@bitpay-labs/bitcore-wallet-service 11.10.4 → 11.10.6

package/package.json

@@ -2,7 +2,7 @@
   "name": "@bitpay-labs/bitcore-wallet-service",
   "description": "A service for Mutisig HD Bitcoin Wallets",
   "author": "BitPay Inc",
-  "version": "11.10.4",
+  "version": "11.10.6",
   "license": "MIT",
   "main": "ts_build/src/index.js",
   "types": "./ts_build/src/index.d.ts",
@@ -107,5 +107,5 @@
       "email": "kjoseph@bitpay.com"
     }
   ],
-  "gitHead": "3cdd407df1a56d452b243083c884735757c10a2a"
+  "gitHead": "68cba09ab40e3e91528cae682333303c08b3f565"
 }

package/src/externalservices/moonpay.ts

@@ -190,6 +190,8 @@ export class MoonpayService {
   }
 
   moonpayGetSignedPaymentUrl(req): { urlWithSignature: string } {
+    // moonpayGetKeys deletes env/context from the body, so read context first
+    const isWebContext = req.body.context === 'web';
     const keys = this.moonpayGetKeys(req);
     const SECRET_KEY = keys.SECRET_KEY;
     const API_KEY = keys.API_KEY;
@@ -225,15 +227,28 @@ export class MoonpayService {
     if (req.body.paymentMethod) qs.push('paymentMethod=' + encodeURIComponent(req.body.paymentMethod));
     if (req.body.areFeesIncluded) qs.push('areFeesIncluded=' + encodeURIComponent(req.body.areFeesIncluded));
 
-    const deviceIp = Utils.getIpFromReq(req);
-    if (!deviceIp) {
+    // Web requests are proxied through the bitpay backend, so the IP on this
+    // request belongs to that server, not the customer. The proxy captures the
+    // customer's public IP and forwards it as deviceIp. Web credentials are only
+    // held by the proxy, so the forwarded value is trusted for that context only.
+    // If the proxy does not forward an IP, omit allowedIpAddress rather than
+    // signing an IP the customer will never match.
+    let deviceIp = isWebContext ? req.body.deviceIp : Utils.getIpFromReq(req);
+    if (!deviceIp && !isWebContext) {
       throw new ClientError('Could not determine device IP address');
     }
-    const allowedIpAddress: string = Bitcore.crypto.Hash.sha256hmac(
-      Buffer.from(deviceIp),
-      Buffer.from(SECRET_KEY)
-    ).toString('base64');
-    qs.push('allowedIpAddress=' + encodeURIComponent(allowedIpAddress));
+    if (deviceIp) {
+      // Canonicalize before hashing: HMAC is byte-exact and MoonPay hashes the
+      // plain IPv4 it observes, while dual-stack sockets report IPv4 clients as
+      // IPv4-mapped IPv6 (::ffff:1.2.3.4) - strip the prefix so both sides
+      // hash the same string
+      deviceIp = String(deviceIp).trim().replace(/^::ffff:/i, '');
+      const allowedIpAddress: string = Bitcore.crypto.Hash.sha256hmac(
+        Buffer.from(deviceIp),
+        Buffer.from(SECRET_KEY)
+      ).toString('base64');
+      qs.push('allowedIpAddress=' + encodeURIComponent(allowedIpAddress));
+    }
 
     const URL_SEARCH: string = `?${qs.join('&')}`;
 

package/src/externalservices/ramp.ts

@@ -112,14 +112,13 @@ export class RampService {
     const webRequiredParams = [
       'selectedCountryCode',
     ];
-    const appRequiredParams = [
+    let appRequiredParams = [
       'enabledFlows',
       'defaultFlow',
       'selectedCountryCode',
-      'defaultAsset',
     ];
-    const extraRequiredParams = req.body.flow && req.body.flow === 'sell' ? ['offrampAsset'] : ['finalUrl', 'userAddress', 'swapAmount', 'swapAsset'];
-    appRequiredParams.concat(extraRequiredParams);
+    const extraRequiredParams = req.body.flow && req.body.flow === 'sell' ? [] : ['finalUrl', 'userAddress'];
+    appRequiredParams = appRequiredParams.concat(extraRequiredParams);
 
