@agirails/sdk 2.0.0 → 2.0.1-beta

package/src/utils/NonceManager.ts

@@ -2,21 +2,7 @@
  * Nonce Manager Implementation
  * Tracks nonces per DID + message type for AIP-4 delivery proofs
  * Reference: AIP-4 §3.2 (nonce field requirement)
- *
- * SECURITY FIXES:
- * - C-2: Added atomic nonce allocation with locking
- * - H-1: Added persistent nonce storage option
- * - H-5: Added nonce upper bound validation
- */
-
-import { assertSafeFileForRead, ensureSafeDir, ensureSafeFile } from './fsSafe';
-
-/**
- * Maximum allowed nonce value.
- * SECURITY FIX (H-5): Prevents nonce overflow attacks.
- * Using Number.MAX_SAFE_INTEGER (2^53 - 1) to ensure safe JavaScript integer operations.
  */
-export const MAX_NONCE_VALUE = Number.MAX_SAFE_INTEGER;
 
 /**
  * Nonce Manager Interface (from DeliveryProofBuilder)
@@ -54,10 +40,6 @@ export interface NonceManager {
  * In-Memory Nonce Manager
  * Simple implementation using Map for per-message-type nonce tracking
  *
- * SECURITY FIXES:
- * - C-2: Added atomic getAndIncrementNonce() to prevent race conditions
- * - H-5: Added nonce upper bound validation
- *
  * ⚠️ WARNING: Nonces are lost on process restart. For production:
  * - Use persistent storage (Redis, PostgreSQL, etc.)
  * - Implement nonce recovery from blockchain events
@@ -65,9 +47,6 @@ export interface NonceManager {
  */
 export class InMemoryNonceManager implements NonceManager {
   private nonces: Map<string, number> = new Map();
-  // SECURITY FIX (C-2): Mutex for atomic nonce operations
-  // Store both the promise and its resolver for proper lock release
-  private locks: Map<string, { promise: Promise<void>; resolve: () => void }> = new Map();
 
   /**
    * Create in-memory nonce manager
@@ -76,58 +55,11 @@ export class InMemoryNonceManager implements NonceManager {
   constructor(initialNonces?: Record<string, number>) {
     if (initialNonces) {
       Object.entries(initialNonces).forEach(([messageType, nonce]) => {
-        // SECURITY FIX (H-5): Validate initial nonces
-        if (nonce > MAX_NONCE_VALUE) {
-          throw new Error(
-            `Initial nonce ${nonce} for ${messageType} exceeds maximum allowed value ${MAX_NONCE_VALUE}`
-          );
-        }
         this.nonces.set(messageType, nonce);
       });
     }
   }
 
-  /**
-   * SECURITY FIX (C-2 + DEADLOCK-FIX): Acquire lock for message type
-   * Ensures atomic nonce operations.
-   *
-   * FIXED: Previous implementation had a deadlock bug where:
-   * - The resolver was stored in a closure but never accessible to releaseLock()
-   * - releaseLock() just deleted the entry without resolving waiting Promises
-   *
-   * New implementation stores both promise AND resolver together.
-   */
-  private async acquireLock(messageType: string): Promise<void> {
-    // Wait for any existing lock to be released
-    while (this.locks.has(messageType)) {
-      const existingLock = this.locks.get(messageType);
-      if (existingLock) {
-        await existingLock.promise;
-      }
-    }
-
-    // Create new lock with stored resolver
-    let resolver: () => void = () => {};
-    const lockPromise = new Promise<void>((resolve) => {
-      resolver = resolve;
-    });
-    this.locks.set(messageType, { promise: lockPromise, resolve: resolver });
-  }
-
-  /**
-   * SECURITY FIX (C-2 + DEADLOCK-FIX): Release lock for message type
-   *
-   * FIXED: Now properly resolves the Promise before deleting,
-   * so any waiting acquireLock() calls can proceed.
-   */
-  private releaseLock(messageType: string): void {
-    const lock = this.locks.get(messageType);
-    if (lock) {
-      lock.resolve(); // Resolve the promise first
-      this.locks.delete(messageType); // Then delete the entry
-    }
-  }
-
   /**
    * Get next nonce for message type
    * @param messageType - Message type identifier
@@ -135,44 +67,7 @@ export class InMemoryNonceManager implements NonceManager {
    */
   getNextNonce(messageType: string): number {
     const current = this.nonces.get(messageType) || 0;
-    const next = current + 1;
-
-    // SECURITY FIX (H-5): Check upper bound
-    if (next > MAX_NONCE_VALUE) {
-      throw new Error(
-        `Nonce overflow: next nonce ${next} exceeds maximum allowed value ${MAX_NONCE_VALUE}. ` +
-        `Consider resetting nonces or using a larger storage type.`
-      );
-    }
-
-    return next;
-  }
-
-  /**
-   * SECURITY FIX (C-2): Atomic get-and-increment nonce
-   * Returns the next nonce and records it atomically to prevent race conditions.
-   *
-   * @param messageType - Message type identifier
-   * @returns Atomically allocated nonce
-   */
-  async getAndIncrementNonce(messageType: string): Promise<number> {
-    await this.acquireLock(messageType);
-    try {
-      const current = this.nonces.get(messageType) || 0;
-      const next = current + 1;
-
-      // SECURITY FIX (H-5): Check upper bound
-      if (next > MAX_NONCE_VALUE) {
-        throw new Error(
-          `Nonce overflow: next nonce ${next} exceeds maximum allowed value ${MAX_NONCE_VALUE}`
-        );
-      }
-
-      this.nonces.set(messageType, next);
-      return next;
-    } finally {
-      this.releaseLock(messageType);
-    }
+    return current + 1;
   }
 
