feat(eims): accept private key/cert as raw PEM env vars

EIMS_PRIVATE_KEY / EIMS_CERTIFICATE — the PEM text pasted directly,
no encode/decode step at all. Precedence: raw PEM > base64 > path.

Motivated by the base64 path hitting a DECODER::unsupported error in
a live deployment with no way to tell whether the cause was transport
truncation, double-encoding, or an actually-bad file. Two fixes for
that class of problem together:
  - the raw-PEM var removes the encode/decode step entirely, so
    there's nothing left to corrupt in transit
  - a literal \\n (two chars) is unescaped to a real newline, for
    env stores that can't hold a literal line break
  - getPrivateKey() now checks the decoded bytes look like a PEM
    header before handing them to OpenSSL, so a still-bad value fails
    with byte count + safe preview instead of an opaque decoder error

apps/edr-freight-api/src/modules/eims/eims-credentials.provider.ts

@@ -5,6 +5,17 @@ import { ConfigService } from "@nestjs/config";
 import { EimsConfig } from "../../config/eims.config";
 import { EimsConfigException } from "./eims.errors";
 
+const PEM_HEADER = /-----BEGIN [A-Z ]*(PRIVATE KEY|CERTIFICATE)-----/;
+
+/**
+ * A safe-to-log fingerprint of decoded key/cert bytes: length + a printable-only preview of the
+ * first line. Never the actual key material — PEM headers aren't secret, the base64 body is.
+ */
+const describeBytes = (bytes: Buffer): string => {
+  const preview = bytes.toString("utf8", 0, 40).replace(/[^\x20-\x7e]/g, "?");
+  return `${bytes.length} bytes, starts with "${preview}"`;
+};
+
 /**
  * Loads the INSA-issued EIMS credentials from disk, once, and keeps them in memory.
  *
@@ -25,20 +36,50 @@ export class EimsCredentialsProvider {
   }
 
   /**
-   * RSA private key, parsed once. `privateKeyBase64` wins when set (no file I/O at all — for a
-   * container that can't be given a host bind mount); otherwise falls back to `privateKeyPath`.
-   * Throws a config error if neither is usable.
+   * RSA private key, parsed once. Three ways in, checked in this order: `privateKeyPem` (the PEM
+   * text itself, no encoding step to get wrong), `privateKeyBase64` (for stores that can't hold a
+   * literal newline), `privateKeyPath` (the original file-on-disk form). Throws a config error if
+   * none is usable.
    */
   getPrivateKey(): KeyObject {
     if (this.privateKey) return this.privateKey;
 
-    const { privateKeyBase64, privateKeyPath: path } = this.cfg;
-    const source = privateKeyBase64 ? "EIMS_PRIVATE_KEY_BASE64" : `EIMS_PRIVATE_KEY_PATH (${path})`;
-    if (!privateKeyBase64 && !path) throw new EimsConfigException("EIMS_PRIVATE_KEY_PATH is not set");
+    const { privateKeyPem, privateKeyBase64, privateKeyPath: path } = this.cfg;
+    const source = privateKeyPem
+      ? "EIMS_PRIVATE_KEY"
+      : privateKeyBase64
+        ? "EIMS_PRIVATE_KEY_BASE64"
+        : `EIMS_PRIVATE_KEY_PATH (${path})`;
+    if (!privateKeyPem && !privateKeyBase64 && !path) {
+      throw new EimsConfigException("EIMS_PRIVATE_KEY_PATH is not set");
+    }
+
+    let bytes: Buffer;
+    try {
+      bytes = privateKeyPem
+        ? Buffer.from(privateKeyPem, "utf8")
+        : privateKeyBase64
+          ? Buffer.from(privateKeyBase64, "base64")
+          : readFileSync(path);
+    } catch (err) {
+      throw new EimsConfigException(
+        `EIMS private key from ${source} could not be read or parsed: ${(err as Error).message}`,
+      );
+    }
+
+    // Fail with a diagnosable message before handing possibly-garbled bytes to OpenSSL, whose own
+    // error ("unsupported") gives no hint whether the problem is truncation, double-encoding, or a
+    // genuinely wrong file — all indistinguishable from outside without seeing the decoded bytes.
+    if (!PEM_HEADER.test(bytes.toString("utf8", 0, 100))) {
+      throw new EimsConfigException(
+        `EIMS private key from ${source} does not look like a PEM key after decoding ` +
+          `(${describeBytes(bytes)}) — check it's base64 of the raw key file with no line-wrapping ` +
+          `or truncation, and not base64 applied twice.`,
+      );
+    }
 
     let key: KeyObject;
     try {
-      const bytes = privateKeyBase64 ? Buffer.from(privateKeyBase64, "base64") : readFileSync(path);
       key = createPrivateKey(bytes);
     } catch (err) {
       // The source is operational information, not a secret; the key material never appears.
@@ -58,13 +99,19 @@ export class EimsCredentialsProvider {
   }
 
