@bitpay-labs/bitcore-wallet-service 11.10.7 → 11.10.9

package/test/integration/tss.test.ts

@@ -7,10 +7,16 @@ import * as twoOfThree from './data/tss/2of3';
 import BWS from '../../src/index';
 import helpers from './helpers';
 import { TssKeyGen } from '../../src/lib/tss';
+import { TssSigGenModel } from '../../src/lib/model/tsssign';
+import { TssKeyGenModel } from '../../src/lib/model/tsskeygen';
+import { Common } from '../../src/lib/common/index';
 
 const should = chai.should();
+const { Utils } = Common;
 
 describe('TSS', function() {
+  this.timeout(Math.max(this['_timeout'], 2000));
+
   const vector = {
     m: 2,
     n: 3,
@@ -250,6 +256,11 @@ describe('TSS', function() {
   describe('POST /v1/tss/keygen/:id', function() {
     const url = id => `${urlPrefix}/v1/tss/keygen/${id}`;
 
+    beforeEach(async function() {
+      const storage = helpers.getStorage();
+      await storage.db.collection(BWS.Storage.collections.TSS_KEYGEN).deleteMany({});
+    });
+
     describe('middleware', function() {
       beforeEach(function() {
         sandbox.stub(TssKeyGen, 'processMessage').resolves();
@@ -336,5 +347,269 @@ describe('TSS', function() {
           });
       });
     });
+
+    it('should error if session is expired', function(done) {
+      const storage = helpers.getStorage();
+      const publicKey = vector.party0.authKey.publicKey.toString();
+      const keyGen = TssKeyGenModel.create({
+        id: 'test',
+        message: { partyId: 0, publicKey } as any,
+        n: 2,
+        copayerId: publicKey,
+        version: 1.1,
+        timeLimit: 1, // 1 minute
+      });
+      storage.storeTssKeyGenSession({ doc: keyGen }).then(() => {
+        // advance time by 2 minutes
+        const now = Date.now() + 2 * 60 * 1000;
+        sandbox.stub(Date, 'now').returns(now);
+
+        const message = JSON.parse(JSON.stringify(vector.keygen.messages.round1.party0));
+        message.publicKey = publicKey;
+
+        app.post(url('test'))
+          .set('x-identity', publicKey)
+          .send({ message })
+          .expect((res) => {
+            res.status.should.equal(400);
+            res.body.code.should.equal('TSS_SESSION_EXPIRED');
+          })
+          .end(done);
+      }).catch(done);
+    });
+  });
+
+  describe('POST /v1/tss/sign/:id', function() {
+    const url = id => `${urlPrefix}/v1/tss/sign/${id}`;
+    const signRequest = body => {
+      const message = `post|${url('test').replace(urlPrefix, '')}|${JSON.stringify(body)}`;
+      const hash = Utils.hashMessage(message, false); // BWC hashes the message with reversal, then signs
+      const xSignature = BitcoreLib.crypto.ECDSA.sign(hash, privateKey, { endian: 'little' }).toString();
+      return xSignature;
+    };
+    const privateKey = new BitcoreLib.PrivateKey('cd643c4f2e68b669d97c51877905e8d77efc98cabb5a36a8eda66bc143055d37');
+    const publicKey = privateKey.publicKey.toString();
+
+    beforeEach(async function() {
+      const storage = helpers.getStorage();
+      await storage.db.collection(BWS.Storage.collections.TSS_SIGN).deleteMany({});
+      await storage.db.collection(BWS.Storage.collections.COPAYERS_LOOKUP).deleteMany({});
+      await storage.db.collection(BWS.Storage.collections.COPAYERS_LOOKUP).insertOne({
+        copayerId: publicKey,
+        walletId: 'test',
+        requestPubKey: publicKey,
+      });
+    });
+
+    it('should error if session is expired', function(done) {
+      const storage = helpers.getStorage();
+      const sigGen = TssSigGenModel.create({
+        id: 'test',
+        message: { partyId: 0, publicKey } as any,
+        m: 2,
+        copayerId: publicKey,
+        version: 1.1,
+        timeLimit: 1, // 1 minute
+      });
+      storage.storeTssSigSession({ doc: sigGen }).then(() => {
+        // advance time by 2 minutes
+        const now = Date.now() + 2 * 60 * 1000;