   /**
@@ -183,13 +78,6 @@ export class InMemoryNonceManager implements NonceManager {
   recordNonce(messageType: string, nonce: number): void {
     const current = this.nonces.get(messageType) || 0;
 
-    // SECURITY FIX (H-5): Check upper bound
-    if (nonce > MAX_NONCE_VALUE) {
-      throw new Error(
-        `Nonce ${nonce} exceeds maximum allowed value ${MAX_NONCE_VALUE}`
-      );
-    }
-
     // Ensure monotonic increase
     if (nonce <= current) {
       throw new Error(
@@ -388,203 +276,18 @@ export class DIDScopedNonceManager implements NonceManager {
   }
 }
 
-/**
- * File-based Nonce Manager for Persistent Storage
- *
- * SECURITY FIX (H-1): Persists nonces to disk to survive process restarts.
- * SECURITY FIX (NEW-H-4): File locking to prevent concurrent write corruption.
- * Uses atomic file writes (temp file + rename) for crash safety.
- *
- * @module utils/NonceManager
- */
-export class FileBasedNonceManager implements NonceManager {
-  private inMemory: InMemoryNonceManager;
-  private filePath: string;
-  private fs: typeof import('fs');
-  private path: typeof import('path');
-  private lockfile: typeof import('proper-lockfile');
-
-  /**
-   * Create file-based nonce manager
-   * @param stateDirectory - Directory to store nonces file
-   */
-  constructor(stateDirectory: string) {
-    this.fs = require('fs');
-    this.path = require('path');
-    // SECURITY FIX (NEW-H-4): File locking to prevent race conditions
-    this.lockfile = require('proper-lockfile');
-
-    // Ensure .actp directory exists
-    const actpDir = this.path.join(stateDirectory, '.actp');
-    ensureSafeDir(actpDir, 0o755);
-
-    this.filePath = this.path.join(actpDir, 'nonces.json');
-
-    // Load existing nonces
-    const initialNonces = this.loadFromFile();
-    this.inMemory = new InMemoryNonceManager(initialNonces);
-  }
-
-  /**
-   * Load nonces from file
-   */
-  private loadFromFile(): Record<string, number> | undefined {
-    if (!this.fs.existsSync(this.filePath)) {
-      return undefined;
-    }
-
-    try {
-      // SECURITY: Refuse to read from symlinked nonce files
-      assertSafeFileForRead(this.filePath);
-
-      const MAX_NONCE_FILE_SIZE = 5 * 1024 * 1024; // 5MB
-      const st = this.fs.statSync(this.filePath);
-      if (st.size > MAX_NONCE_FILE_SIZE) {
-        throw new Error(
-          `nonces.json exceeds ${MAX_NONCE_FILE_SIZE / 1024 / 1024}MB limit: ${this.filePath}`
-        );
-      }
-
-      const data = JSON.parse(this.fs.readFileSync(this.filePath, 'utf-8'));
-      return data as Record<string, number>;
-    } catch (e: any) {
-      // Fail closed: nonce resets can enable replay.
-      throw new Error(
-        `Failed to parse nonces.json (replay protection would be weakened). ` +
-          `Fix/delete the file: ${this.filePath}. Error: ${e?.message || String(e)}`
-      );
-    }
-  }
-
-  /**
-   * Save nonces to file atomically with file locking
-   *
-   * SECURITY FIX (NEW-H-4): File locking prevents concurrent write corruption
-   */
-  private async saveToFile(): Promise<void> {
-    const data = this.inMemory.getAllNonces();
-    const tempPath = `${this.filePath}.tmp`;
-
-    // SECURITY FIX: Ensure file exists before locking (proper-lockfile requirement)
-    ensureSafeFile(this.filePath, '{}', 0o644);
-
-    // SECURITY FIX (NEW-H-4): Acquire file lock before writing
-    let release: (() => Promise<void>) | null = null;
-    try {