     const requiredParams = req.body.context === 'web' ? webRequiredParams : appRequiredParams;
     const keys = this.rampGetKeys(req);
@@ -138,21 +137,42 @@ export class RampService {
     qs.push('selectedCountryCode=' + encodeURIComponent(req.body.selectedCountryCode));
     if (req.body.finalUrl) qs.push('finalUrl=' + encodeURIComponent(req.body.finalUrl));
     if (req.body.userAddress) qs.push('userAddress=' + encodeURIComponent(req.body.userAddress));
-    if (req.body.swapAsset) qs.push('swapAsset=' + encodeURIComponent(req.body.swapAsset));
-    if (req.body.offrampAsset) qs.push('offrampAsset=' + encodeURIComponent(req.body.offrampAsset));
     if (req.body.enabledFlows) qs.push('enabledFlows=' + encodeURIComponent(req.body.enabledFlows));
     if (req.body.defaultFlow) qs.push('defaultFlow=' + encodeURIComponent(req.body.defaultFlow));
     if (req.body.hostLogoUrl) qs.push('hostLogoUrl=' + encodeURIComponent(req.body.hostLogoUrl));
     if (req.body.hostAppName) qs.push('hostAppName=' + encodeURIComponent(req.body.hostAppName));
-    if (req.body.swapAmount) qs.push('swapAmount=' + encodeURIComponent(req.body.swapAmount));
-    if (req.body.fiatValue) qs.push('fiatValue=' + encodeURIComponent(req.body.fiatValue));
-    if (req.body.fiatCurrency) qs.push('fiatCurrency=' + encodeURIComponent(req.body.fiatCurrency));
-    if (req.body.defaultAsset) qs.push('defaultAsset=' + encodeURIComponent(req.body.defaultAsset));
     if (req.body.userEmailAddress) qs.push('userEmailAddress=' + encodeURIComponent(req.body.userEmailAddress));
     if (req.body.useSendCryptoCallback) qs.push('useSendCryptoCallback=' + encodeURIComponent(req.body.useSendCryptoCallback));
     if (req.body.paymentMethodType) qs.push('paymentMethodType=' + encodeURIComponent(req.body.paymentMethodType));
     if (req.body.hideExitButton) qs.push('hideExitButton=' + encodeURIComponent(req.body.hideExitButton));
-    if (req.body.useSendCryptoCallbackVersion) qs.push('useSendCryptoCallbackVersion=' + encodeURIComponent(req.body.useSendCryptoCallbackVersion));
+
+    // Ramp deprecated the legacy per-flow search params in favor of a unified format.
+    // Ref: https://docs.rampnetwork.com/search-params-migration
+    // Older app versions still send the legacy fields, so we translate them into the new
+    // unified params here to keep those requests working going forward.
+    // `flow === 'sell'` => OFFRAMP; otherwise => ONRAMP.
+    // If a newer client already sends the new params, those take precedence.
+    const isOfframp = req.body.flow === 'sell';
+
+    // enabledCryptoAssets <- swapAsset (onramp) / offrampAsset (offramp)
+    const enabledCryptoAssets = req.body.enabledCryptoAssets ?? (isOfframp ? req.body.offrampAsset : req.body.swapAsset);
+    if (enabledCryptoAssets) qs.push('enabledCryptoAssets=' + encodeURIComponent(enabledCryptoAssets));
+
+    // inAsset (incoming, paid by the user) <- fiatCurrency (onramp) / defaultAsset (offramp)
+    const inAsset = req.body.inAsset ?? (isOfframp ? req.body.defaultAsset : req.body.fiatCurrency);
+    if (inAsset) qs.push('inAsset=' + encodeURIComponent(inAsset));
+
+    // outAsset (outgoing, received by the user) <- defaultAsset (onramp) / fiatCurrency (offramp)
+    const outAsset = req.body.outAsset ?? (isOfframp ? req.body.fiatCurrency : req.body.defaultAsset);
+    if (outAsset) qs.push('outAsset=' + encodeURIComponent(outAsset));
+
+    // inAssetValue (units, no decimals) <- fiatValue (onramp) / swapAmount (offramp)
+    const inAssetValue = req.body.inAssetValue ?? (isOfframp ? req.body.swapAmount : req.body.fiatValue);
+    if (inAssetValue) qs.push('inAssetValue=' + encodeURIComponent(inAssetValue));
+
+    // outAssetValue (units, no decimals) <- swapAmount (onramp) / fiatValue (offramp)
+    const outAssetValue = req.body.outAssetValue ?? (isOfframp ? req.body.fiatValue : req.body.swapAmount);
+    if (outAssetValue) qs.push('outAssetValue=' + encodeURIComponent(outAssetValue));
 
