36,13 @@ import {
   completeRegistration,
   getRegistrationSession,
   pairDeviceForRegistration,
+  peekPendingDemoCode,
   RegistrationStateError,
+  shouldCacheDemoCode,
   startRegistration,
   submitCommitmentForRegistration,
 } from '../src/services/registration';
+import { DEMO_PORTAL_TENANT_ID } from '../src/services/demo-portal-seed';
 
 const TENANT = 'tenant-A';
 const ENV = 'live' as const;
@@ -401,3 +404,68 @@ describe('RegistrationStateError reasons', () => {
     expect(e.message).toBe('challenge_mismatch');
   });
 });
+
+// ─── Regression: demo-code peek cache gating (prod hosted demo) ─────────
+//
+// The hosted bank demo (zeroauth.dev/bank-demo) runs the demo-portal
+// tenant on a NODE_ENV=production box. The SPA renders QR2/QR3 by peeking
+// the plaintext codes the server minted for the phone. That peek cache
+// was gated `NODE_ENV !== 'production'`, so on prod it stayed empty →
+// QR2/QR3 never rendered → registration stalled after QR1 → no user →
+// sign-in `pairing_did_unknown`. Tests missed it because they run under
+// NODE_ENV=test (gate was true). These pin the tenant-scoped gate.
+
+describe('demo-code peek cache gating (shouldCacheDemoCode)', () => {
+  const origEnv = process.env.NODE_ENV;
+  afterEach(() => { process.env.NODE_ENV = origEnv; });
+
+  it('caches for ANY tenant when not in production (local dev / tests)', () => {
+    process.env.NODE_ENV = 'test';
+    expect(shouldCacheDemoCode('some-real-tenant')).toBe(true);
+    expect(shouldCacheDemoCode(DEMO_PORTAL_TENANT_ID)).toBe(true);
+  });
+
+  it('caches for the demo-portal tenant in production (hosted bank demo)', () => {
+    process.env.NODE_ENV = 'production';
+    expect(shouldCacheDemoCode(DEMO_PORTAL_TENANT_ID)).toBe(true);
+  });
+
+  it('does NOT cache for a real tenant in production (codes stay private to the phone)', () => {
+    process.env.NODE_ENV = 'production';
+    expect(shouldCacheDemoCode('some-real-tenant')).toBe(false);
+  });
+
+  it('regression: startRegistration for the demo tenant under prod populates the peek cache', async () => {
+    process.env.NODE_ENV = 'production';
+    const sid = 'demo-prod-sess-regression';
+    mockQuery.mockResolvedValueOnce({
+      rows: [{ id: sid, tenant_id: DEMO_PORTAL_TENANT_ID, environment: 'live', state: 'awaiting_device', profile: {} }],
+      rowCount: 1,
+    });
+    await startRegistration(
+      DEMO_PORTAL_TENANT_ID,
+      'live',
+      { profile: { name: 'Demo', email: 'demo@neobank.example' } },
+      { type: 'api_key', id: null },
+    );
+    const cached = peekPendingDemoCode(sid);
+    expect(cached).not.toBeNull();
+    expect(cached?.step).toBe('pair');
+  });
+
+  it('regression: startRegistration for a REAL tenant under prod does NOT populate the cache', async () => {
+    process.env.NODE_ENV = 'production';
+    const sid = 'real-prod-sess-regression';
+    mockQuery.mockResolvedValueOnce({
+      rows: [{ id: sid, tenant_id: 'real-tenant-xyz', environment: 'live', state: 'awaiting_device', profile: {} }],
+      rowCount: 1,
+    });
+    await startRegistration(
+      'real-tenant-xyz',
+      'live',
+      { profile: { name: 'Real', email: 'real@bank.example' } },
+      { type: 'api_key', id: 'k-real' },
+    );
+    expect(peekPendingDemoCode(sid)).toBeNull();
+  });
+});