-      release = await this.lockfile.lock(this.filePath, {
-        stale: 10000, // Lock expires after 10 seconds if process crashes
-        retries: {
-          retries: 5,
-          minTimeout: 100,
-          maxTimeout: 500
-        }
-      });
-
-      // Atomic write: temp file + rename
-      if (this.fs.existsSync(tempPath)) {
-        this.fs.unlinkSync(tempPath);
-      }
-      this.fs.writeFileSync(tempPath, JSON.stringify(data, null, 2), {
-        encoding: 'utf-8',
-        mode: 0o644,
-        flag: 'wx'
-      });
-      this.fs.renameSync(tempPath, this.filePath);
-    } catch (error) {
-      // Clean up temp file on error
-      if (this.fs.existsSync(tempPath)) {
-        try {
-          this.fs.unlinkSync(tempPath);
-        } catch {
-          // Ignore cleanup errors
-        }
-      }
-      throw error;
-    } finally {
-      if (release) {
-        await release();
-      }
-    }
-  }
-
-  getNextNonce(messageType: string): number {
-    return this.inMemory.getNextNonce(messageType);
-  }
-
-  /**
-   * Atomic get and increment with persistence
-   */
-  async getAndIncrementNonce(messageType: string): Promise<number> {
-    const nonce = await this.inMemory.getAndIncrementNonce(messageType);
-    // SECURITY FIX (NEW-H-4): saveToFile is now async
-    await this.saveToFile();
-    return nonce;
-  }
-
-  recordNonce(messageType: string, nonce: number): void {
-    this.inMemory.recordNonce(messageType, nonce);
-    // Fire-and-forget to maintain sync interface
-    this.saveToFile().catch((err) => {
-      console.error('Failed to save nonce manager state:', err);
-    });
-  }
-
-  getCurrentNonce(messageType: string): number {
-    return this.inMemory.getCurrentNonce(messageType);
-  }
-
-  resetNonce(messageType: string): void {
-    this.inMemory.resetNonce(messageType);
-    // Fire-and-forget to maintain sync interface
-    this.saveToFile().catch((err) => {
-      console.error('Failed to save nonce manager state:', err);
-    });
-  }
-
-  getAllNonces(): Record<string, number> {
-    return this.inMemory.getAllNonces();
-  }
-
-  clearAll(): void {
-    this.inMemory.clearAll();
-    if (this.fs.existsSync(this.filePath)) {
-      this.fs.unlinkSync(this.filePath);
-    }
-  }
-}
-
 /**
  * Create nonce manager based on environment
- * @param options - Configuration options
+ * @param did - Optional DID for scoped tracking
+ * @param initialNonces - Optional initial nonces
  * @returns NonceManager instance
- *
- * @example
- * ```typescript
- * // In-memory (default)
- * const manager = createNonceManager();
- *
- * // DID-scoped
- * const manager = createNonceManager({ did: 'did:ethr:0x...' });
- *
- * // Persistent (survives restarts)
- * const manager = createNonceManager({ stateDirectory: '/path/to/project' });
- * ```
  */
 export function createNonceManager(
-  options?: {
-    did?: string;
-    initialNonces?: Record<string, number>;
-    stateDirectory?: string;
-  }
+  did?: string,
+  initialNonces?: Record<string, number>
 ): NonceManager {
-  // SECURITY FIX (H-1): Support persistent storage
-  if (options?.stateDirectory) {
-    return new FileBasedNonceManager(options.stateDirectory);
+  if (did) {
+    return new DIDScopedNonceManager(did, initialNonces);
   }
-
-  if (options?.did) {
-    return new DIDScopedNonceManager(options.did, options?.initialNonces);
-  }
-
-  return new InMemoryNonceManager(options?.initialNonces);
+  return new InMemoryNonceManager(initialNonces);
 }