     const queryString = qs.join('&');
 

package/src/lib/expressapp.ts

@@ -126,6 +126,7 @@ export class ExpressApp {
 
     registerMoralisRoutes(router, {
       getServer,
+      getServerWithAuth,
       returnError
     });
 

package/src/lib/routes/moralis.ts

@@ -6,6 +6,7 @@ import type { WalletService } from '../server';
 
 interface RouteContext {
   getServer: Types.GetServerFn;
+  getServerWithAuth: Types.GetServerWithAuthFn;
   returnError: Types.ReturnErrorFn;
 }
 
@@ -33,6 +34,21 @@ function respondWithPublicServer(req, res, context: RouteContext, handler: Route
     });
 }
 
+function walletAuthOrPublic(context: RouteContext) {
+  return function(req, res, next) {
+    if (!req.header('x-identity')) {
+      // Not from wallet
+      return next();
+    }
+    return context.getServerWithAuth(req, res, _server => {
+      if (!req.header('origin')) {
+        req.headers['origin'] = config.moralis?.whitelist?.[0];
+      }
+      return next();
+    });
+  };
+}
+
 export function registerMoralisRoutes(router: express.Router, context: RouteContext) {
   const moralisCorsOptions = {
     origin: (origin, cb) => {
@@ -45,55 +61,55 @@ export function registerMoralisRoutes(router: express.Router, context: RouteCont
     }
   };
 
-  router.post('/v1/moralis/getWalletTokenBalances', cors(moralisCorsOptions), (req, res) => {
+  router.post('/v1/moralis/getWalletTokenBalances', walletAuthOrPublic(context), cors(moralisCorsOptions), (req, res) => {
     respondWithPublicServer(req, res, context, server => {
       return server.moralisGetWalletTokenBalances(req);
     });
   });
 
-  router.post('/v1/moralis/moralisGetTokenAllowance', cors(moralisCorsOptions), (req, res) => {
+  router.post('/v1/moralis/moralisGetTokenAllowance', walletAuthOrPublic(context), cors(moralisCorsOptions), (req, res) => {
     respondWithPublicServer(req, res, context, server => {
       return server.moralisGetTokenAllowance(req);
     });
   });
 
-  router.post('/v1/moralis/moralisGetNativeBalance', cors(moralisCorsOptions), (req, res) => {
+  router.post('/v1/moralis/moralisGetNativeBalance', walletAuthOrPublic(context), cors(moralisCorsOptions), (req, res) => {
     respondWithPublicServer(req, res, context, server => {
       return server.moralisGetNativeBalance(req);
     });
   });
 
-  router.post('/v1/moralis/GetTokenPrice', cors(moralisCorsOptions), (req, res) => {
+  router.post('/v1/moralis/GetTokenPrice', walletAuthOrPublic(context), cors(moralisCorsOptions), (req, res) => {
     respondWithPublicServer(req, res, context, server => {
       return server.moralisGetTokenPrice(req);
     });
   });
 
-  router.post('/v1/moralis/getMultipleERC20TokenPrices', cors(moralisCorsOptions), (req, res) => {
+  router.post('/v1/moralis/getMultipleERC20TokenPrices', walletAuthOrPublic(context), cors(moralisCorsOptions), (req, res) => {
     respondWithPublicServer(req, res, context, server => {
       return server.moralisGetMultipleERC20TokenPrices(req);
     });
   });
 
