@bitpay-labs/bitcore-wallet-service 11.10.7 → 11.10.8

package/ts_build/test/integration/server.test.js

@@ -40,6 +40,8 @@ const chai = __importStar(require("chai"));
 require("chai/register-should");
 const util_1 = __importDefault(require("util"));
 const sinon_1 = __importDefault(require("sinon"));
+const http_1 = __importDefault(require("http"));
+const request_1 = __importDefault(require("request"));
 const CWC = __importStar(require("@bitpay-labs/crypto-wallet-core"));
 const index_1 = require("../../src/lib/chain/index");
 const config_1 = __importDefault(require("../../src/config"));
@@ -47,10 +49,12 @@ const server_1 = require("../../src/lib/server");
 const storage_1 = require("../../src/lib/storage");
 const common_1 = require("../../src/lib/common");
 const Model = __importStar(require("../../src/lib/model"));
+const tsskeygen_1 = require("../../src/lib/model/tsskeygen");
 const bchaddresstranslator_1 = require("../../src/lib/bchaddresstranslator");
 const TestData = __importStar(require("../testdata"));
 const helpers_1 = __importDefault(require("./helpers"));
 const clienterror_1 = require("../../src/lib/errors/clienterror");
+const expressapp_1 = require("../../src/lib/expressapp");
 const should = chai.should();
 config_1.default.moralis = config_1.default.moralis ?? {
     apiKey: 'apiKey',
@@ -1085,6 +1089,231 @@ describe('Wallet service', function () {
                     done();
                 });
             });
+            it('should fail to join with wrong signature even when hardwareSourcePublicKey is present', function (done) {
+                const copayerOpts = helpers_1.default.getSignedCopayerOpts({
+                    walletId: walletId,
+                    name: 'me',
+                    xPubKey: TestData.copayers[0].xPubKey_44H_0H_0H,
+                    requestPubKey: TestData.copayers[0].pubKey_1H_0,
+                });
+                copayerOpts.name = 'me2';
+                copayerOpts.hardwareSourcePublicKey = 'attacker-controlled-hw-pubkey';
+                server.joinWallet(copayerOpts, function (err, result) {
+                    should.not.exist(result);
+                    should.exist(err);
+                    err.message.should.equal('Bad request');
+                    server.getWallet({}, function (err, wallet) {
+                        should.not.exist(err);
+                        wallet.copayers.length.should.equal(0);
+                        done();
+                    });
+                });
+            });
+            it('should fail to join with wrong signature even when clientDerivedPublicKey is present', function (done) {
+                const copayerOpts = helpers_1.default.getSignedCopayerOpts({
+                    walletId: walletId,
+                    name: 'me',
+                    xPubKey: TestData.copayers[0].xPubKey_44H_0H_0H,
+                    requestPubKey: TestData.copayers[0].pubKey_1H_0,
+                });
+                copayerOpts.name = 'me2';
+                copayerOpts.clientDerivedPublicKey = 'attacker-controlled-client-derived-pubkey';
+                server.joinWallet(copayerOpts, function (err, result) {
+                    should.not.exist(result);
+                    should.exist(err);
+                    err.message.should.equal('Bad request');
+                    server.getWallet({}, function (err, wallet) {
+                        should.not.exist(err);
+                        wallet.copayers.length.should.equal(0);
+                        done();
+                    });
+                });
+            });
+            it('should join existing wallet with a valid signature and hardwareSourcePublicKey present', function (done) {
+                const copayerOpts = helpers_1.default.getSignedCopayerOpts({
+                    walletId: walletId,
+                    name: 'me',
+                    xPubKey: TestData.copayers[0].xPubKey_44H_0H_0H,
+                    requestPubKey: TestData.copayers[0].pubKey_1H_0,
+                });
+                copayerOpts.hardwareSourcePublicKey = 'legit-hw-pubkey';
+                server.joinWallet(copayerOpts, function (err, result) {
+                    should.not.exist(err);
+                    should.exist(result);
+                    should.exist(result.copayerId);
+                    server.getWallet({}, function (err, wallet) {
+                        should.not.exist(err);
+                        wallet.copayers.length.should.equal(1);
+                        const copayer = wallet.copayers[0];
+                        copayer.id.should.equal(result.copayerId);
+                        copayer.hardwareSourcePublicKey.should.equal('legit-hw-pubkey');
+                        done();