+        sandbox.stub(Date, 'now').returns(now);
+
+        const message = { publicKey, p2pMessages: [{ payload: { encryptedMessage: 'encryptie', signature: 'siggie' } }], broadcastMessages: [] };
+        const xSignature = signRequest({ message });
+
+        app.post(url('test'))
+          .set('x-identity', publicKey)
+          .set('x-signature', xSignature)
+          .send({ message })
+          .expect((res) => {
+            res.status.should.equal(400);
+            res.body.code.should.equal('TSS_SESSION_EXPIRED');
+          })
+          .end(done);
+      }).catch(done);
+    });
+  });
+
+  describe('POST /v1/tss/sign/:id/store', function() {
+    const url = id => `${urlPrefix}/v1/tss/sign/${id}/store`;
+    const signRequest = body => {
+      const message = `post|${url('test').replace(urlPrefix, '')}|${JSON.stringify(body)}`;
+      const hash = Utils.hashMessage(message, false); // BWC hashes the message with reversal, then signs
+      const xSignature = BitcoreLib.crypto.ECDSA.sign(hash, privateKey, { endian: 'little' }).toString();
+      return xSignature;
+    };
+    const privateKey = new BitcoreLib.PrivateKey('cd643c4f2e68b669d97c51877905e8d77efc98cabb5a36a8eda66bc143055d37');
+    const publicKey = privateKey.publicKey.toString();
+    const signature = {
+      r: '0x71a8fb6b23203f7ae7f5df7dac410204d8b8d8b74e31c3919e0c764a00925f74',
+      s: '0x18048c9ce4a860f6354b4bb795178ff3cde858ed3afef6c2e2c51c8fac8b9257',
+      v: 1,
+      pubKey: '0267c2c572fcc1a5026d0e5d8e60a04ff6adeaf1a3a996c9c69f3b1714cff1db85',
+    };
+
+
+    beforeEach(async function() {
+      const storage = helpers.getStorage();
+      await storage.db.collection(BWS.Storage.collections.TSS_SIGN).deleteMany({});
+      const sigGen = TssSigGenModel.create({
+        id: 'test',
+        message: { partyId: 0, publicKey } as any,
+        m: 2,
+        copayerId: publicKey,
+        version: 1.1,
+      });
+      await storage.storeTssSigSession({ doc: sigGen });
+      await storage.storeTssSignature({ id: 'test', signature });
+    });
+
+    it('should throw a mismatch error for a mismatched signature: r', function(done) {
+      const modifiedSignature = {
+        ...signature,
+        r: '0x71a8fb6b23203f7ae7f5df7dac410204d8b8d8b74e31c3919e0c764a00925f75', // modified r value to create a mismatch
+      };
+      const xSignature = signRequest({ signature: modifiedSignature });
+
+      app.post(url('test'))
+        .set('x-identity', publicKey)
+        .set('x-signature', xSignature)
+        .send({
+          signature: modifiedSignature
+        })
+        .expect(res => {
+          res.status.should.equal(400);
+          res.body.should.have.property('code');
+          res.body.code.should.equal('TSS_FINAL_SIGNATURE_MISMATCH');
+          res.body.message.should.equal('Final signature does not match the one generated by the session');
+        })
+        .end(done);
+    });
+
+    it('should throw a mismatch error for a mismatched signature: s', function(done) {
+      const modifiedSignature = {
+        ...signature,
+        s: '0x18048c9ce4a860f6354b4bb795178ff3cde858ed3afef6c2e2c51c8fac8b9256', // modified s value to create a mismatch
+      };
+      const xSignature = signRequest({ signature: modifiedSignature });
+
+      app.post(url('test'))
+        .set('x-identity', publicKey)
+        .set('x-signature', xSignature)
+        .send({
+          signature: modifiedSignature
+        })
+        .expect(res => {
+          res.status.should.equal(400);
+          res.body.should.have.property('code');
+          res.body.code.should.equal('TSS_FINAL_SIGNATURE_MISMATCH');
+          res.body.message.should.equal('Final signature does not match the one generated by the session');
+        })
+        .end(done);
+    });
+
+    it('should throw a mismatch error for a mismatched signature: v', function(done) {
