@bitpay-labs/bitcore-wallet-service 11.10.2 → 11.10.3

package/bws.example.config.js

@@ -325,7 +325,7 @@ module.exports = {
   //     publicKey: 'simplex_web_public_key_here',
   //   }
   // },
-  // thorswap : {
+  // thorswap: {
   //   sandbox: {
   //     api: 'https://dev-api.thorswap.net',
   //     apiKey: 'thorswap_sandbox_api_key_here',
@@ -339,7 +339,7 @@ module.exports = {
   //     referer: 'thorswap_production_referer_here'
   //   },
   // },
-  // transak : {
+  // transak: {
   //   sandbox: {
   //     api: 'https://api-stg.transak.com',
   //     widgetApi: 'https://api-gateway-stg.transak.com',
@@ -363,7 +363,8 @@ module.exports = {
   //     widgetApi: 'https://api-gateway.transak.com',
   //     apiKey: 'transak_production_web_api_key_here',
   //     secretKey: 'transak_production_web_secret_key_here',
-  //   }
+  //   },
+  //   whitelist: []
   // },
   // wyre: {
   //   sandbox: {

package/package.json

@@ -2,7 +2,7 @@
   "name": "@bitpay-labs/bitcore-wallet-service",
   "description": "A service for Mutisig HD Bitcoin Wallets",
   "author": "BitPay Inc",
-  "version": "11.10.2",
+  "version": "11.10.3",
   "license": "MIT",
   "main": "ts_build/src/index.js",
   "types": "./ts_build/src/index.d.ts",
@@ -43,9 +43,9 @@
     "cp:templates": "cp -r ./templates ./ts_build/templates"
   },
   "dependencies": {
-    "@bitpay-labs/bitcore-logging": "^11.8.1",
-    "@bitpay-labs/bitcore-tss": "^11.10.0",
-    "@bitpay-labs/crypto-wallet-core": "^11.10.0",
+    "@bitpay-labs/bitcore-logging": "^11.10.3",
+    "@bitpay-labs/bitcore-tss": "^11.10.3",
+    "@bitpay-labs/crypto-wallet-core": "^11.10.3",
     "@sendgrid/mail": "6.5.4",
     "abi-decoder": "2.4.0",
     "async": "0.9.2",
@@ -126,5 +126,5 @@
       "email": "kjoseph@bitpay.com"
     }
   ],
-  "gitHead": "bcf06b7f572a535f778a6060e1843fccf33ee91b"
+  "gitHead": "70298eedd1e458b23139e275125a07c577219bac"
 }

package/src/config.ts

@@ -400,7 +400,7 @@ const Config = (): any => {
     //     publicKey: 'simplex_web_public_key_here',
     //   }
     // },
-    // thorswap : {
+    // thorswap: {
     //   sandbox: {
     //     api: 'https://dev-api.thorswap.net',
     //     apiKey: 'thorswap_sandbox_api_key_here',
@@ -414,7 +414,7 @@ const Config = (): any => {
     //     referer: 'thorswap_production_referer_here'
     //   },
     // },
-    // transak : {
+    // transak: {
     //   sandbox: {
     //     api: 'https://api-stg.transak.com',
     //     widgetApi: 'https://global-stg.transak.com',
@@ -438,7 +438,8 @@ const Config = (): any => {
     //     widgetApi: 'https://global.transak.com',
     //     apiKey: 'transak_production_web_api_key_here',
     //     secretKey: 'transak_production_web_secret_key_here',
-    //   }
+    //   },
+    //   whitelist: []
     // },
     // wyre: {
     //   sandbox: {

package/src/externalservices/moonpay.ts

@@ -225,6 +225,16 @@ export class MoonpayService {
     if (req.body.paymentMethod) qs.push('paymentMethod=' + encodeURIComponent(req.body.paymentMethod));
     if (req.body.areFeesIncluded) qs.push('areFeesIncluded=' + encodeURIComponent(req.body.areFeesIncluded));
 