+                    });
+                });
+            });
+            it('should join existing wallet with a valid signature and clientDerivedPublicKey present', function (done) {
+                const copayerOpts = helpers_1.default.getSignedCopayerOpts({
+                    walletId: walletId,
+                    name: 'me',
+                    xPubKey: TestData.copayers[0].xPubKey_44H_0H_0H,
+                    requestPubKey: TestData.copayers[0].pubKey_1H_0,
+                });
+                copayerOpts.clientDerivedPublicKey = 'legit-client-derived-pubkey';
+                server.joinWallet(copayerOpts, function (err, result) {
+                    should.not.exist(err);
+                    should.exist(result);
+                    should.exist(result.copayerId);
+                    server.getWallet({}, function (err, wallet) {
+                        should.not.exist(err);
+                        wallet.copayers.length.should.equal(1);
+                        const copayer = wallet.copayers[0];
+                        copayer.id.should.equal(result.copayerId);
+                        copayer.clientDerivedPublicKey.should.equal('legit-client-derived-pubkey');
+                        done();
+                    });
+                });
+            });
+            it('should reject a join with hardwareSourcePublicKey present when xPubKey is absent', function (done) {
+                const copayerOpts = helpers_1.default.getSignedCopayerOpts({
+                    walletId: walletId,
+                    name: 'me',
+                    requestPubKey: TestData.copayers[0].pubKey_1H_0,
+                });
+                should.not.exist(copayerOpts.xPubKey);
+                copayerOpts.hardwareSourcePublicKey = 'legit-hw-pubkey-no-xpub';
+                server.joinWallet(copayerOpts, function (err, result) {
+                    should.not.exist(result);
+                    should.exist(err);
+                    err.should.be.instanceof(clienterror_1.ClientError);
+                    server.storage.fetchWallet(walletId, function (err, wallet) {
+                        should.not.exist(err);
+                        should.exist(wallet);
+                        wallet.copayers.length.should.equal(0);
+                        done();
+                    });
+                });
+            });
+            for (const ancillaryField of ['hardwareSourcePublicKey', 'clientDerivedPublicKey']) {
+                it(`should reject an xPubKey-less ${ancillaryField} join without persisting a copayer`, function (done) {
+                    const copayerOpts = helpers_1.default.getSignedCopayerOpts({
+                        walletId: walletId,
+                        name: 'me',
+                        requestPubKey: TestData.copayers[0].pubKey_1H_0,
+                    });
+                    should.not.exist(copayerOpts.xPubKey);
+                    copayerOpts[ancillaryField] = 'legit-value-no-xpub';
+                    server.joinWallet(copayerOpts, function (err, result) {
+                        should.not.exist(result);
+                        should.exist(err);
+                        err.should.be.instanceof(clienterror_1.ClientError);
+                        server.storage.fetchWallet(walletId, function (err, wallet) {
+                            should.not.exist(err);
+                            should.exist(wallet);
+                            wallet.copayers.length.should.equal(0);
+                            done();
+                        });
+                    });
+                });
+            }
+            it('should fail to join with a malformed xPubKey even when hardwareSourcePublicKey is present', function (done) {
+                const copayerOpts = helpers_1.default.getSignedCopayerOpts({
+                    walletId: walletId,
+                    name: 'me',
+                    xPubKey: 'invalid',
+                    requestPubKey: TestData.copayers[0].pubKey_1H_0,
+                });
+                copayerOpts.hardwareSourcePublicKey = 'legit-hw-pubkey';
+                server.joinWallet(copayerOpts, function (err, result) {
+                    should.not.exist(result);
+                    should.exist(err);
+                    err.should.be.instanceof(clienterror_1.ClientError);
+                    server.storage.fetchWallet(walletId, function (err, wallet) {
+                        should.not.exist(err);
+                        should.exist(wallet);
+                        wallet.copayers.length.should.equal(0);
+                        done();
+                    });
+                });
+            });
+            it('should fail to join with a malformed xPubKey even when clientDerivedPublicKey is present', function (done) {