-  router.post('/v1/moralis/getERC20TokenBalancesWithPricesByWallet', cors(moralisCorsOptions), (req, res) => {
+  router.post('/v1/moralis/getERC20TokenBalancesWithPricesByWallet', walletAuthOrPublic(context), cors(moralisCorsOptions), (req, res) => {
     respondWithPublicServer(req, res, context, server => {
       return server.moralisGetERC20TokenBalancesWithPricesByWallet(req);
     });
   });
 
-  router.post('/v1/moralis/getSolWalletPortfolio', cors(moralisCorsOptions), (req, res) => {
+  router.post('/v1/moralis/getSolWalletPortfolio', walletAuthOrPublic(context), cors(moralisCorsOptions), (req, res) => {
     respondWithPublicServer(req, res, context, server => {
       return server.moralisGetSolWalletPortfolio(req);
     });
   });
 
-  router.post('/v1/moralis/getTransactionVerbose', cors(moralisCorsOptions), (req, res) => {
+  router.post('/v1/moralis/getTransactionVerbose', walletAuthOrPublic(context), cors(moralisCorsOptions), (req, res) => {
     respondWithPublicServer(req, res, context, server => {
       return server.moralisGetTransactionVerbose(req);
     });
   });
 
-  router.post('/v1/moralis/getMultipleSolTokenPrices', cors(moralisCorsOptions), (req, res) => {
+  router.post('/v1/moralis/getMultipleSolTokenPrices', walletAuthOrPublic(context), cors(moralisCorsOptions), (req, res) => {
     respondWithPublicServer(req, res, context, server => {
       return server.moralisGetMultipleSolTokenPrices(req);
     });

package/src/lib/routes/services.ts

@@ -232,7 +232,7 @@ export function registerServiceRoutes(router: express.Router, context: RouteCont
   });
 
   router.post('/v1/service/banxa/getOrder', (req, res) => {
-    respondWithPublicServer(req, res, context, server => {
+    respondWithAuthServer(req, res, context, server => {
       return server.externalServices.banxa.banxaGetOrder(req);
     });
   });
@@ -274,7 +274,7 @@ export function registerServiceRoutes(router: express.Router, context: RouteCont
   });
 
   router.post('/v1/service/moonpay/transactionDetails', (req, res) => {
-    respondWithPublicServer(req, res, context, server => {
+    respondWithAuthServer(req, res, context, server => {
       return server.externalServices.moonpay.moonpayGetTransactionDetails(req);
     });
   });
@@ -292,7 +292,7 @@ export function registerServiceRoutes(router: express.Router, context: RouteCont
   });
 
   router.post('/v1/service/moonpay/accountDetails', (req, res) => {
-    respondWithPublicServer(req, res, context, server => {
+    respondWithAuthServer(req, res, context, server => {
       return server.externalServices.moonpay.moonpayGetAccountDetails(req);
     });
   });
@@ -364,7 +364,7 @@ export function registerServiceRoutes(router: express.Router, context: RouteCont
   });
 
   router.post('/v1/service/sardine/ordersDetails', (req, res) => {
-    respondWithPublicServer(req, res, context, server => {
+    respondWithAuthServer(req, res, context, server => {
       return server.externalServices.sardine.sardineGetOrdersDetails(req);
     });
   });
@@ -431,7 +431,7 @@ export function registerServiceRoutes(router: express.Router, context: RouteCont
   });
 
   router.post('/v1/service/thorswap/getSwapTx', (req, res) => {
-    respondWithPublicServer(req, res, context, server => {
+    respondWithAuthServer(req, res, context, server => {
       return server.externalServices.thorswap.thorswapGetSwapTx(req);
     });
   });
@@ -467,7 +467,7 @@ export function registerServiceRoutes(router: express.Router, context: RouteCont
   });
 
   router.post('/v1/service/transak/orderDetails', cors(transakCorsOptions), (req, res) => {
-    respondWithPublicServer(req, res, context, server => {
+    respondWithAuthServer(req, res, context, server => {
       return server.externalServices.transak.transakGetOrderDetails(req);
     });
   });
@@ -509,13 +509,13 @@ export function registerServiceRoutes(router: express.Router, context: RouteCont
   });
 