+    const deviceIp = Utils.getIpFromReq(req);
+    if (!deviceIp) {
+      throw new ClientError('Could not determine device IP address');
+    }
+    const allowedIpAddress: string = Bitcore.crypto.Hash.sha256hmac(
+      Buffer.from(deviceIp),
+      Buffer.from(SECRET_KEY)
+    ).toString('base64');
+    qs.push('allowedIpAddress=' + encodeURIComponent(allowedIpAddress));
+
     const URL_SEARCH: string = `?${qs.join('&')}`;
 
     const URLSignatureHash: string = Bitcore.crypto.Hash.sha256hmac(

package/src/externalservices/transak.ts

@@ -1,5 +1,6 @@
 import * as request from 'request';
 import config from '../config';
+import { Utils } from '../lib/common/utils';
 import { ClientError } from '../lib/errors/clienterror';
 import { checkRequired } from '../lib/server';
 
@@ -50,6 +51,8 @@ export class TransakService {
       const headers = {
         'Content-Type': 'application/json',
         'api-secret': SECRET_KEY,
+        'x-api-key': API_KEY,
+        'x-user-ip': Utils.getIpFromReq(req),
       };
 
       const body = {
@@ -85,10 +88,13 @@ export class TransakService {
         return reject(err);
       }
       const API = keys.API;
+      const API_KEY = keys.API_KEY;
 
       const headers = {
         'Accept': 'application/json',
         'Content-Type': 'application/json',
+        'x-api-key': API_KEY,
+        'x-user-ip': Utils.getIpFromReq(req),
       };
 
       const URL: string = API + '/api/v2/currencies/crypto-currencies';
@@ -124,6 +130,8 @@ export class TransakService {
       const headers = {
         'Accept': 'application/json',
         'Content-Type': 'application/json',
+        'x-api-key': API_KEY,
+        'x-user-ip': Utils.getIpFromReq(req),
       };
 
       const URL: string = API + `/api/v2/currencies/fiat-currencies?apiKey=${API_KEY}`;
@@ -162,6 +170,8 @@ export class TransakService {
 
       const headers = {
         Accept: 'application/json',
+        'x-api-key': API_KEY,
+        'x-user-ip': Utils.getIpFromReq(req),
       };
 
       const qs: string[] = [];
@@ -227,6 +237,8 @@ export class TransakService {
         Accept: 'application/json',
         'Content-Type': 'application/json',
         'access-token': req.body.accessToken,
+        'x-api-key': API_KEY,
+        'x-user-ip': Utils.getIpFromReq(req),
       };
 
       const body = {
@@ -266,6 +278,7 @@ export class TransakService {
         return reject(err);
       }
       const API = keys.API;
+      const API_KEY = keys.API_KEY;
 
       if (!checkRequired(req.body, ['orderId', 'accessToken'])) {
         return reject(new ClientError("Transak's request missing arguments"));
@@ -274,6 +287,8 @@ export class TransakService {
       const headers = {
         Accept: 'application/json',
         'access-token': req.body.accessToken,
+        'x-api-key': API_KEY,
+        'x-user-ip': Utils.getIpFromReq(req),
       };
 
       const URL: string = API + `/partners/api/v2/order/${req.body.orderId}`;

package/src/lib/blockchainexplorers/v8.ts

@@ -43,6 +43,13 @@ function v8network(bwsNetwork, chain = 'btc') {
   return bwsNetwork;
 }
 
+function scrubResponseError(err) {
+  if (err.response) {
+    return new Error(`HTTP ${err.response.statusCode} - ${err.response.statusMessage}: ${err.response.body}\n${err.response.request.method} ${err.response.request.href}`);
+  }
+  return new Error(err);
+}
+
 export type WalletWithOpts = IWallet & { tokenAddress?: string; multisigContractAddress?: string };
 
 export class V8 {
@@ -765,6 +772,18 @@ export class V8 {
       return callbacks.onIncomingPayments(notification);
     });
   }
+
+  async getFlags(opts: { address: string }) {
+    try {
+      const url = `${this.baseUrl}/address/${opts.address}/flags`;
+      const ret = await this.request.get(url);
+      return JSON.parse(ret).flags;
+    } catch (err) {
+      const e = scrubResponseError(err);
+      logger.error(`Error getting flags for address ${opts.address}: %o`, e);
+      throw e;
+    }
+  }
 }
 