+                const copayerOpts = helpers_1.default.getSignedCopayerOpts({
+                    walletId: walletId,
+                    name: 'me',
+                    xPubKey: 'invalid',
+                    requestPubKey: TestData.copayers[0].pubKey_1H_0,
+                });
+                copayerOpts.clientDerivedPublicKey = 'legit-client-derived-pubkey';
+                server.joinWallet(copayerOpts, function (err, result) {
+                    should.not.exist(result);
+                    should.exist(err);
+                    err.should.be.instanceof(clienterror_1.ClientError);
+                    server.storage.fetchWallet(walletId, function (err, wallet) {
+                        should.not.exist(err);
+                        should.exist(wallet);
+                        wallet.copayers.length.should.equal(0);
+                        done();
+                    });
+                });
+            });
+            it('should reject a join when xPubKey, hardwareSourcePublicKey and clientDerivedPublicKey are all missing or empty', function (done) {
+                const copayerOpts = helpers_1.default.getSignedCopayerOpts({
+                    walletId: walletId,
+                    name: 'me',
+                    requestPubKey: TestData.copayers[0].pubKey_1H_0,
+                });
+                should.not.exist(copayerOpts.xPubKey);
+                copayerOpts.hardwareSourcePublicKey = '';
+                copayerOpts.clientDerivedPublicKey = '';
+                server.joinWallet(copayerOpts, function (err, result) {
+                    should.not.exist(result);
+                    should.exist(err);
+                    err.should.be.instanceof(clienterror_1.ClientError);
+                    server.storage.fetchWallet(walletId, function (err, wallet) {
+                        should.not.exist(err);
+                        should.exist(wallet);
+                        wallet.copayers.length.should.equal(0);
+                        done();
+                    });
+                });
+            });
+            it('should fail to join a full wallet with a valid signature and hardwareSourcePublicKey present', function (done) {
+                const firstCopayerOpts = helpers_1.default.getSignedCopayerOpts({
+                    walletId: walletId,
+                    name: 'copayer 1',
+                    xPubKey: TestData.copayers[0].xPubKey_44H_0H_0H,
+                    requestPubKey: TestData.copayers[0].pubKey_1H_0,
+                });
+                server.joinWallet(firstCopayerOpts, function (err) {
+                    should.not.exist(err);
+                    const secondCopayerOpts = helpers_1.default.getSignedCopayerOpts({
+                        walletId: walletId,
+                        name: 'copayer 2',
+                        xPubKey: TestData.copayers[1].xPubKey_44H_0H_0H,
+                        requestPubKey: TestData.copayers[1].pubKey_1H_0,
+                    });
+                    server.joinWallet(secondCopayerOpts, function (err) {
+                        should.not.exist(err);
+                        const thirdCopayerOpts = helpers_1.default.getSignedCopayerOpts({
+                            walletId: walletId,
+                            name: 'copayer 3',
+                            xPubKey: TestData.copayers[2].xPubKey_44H_0H_0H,
+                            requestPubKey: TestData.copayers[2].pubKey_1H_0,
+                        });
+                        thirdCopayerOpts.hardwareSourcePublicKey = 'attacker-or-legit-hw-pubkey';
+                        server.joinWallet(thirdCopayerOpts, function (err, result) {
+                            should.not.exist(result);
+                            should.exist(err);
+                            err.should.be.instanceof(clienterror_1.ClientError);
+                            err.code.should.equal('WALLET_FULL');
+                            server.getWallet({}, function (err, wallet) {
+                                should.not.exist(err);
+                                wallet.copayers.length.should.equal(2);
+                                done();
+                            });
+                        });
+                    });
+                });
+            });
             it('should set pkr and status = complete on last copayer joining (2-3)', function (done) {
                 helpers_1.default.createAndJoinWallet(2, 3).then(function ({ server }) {
                     server.getWallet({}, function (err, wallet) {
@@ -1317,6 +1546,87 @@ describe('Wallet service', function () {
                 });
             });
         });
+        describe('TSS wallets (non-participant bypass)', function () {