+      const modifiedSignature = {
+        ...signature,
+        v: 123, // modified v value to create a mismatch
+      };
+      const xSignature = signRequest({ signature: modifiedSignature });
+
+      app.post(url('test'))
+        .set('x-identity', publicKey)
+        .set('x-signature', xSignature)
+        .send({
+          signature: modifiedSignature
+        })
+        .expect(res => {
+          res.status.should.equal(400);
+          res.body.should.have.property('code');
+          res.body.code.should.equal('TSS_FINAL_SIGNATURE_MISMATCH');
+          res.body.message.should.equal('Final signature does not match the one generated by the session');
+        })
+        .end(done);
+    });
+
+    it('should throw a mismatch error for a mismatched signature: pubKey', function(done) {
+      const modifiedSignature = {
+        ...signature,
+        pubKey: 'not-equal-pub-key', // modified pubKey value to create a mismatch
+      };
+      const xSignature = signRequest({ signature: modifiedSignature });
+
+      app.post(url('test'))
+        .set('x-identity', publicKey)
+        .set('x-signature', xSignature)
+        .send({
+          signature: modifiedSignature
+        })
+        .expect(res => {
+          res.status.should.equal(400);
+          res.body.should.have.property('code');
+          res.body.code.should.equal('TSS_FINAL_SIGNATURE_MISMATCH');
+          res.body.message.should.equal('Final signature does not match the one generated by the session');
+        })
+        .end(done);
+    });
+
+    it('should cleanly handle race condition when saving signature', function(done) {
+      const fetchSessionStub = sandbox.stub(BWS.Storage.prototype, 'fetchTssSigSession');
+      fetchSessionStub.callsFake(async function({ id }) {
+        const session = await fetchSessionStub.wrappedMethod.call(this, { id });
+        session.signature = null;
+        return session;
+      });
+      fetchSessionStub.onThirdCall().callsFake(async function({ id }) {
+        const session = await fetchSessionStub.wrappedMethod.call(this, { id });
+        return session;
+      });
+      const xSignature = signRequest({ signature });
+
+      app.post(url('test'))
+        .set('x-identity', publicKey)
+        .set('x-signature', xSignature)
+        .send({
+          signature
+        })
+        .expect(res => {
+          res.status.should.equal(200);
+        })
+        .end(done);
+    });
+
+    it('should handle race condition when saving signature but mismatched signature', function(done) {
+      const fetchSessionStub = sandbox.stub(BWS.Storage.prototype, 'fetchTssSigSession');
+      fetchSessionStub.callsFake(async function({ id }) {
+        const session = await fetchSessionStub.wrappedMethod.call(this, { id });
+        session.signature = null;
+        return session;
+      });
+      fetchSessionStub.onThirdCall().callsFake(async function({ id }) {
+        const session = await fetchSessionStub.wrappedMethod.call(this, { id });
+        return session;
+      });
+
+      const modifiedSignature = {
+        ...signature,
+        r: '0x71a8fb6b23203f7ae7f5df7dac410204d8b8d8b74e31c3919e0c764a00925f75', // modified r value to create a mismatch
+      };
+
+      const xSignature = signRequest({ signature: modifiedSignature });
+
+      app.post(url('test'))
+        .set('x-identity', publicKey)
+        .set('x-signature', xSignature)
+        .send({
+          signature: modifiedSignature
+        })
+        .expect(res => {
+          res.status.should.equal(400);
+          res.body.should.have.property('code');
+          res.body.code.should.equal('TSS_FINAL_SIGNATURE_MISMATCH');
+          res.body.message.should.equal('Final signature does not match the one generated by the session');
+        })
+        .end(done);
+    });
   });
+
 });