 const getPerformanceKey = (name: string) => {

package/src/lib/chain/xrp/index.ts

@@ -90,14 +90,19 @@ export class XrpChain implements IChain {
   getWalletSendMaxInfo(server, wallet, opts, cb) {
     server.getBalance({}, (err, balance) => {
       if (err) return cb(err);
-      const { availableAmount } = balance;
-      const fee = opts.feePerKb;
-      return cb(null, {
-        utxosBelowFee: 0,
-        amountBelowFee: 0,
-        amount: availableAmount - fee,
-        feePerKb: opts.feePerKb,
-        fee
+
+      server._getFeePerKb(wallet, opts, (err, feePerKb) => {
+        if (err) return cb(err);
+
+        const { availableAmount } = balance;
+        const fee = feePerKb;
+        return cb(null, {
+          utxosBelowFee: 0,
+          amountBelowFee: 0,
+          amount: availableAmount - fee,
+          feePerKb,
+          fee
+        });
       });
     });
   }

package/src/lib/common/defaults.ts

@@ -19,6 +19,9 @@ export const Defaults = {
   // TODO: should allow different gap sizes for external/internal chains
   SCAN_ADDRESS_GAP: 30,
 
+  // Lookback window (in seconds) for scanning broadcasted txps during nonce assignment
+  BROADCASTED_NONCE_SCAN_WINDOW: 24 * 3600,
+
   FEE_LEVELS: {
     btc: [
       {

package/src/lib/common/utils.ts

@@ -81,11 +81,11 @@ export const Utils = {
 
   /**
    *
-   * @desc rounds a JAvascript number
-   * @param number
+   * @desc rounds a Javascript number
+   * @param {number} number
    * @return {number}
    */
-  strip(number) {
+  strip(number: number): number {
     return parseFloat(number.toPrecision(12));
   },
 

package/src/lib/emailservice.ts

@@ -561,7 +561,8 @@ export class EmailService {
   _checkShouldSendEmail(notification: Notification, cb) {
     if (notification.type != 'NewTxProposal') return cb(null, true);
     this.storage.fetchWallet(notification.walletId, (err, wallet) => {
-      return cb(err, wallet.m > 1);
+      // TSS wallets are stored as m=1 but still need other signers
+      return cb(err, wallet && (wallet.m > 1 || !!wallet.tssKeyId));
     });
   }
 

package/src/lib/model/txproposal.ts

@@ -81,6 +81,7 @@ export interface ITxProposal<NumberType = number> {
   multisigTxId?: string;
   destinationTag?: string;
   invoiceID?: string;
+  flags?: string; // Comma-delimited list of XRP account flags to set (e.g. "tfRequireDestTag,tfDisallowXRP")
   lockUntilBlockHeight?: NumberType;
   instantAcceptanceEscrow?: NumberType;
   isTokenSwap?: boolean;
@@ -175,6 +176,7 @@ export class TxProposal<NumberType = number> implements ITxProposal<NumberType>
   multisigTxId?: string;
   destinationTag?: string;
   invoiceID?: string;
+  flags?: string; // Comma-delimited list of XRP account flags to set (e.g. "tfRequireDestTag,tfDisallowXRP")
   lockUntilBlockHeight?: NumberType;
   instantAcceptanceEscrow?: NumberType;
   isTokenSwap?: boolean;
@@ -305,6 +307,7 @@ export class TxProposal<NumberType = number> implements ITxProposal<NumberType>
     x.destinationTag = opts.destinationTag;
     x.invoiceID = opts.invoiceID;
     x.multiTx = opts.multiTx; // proposal contains multiple transactions
+    x.flags = opts.flags; // XRP account flags to set
     
     // SOL
     x.space = opts.space; // space to allocate for account creation
@@ -400,6 +403,7 @@ export class TxProposal<NumberType = number> implements ITxProposal<NumberType>
     x.destinationTag = obj.destinationTag;
     x.invoiceID = obj.invoiceID;
     x.multiTx = obj.multiTx;
+    x.flags = obj.flags; // XRP account flags to set
 