+            it('should reject a join from a copayer who is not a TSS keygen session participant, even with clientDerivedPublicKey supplied', async function () {
+                const server = new server_1.WalletService();
+                const legitXPubKey = TestData.copayers[0].xPubKey_44H_0H_0H;
+                const legitCopayerId = Model.Copayer.xPubToCopayerId('btc', legitXPubKey);
+                const session = tsskeygen_1.TssKeyGenModel.create({
+                    id: 'tss-non-participant-bypass-test-session',
+                    message: { partyId: 0, broadcastMessages: [], p2pMessages: [], publicKey: 'dummy', round: 0 },
+                    n: 1,
+                    copayerId: legitCopayerId,
+                    version: 1.1,
+                });
+                session.sharedPublicKey = 'dummy-shared-public-key';
+                await server.storage.db.collection('tss_keygen').deleteMany({ id: session.id });
+                await server.storage.storeTssKeyGenSession({ doc: session });
+                const walletId = await util_1.default.promisify(server.createWallet).call(server, {
+                    name: 'tss wallet',
+                    m: 1,
+                    n: 1,
+                    pubKey: TestData.keyPair.pub,
+                    coin: 'btc',
+                    tssKeyId: session.id,
+                });
+                should.exist(walletId);
+                const copayerOpts = helpers_1.default.getSignedCopayerOpts({
+                    walletId,
+                    name: 'attacker',
+                    xPubKey: TestData.copayers[1].xPubKey_44H_0H_0H,
+                    clientDerivedPublicKey: 'attacker-controlled-client-derived-pubkey',
+                    requestPubKey: TestData.copayers[1].pubKey_1H_0,
+                });
+                const { err, result } = await new Promise(resolve => {
+                    server.joinWallet(copayerOpts, (err, result) => resolve({ err, result }));
+                });
+                should.not.exist(result);
+                should.exist(err);
+                err.code.should.equal('TSS_NON_PARTICIPANT');
+                const wallet = await util_1.default.promisify(server.getWallet).call(server, {});
+                wallet.copayers.length.should.equal(0);
+            });
+            it('should reject a TSS join with clientDerivedPublicKey present when xPubKey is absent, even if the ancillary-derived ID is a keygen session participant', async function () {
+                const server = new server_1.WalletService();
+                const clientDerivedPublicKey = 'legit-client-derived-pubkey-no-xpub';
+                const ancillaryDerivedCopayerId = Model.Copayer.xPubToCopayerId('btc', clientDerivedPublicKey);
+                const session = tsskeygen_1.TssKeyGenModel.create({
+                    id: 'tss-no-xpubkey-rejected-test-session',
+                    message: { partyId: 0, broadcastMessages: [], p2pMessages: [], publicKey: 'dummy', round: 0 },
+                    n: 1,
+                    copayerId: ancillaryDerivedCopayerId,
+                    version: 1.1,
+                });
+                session.sharedPublicKey = 'dummy-shared-public-key';
+                await server.storage.db.collection('tss_keygen').deleteMany({ id: session.id });
+                await server.storage.storeTssKeyGenSession({ doc: session });
+                const walletId = await util_1.default.promisify(server.createWallet).call(server, {
+                    name: 'tss wallet',
+                    m: 1,
+                    n: 1,
+                    pubKey: TestData.keyPair.pub,
+                    coin: 'btc',
+                    tssKeyId: session.id,
+                });
+                should.exist(walletId);
+                const copayerOpts = helpers_1.default.getSignedCopayerOpts({
+                    walletId,
+                    name: 'me',
+                    clientDerivedPublicKey,
+                    requestPubKey: TestData.copayers[0].pubKey_1H_0,
+                });
+                should.not.exist(copayerOpts.xPubKey);
+                const { err, result } = await new Promise(resolve => {
+                    server.joinWallet(copayerOpts, (err, result) => resolve({ err, result }));
+                });
+                should.not.exist(result);
+                should.exist(err);
+                err.should.be.instanceof(clienterror_1.ClientError);
+                const wallet = await util_1.default.promisify(server.storage.fetchWallet).call(server.storage, walletId);
+                should.exist(wallet);
+                wallet.copayers.length.should.equal(0);
+            });
+        });
     });
     describe('#removeWallet', function () {
