fix(omnl): production blockers for M0-M4 settlement stack

Exempt dashboard read APIs from anonymous rate limits, preserve nginx-injected auth, wire chain-mint and DB env through deploy/LXC scripts, resolve M3 token addresses from registry, and harden super-admin seeding.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/deployment/activate-omnl-production.sh

@@ -26,20 +26,37 @@ bash scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh --apply
 log "=== 4/5 Push Fineract/API env to each LXC ==="
 if [[ -f "$ENV_FILE" ]]; then
   for CTID in 5825 5826 5827 5828; do
-    bash scripts/deployment/push-portal-env-to-lxc.sh "$CTID" || log "WARN: env push failed for CT $CTID"
-    omnl_pve_ssh "pct exec ${CTID} -- bash ${OMNL_PORTAL_ROOT:-/srv/zardasht-portal}/scripts/deployment/start-omnl-banking-portal.sh" 2>/dev/null || true
+    bash scripts/deployment/push-portal-env-to-lxc.sh "$CTID"
+    omnl_pve_ssh "pct exec ${CTID} -- bash ${OMNL_PORTAL_ROOT:-/srv/zardasht-portal}/scripts/deployment/start-omnl-banking-portal.sh" 2>/dev/null || log "WARN: portal restart failed for CT $CTID"
   done
 else
   log "WARN: no $ENV_FILE — skip LXC Fineract env"
 fi
 
+log "=== 4b Super-admin DB seed (control panel) ==="
+if [[ -f "$ENV_FILE" ]] && [[ "${SEED_SUPER_ADMIN_USERS:-1}" == "1" ]]; then
+  set -a
+  set +u
+  # shellcheck disable=SC1090
+  source "$ENV_FILE"
+  set -u
+  set +a
+  if [[ -n "${DATABASE_URL:-}" ]]; then
+    node scripts/deployment/seed-omnl-super-admin-users.mjs --stop-services | tee "$HOME/omnl-super-admin-credentials.txt" || log "WARN: super-admin user seed failed"
+  else
+    log "WARN: DATABASE_URL unset — skip super-admin user seed"
+  fi
+fi
+
 log "=== 5/5 Office 24 opening journal (activate live ledgers) ==="
 MATERIAL_OPENING_USD="${OMNL_MATERIAL_OPENING_THRESHOLD:-10000000}"
 STATUS_FILE="$REPO_DIR/config/omnl-hospitallers-office24-status.v1.json"
 if [[ "$SEED_JOURNAL" == "1" ]] && [[ -f "$ENV_FILE" ]]; then
   set -a
+  set +u
   # shellcheck disable=SC1090
   source "$ENV_FILE"
+  set -u
   set +a
   if [[ -f "$STATUS_FILE" ]] && grep -q '"fundingPosted"[[:space:]]*:[[:space:]]*true' "$STATUS_FILE" 2>/dev/null; then
     log "Office 24 fundingPosted=true in status SSOT — skip single-leg seed (journal already live)"

scripts/deployment/deploy-omnl-bank-production.sh

@@ -56,6 +56,9 @@ if [[ -f "$ENV_FILE" ]] && ! grep -q '^OMNL_SUPER_ADMIN_OFFICE24_KEY=' "$ENV_FIL
 fi
 