     // SOL
     x.space = obj.space; // space to allocate for account creation

package/src/lib/pushnotificationsservice.ts

@@ -358,7 +358,8 @@ export class PushNotificationsService {
   _checkShouldSendNotif(notification, cb) {
     if (notification.type != 'NewTxProposal') return cb(null, true);
     this.storage.fetchWallet(notification.walletId, (err, wallet) => {
-      return cb(err, wallet && wallet.m > 1);
+      // TSS wallets are stored as m=1 but still need other signers
+      return cb(err, wallet && (wallet.m > 1 || !!wallet.tssKeyId));
     });
   }
 

package/src/lib/routes/services.ts

@@ -1,5 +1,7 @@
+import cors from 'cors';
 import express from 'express';
 import rp from 'request-promise-native';
+import config from '../../config';
 import { Common } from '../common';
 import type * as Types from '../../types/expressapp';
 import type { WalletService } from '../server';
@@ -65,6 +67,20 @@ function respondWithAuthServer(req, res, context: RouteContext, handler: RouteHa
 export function registerServiceRoutes(router: express.Router, context: RouteContext) {
   const { getServerWithAuth, setPublicCache, returnError } = context;
 
+  const transakCorsOptions = {
+    origin: (origin, cb) => {
+      if (!origin) {
+        return cb(null, true);
+      }
+      const transakWhiteList = config.transak?.whitelist ?? [];
+      if (transakWhiteList.indexOf(origin) !== -1) {
+        cb(null, true);
+      } else {
+        cb(new Error('Not allowed by CORS'));
+      }
+    }
+  };
+
   router.get('/latest-version', async (req, res) => {
     setPublicCache(res, 10 * ONE_MINUTE);
     try {
@@ -420,37 +436,37 @@ export function registerServiceRoutes(router: express.Router, context: RouteCont
     });
   });
 
-  router.post('/v1/service/transak/getAccessToken', (req, res) => {
+  router.post('/v1/service/transak/getAccessToken', cors(transakCorsOptions), (req, res) => {
     respondWithAuthServer(req, res, context, server => {
       return server.externalServices.transak.transakGetAccessToken(req);
     });
   });
 
-  router.post('/v1/service/transak/cryptoCurrencies', (req, res) => {
+  router.post('/v1/service/transak/cryptoCurrencies', cors(transakCorsOptions), (req, res) => {
     respondWithPublicServer(req, res, context, server => {
       return server.externalServices.transak.transakGetCryptoCurrencies(req);
     });
   });
 
-  router.post('/v1/service/transak/fiatCurrencies', (req, res) => {
+  router.post('/v1/service/transak/fiatCurrencies', cors(transakCorsOptions), (req, res) => {
     respondWithPublicServer(req, res, context, server => {
       return server.externalServices.transak.transakGetFiatCurrencies(req);
     });
   });
 
-  router.post('/v1/service/transak/quote', (req, res) => {
+  router.post('/v1/service/transak/quote', cors(transakCorsOptions), (req, res) => {
     respondWithAuthServer(req, res, context, server => {
       return server.externalServices.transak.transakGetQuote(req);
     });
   });
 
-  router.post('/v1/service/transak/signedPaymentUrl', (req, res) => {
+  router.post('/v1/service/transak/signedPaymentUrl', cors(transakCorsOptions), (req, res) => {
     respondWithAuthServer(req, res, context, server => {
       return server.externalServices.transak.transakGetSignedPaymentUrl(req);
     });
   });
 