package/test/model/copayer.test.ts

@@ -8,6 +8,134 @@ import { Copayer } from '../../src/lib/model/copayer';
 const should = chai.should();
 
 describe('Copayer', function() {
+  // xPubKey is the canonical copayer identity: the ID is always derived from it, and
+  // hardwareSourcePublicKey / clientDerivedPublicKey are persisted ancillary metadata
+  // that never select identity.
+
+  // 20 Aug '26 - support for hardware wallets lacking xPubKey will
+  // change the above statement and change the nature of these tests
+  describe('#xPubToCopayerId', function() {
+    it('should reject a missing xPubKey for the default coin', function() {
+      should.throw(() => Copayer.xPubToCopayerId('btc', undefined), 'Missing xPubKey for copayer id derivation');
+    });
+
+    it('should reject a missing xPubKey for a non-default coin instead of hashing "<coin>undefined"', function() {
+      should.throw(() => Copayer.xPubToCopayerId('bch', undefined), 'Missing xPubKey for copayer id derivation');
+    });
+
+    it('should reject null and empty xPubKey values', function() {
+      should.throw(() => Copayer.xPubToCopayerId('btc', null), 'Missing xPubKey for copayer id derivation');
+      should.throw(() => Copayer.xPubToCopayerId('btc', ''), 'Missing xPubKey for copayer id derivation');
+    });
+
+    it('should preserve existing copayer IDs for valid xPubKey inputs', function() {
+      const xPubKey = 'xpub661MyMwAqRbcFLRkhYzK8eQdoywNHJVsJCMQNDoMks5bZymuMcyDgYfnVQYq2Q9npnVmdTAthYGc3N3uxm5sEdnTpSqBc4YYTAhNnoSxCm9';
+      // Pinned hash so a change to the derivation (e.g. algorithm, encoding, or the
+      // coin == Defaults.COIN branch) would break existing wallets' copayer ids silently.
+      Copayer.xPubToCopayerId('btc', xPubKey).should.equal(
+        '77a8752fdddbe10fb9c290bd55ea8efbb1ad72adb4e68e8b57bf04adc3cc3ebb'
+      );
+    });
+  });
+
+  describe('#create identity', function() {
+    // `chain` is passed explicitly below because the service layer
+    // (joinWallet / _addCopayerToWallet) always supplies a resolved chain (backfilled
+    // from coin via Wallet.fromObj); these model tests encode the identity contract
+    // under that precondition rather than pinning a coin-only input shape.
+    const baseOpts = {
+      coin: 'btc',
+      chain: 'btc',
+      name: 'me',
+      requestPubKey: '03814ac7decf64321a3c6967bfb746112fdb5b583531cd512cc3787eaf578947dc',
+      signature: 'dummy-signature',
+    };
+
+    it('should derive the ID from xPubKey alone', function() {
+      const xPubKey = 'xpub-abc';
+      const c = Copayer.create({ ...baseOpts, xPubKey });
+      c.id.should.equal(Copayer.xPubToCopayerId('btc', xPubKey));
+    });
+
+    it('should prefer xPubKey when hardwareSourcePublicKey is also present', function() {
+      const xPubKey = 'xpub-abc';
+      const hardwareSourcePublicKey = 'hw-key';
+
+      const c = Copayer.create({ ...baseOpts, xPubKey, hardwareSourcePublicKey });
+      c.id.should.equal(Copayer.xPubToCopayerId('btc', xPubKey));
+    });
+
+    it('should prefer xPubKey when both alternate credentials are also present', function() {
+      const xPubKey = 'xpub-abc';
+      const hardwareSourcePublicKey = 'hw-key';