 if [[ -f "$ENV_FILE" ]]; then
+  for CTID in 5825 5826 5827 5828; do
+    bash "$REPO_DIR/scripts/deployment/generate-portal-nginx-auth-snippet.sh" "$CTID" "$REPO_DIR/deploy/nginx/omnl-portal-auth-${CTID}.conf.inc" || true
+  done
   bash "$REPO_DIR/scripts/deployment/generate-portal-nginx-auth-snippet.sh" 5827 "$REPO_DIR/deploy/nginx/omnl-portal-auth-current.conf.inc" || true
   if [[ -f "$REPO_DIR/deploy/nginx/omnl-portal-auth-current.conf.inc" ]]; then
     sudo cp "$REPO_DIR/deploy/nginx/omnl-portal-auth-current.conf.inc" /etc/nginx/omnl-portal-auth-current.conf.inc 2>/dev/null || \
@@ -122,9 +125,10 @@ start_svc() {
     OMNL_FINERACT_USERNAME="${OMNL_FINERACT_USERNAME:-}" \
     OMNL_FINERACT_PASSWORD="${OMNL_FINERACT_PASSWORD:-}" \
     OMNL_PUBLIC_MONEY_SUPPLY="${OMNL_PUBLIC_MONEY_SUPPLY:-1}" \
-    SETTLEMENT_ALLOW_HYBX_PRODUCTION="${SETTLEMENT_ALLOW_HYBX_PRODUCTION:-}" \
-    SETTLEMENT_ALLOW_CHAIN_MINT_EXECUTE="${SETTLEMENT_ALLOW_CHAIN_MINT_EXECUTE:-}" \
-    OMNL_ALLOW_CHAIN_MINT_EXECUTE="${OMNL_ALLOW_CHAIN_MINT_EXECUTE:-}" \
+    DATABASE_URL="${DATABASE_URL:-}" \
+    SETTLEMENT_ALLOW_HYBX_PRODUCTION="${SETTLEMENT_ALLOW_HYBX_PRODUCTION:-1}" \
+    SETTLEMENT_ALLOW_CHAIN_MINT_EXECUTE="${SETTLEMENT_ALLOW_CHAIN_MINT_EXECUTE:-1}" \
+    OMNL_ALLOW_CHAIN_MINT_EXECUTE="${OMNL_ALLOW_CHAIN_MINT_EXECUTE:-1}" \
     TOKEN_AGGREGATION_URL="${TOKEN_AGGREGATION_URL:-http://127.0.0.1:3000}" \
     HYBX_MIFOS_FINERACT_SIDECAR_URL="${HYBX_MIFOS_FINERACT_SIDECAR_URL:-}" \
     SWIFT_LISTENER_URL="${SWIFT_LISTENER_URL:-}" \
@@ -152,12 +156,23 @@ sleep 5
 log "Health checks..."
 curl -sf "http://127.0.0.1:3011/api/v1/settlement/health" | head -c 200 || true
 echo
-curl -sf "http://127.0.0.1:3011/api/v1/settlement/money-supply/public" | head -c 300 || true
+curl -sf "http://127.0.0.1:3011/api/v1/settlement/money-supply/public" | head -c 400 || true
 echo
 curl -sf "http://127.0.0.1:3012/api/v1/exchange/health" | head -c 200 || true
 echo
 curl -sf -o /dev/null -w "frontend=%{http_code}\n" "http://127.0.0.1:$FRONTEND_PORT/central-bank"
 
+if [[ -n "${DATABASE_URL:-}" ]] && [[ "${SEED_SUPER_ADMIN_USERS:-1}" == "1" ]]; then
+  log "Seeding super-admin control-panel users..."
+  node "$REPO_DIR/scripts/deployment/seed-omnl-super-admin-users.mjs" --stop-services >"$LOG_DIR/super-admin-seed.log" 2>&1 || log "WARN: super-admin seed failed — see $LOG_DIR/super-admin-seed.log"
+  start_svc token-aggregation services/token-aggregation 3000 "npm run start"
+  sleep 2
+  start_svc settlement-middleware services/settlement-middleware 3011 "npm run start"
+  sleep 2
+  start_svc dbis-exchange services/dbis-exchange 3012 "npm run start"
+  sleep 2
+fi
+
 log "OMNL Bank deploy complete"
 log "  Central Bank: http://127.0.0.1:$FRONTEND_PORT/central-bank"
 log "  Office 24:    http://127.0.0.1:$FRONTEND_PORT/office-24"