-  router.post('/v1/service/transak/orderDetails', (req, res) => {
+  router.post('/v1/service/transak/orderDetails', cors(transakCorsOptions), (req, res) => {
     respondWithPublicServer(req, res, context, server => {
       return server.externalServices.transak.transakGetOrderDetails(req);
     });

package/src/lib/routes/tss.ts

@@ -120,4 +120,4 @@ export class TssRouter {
 
     this.router = router;
   }
-};
+}

package/src/lib/routes/wallets.ts

@@ -291,4 +291,19 @@ export function registerWalletRoutes(router: express.Router, context: RouteConte
       });
     });
   });
-}
+
+  router.get('/v1/flags', (req, res) => {
+    getServerWithAuth(req, res, async server => {
+      try {
+        const opts = { account: 0 };
+        if (req.query.account) {
+          opts.account = parseInt(req.query.account);
+        }
+        const flags = await server.getFlags(opts);
+        res.json(flags);
+      } catch (err) {
+        returnError(err, res, req);
+      }
+    });
+  });
+}

package/src/lib/server.ts

@@ -1,3 +1,4 @@
+import util from 'util';
 import {
   BitcoreLib as Bitcore,
   BitcoreLibCash as BitcoreCash,
@@ -2924,7 +2925,8 @@ export class WalletService implements IWalletService {
                       fromAta: opts.fromAta,
                       decimals: opts.decimals,
                       refreshOnPublish: opts.refreshOnPublish,
-                      deferNonce: opts.deferNonce
+                      deferNonce: opts.deferNonce,
+                      flags: opts.flags
                     };
                     txp = TxProposal.create(txOpts);
                     next();
@@ -3358,6 +3360,19 @@ export class WalletService implements IWalletService {
                   return cb(Errors.TX_NONCE_CONFLICT);
                 }
               }
+              // A deferred txp matching a broadcasted txp's nonce means its JIT-assigned
+              // value went stale. Non-deferred txps may reuse an in-flight nonce
+              // intentionally (e.g. speed-up).
+              if (txp.nonce != null && txp.deferNonce) {
+                const broadcastedTxps = await util.promisify(this.storage.fetchBroadcastedTxs).call(this.storage, this.walletId, {
+                  minTs: Math.floor(Date.now() / 1000) - Defaults.BROADCASTED_NONCE_SCAN_WINDOW
+                });
+                for (const t of broadcastedTxps || []) {
+                  if (t.id !== txp.id && t.nonce != null && Number(t.nonce) === Number(txp.nonce)) {
+                    return cb(Errors.TX_NONCE_CONFLICT);
+                  }
+                }
+              }
             } catch (err) {
               return cb(err);
             }
@@ -3486,9 +3501,18 @@ export class WalletService implements IWalletService {
               .filter(t => t.id !== txp.id && t.nonce != null && t.status !== 'rejected')
               .map(t => Number(t.nonce));
 
+            // 2b. Broadcasted-but-unmined txps still occupy their nonces but appear in
+            // neither the confirmed count nor the pending set
+            const broadcastedTxps = await util.promisify(this.storage.fetchBroadcastedTxs).call(this.storage, this.walletId, {
+              minTs: Math.floor(Date.now() / 1000) - Defaults.BROADCASTED_NONCE_SCAN_WINDOW
+            });
+            const inFlightNonces = (broadcastedTxps || [])
+              .filter(t => t.nonce != null && Number(t.nonce) >= Number(confirmedNonce))
+              .map(t => Number(t.nonce));
+
             // 3. Calculate gap-free nonce
             let suggestedNonce = Number(confirmedNonce);
-            const allNonces = pendingNonces.sort((a, b) => a - b);
+            const allNonces = [...pendingNonces, ...inFlightNonces].sort((a, b) => a - b);
             for (const n of allNonces) {
               if (n === suggestedNonce) {
                 suggestedNonce++;
@@ -5303,6 +5327,27 @@ export class WalletService implements IWalletService {
     });
   }
 