+      const clientDerivedPublicKey = 'cdk-key';
+
+      const c = Copayer.create({
+        ...baseOpts,
+        xPubKey,
+        hardwareSourcePublicKey,
+        clientDerivedPublicKey,
+      });
+      c.id.should.equal(Copayer.xPubToCopayerId('btc', xPubKey));
+    });
+
+    it('should derive the same xpub-based ID on a non-default chain', function() {
+      const xPubKey = 'xpub-abc';
+      const opts = { ...baseOpts, coin: 'bch', chain: 'bch' };
+      const c = Copayer.create({ ...opts, xPubKey });
+      c.id.should.equal(Copayer.xPubToCopayerId('bch', xPubKey));
+    });
+
+    it('should reject creation without xPubKey and without ancillary fields', function() {
+      should.throw(() => Copayer.create({ ...baseOpts }));
+    });
+
+    it('should reject an xPubKey-less copayer with hardwareSourcePublicKey until alternative ID derivation is implemented', function() {
+      // Copayer.create's own xPubKey guard is skipped when hardwareSourcePublicKey is present
+      // (that's the carve-out left for a future hardware-derived identity), but there is no
+      // alternative ID derivation yet, so the id assignment below falls through to
+      // xPubToCopayerId(chain, undefined), which still throws.
+      should.throw(() => Copayer.create({ ...baseOpts, hardwareSourcePublicKey: 'hw-key' }));
+    });
+
+    it('should reject an xPubKey-less copayer with clientDerivedPublicKey until alternative ID derivation is implemented', function() {
+      should.throw(() => Copayer.create({ ...baseOpts, clientDerivedPublicKey: 'cdk-key' }));
+    });
+
+    it('should continue deriving the copayer ID from xPubKey when ancillary public keys are also present', function() {
+      const xPubKey = 'xpub-abc';
+      const c = Copayer.create({
+        ...baseOpts,
+        xPubKey,
+        hardwareSourcePublicKey: 'hw-key',
+        clientDerivedPublicKey: 'cdk-key',
+      });
+      c.id.should.equal(Copayer.xPubToCopayerId('btc', xPubKey));
+    });
+
+    it('should persist the supplied ancillary fields and leave unsupplied ones absent', function() {
+      const xPubKey = 'xpub-abc';
+      const hardwareSourcePublicKey = 'hw-key';
+
+      const c = Copayer.create({ ...baseOpts, xPubKey, hardwareSourcePublicKey });
+      c.xPubKey.should.equal(xPubKey);
+      c.hardwareSourcePublicKey.should.equal(hardwareSourcePublicKey);
+      should.not.exist(c.clientDerivedPublicKey);
+    });
+
+    it('should persist both ancillary fields without changing the xpub-derived ID', function() {
+      const xPubKey = 'xpub-abc';
+      const hardwareSourcePublicKey = 'hw-key';
+      const clientDerivedPublicKey = 'cdk-key';
+
+      const c = Copayer.create({ ...baseOpts, xPubKey, hardwareSourcePublicKey, clientDerivedPublicKey });
+      c.id.should.equal(Copayer.xPubToCopayerId('btc', xPubKey));
+      c.xPubKey.should.equal(xPubKey);
+      c.hardwareSourcePublicKey.should.equal(hardwareSourcePublicKey);
+      c.clientDerivedPublicKey.should.equal(clientDerivedPublicKey);
+    });
+  });
+
   describe('#fromObj', function() {
     it('read a copayer', function() {
       const c = Copayer.fromObj(testWallet.copayers[0]);