   router.post('/v1/service/changelly/getTransactions', (req, res) => {
-    respondWithPublicServer(req, res, context, server => {
+    respondWithAuthServer(req, res, context, server => {
       return server.externalServices.changelly.changellyGetTransactions(req);
     });
   });
 
   router.post('/v1/service/changelly/getStatus', (req, res) => {
-    respondWithPublicServer(req, res, context, server => {
+    respondWithAuthServer(req, res, context, server => {
       return server.externalServices.changelly.changellyGetStatus(req);
     });
   });

package/test/expressapp.test.ts

@@ -610,6 +610,89 @@ describe('ExpressApp', function() {
         });
       });
 
+      describe('Moralis routes (wallet-authenticated or public)', function() {
+        const whitelistedOrigin = 'https://whitelisted-dapp.example';
+        let originalMoralisConfig;
+        beforeEach(function() {
+          originalMoralisConfig = config.moralis;
+          config.moralis = { whitelist: [whitelistedOrigin] };
+        });
+        afterEach(function() {
+          config.moralis = originalMoralisConfig;
+        });
+
+        it('/v1/moralis/getMultipleERC20TokenPrices should work without auth headers (public/dApp)', function(done) {
+          const server = {
+            moralisGetMultipleERC20TokenPrices: sinon.stub().resolves([{ tokenAddress: '0xaaa', usdPrice: 1 }]),
+          };
+          sandbox.stub(WalletService, 'initialize').callsArg(1);
+          sandbox.stub(WalletService, 'getInstance').returns(server);
+          start(ExpressApp, function() {
+            const requestOptions = {
+              url: testHost + ':' + testPort + config.basePath + '/v1/moralis/getMultipleERC20TokenPrices',
+              method: 'post',
+              json: { chain: '0x1', tokens: [{ tokenAddress: '0xaaa' }] },
+              headers: {
+                origin: whitelistedOrigin
+              }
+            };
+            request(requestOptions, function(err, res, body) {
+              should.not.exist(err);
+              res.statusCode.should.equal(200);
+              body[0].tokenAddress.should.equal('0xaaa');
+              done();
+            });
+          });
+        });
+
+        it('/v1/moralis/getMultipleERC20TokenPrices should work with valid wallet auth headers', function(done) {
+          const server = {
+            moralisGetMultipleERC20TokenPrices: sinon.stub().resolves([{ tokenAddress: '0xaaa', usdPrice: 1 }]),
+          };
+          sandbox.stub(WalletService, 'initialize').callsArg(1);
+          sandbox.stub(WalletService, 'getInstance').returns(server);
+          sandbox.stub(WalletService, 'getInstanceWithAuth').callsArgWith(1, null, server);
+          start(ExpressApp, function() {
+            const requestOptions = {
+              url: testHost + ':' + testPort + config.basePath + '/v1/moralis/getMultipleERC20TokenPrices',
+              method: 'post',
+              json: { chain: '0x1', tokens: [{ tokenAddress: '0xaaa' }] },
+              headers: {
+                'x-identity': 'identity',
+                'x-signature': 'signature'
+              }
+            };
+            request(requestOptions, function(err, res, body) {
+              should.not.exist(err);
+              res.statusCode.should.equal(200);
+              body[0].tokenAddress.should.equal('0xaaa');
+              done();
+            });
+          });
+        });
+
+        it('/v1/moralis/getMultipleERC20TokenPrices should fail with invalid wallet auth headers', function(done) {
+          sandbox.stub(WalletService, 'initialize').callsArg(1);
+          sandbox.stub(WalletService, 'getInstanceWithAuth').callsArgWith(1, new ClientError('NOT_AUTHORIZED', 'Not authorized'));
+          start(ExpressApp, function() {
+            const requestOptions = {
+              url: testHost + ':' + testPort + config.basePath + '/v1/moralis/getMultipleERC20TokenPrices',
+              method: 'post',
+              json: { chain: '0x1', tokens: [{ tokenAddress: '0xaaa' }] },
+              headers: {
+                'x-identity': 'identity',
+                'x-signature': 'bad-signature'
+              }
+            };
+            request(requestOptions, function(err, res) {
+              should.not.exist(err);
+              res.statusCode.should.equal(401);
+              done();
+            });
+          });
+        });
+      });
+
       describe('Token allowance', function() {
         it('/v1/token/allowance', function(done) {
           const server = {

package/test/integration/externalservices/moonpay.test.ts

@@ -292,6 +292,36 @@ describe('Moonpay integration', () => {
       }
     });
 