package/src/utils/ReceivedNonceTracker.ts

@@ -228,10 +228,6 @@ export class InMemoryReceivedNonceTracker implements IReceivedNonceTracker {
  * - Reject duplicate nonces (replay attack)
  * - Allows non-sequential nonces (nonce gaps are OK)
  *
- * SECURITY FIX (NEW-H-2): Max size enforcement to prevent memory exhaustion
- * SECURITY FIX (HIGH-2): Global total entries limit to prevent DoS via many sender combinations
- * SECURITY FIX (H-2): Rate limiting per sender to prevent flood attacks
- *
  * Trade-off:
  * - Higher memory usage (stores every nonce)
  * - More flexible (allows out-of-order delivery)
@@ -241,94 +237,8 @@ export class SetBasedReceivedNonceTracker implements IReceivedNonceTracker {
   // Map: sender -> messageType -> Set of used nonces
   private usedNonces: Map<string, Map<string, Set<string>>> = new Map();
 
-  // SECURITY FIX (NEW-H-2): Maximum entries per sender+messageType
-  private readonly maxSizePerType: number;
-
-  // SECURITY FIX (HIGH-2): Global limit across ALL sender+messageType combinations
-  private readonly maxTotalEntries: number;
-  private totalEntries: number = 0;
-
-  // SECURITY FIX (H-2): Rate limiting per sender
-  // Map: sender -> { count: number, windowStart: number }
-  private rateLimitState: Map<string, { count: number; windowStart: number }> = new Map();
-  private readonly maxNoncesPerMinute: number;
-  private readonly rateLimitWindowMs: number = 60000; // 1 minute window
-
-  /**
-   * Create set-based tracker with optional max size
-   * @param maxSizePerType - Maximum nonces per sender+messageType (default: 10,000)
-   * @param maxTotalEntries - Maximum total nonces across all combinations (default: 100,000)
-   * @param maxNoncesPerMinute - Maximum nonces per sender per minute (default: 100)
-   */
-  constructor(
-    maxSizePerType: number = 10000,
-    maxTotalEntries: number = 100000,
-    maxNoncesPerMinute: number = 100
-  ) {
-    if (maxSizePerType <= 0) {
-      throw new Error('maxSizePerType must be positive');
-    }
-    if (maxTotalEntries <= 0) {
-      throw new Error('maxTotalEntries must be positive');
-    }
-    if (maxNoncesPerMinute <= 0) {
-      throw new Error('maxNoncesPerMinute must be positive');
-    }
-    this.maxSizePerType = maxSizePerType;
-    this.maxTotalEntries = maxTotalEntries;
-    this.maxNoncesPerMinute = maxNoncesPerMinute;
-  }
-
-  /**
-   * SECURITY FIX (H-2): Check rate limit for sender
-   * @param sender - Sender DID
-   * @returns true if rate limit exceeded
-   */
-  private checkRateLimit(sender: string): boolean {
-    const now = Date.now();
-    const state = this.rateLimitState.get(sender);
-
-    if (!state) {
-      // First nonce from this sender
-      this.rateLimitState.set(sender, { count: 1, windowStart: now });
-      return false; // Not rate limited
-    }
-
-    // Check if window expired (reset counter)
-    if (now - state.windowStart >= this.rateLimitWindowMs) {
-      state.count = 1;
-      state.windowStart = now;
-      return false; // Not rate limited
-    }
-
-    // Increment counter
-    state.count++;
-
-    // Check if rate limit exceeded
-    return state.count > this.maxNoncesPerMinute;
-  }
-
-  /**
-   * SECURITY FIX (H-2): Periodic cleanup of rate limit state
-   * Removes expired rate limit entries (older than 5 minutes)
-   */
-  private cleanupRateLimitState(): void {
-    const now = Date.now();
-    const expiryThreshold = 5 * 60 * 1000; // 5 minutes
-
-    for (const [sender, state] of this.rateLimitState.entries()) {
-      if (now - state.windowStart > expiryThreshold) {
-        this.rateLimitState.delete(sender);
-      }
-    }
-  }
-
   /**
    * Validate and record a received nonce
-   *
-   * SECURITY FIX (NEW-H-2): Automatic cleanup when max size reached
-   * SECURITY FIX (HIGH-2): Global limit check to prevent DoS
-   * SECURITY FIX (H-2): Rate limiting per sender (max 100 nonces/minute)
    */
   validateAndRecord(sender: string, messageType: string, nonce: string): NonceValidationResult {
     // Validate nonce format
@@ -340,34 +250,6 @@ export class SetBasedReceivedNonceTracker implements IReceivedNonceTracker {
       };
     }
 