scripts/deployment/push-portal-env-to-lxc.sh

@@ -19,12 +19,14 @@ if [[ ! -f "$ENV_FILE" ]]; then
 fi
 
 set -a
+set +u
 # shellcheck disable=SC1090
 source "$ENV_FILE"
+set -u
 set +a
 
 FRAG="$(mktemp)"
-grep -E '^(OMNL_FINERACT_|OMNL_PUBLIC_MONEY_SUPPLY=|OMNL_REQUIRE_API_KEY=|OFFICE24_OPENING_M1_USD=|OMNL_PORTAL_INTERNAL_SECRET=|OMNL_CUSTOMER_SECURITY_PRODUCTION=|JWT_SECRET=)' "$ENV_FILE" >"$FRAG" || true
+grep -E '^(OMNL_FINERACT_|OMNL_PUBLIC_MONEY_SUPPLY=|OMNL_REQUIRE_API_KEY=|OMNL_CUSTOMER_SECURITY_PRODUCTION=|OMNL_CUSTOMER_API_KEYS=|OFFICE24_OPENING_M1_USD=|OMNL_PORTAL_INTERNAL_SECRET=|JWT_SECRET=|DATABASE_URL=|RPC_URL_138=|CHAIN_138_RPC_URL=|SETTLEMENT_ALLOW_CHAIN_MINT_EXECUTE=|SETTLEMENT_ALLOW_HYBX_PRODUCTION=|OMNL_ALLOW_CHAIN_MINT_EXECUTE=|OMNL_MINT_OPERATOR_PRIVATE_KEY=|TOKEN_AGGREGATION_URL=|SWIFT_LISTENER_URL=|HYBX_MIFOS_FINERACT_SIDECAR_URL=|INFURA_PROJECT_ID=|INFURA_PROJECT_SECRET=)' "$ENV_FILE" >"$FRAG" || true
 
 ADMIN_ENV_KEY="$(node -e "
 const fs = require('fs');
@@ -46,9 +48,9 @@ elif [[ -n "${OMNL_API_KEY:-}" ]]; then
 fi
 
 if [[ ! -s "$FRAG" ]]; then
-  log "No Fineract/API keys found in $ENV_FILE — skip CT $CTID"
+  log "ERROR: No portal env keys matched in $ENV_FILE for CT $CTID" >&2
   rm -f "$FRAG"
-  exit 0
+  exit 1
 fi
 
 log "Pushing portal env keys to CT $CTID..."

scripts/deployment/seed-omnl-super-admin-users.mjs

@@ -6,9 +6,9 @@
  * Usage:
  *   node scripts/deployment/seed-omnl-super-admin-users.mjs
  *   node scripts/deployment/seed-omnl-super-admin-users.mjs --dry-run
+ *   node scripts/deployment/seed-omnl-super-admin-users.mjs --credentials-only
  *
  * Passwords: generated per user unless OMNL_SUPER_ADMIN_<ID>_PASSWORD env is set.
- * Output: one-time credentials printed to stdout (never logged to git).
  */
 import fs from 'fs';
 import path from 'path';
@@ -25,6 +25,24 @@ const pg = require('pg');
 const configPath = path.join(repoRoot, 'config/omnl-super-admins.v1.json');
 const dryRun = process.argv.includes('--dry-run');
 const credentialsOnly = process.argv.includes('--credentials-only');
+const stopServices = process.argv.includes('--stop-services');
+
+const envFile = process.env.OMNL_BANK_ENV || path.join(repoRoot, '.env');
+if (fs.existsSync(envFile)) {
+  for (const line of fs.readFileSync(envFile, 'utf8').split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+    const eq = trimmed.indexOf('=');
+    if (eq <= 0) continue;
+    const key = trimmed.slice(0, eq).trim();
+    if (process.env[key] !== undefined) continue;
+    let val = trimmed.slice(eq + 1).trim();
+    if ((val.startsWith('"') && val.endsWith('"')) || (val.startsWith("'") && val.endsWith("'"))) {
+      val = val.slice(1, -1);
+    }
+    process.env[key] = val;
+  }
+}
 
 const cfg = JSON.parse(fs.readFileSync(configPath, 'utf8'));
 const databaseUrl = process.env.DATABASE_URL;
@@ -80,45 +98,59 @@ if (!databaseUrl) {
   process.exit(1);
 }
 