+  async getFlags(opts: { account: number }) {
+    try {
+      const wallet = await util.promisify(this.getWallet).call(this, {});
+      if (wallet.chain !== 'xrp') throw new Error('Flags are only supported for XRP wallets');
+
+      const addresses = await util.promisify(this.storage.fetchAddresses).call(this.storage, this.walletId);
+      const addressObj = addresses.find(a => a.path === `m/0/${opts.account || 0}`);
+      if (!addressObj) throw new Error('Could not find address for account ' + opts.account);
+
+      const bc = this._getBlockchainExplorer(wallet.chain, wallet.network);
+      if (!bc) throw new Error('Could not get blockchain explorer instance');
+
+      const address = addressObj.address.split(':')[0]; // Remove testnet suffix
+      const flags = await bc.getFlags({ address });
+      return flags;
+    } catch (err) {
+      this.logw('Error getting flags: %o', err);
+      throw err;
+    }
+  }
+
   static upgradeNeeded(
     paths: Upgrade | Upgrade[],
     opts: UpgradeCheckOpts & { clientVersion: string; userAgent: string }

package/test/chain/xrp.test.ts

@@ -10,6 +10,27 @@ const should = chai.should();
 const xpub = 'tpubDD7tYYerLNNm65Ez7pRjxQ2NpRHDoyRWoLWudnQ8agXjr7qs9BsPsRXk8Z6spPPJodnaY158YqeCKT5oXuZvbuNLfm1R4kXGJ2vPd9pUxDT';
 
 describe('Chain XRP', function() { 
+  describe('#getWalletSendMaxInfo', function() {
+    it('should resolve fee level before calculating sendMax amount', function(done) {
+      const server = {
+        getBalance: (_opts, cb) => cb(null, { availableAmount: 1000000 }),
+        _getFeePerKb: (_wallet, opts, cb) => {
+          opts.feeLevel.should.equal('normal');
+          return cb(null, 12);
+        }
+      };
+      const wallet = { chain: 'xrp' };
+
+      ChainService.get('xrp').getWalletSendMaxInfo(server as any, wallet as any, { feeLevel: 'normal' }, (err, info) => {
+        should.not.exist(err);
+        info.amount.should.equal(999988);
+        info.fee.should.equal(12);
+        info.feePerKb.should.equal(12);
+        done();
+      });
+    });
+  });
+
   describe('#getBitcoreTx', function() {
     it('should create a valid bitcore TX', function() {
       const txp = TxProposal.fromObj(aTXP()) as TxProposal;

package/test/integration/externalservices/moonpay.test.ts

@@ -260,7 +260,9 @@ describe('Moonpay integration', () => {
   describe('#moonpayGetSignedPaymentUrl', () => {
     beforeEach(() => {
       req = {
-        headers: {},
+        headers: {
+          'x-forwarded-for': '1.2.3.4'
+        },
         body: {
           env: 'production',
           currencyCode: 'btc',
@@ -277,7 +279,17 @@ describe('Moonpay integration', () => {
     it('should get the paymentUrl properly if req is OK', () => {
       const data = server.externalServices.moonpay.moonpayGetSignedPaymentUrl(req);
       should.exist(data.urlWithSignature);
-      data.urlWithSignature.should.equal('widgetApi2?apiKey=apiKey2&currencyCode=btc&walletAddress=bitcoin%3A123123&baseCurrencyCode=usd&baseCurrencyAmount=500&externalTransactionId=123123&redirectURL=bitpay%3A%2F%2Fmoonpay&signature=%2FDnbsboySgE%2FeAvMrwzROCLuuctkhgw5C2t2OofjOzo%3D');
+      data.urlWithSignature.should.equal('widgetApi2?apiKey=apiKey2&currencyCode=btc&walletAddress=bitcoin%3A123123&baseCurrencyCode=usd&baseCurrencyAmount=500&externalTransactionId=123123&redirectURL=bitpay%3A%2F%2Fmoonpay&allowedIpAddress=CN35SFB5PKS4vkiZ4CglTxRgTAaUHBLGZcenAw6gHEY%3D&signature=3XxjRX3EMj2RNaoAwgOwFBOiVTXsgAS7C50uJf9SsvM%3D');
+    });
+
+    it('should return error if request does not have IP', () => {
+      delete req.headers['x-forwarded-for'];
+      try {
+        server.externalServices.moonpay.moonpayGetSignedPaymentUrl(req);
+        should.fail('should have thrown');
+      } catch (err) {
+        err.message.should.equal('Could not determine device IP address');
+      }
     });
 
     it('should return error if there is some missing arguments', () => {