package/test/storage.test.ts

@@ -200,6 +200,97 @@ describe('Storage', function() {
       });
     });
 
+    it('should fetch tx by hash scoped to wallet, disambiguating duplicate txids across wallets', async function() {
+      // A second, unrelated wallet with its own proposal reusing 'txid0'. The
+      // txid index is non-unique, so this can happen in production; the
+      // scoped method must still resolve deterministically per walletId
+      // while the legacy global fetchTxByHash contract stays unchanged.
+      const otherWallet = Model.Wallet.create({
+        id: '456',
+        name: 'other wallet',
+        m: 1,
+        n: 1,
+        coin: 'btc',
+        chain: 'btc',
+        network: 'livenet',
+        pubKey: '',
+        singleAddress: false,
+        derivationStrategy: 'BIP45',
+        addressType: 'P2SH',
+      });
+      const otherCopayer = Model.Copayer.create({
+        coin: 'btc',
+        name: 'other copayer',
+        xPubKey: 'other xPubKey',
+        requestPubKey: 'other requestPubKey',
+        signature: 'other signature',
+      });
+      otherWallet.addCopayer(otherCopayer);
+      await util.promisify(storage.storeWalletAndUpdateCopayersLookup).call(storage, otherWallet);
+
+      const otherTx = Model.TxProposal.create({
+        walletId: '456',
+        coin: 'btc',
+        network: 'livenet',
+        outputs: [{
+          toAddress: '18PzpUFkFZE8zKWUPvfykkTxmB9oMR8qP7',
+          amount: 999,
+        }],
+        feePerKb: 100e2,
+        creatorId: otherWallet.copayers[0].id,
+      });
+      otherTx.status = 'pending';
+      otherTx.txid = 'txid0';
+      await util.promisify(storage.storeTx).call(storage, '456', otherTx);
+
+      // Global lookup is unchanged: it still finds *a* proposal with this
+      // txid (which one is not guaranteed with duplicates), proving the
+      // existing internal-caller contract was not altered.
+      const globalTx = await util.promisify(storage.fetchTxByHash).call(storage, 'txid0');
+      should.exist(globalTx);
+      globalTx.txid.should.equal('txid0');
+
+      // The scoped method resolves the correct wallet's proposal regardless
+      // of the duplicate.
+      const txForWalletA = await util.promisify(storage.fetchTxByHashForWallet).call(storage, '123', 'txid0');
+      should.exist(txForWalletA);
+      txForWalletA.walletId.should.equal('123');
+      txForWalletA.id.should.equal(proposals[0].id);
+
+      const txForWalletB = await util.promisify(storage.fetchTxByHashForWallet).call(storage, '456', 'txid0');
+      should.exist(txForWalletB);
+      txForWalletB.walletId.should.equal('456');
+      txForWalletB.id.should.equal(otherTx.id);
+
+      // A wallet with no proposal for this txid gets nothing (not the other
+      // wallet's data) -- proving the query is scoped, not just filtered
+      // client-side.
+      const otherWallet2 = Model.Wallet.create({
+        id: '789',
+        name: 'third wallet',
+        m: 1,
+        n: 1,
+        coin: 'btc',
+        chain: 'btc',
+        network: 'livenet',
+        pubKey: '',
+        singleAddress: false,
+        derivationStrategy: 'BIP45',
+        addressType: 'P2SH',
+      });
+      const thirdCopayer = Model.Copayer.create({
+        coin: 'btc',
+        name: 'third copayer',
+        xPubKey: 'third xPubKey',
+        requestPubKey: 'third requestPubKey',
+        signature: 'third signature',
+      });
+      otherWallet2.addCopayer(thirdCopayer);
+      await util.promisify(storage.storeWalletAndUpdateCopayersLookup).call(storage, otherWallet2);
+      const noTx = await util.promisify(storage.fetchTxByHashForWallet).call(storage, '789', 'txid0');
+      should.not.exist(noTx);
+    });
+
     it('should fetch all pending txs', function(done) {
       storage.fetchPendingTxs('123', function(err, txs) {
         should.not.exist(err);

package/ts_build/package.json

@@ -2,7 +2,7 @@
     "name": "@bitpay-labs/bitcore-wallet-service",
     "description": "A service for Mutisig HD Bitcoin Wallets",
     "author": "BitPay Inc",
-    "version": "11.10.6",
+    "version": "11.10.8",
     "license": "MIT",
     "main": "ts_build/src/index.js",
     "types": "./ts_build/src/index.d.ts",
@@ -24,7 +24,7 @@
     "scripts": {
         "start": "npm run clean && npm run build && ./start.sh",
         "stop": "./stop.sh",
-        "test": "npm run compile && nyc mocha 'ts_build/test/**/*.test.js'",
+        "test": "npm run compile && mcr mocha ts_build/test",
         "build": "tsc && npm run cp:templates",
         "build:prod": "tsc -p tsconfig.prod.json && npm run cp:templates",
         "build:docker": "docker build -t bitpay/bitcore-wallet-service:latest -f ./Dockerfile ../..",
@@ -42,7 +42,7 @@
     },
     "dependencies": {
         "@bitpay-labs/bitcore-logging": "^11.10.4",
-        "@bitpay-labs/bitcore-tss": "^11.10.4",
+        "@bitpay-labs/bitcore-tss": "^11.10.8",
         "@bitpay-labs/crypto-wallet-core": "^11.10.4",
         "@sendgrid/mail": "6.5.4",
         "abi-decoder": "2.4.0",