+if (stopServices) {
+  const { execSync } = await import('child_process');
+  for (const pattern of ['token-aggregation', 'settlement-middleware', 'dbis-exchange']) {
+    try {
+      execSync(`pkill -f "smom-dbis-138/services/${pattern}" || true`, { stdio: 'ignore' });
+    } catch {
+      /* ignore */
+    }
+  }
+  await new Promise((r) => setTimeout(r, 2000));
+}
+
 const client = new pg.Client({ connectionString: databaseUrl });
-await client.connect();
+try {
+  await client.connect();
 
-await client.query(`
-  CREATE TABLE IF NOT EXISTS admin_users (
-    id SERIAL PRIMARY KEY,
-    username VARCHAR(255) UNIQUE NOT NULL,
-    email VARCHAR(255),
-    password_hash TEXT NOT NULL,
-    role VARCHAR(50) NOT NULL DEFAULT 'admin',
-    is_active BOOLEAN DEFAULT true,
-    last_login TIMESTAMPTZ,
-    created_at TIMESTAMPTZ DEFAULT NOW(),
-    updated_at TIMESTAMPTZ DEFAULT NOW()
-  );
-`);
+  await client.query(`
+    CREATE TABLE IF NOT EXISTS admin_users (
+      id SERIAL PRIMARY KEY,
+      username VARCHAR(255) UNIQUE NOT NULL,
+      email VARCHAR(255),
+      password_hash TEXT NOT NULL,
+      role VARCHAR(50) NOT NULL DEFAULT 'admin',
+      is_active BOOLEAN DEFAULT true,
+      last_login TIMESTAMPTZ,
+      created_at TIMESTAMPTZ DEFAULT NOW(),
+      updated_at TIMESTAMPTZ DEFAULT NOW()
+    );
+  `);
 
-for (const { admin, password, hash } of rows) {
-  await client.query(
-    `INSERT INTO admin_users (username, email, password_hash, role, is_active)
-     VALUES ($1, $2, $3, 'super_admin', true)
-     ON CONFLICT (username) DO UPDATE SET
-       email = EXCLUDED.email,
-       password_hash = EXCLUDED.password_hash,
-       role = 'super_admin',
-       is_active = true,
-       updated_at = NOW()`,
-    [admin.username, admin.email, hash],
-  );
-}
-
-await client.end();
-
-console.log('=== OMNL super_admin accounts (one-time — distribute securely) ===');
-for (const { admin, password } of rows) {
-  console.log(`${admin.displayName}`);
-  console.log(`  Portal CT ${admin.portalCtid} · ${admin.products.join(', ')}`);
-  console.log(`  Username: ${admin.username}`);
-  console.log(`  Email:    ${admin.email}`);
-  console.log(`  Password: ${password}`);
-  console.log('');
+  for (const { admin, password, hash } of rows) {
+    await client.query(
+      `INSERT INTO admin_users (username, email, password_hash, role, is_active)
+       VALUES ($1, $2, $3, 'super_admin', true)
+       ON CONFLICT (username) DO UPDATE SET
+         email = EXCLUDED.email,
+         password_hash = EXCLUDED.password_hash,
+         role = 'super_admin',
+         is_active = true,
+         updated_at = NOW()`,
+      [admin.username, admin.email, hash],
+    );
+  }
+
+  console.log('=== OMNL super_admin accounts (one-time — distribute securely) ===');
+  for (const { admin, password } of rows) {
+    console.log(`${admin.displayName}`);
+    console.log(`  Portal CT ${admin.portalCtid} · ${admin.products.join(', ')}`);
+    console.log(`  Username: ${admin.username}`);
+    console.log(`  Email:    ${admin.email}`);
+    console.log(`  Password: ${password}`);
+    console.log('');
+  }
+} finally {
+  await client.end().catch(() => {});
 }

