fix(verifayda): format nested Fayda address objects into strings

apps/edr-freight-api/src/migrations/3150000000000-FixFaydaAddressShape.ts

@@ -0,0 +1,81 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/**
+ * A normalizeUserInfo bug in VerifaydaService read the raw `address#en` /
+ * `address#am` claim objects (e.g. `{ "zone#en": "...", "region#en": "...",
+ * "woreda#en": "..." }`) straight through as if they were strings, so any
+ * company verified before the fix has `attributes.ownerAddress` /
+ * `poaAddress` stored as that raw object instead of a formatted string —
+ * which crashes the portal when it tries to render it as text.
+ *
+ * Reformats every affected row's ownerAddress/poaAddress into
+ * "woreda, zone, region" (falling back to whatever #en fields are present,
+ * in that preferred order, then any leftover fields), mirroring
+ * VerifaydaService.formatFaydaAddress. Only touches rows where the field is
+ * still a jsonb object, so it's idempotent and a no-op once repaired.
+ */
+export class FixFaydaAddressShape3150000000000 implements MigrationInterface {
+  name = "FixFaydaAddressShape3150000000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      CREATE OR REPLACE FUNCTION pg_temp.format_fayda_address(addr jsonb)
+      RETURNS text AS $$
+      DECLARE
+        field_order text[] := ARRAY['houseNumber','kebele','woreda','city','subCity','zone','region','postalCode','country'];
+        f text;
+        v text;
+        parts text[] := '{}';
+        used_keys text[] := '{}';
+        kv record;
+      BEGIN
+        IF addr IS NULL OR jsonb_typeof(addr) != 'object' THEN
+          RETURN NULL;
+        END IF;
+
+        FOREACH f IN ARRAY field_order LOOP
+          v := addr ->> (f || '#en');
+          IF v IS NOT NULL AND trim(v) != '' THEN
+            parts := array_append(parts, trim(v));
+            used_keys := array_append(used_keys, f || '#en');
+          END IF;
+        END LOOP;
+
+        FOR kv IN SELECT * FROM jsonb_each_text(addr) LOOP
+          IF kv.key LIKE '%#en' AND NOT (kv.key = ANY(used_keys))
+             AND kv.value IS NOT NULL AND trim(kv.value) != '' THEN
+            parts := array_append(parts, trim(kv.value));
+          END IF;
+        END LOOP;
+
+        IF array_length(parts, 1) IS NULL THEN
+          RETURN NULL;
+        END IF;
+        RETURN array_to_string(parts, ', ');
+      END;
+      $$ LANGUAGE plpgsql;
+
+      UPDATE freight.companies
+         SET attributes = jsonb_set(
+               attributes,
+               '{ownerAddress}',
+               to_jsonb(pg_temp.format_fayda_address(attributes -> 'ownerAddress'))
+             )
+       WHERE jsonb_typeof(attributes -> 'ownerAddress') = 'object';
+
+      UPDATE freight.companies
+         SET attributes = jsonb_set(
+               attributes,
+               '{poaAddress}',
+               to_jsonb(pg_temp.format_fayda_address(attributes -> 'poaAddress'))
+             )
+       WHERE jsonb_typeof(attributes -> 'poaAddress') = 'object';
+
+      DROP FUNCTION pg_temp.format_fayda_address(jsonb);
+    `);
+  }
+
+  public async down(): Promise<void> {
+    // Data repair — not reversible (the original malformed shape isn't worth restoring).
+  }
+}

apps/edr-freight-api/src/modules/verifayda/utils/client-assertion.util.ts

@@ -7,12 +7,15 @@ export interface GenerateClientAssertionInput {
   expiresIn?: string;
 }
 
+// Mirrors the National ID Program's own reference implementation
+// (fayda-auth-python): plain {alg: RS256} header, no kid, no jti — eSignet
+// resolves the verification key from client_id alone.
 export async function generateClientAssertion(
   input: GenerateClientAssertionInput,
 ): Promise<string> {
   const privateKey = await importJWK(input.privateJwk, 'RS256');
   return new SignJWT({})
-    .setProtectedHeader({ alg: 'RS256', typ: 'JWT' })
+    .setProtectedHeader({ alg: 'RS256' })
     .setIssuer(input.clientId)
     .setSubject(input.clientId)
     .setAudience(input.audience)

apps/edr-freight-api/src/modules/verifayda/verifayda.service.ts

@@ -396,13 +396,63 @@ export class VerifaydaService {
     );
   }
 
+  // Like name/gender, address is flattened by eSignet into top-level
+  // `address#en` / `address#am` keys — but since it's a structured claim,
+  // each of those is itself an object whose *leaf* fields carry the same
+  // locale suffix again, e.g.
+  // `address#en: { "zone#en": "...", "region#en": "...", "woreda#en": "..." }`.
+  private static readonly ADDRESS_FIELD_ORDER = [
+    'houseNumber',
+    'kebele',
+    'woreda',
+    'city',
+    'subCity',
+    'zone',
+    'region',
+    'postalCode',
+    'country',
+  ];
+
+  private formatFaydaAddress(
+    address: Record<string, unknown> | undefined,
+    locale: 'en' | 'am',
+  ): string | undefined {
+    if (!address) return undefined;
+
+    const formatted = address[`formatted#${locale}`];
+    if (typeof formatted === 'string' && formatted.trim()) return formatted;
+
+    const suffix = `#${locale}`;
+    const byField = new Map<string, string>();
+    for (const [key, value] of Object.entries(address)) {
+      if (!key.endsWith(suffix) || typeof value !== 'string' || !value.trim()) continue;
+      byField.set(key.slice(0, -suffix.length), value);
+    }
+
+    const ordered = VerifaydaService.ADDRESS_FIELD_ORDER.filter((f) =>
+      byField.has(f),
+    ).map((f) => byField.get(f)!);
+    const rest = [...byField.entries()]
+      .filter(([f]) => !VerifaydaService.ADDRESS_FIELD_ORDER.includes(f))
+      .map(([, v]) => v);
+
+    const parts = [...ordered, ...rest];
+    return parts.length > 0 ? parts.join(', ') : undefined;
+  }
+
   private normalizeUserInfo(raw: FaydaUserInfo): NormalizedFaydaUserInfo {
     const nameEn   = raw['name#en'] as string | undefined;
     const nameAm   = raw['name#am'] as string | undefined;
     const genderEn = raw['gender#en'] as string | undefined;
     const genderAm = raw['gender#am'] as string | undefined;
-    const addressEn = raw['address#en'] as string | undefined;
-    const addressAm = raw['address#am'] as string | undefined;
+    const addressEn = this.formatFaydaAddress(
+      raw['address#en'] as Record<string, unknown> | undefined,
+      'en',
+    );
+    const addressAm = this.formatFaydaAddress(
+      raw['address#am'] as Record<string, unknown> | undefined,
+      'am',
+    );
     const rawPhone  = (raw.phone_number ?? raw['phone_number#en'] ?? raw['phone_number#am'] ?? raw.phone) as string | undefined;
 
     return {

apps/edr-freight-api/src/modules/verifayda/verifayda.types.ts

@@ -21,7 +21,8 @@ export interface FaydaUserInfo {
   gender?: string;
   birthdate?: string;
   picture?: string;
-  address?: Record<string, unknown>;
+  'address#en'?: Record<string, unknown>;
+  'address#am'?: Record<string, unknown>;
   [key: string]: unknown;
 }