   /**
-   * Base64 of the certificate file's exact bytes. No parsing, no re-encoding. `certificateBase64`
-   * config wins when set (already base64, used as-is); otherwise read from `certificatePath`.
+   * Base64 of the certificate file's exact bytes. No parsing, no re-encoding of what MoR issued.
+   * `certificatePem`/`certificateBase64` config win when set (used as-is, or re-encoded from the
+   * pasted text respectively); otherwise read from `certificatePath`.
    */
   getCertificateBase64(): string {
     if (this.certificateBase64) return this.certificateBase64;
 
-    const { certificateBase64: inline, certificatePath: path } = this.cfg;
+    const { certificatePem: pem, certificateBase64: inline, certificatePath: path } = this.cfg;
+    if (pem) {
+      this.certificateBase64 = Buffer.from(pem, "utf8").toString("base64");
+      this.logger.log(`EIMS certificate bundle loaded from EIMS_CERTIFICATE`);
+      return this.certificateBase64;
+    }
     if (inline) {
       this.certificateBase64 = inline;
       this.logger.log(`EIMS certificate bundle loaded from EIMS_CERTIFICATE_BASE64`);

apps/edr-freight-api/src/modules/eims/eims-signer.service.spec.ts

@@ -102,6 +102,8 @@ describe("EimsCredentialsProvider", () => {
     certificatePath?: string;
     privateKeyBase64?: string;
     certificateBase64?: string;
+    privateKeyPem?: string;
+    certificatePem?: string;
   }) => new EimsCredentialsProvider({ get: () => cfg } as unknown as ConfigService);
 
   it("fails clearly when the key path is unset", () => {
@@ -137,4 +139,34 @@ describe("EimsCredentialsProvider", () => {
     const certBase64 = Buffer.from(CERTIFICATE_FIXTURE, "utf8").toString("base64");
     expect(providerFor({ certificateBase64: certBase64 }).getCertificateBase64()).toBe(certBase64);
   });
+
+  it("fails with a decoded-bytes preview when the base64 doesn't decode to a PEM key", () => {
+    // Simulates the real failure this guards against: a truncated/mangled env var still decodes
+    // as *some* bytes, but not a key — OpenSSL's own error here gives no hint why.
+    const notAKey = Buffer.from("not actually a pem file", "utf8").toString("base64");
+    expect(() => providerFor({ privateKeyBase64: notAKey }).getPrivateKey()).toThrow(
+      /does not look like a PEM key.*23 bytes, starts with "not actually a pem file"/s,
+    );
+  });
+
+  it("loads the key from the raw PEM env var directly, no encoding step", () => {
+    const pem = readFileSync(keyPath).toString("utf8");
+    const key = providerFor({ privateKeyPem: pem }).getPrivateKey();
+    expect(key.asymmetricKeyType).toBe("rsa");
+  });
+
+  it("prefers the raw PEM var over base64 and path when all three are set", () => {
+    const pem = readFileSync(keyPath).toString("utf8");
+    const key = providerFor({
+      privateKeyPem: pem,
+      privateKeyBase64: Buffer.from("garbage").toString("base64"),
+      privateKeyPath: join(dir, "nope.key"),
+    }).getPrivateKey();
+    expect(key.asymmetricKeyType).toBe("rsa");
+  });
+
+  it("loads the certificate from the raw PEM env var, re-encoded to base64", () => {
+    const base64 = providerFor({ certificatePem: CERTIFICATE_FIXTURE }).getCertificateBase64();
+    expect(base64).toBe(Buffer.from(CERTIFICATE_FIXTURE, "utf8").toString("base64"));
+  });
 });

apps/edr-freight-api/src/modules/eims/eims-test-fixtures.ts

@@ -61,6 +61,8 @@ export const eimsConfig = (over: Partial<EimsConfig> = {}): EimsConfig => ({
   certificatePath: "/dev/null",
   privateKeyBase64: "",
   certificateBase64: "",
+  privateKeyPem: "",
+  certificatePem: "",
   httpTimeoutMs: 30_000,
   tokenSkewMs: 45_000,
   autoSubmit: false,