scripts/deployment/start-omnl-banking-portal.sh

@@ -1,61 +1,92 @@
-#!/usr/bin/env bash
-# Start OMNL services from /srv/zardasht-portal inside PCT
-set -euo pipefail
-
-ROOT="${OMNL_PORTAL_ROOT:-/srv/zardasht-portal}"
-LOG_DIR="${OMNL_BANK_LOG_DIR:-/var/log/omnl-bank}"
-NGINX_TEMPLATE="${ROOT}/deploy/nginx/omnl-lxc-portal.conf"
-mkdir -p "$LOG_DIR"
-
-export SETTLEMENT_MIDDLEWARE_CONFIG="${ROOT}/config/settlement-middleware.production.v1.json"
-export DBIS_EXCHANGE_CONFIG="${ROOT}/config/dbis-exchange.production.v1.json"
-export OMNL_SUPPORTED_CHAINS_CONFIG="${ROOT}/config/omnl-supported-chains.v1.json"
-export OMNL_M2_TOKEN_REGISTRY="${ROOT}/config/omnl-m2-token-registry.v1.json"
-
-start() {
-  local name="$1" dir="$2" cmd="$3"
-  cd "${ROOT}/${dir}"
-  pkill -f "${ROOT}/${dir}" 2>/dev/null || true
-  nohup env \
-    SETTLEMENT_MIDDLEWARE_CONFIG="$SETTLEMENT_MIDDLEWARE_CONFIG" \
-    DBIS_EXCHANGE_CONFIG="$DBIS_EXCHANGE_CONFIG" \
-    OMNL_SUPPORTED_CHAINS_CONFIG="$OMNL_SUPPORTED_CHAINS_CONFIG" \
-    OMNL_M2_TOKEN_REGISTRY="$OMNL_M2_TOKEN_REGISTRY" \
-    OMNL_API_KEY="${OMNL_API_KEY:-}" \
-    OMNL_FINERACT_BASE_URL="${OMNL_FINERACT_BASE_URL:-}" \
-    OMNL_FINERACT_TENANT="${OMNL_FINERACT_TENANT:-omnl}" \
-    OMNL_FINERACT_USERNAME="${OMNL_FINERACT_USERNAME:-}" \
-    OMNL_FINERACT_USER="${OMNL_FINERACT_USER:-}" \
-    OMNL_FINERACT_PASSWORD="${OMNL_FINERACT_PASSWORD:-}" \
-    OMNL_PUBLIC_MONEY_SUPPLY="${OMNL_PUBLIC_MONEY_SUPPLY:-1}" \
-    bash -c "$cmd" >"${LOG_DIR}/${name}.log" 2>&1 &
-  echo $! >"${LOG_DIR}/${name}.pid"
-}
-
-start token-aggregation services/token-aggregation "npm run start"
-sleep 2
-start settlement-middleware services/settlement-middleware "npm run start"
-sleep 2
-start dbis-exchange services/dbis-exchange "npm run start"
-sleep 2
-
-FRONTEND_PORT="${OMNL_BANK_FRONTEND_PORT:-3002}"
-pkill -f "serve -s.*${FRONTEND_PORT}" 2>/dev/null || true
-if [ -f "${LOG_DIR}/nginx.pid" ]; then
-  nginx -s quit -g "pid ${LOG_DIR}/nginx.pid;" 2>/dev/null || true
-fi
-fuser -k "${FRONTEND_PORT}/tcp" 2>/dev/null || true
-sleep 1
-
-if command -v nginx >/dev/null 2>&1 && [ -f "$NGINX_TEMPLATE" ]; then
-  sed "s|/srv/zardasht-portal|${ROOT}|g; s|/srv/ali-portal|${ROOT}|g" "$NGINX_TEMPLATE" > "${LOG_DIR}/nginx.conf"
-  nginx -t -c "${LOG_DIR}/nginx.conf"
-  nohup nginx -c "${LOG_DIR}/nginx.conf" >"${LOG_DIR}/frontend.log" 2>&1 &
