@bitpay-labs/bitcore-wallet-service 11.11.1 → 11.11.3

package/test/expressapp.test.ts

@@ -11,6 +11,9 @@ import { Common } from '../src/lib/common';
 import { WalletService } from '../src/lib/server';
 import { ExpressApp } from '../src/lib/expressapp';
 import { ClientError } from '../src/lib/errors/clienterror';
+import { BitcoreLib } from '@bitpay-labs/crypto-wallet-core';
+import * as TestData from './testdata';
+import { Stats } from '../src/lib/stats';
 
 const Defaults = Common.Defaults;
 const should = chai.should();
@@ -63,6 +66,104 @@ describe('ExpressApp', function() {
         httpServer.close();
       });
 
+      describe('Public query validation', function() {
+        let runStats, getFiatRate;
+
+        beforeEach(function() {
+          runStats = sandbox.stub(Stats.prototype, 'run').callsArgWith(0, null, {});
+          getFiatRate = sinon.stub().callsArgWith(1, null, {});
+          sandbox.stub(WalletService, 'initialize').callsArg(1);
+          sandbox.stub(WalletService, 'getInstance').returns({ getFiatRate } as any);
+        });
+
+        const targets = [
+          { path: '/v1/stats/', parameter: 'network' },
+          { path: '/v1/stats/', parameter: 'coin' },
+          { path: '/v1/fiatrates/USD/', parameter: 'coin' }
+        ];
+
+        for (const { path, parameter } of targets) {
+          const value = parameter === 'network' ? 'livenet' : 'btc';
+          // Cover operator objects, bracket arrays, and duplicate parameters.
+          const invalidQueries = [
+            `${parameter}[$regex]=.*`,
+            `${parameter}[]=${value}`,
+            `${parameter}=${value}&${parameter}=${value}`
+          ];
+          for (const query of invalidQueries) {
+            it(`should reject ${path}?${query} before accessing data`, function(done) {
+              start(ExpressApp, function() {
+                request({ url: testHost + ':' + testPort + config.basePath + path + '?' + query, json: true }, function(err, res, body) {
+                  should.not.exist(err);
+                  res.statusCode.should.equal(400);
+                  body.code.should.equal('BADREQUEST');
+                  runStats.called.should.equal(false);
+                  getFiatRate.called.should.equal(false);
+                  done();
+                });
+              });
+            });
+          }
+        }
+
+        for (const query of ['', '?coin=&network=']) {
+          it(`should preserve stats defaults for ${query || 'omitted parameters'}`, function(done) {
+            start(ExpressApp, function() {
+              request({ url: testHost + ':' + testPort + config.basePath + '/v1/stats/' + query, json: true }, function(err, res) {
+                should.not.exist(err);
+                res.statusCode.should.equal(200);
+                runStats.calledOnce.should.equal(true);
+                runStats.firstCall.thisValue.coin.should.equal('btc');
+                runStats.firstCall.thisValue.network.should.equal('livenet');
+                done();
+              });
+            });
+          });
+        }
+
+        it('should pass valid stats filters through unchanged', function(done) {
+          start(ExpressApp, function() {
+            const query = '?coin=eth&network=testnet&from=2026-01-01&to=2026-02-01';
+            request({ url: testHost + ':' + testPort + config.basePath + '/v1/stats/' + query, json: true }, function(err, res) {
+              should.not.exist(err);
+              res.statusCode.should.equal(200);
+              runStats.calledOnce.should.equal(true);
+              const stats = runStats.firstCall.thisValue;
+              stats.coin.should.equal('eth');
+              stats.network.should.equal('testnet');
+              stats.from.should.equal('2026-01-01');
+              stats.to.should.equal('2026-02-01');
+              done();
+            });
+          });
+        });
+
+        for (const query of ['', '?coin=']) {
+          it(`should preserve the fiat coin default for ${query || 'omitted parameters'}`, function(done) {
+            start(ExpressApp, function() {
+              request({ url: testHost + ':' + testPort + config.basePath + '/v1/fiatrates/USD/' + query, json: true }, function(err, res) {
+                should.not.exist(err);
+                res.statusCode.should.equal(200);
+                getFiatRate.calledOnceWithExactly({ code: 'USD', coin: 'btc', ts: null }, sinon.match.func).should.equal(true);
+                done();
+              });
+            });
+          });
+        }
+
+        it('should pass a valid fiat coin and numeric timestamp through unchanged', function(done) {
+          start(ExpressApp, function() {
+            const query = '?coin=eth&ts=1700000000000';
+            request({ url: testHost + ':' + testPort + config.basePath + '/v1/fiatrates/EUR/' + query, json: true }, function(err, res) {
+              should.not.exist(err);
+              res.statusCode.should.equal(200);
+              getFiatRate.calledOnceWithExactly({ code: 'EUR', coin: 'eth', ts: 1700000000000 }, sinon.match.func).should.equal(true);
+              done();
+            });
+          });
+        });
+      });
+
       it('/v2/wallets', function(done) {
         const server = {
           getStatus: sinon.stub().callsArgWith(1, null, {}),
@@ -762,6 +863,148 @@ describe('ExpressApp', function() {
         });
       });
 