+    it('should hash the forwarded deviceIp instead of the request IP for web context', () => {
+      req.body.context = 'web';
+      req.body.deviceIp = '203.0.113.42';
+      const data = server.externalServices.moonpay.moonpayGetSignedPaymentUrl(req);
+      should.exist(data.urlWithSignature);
+      data.urlWithSignature.should.equal('widgetApi4?apiKey=apiKey4&currencyCode=btc&walletAddress=bitcoin%3A123123&baseCurrencyCode=usd&baseCurrencyAmount=500&externalTransactionId=123123&redirectURL=bitpay%3A%2F%2Fmoonpay&allowedIpAddress=HkPyqsZMUzAgsEx27Tlz%2B5XfZHaH0fSfWV%2FMKR7JAPc%3D&signature=B%2Bw0TTQiy8%2Ffq6QeoeSf4dKpdPHZ%2F2EnBB1S4UotNGM%3D');
+    });
+
+    it('should canonicalize IPv4-mapped IPv6 deviceIp before hashing', () => {
+      req.body.context = 'web';
+      req.body.deviceIp = '::ffff:203.0.113.42';
+      const data = server.externalServices.moonpay.moonpayGetSignedPaymentUrl(req);
+      should.exist(data.urlWithSignature);
+      data.urlWithSignature.should.equal('widgetApi4?apiKey=apiKey4&currencyCode=btc&walletAddress=bitcoin%3A123123&baseCurrencyCode=usd&baseCurrencyAmount=500&externalTransactionId=123123&redirectURL=bitpay%3A%2F%2Fmoonpay&allowedIpAddress=HkPyqsZMUzAgsEx27Tlz%2B5XfZHaH0fSfWV%2FMKR7JAPc%3D&signature=B%2Bw0TTQiy8%2Ffq6QeoeSf4dKpdPHZ%2F2EnBB1S4UotNGM%3D');
+    });
+
+    it('should omit allowedIpAddress for web context when no deviceIp is forwarded', () => {
+      req.body.context = 'web';
+      const data = server.externalServices.moonpay.moonpayGetSignedPaymentUrl(req);
+      should.exist(data.urlWithSignature);
+      data.urlWithSignature.should.equal('widgetApi4?apiKey=apiKey4&currencyCode=btc&walletAddress=bitcoin%3A123123&baseCurrencyCode=usd&baseCurrencyAmount=500&externalTransactionId=123123&redirectURL=bitpay%3A%2F%2Fmoonpay&signature=13Q%2BET1UQLnCqCyg3stDAN4%2FTQ8QB009LcuAP1y6B%2FI%3D');
+    });
+
+    it('should ignore a body deviceIp for non-web context and use the request IP', () => {
+      req.body.deviceIp = '203.0.113.42';
+      const data = server.externalServices.moonpay.moonpayGetSignedPaymentUrl(req);
+      should.exist(data.urlWithSignature);
+      data.urlWithSignature.should.equal('widgetApi2?apiKey=apiKey2&currencyCode=btc&walletAddress=bitcoin%3A123123&baseCurrencyCode=usd&baseCurrencyAmount=500&externalTransactionId=123123&redirectURL=bitpay%3A%2F%2Fmoonpay&allowedIpAddress=CN35SFB5PKS4vkiZ4CglTxRgTAaUHBLGZcenAw6gHEY%3D&signature=3XxjRX3EMj2RNaoAwgOwFBOiVTXsgAS7C50uJf9SsvM%3D');
+    });
+
     it('should return error if there is some missing arguments', () => {
       delete req.body.currencyCode;
       try {