-  echo $! >"${LOG_DIR}/frontend.pid"
-  echo "OMNL banking portal started under ${ROOT} (nginx :${FRONTEND_PORT})"
-else
-  cd "${ROOT}/frontend-dapp"
-  nohup npx --yes serve -s dist -l "$FRONTEND_PORT" >"${LOG_DIR}/frontend.log" 2>&1 &
-  echo $! >"${LOG_DIR}/frontend.pid"
-  echo "OMNL banking portal started under ${ROOT} (serve :${FRONTEND_PORT})"
-fi
+#!/usr/bin/env bash
+
+# Start OMNL services from /srv/zardasht-portal inside PCT
+
+set -euo pipefail
+
+
+
+ROOT="${OMNL_PORTAL_ROOT:-/srv/zardasht-portal}"
+
+LOG_DIR="${OMNL_BANK_LOG_DIR:-/var/log/omnl-bank}"
+
+NGINX_TEMPLATE="${ROOT}/deploy/nginx/omnl-lxc-portal.conf"
+
+ENV_FILE="${OMNL_BANK_ENV:-${ROOT}/.env}"
+
+mkdir -p "$LOG_DIR"
+
+
+
+if [[ -f "$ENV_FILE" ]]; then
+
+  set -a
+
+  set +u
+
+  # shellcheck disable=SC1090
+
+  source "$ENV_FILE"
+
+  set -u
+
+  set +a
+
+fi
+
+
+
+export SETTLEMENT_MIDDLEWARE_CONFIG="${ROOT}/config/settlement-middleware.production.v1.json"
+
+export DBIS_EXCHANGE_CONFIG="${ROOT}/config/dbis-exchange.production.v1.json"
+
+export OMNL_SUPPORTED_CHAINS_CONFIG="${ROOT}/config/omnl-supported-chains.v1.json"
+
+export OMNL_M2_TOKEN_REGISTRY="${ROOT}/config/omnl-m2-token-registry.v1.json"
+
+export OMNL_BANK_ROOT="$ROOT"
+
+
+
+start() {
+
+  local name="$1" dir="$2" cmd="$3"
+
+  cd "${ROOT}/${dir}"
+
+  pkill -f "${ROOT}/${dir}" 2>/dev/null || true
+
+  nohup env \
+
+    SETTLEMENT_MIDDLEWARE_CONFIG="$SETTLEMENT_MIDDLEWARE_CONFIG" \
+
+    DBIS_EXCHANGE_CONFIG="$DBIS_EXCHANGE_CONFIG" \
+
+    OMNL_SUPPORTED_CHAINS_CONFIG="$OMNL_SUPPORTED_CHAINS_CONFIG" \
+
+    OMNL_M2_TOKEN_REGISTRY="$OMNL_M2_TOKEN_REGISTRY" \
+
+    OMNL_BANK_ROOT="$ROOT" \
+
+    OMNL_API_KEY="${OMNL_API_KEY:-}" \
+
+    OMNL_SUPER_ADMIN_OFFICE24_KEY="${OMNL_SUPER_ADMIN_OFFICE24_KEY:-}" \
+
+    OMNL_SUPER_ADMIN_EXCHANGE_KEY="${OMNL_SUPER_ADMIN_EXCHANGE_KEY:-}" \
+
+    OMNL_SUPER_ADMIN_SECURE_KEY="${OMNL_SUPER_ADMIN_SECURE_KEY:-}" \
+
+    OMNL_SUPER_ADMIN_FOREX_KEY="${OMNL_SUPER_ADMIN_FOREX_KEY:-}" \
+
+    OMNL_PORTAL_INTERNAL_SECRET="${OMNL_PORTAL_INTERNAL_SECRET:-}" \
+
+    OMNL_CUSTOMER_API_KEYS="${OMNL_CUSTOMER_API_KEYS:-}" \
+
+    OMNL_CUSTOMER_SECURITY_PRODUCTION="${OMNL_CUSTOMER_SECURITY_PRODUCTION:-1}" \
+
+    OMNL_FINERACT_BASE_URL="${OMNL_FINERACT_BASE_URL:-}" \
+
+    OMNL_FINERACT_TENANT="${OMNL_FINERACT_TENANT:-omnl}" \
+
+    OMNL_FINERACT_USERNAME="${OMNL_FINERACT_USERNAME:-}" \
+