-    // SECURITY FIX (H-2): Rate limit check (BEFORE global limit to avoid unnecessary work)
-    if (this.checkRateLimit(sender)) {
-      return {
-        valid: false,
-        reason: `Rate limit exceeded for sender ${sender}: ` +
-                `Maximum ${this.maxNoncesPerMinute} nonces per minute allowed. ` +
-                `This may indicate a flood attack or misconfigured client. ` +
-                `Wait 1 minute before retrying.`,
-        receivedNonce: nonce
-      };
-    }
-
-    // SECURITY FIX (H-2): Periodic cleanup every 100 validations (amortized cost)
-    if (this.totalEntries % 100 === 0) {
-      this.cleanupRateLimitState();
-    }
-
-    // SECURITY FIX (HIGH-2): Check global limit BEFORE adding
-    if (this.totalEntries >= this.maxTotalEntries) {
-      return {
-        valid: false,
-        reason: `Global nonce tracker limit reached (${this.maxTotalEntries} entries). ` +
-                `This may indicate a DoS attack or need for cleanup. ` +
-                `Current usage: ${this.totalEntries} entries across ${this.getCombinationCount()} sender+type combinations.`,
-        receivedNonce: nonce
-      };
-    }
-
     // Get sender's nonce map
     let senderNonces = this.usedNonces.get(sender);
     if (!senderNonces) {
@@ -391,53 +273,11 @@ export class SetBasedReceivedNonceTracker implements IReceivedNonceTracker {
       };
     }
 
-    // SECURITY FIX (NEW-H-2): Auto-cleanup if max size per type reached
-    if (usedSet.size >= this.maxSizePerType) {
-      // Keep only last 80% of entries (sorted by nonce value)
-      const keepCount = Math.floor(this.maxSizePerType * 0.8);
-      const sortedNonces = Array.from(usedSet).sort((a, b) => {
-        const aVal = BigInt(a);
-        const bVal = BigInt(b);
-        return aVal < bVal ? -1 : aVal > bVal ? 1 : 0;
-      });
-      const removedCount = usedSet.size - keepCount;
-      usedSet = new Set(sortedNonces.slice(-keepCount));
-      senderNonces.set(messageType, usedSet);
-      // SECURITY FIX (HIGH-2): Update global counter
-      this.totalEntries -= removedCount;
-    }
-
     // Valid nonce - record it
     usedSet.add(nonce);
-    // SECURITY FIX (HIGH-2): Update global counter
-    this.totalEntries++;
     return { valid: true };
   }
 
-  /**
-   * Get number of sender+messageType combinations (for monitoring)
-   * SECURITY FIX (HIGH-2): Monitoring method
-   */
-  private getCombinationCount(): number {
-    let count = 0;
-    this.usedNonces.forEach(senderMap => {
-      count += senderMap.size;
-    });
-    return count;
-  }
-
-  /**
-   * Get memory usage statistics
-   * SECURITY FIX (HIGH-2): Monitoring method for DoS detection
-   */
-  getMemoryUsage(): { totalEntries: number; combinations: number; maxTotalEntries: number } {
-    return {
-      totalEntries: this.totalEntries,
-      combinations: this.getCombinationCount(),
-      maxTotalEntries: this.maxTotalEntries
-    };
-  }
-
   /**
    * Check if a nonce has been used
    */
@@ -487,11 +327,6 @@ export class SetBasedReceivedNonceTracker implements IReceivedNonceTracker {
   reset(sender: string, messageType: string): void {
     const senderNonces = this.usedNonces.get(sender);
     if (senderNonces) {
-      const usedSet = senderNonces.get(messageType);
-      if (usedSet) {
-        // SECURITY FIX (HIGH-2): Update global counter
-        this.totalEntries -= usedSet.size;
-      }
       senderNonces.delete(messageType);
       if (senderNonces.size === 0) {
         this.usedNonces.delete(sender);
@@ -504,8 +339,6 @@ export class SetBasedReceivedNonceTracker implements IReceivedNonceTracker {
    */
   clearAll(): void {
     this.usedNonces.clear();
-    // SECURITY FIX (HIGH-2): Reset global counter
-    this.totalEntries = 0;
   }
 
   /**
@@ -544,11 +377,8 @@ export class SetBasedReceivedNonceTracker implements IReceivedNonceTracker {
     });
 
     // Keep only the last N nonces
-    const removedCount = usedSet.size - keepLast;
     const toKeep = new Set(sortedNonces.slice(-keepLast));
     senderNonces.set(messageType, toKeep);
-    // SECURITY FIX (HIGH-2): Update global counter
-    this.totalEntries -= removedCount;
   }
 }