         let server;
@@ -2609,6 +2919,93 @@ describe('Wallet service', function () {
                 });
             });
         });
+        describe('#add access with historical copayer state', function () {
+            beforeEach(async function () {
+                ({ server, wallet } = await helpers_1.default.createAndJoinWallet(1, 1));
+            });
+            function snapshotState(cb) {
+                server.storage.db.collection(storage_1.Storage.collections.WALLETS).findOne({ id: wallet.id }, (err, walletDoc) => {
+                    if (err)
+                        return cb(err);
+                    server.storage.db.collection(storage_1.Storage.collections.COPAYERS_LOOKUP).findOne({ copayerId: opts.copayerId }, (err2, lookupDoc) => {
+                        if (err2)
+                            return cb(err2);
+                        return cb(null, {
+                            wallet: JSON.parse(JSON.stringify(walletDoc)),
+                            lookup: JSON.parse(JSON.stringify(lookupDoc))
+                        });
+                    });
+                });
+            }
+            function mutateWalletDoc(mutation, cb) {
+                server.storage.db.collection(storage_1.Storage.collections.WALLETS).findOne({ id: wallet.id }, (err, walletDoc) => {
+                    if (err)
+                        return cb(err);
+                    mutation(walletDoc);
+                    server.storage.db.collection(storage_1.Storage.collections.WALLETS).replaceOne({ id: wallet.id }, walletDoc, cb);
+                });
+            }
+            it('should return NOT_AUTHORIZED when the target copayer is missing from the wallet', function (done) {
+                mutateWalletDoc(doc => {
+                    doc.copayers = doc.copayers.filter(c => c.id !== opts.copayerId);
+                }, (err) => {
+                    should.not.exist(err);
+                    snapshotState((err, before) => {
+                        should.not.exist(err);
+                        ws.addAccess(opts, (err, res) => {
+                            err.should.be.instanceof(clienterror_1.ClientError);
+                            err.code.should.equal('NOT_AUTHORIZED');
+                            should.not.exist(res);
+                            snapshotState((err, after) => {
+                                should.not.exist(err);
+                                after.should.deep.equal(before);
+                                done();
+                            });
+                        });
+                    });
+                });
+            });
+            it('should return NOT_AUTHORIZED when the target copayer has no xPubKey', function (done) {
+                mutateWalletDoc(doc => {
+                    delete doc.copayers[0].xPubKey;
+                }, (err) => {
+                    should.not.exist(err);
+                    snapshotState((err, before) => {
+                        should.not.exist(err);
+                        ws.addAccess(opts, (err, res) => {
+                            err.should.be.instanceof(clienterror_1.ClientError);
+                            err.code.should.equal('NOT_AUTHORIZED');
+                            should.not.exist(res);
+                            snapshotState((err, after) => {
+                                should.not.exist(err);
+                                after.should.deep.equal(before);
+                                done();
+                            });
+                        });
+                    });
+                });
+            });
+            it('should return NOT_AUTHORIZED when the target copayer has a malformed xPubKey', function (done) {
+                mutateWalletDoc(doc => {
+                    doc.copayers[0].xPubKey = 'invalid';
+                }, (err) => {
+                    should.not.exist(err);
+                    snapshotState((err, before) => {
+                        should.not.exist(err);
+                        ws.addAccess(opts, (err, res) => {
+                            err.should.be.instanceof(clienterror_1.ClientError);
+                            err.code.should.equal('NOT_AUTHORIZED');
+                            should.not.exist(res);
+                            snapshotState((err, after) => {
+                                should.not.exist(err);
+                                after.should.deep.equal(before);
+                                done();
+                            });
+                        });
+                    });
+                });
+            });
+        });
     });
     describe('#getBalance', function () {
         let server;