package/ts_build/src/externalservices/coingecko.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coingecko.d.ts","sourceRoot":"","sources":["../../../src/externalservices/coingecko.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,KAAK,aAAa,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD,KAAK,cAAc,GAAG;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,KAAK,gBAAgB,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC;AA2H1D,qBAAa,gBAAgB;IAC3B,OAAO,EAAE,GAAG,CAAW;IACvB,OAAO,EAAE,OAAO,CAAC;gBAEL,OAAO,EAAE,OAAO;IAI5B,OAAO,CAAC,uBAAuB;IAK/B,OAAO,CAAC,mBAAmB;IAQ3B,OAAO,CAAC,KAAK;YAaC,eAAe;IA6B7B,OAAO,CAAC,gBAAgB;YAqCV,kBAAkB;YAiElB,mBAAmB;YAkBnB,iBAAiB;YAcjB,gBAAgB;IA8ExB,uBAAuB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IA2B1E,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC,GAAG,aAAa,EAAE,CAAC;IA8CxG,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;CA2B3E"}
+{"version":3,"file":"coingecko.d.ts","sourceRoot":"","sources":["../../../src/externalservices/coingecko.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,KAAK,aAAa,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD,KAAK,cAAc,GAAG;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,KAAK,gBAAgB,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC;AA0I1D,qBAAa,gBAAgB;IAC3B,OAAO,EAAE,GAAG,CAAW;IACvB,OAAO,EAAE,OAAO,CAAC;gBAEL,OAAO,EAAE,OAAO;IAI5B,OAAO,CAAC,uBAAuB;IAK/B,OAAO,CAAC,mBAAmB;IAQ3B,OAAO,CAAC,KAAK;YAaC,eAAe;IA6B7B,OAAO,CAAC,gBAAgB;YAqCV,kBAAkB;YAiElB,mBAAmB;YAkBnB,iBAAiB;YAcjB,gBAAgB;IA8ExB,uBAAuB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IA2B1E,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC,GAAG,aAAa,EAAE,CAAC;IA6CxG,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;CA2B3E"}

package/ts_build/src/externalservices/coingecko.js

@@ -44,8 +44,8 @@ const constants_1 = require("../lib/common/constants");
 const defaults_1 = require("../lib/common/defaults");
 const logger_1 = __importDefault(require("../lib/logger"));
 const SUPPORTED_FIAT_CODES = new Set(defaults_1.Defaults.FIAT_CURRENCIES.map(f => f.code));
-const ALLOWED_DAYS = new Set([1, 7, 30, 90, 365, 1825]);
-const DEFAULT_ALL_TIME_DAYS = 100000;
+const ALLOWED_NUMERIC_DAYS = new Set([1, 7, 30, 90, 365, 1825]);
+const ALL_TIME_DAYS = 'max';
 const MAX_QUERY_PARAM_LENGTH = 64;
 const CHAIN_PARAM_PATTERN = /^[a-z0-9-_]+$/i;
 const COIN_GECKO_REQUEST_TIMEOUT_MS = 15000;
@@ -106,6 +106,15 @@ function validateQueryParam(query, key) {
         throw badRequest(`Unsupported ${key}`);
     }
 }
+function isAllowedNumericDays(value) {
+    return ALLOWED_NUMERIC_DAYS.has(value);
+}
+function parseFiatRateNumericDays(raw) {
+    const parsed = +raw;
+    if (!isAllowedNumericDays(parsed))
+        throw badRequest('Invalid days');
+    return parsed;
+}
 function parseCoinChainTokenAddress(query) {
     return {
         coin: validateQueryParam(query, 'coin'),
@@ -287,7 +296,7 @@ class CoinGeckoService {
         const { API_KEY } = this.coinGeckoGetCredentials();
         const headers = this.coinGeckoGetHeaders(API_KEY);
         const params = { vs_currency: vsCurrency, days };
-        if (days >= 90)
+        if (days === ALL_TIME_DAYS || days >= 90)
             params.interval = 'daily';
         const url = this.cgUrl(`/v3/coins/${encodeURIComponent(id)}/market_chart`, params);
         const body = await this.coinGeckoGetJson(url, headers);
@@ -402,14 +411,11 @@ class CoinGeckoService {
             throw badRequest(`Unsupported fiat currency code '${currency}'`);
         const vsCurrency = currency.toLowerCase();
         const { coin: coinParam, chain: chainParam, tokenAddress: tokenAddressParam } = parseCoinChainTokenAddress(req.query);
-        let days = DEFAULT_ALL_TIME_DAYS;
+        let days = ALL_TIME_DAYS;
         try {
             const daysParam = getQueryString(req.query, 'days');
             if (daysParam !== undefined) {
-                const parsed = +daysParam;
-                if (!ALLOWED_DAYS.has(parsed))
-                    throw badRequest('Invalid days');
-                days = parsed;
+                days = parseFiatRateNumericDays(daysParam);
             }
         }
         catch {