@@ -8355,6 +8752,206 @@ describe('Wallet service', function () {
         it.skip('should get accepted/rejected transaction proposal', function (done) { });
         it.skip('should get broadcasted transaction proposal', function (done) { });
     });
+    describe('#getTxByHash', function () {
+        let serverA;
+        let walletA;
+        let serverB;
+        let txp;
+        beforeEach(async function () {
+            ({ server: serverA, wallet: walletA } = await helpers_1.default.createAndJoinWallet(1, 1));
+            await helpers_1.default.stubUtxos(serverA, walletA, 1);
+            const txOpts = {
+                outputs: [{
+                        toAddress: '18PzpUFkFZE8zKWUPvfykkTxmB9oMR8qP7',
+                        amount: 0.5e8
+                    }],
+                feePerKb: 100e2,
+                message: 'some message',
+            };
+            txp = await helpers_1.default.createAndPublishTx(serverA, txOpts, TestData.copayers[0].privKey_1H_0);
+            should.exist(txp);
+            const signatures = helpers_1.default.clientSign(txp, TestData.copayers[0].xPrivKey_44H_0H_0H);
+            txp = await util_1.default.promisify(serverA.signTx).call(serverA, {
+                txProposalId: txp.id,
+                signatures,
+            });
+            should.exist(txp.txid);
+            ({ server: serverB } = await helpers_1.default.createAndJoinWallet(1, 1, { offset: 1 }));
+        });
+        it('should not disclose another wallet\'s transaction proposal by hash', function (done) {
+            serverB.getTxByHash({
+                txid: txp.txid
+            }, function (err, res) {
+                should.exist(err);
+                should.not.exist(res);
+                err.should.be.instanceof(clienterror_1.ClientError);
+                err.code.should.equal('TX_NOT_FOUND');
+                err.message.should.equal('Transaction proposal not found');
+                JSON.stringify(err).should.not.include(walletA.id);
+                done();
+            });
+        });
+        it('should get own transaction proposal by hash, unchanged from before the fix', function (done) {
+            serverA.editTxNote({
+                txid: txp.txid,
+                body: 'a note from wallet A'
+            }, function (err) {
+                should.not.exist(err);
+                serverA.getTxByHash({
+                    txid: txp.txid
+                }, function (err, res) {
+                    should.not.exist(err);
+                    should.exist(res);
+                    res.id.should.equal(txp.id);
+                    res.walletId.should.equal(walletA.id);
+                    res.txid.should.equal(txp.txid);
+                    should.exist(res.raw);
+                    should.exist(res.note);
+                    res.note.body.should.equal('a note from wallet A');
+                    done();
+                });
+            });
+        });
+        it('should return the identical not-found error for a foreign txid and an unknown txid', function (done) {
+            serverB.getTxByHash({
+                txid: txp.txid
+            }, function (errForeign, resForeign) {
+                should.exist(errForeign);
+                should.not.exist(resForeign);
+                serverB.getTxByHash({
+                    txid: helpers_1.default.randomTXID()
+                }, function (errUnknown, resUnknown) {
+                    should.exist(errUnknown);
+                    should.not.exist(resUnknown);
+                    errForeign.code.should.equal(errUnknown.code);
+                    errForeign.message.should.equal(errUnknown.message);
+                    errForeign.code.should.equal('TX_NOT_FOUND');
+                    done();
+                });
+            });
+        });
+        it('should return a bad-request error when txid is missing', function (done) {
+            serverA.getTxByHash({}, function (err, res) {
+                should.exist(err);
+                should.not.exist(res);
+                err.should.be.instanceof(clienterror_1.ClientError);
+                err.code.should.equal('BADREQUEST');
+                err.message.should.equal('Required argument: txid missing.');
+                done();
+            });
+        });
+    });
+    describe('GET /v1/txproposalsbyhash/:id/ (HTTP route)', function () {
+        const testHost = 'http://127.0.0.1';
+        let testPort;
+        let httpServer;
+        let verifyStub;
+        let walletA;
+        let walletB;
+        let txp;
+        beforeEach(async function () {
+            httpServer = undefined;
+            verifyStub = undefined;
+            let serverA;
+            let serverB;
+            ({ server: serverA, wallet: walletA } = await helpers_1.default.createAndJoinWallet(1, 1));
+            await helpers_1.default.stubUtxos(serverA, walletA, 1);
+            const txOpts = {
+                outputs: [{
+                        toAddress: '18PzpUFkFZE8zKWUPvfykkTxmB9oMR8qP7',
+                        amount: 0.5e8
+                    }],
+                feePerKb: 100e2,
+                message: 'some message',
+            };
+            txp = await helpers_1.default.createAndPublishTx(serverA, txOpts, TestData.copayers[0].privKey_1H_0);
+            const signatures = helpers_1.default.clientSign(txp, TestData.copayers[0].xPrivKey_44H_0H_0H);
+            txp = await util_1.default.promisify(serverA.signTx).call(serverA, {
+                txProposalId: txp.id,
+                signatures,
+            });
+            should.exist(txp.txid);
+            ({ server: serverB, wallet: walletB } = await helpers_1.default.createAndJoinWallet(1, 1, { offset: 1 }));
+            verifyStub = sinon_1.default.stub(server_1.WalletService.prototype, '_verifySignature').returns(true);
+            const app = new expressapp_1.ExpressApp();
+            httpServer = new http_1.default.Server(app.app);
+            await util_1.default.promisify(app.start).call(app, {
+                storage: helpers_1.default.getStorage(),
+                blockchainExplorer: helpers_1.default.getBlockchainExplorer(),
+                request: sinon_1.default.stub(),
+                disableLogs: true,
+                basePath: config_1.default.basePath
+            });
+            await new Promise((resolve, reject) => {
+                httpServer.once('error', reject);
+                httpServer.listen(0, '127.0.0.1', () => {
+                    httpServer.off('error', reject);
+                    const address = httpServer.address();
+                    if (!address || typeof address === 'string') {
+                        return reject(new Error('HTTP test server did not bind to a TCP port'));
+                    }
+                    testPort = address.port;
+                    resolve();
+                });
+            });
+        });
+        afterEach(function (done) {
+            if (verifyStub) {
+                verifyStub.restore();
+                verifyStub = undefined;
+            }
+            if (!httpServer?.listening) {
+                httpServer = undefined;
+                return done();
+            }
+            httpServer.close(err => {
+                httpServer = undefined;
+                done(err);
+            });
+        });
+        function getByHash(copayerId, txid, cb) {
+            (0, request_1.default)({
+                method: 'GET',
+                url: testHost + ':' + testPort + config_1.default.basePath + '/v1/txproposalsbyhash/' + txid + '/',
+                headers: {
+                    'x-identity': copayerId,
+                    'x-signature': 'stubbed'
+                },
+                json: true
+            }, (err, res, body) => cb(err, res, body));
+        }
+        it('foreign wallet gets HTTP 400 TX_NOT_FOUND with no owner data in the body', function (done) {
+            getByHash(walletB.copayers[0].id, txp.txid, (err, res, body) => {
+                should.not.exist(err);
+                res.statusCode.should.equal(400);
+                body.code.should.equal('TX_NOT_FOUND');
+                JSON.stringify(body).should.not.include(walletA.id);
+                done();
+            });
+        });
+        it('owner wallet gets HTTP 200 with the full proposal, unchanged', function (done) {
+            getByHash(walletA.copayers[0].id, txp.txid, (err, res, body) => {
+                should.not.exist(err);
+                res.statusCode.should.equal(200);
+                body.walletId.should.equal(walletA.id);
+                body.txid.should.equal(txp.txid);
+                should.exist(body.raw);
+                done();
+            });
+        });
+        it('foreign and unknown txids produce an identical HTTP 400 TX_NOT_FOUND body', function (done) {
+            getByHash(walletB.copayers[0].id, txp.txid, (err, resForeign, bodyForeign) => {
+                should.not.exist(err);
+                getByHash(walletB.copayers[0].id, helpers_1.default.randomTXID(), (err, resUnknown, bodyUnknown) => {
+                    should.not.exist(err);
+                    resForeign.statusCode.should.equal(resUnknown.statusCode);
+                    bodyForeign.code.should.equal(bodyUnknown.code);
+                    bodyForeign.code.should.equal('TX_NOT_FOUND');
+                    done();
+                });
+            });
+        });
+    });
     describe('#getTxs', function () {
         let server;
         let wallet;