+      describe('/v1/wallets/exist', function() {
+        const idA = 'a'.repeat(64);
+        const idB = 'b'.repeat(64);
+        const idC = 'c'.repeat(64);
+        let storage;
+
+        function sign(message) {
+          const hash = Common.Utils.hashMessage(message, false);
+          return BitcoreLib.crypto.ECDSA.sign(hash, new BitcoreLib.PrivateKey(TestData.keyPair.priv), { endian: 'little' }).toString();
+        }
+
+        // posts each body in turn, and calls back with each response's status and body
+        function postEach(bodies, cb) {
+          sandbox.stub(WalletService, 'initialize').callsArg(1);
+          sandbox.stub(WalletService, 'getStorage').returns(storage);
+          start(ExpressApp, function() {
+            const results = [];
+            (function next() {
+              if (results.length === bodies.length) {
+                return cb(null, results);
+              }
+              request({
+                url: testHost + ':' + testPort + config.basePath + '/v1/wallets/exist',
+                method: 'post',
+                json: true,
+                body: bodies[results.length]
+              }, function(err, res, body) {
+                if (err) {
+                  return cb(err);
+                }
+                results.push({ status: res.statusCode, body });
+                next();
+              });
+            })();
+          });
+        }
+
+        function post(body, cb) {
+          postEach([body], (err, results) => (err ? cb(err) : cb(null, { statusCode: results[0].status }, results[0].body)));
+        }
+
+        beforeEach(function() {
+          const copayer = { requestPubKeys: [{ key: TestData.keyPair.pub }] };
+          storage = {
+            fetchCopayerLookup: sinon.stub().callsFake(async id => (id === idA || id === idB ? copayer : undefined))
+          };
+        });
+
+        it('returns the copayers whose signature verifies against their request key', function(done) {
+          post({
+            copayers: [
+              { copayerId: idA, signature: sign(idA) },
+              { copayerId: idB, signature: sign(idA) },
+              { copayerId: idC, signature: sign(idC) }
+            ]
+          }, function(err, res, body) {
+            should.not.exist(err);
+            res.statusCode.should.equal(200);
+            body.should.deep.equal([idA]);
+            storage.fetchCopayerLookup.args.should.deep.equal([[idA], [idB], [idC]]);
+            done();
+          });
+        });
+
+        it('returns no copayers when given none to check', function(done) {
+          postEach([
+            {},
+            { copayers: null },
+            { copayers: idA },
+            { copayers: { copayerId: idA, signature: sign(idA) } },
+            { copayers: [] }
+          ], function(err, results) {
+            should.not.exist(err);
+            results.should.deep.equal(Array(5).fill({ status: 200, body: [] }));
+            storage.fetchCopayerLookup.callCount.should.equal(0);
+            done();
+          });
+        });
+
+        it('does not verify a copayer whose signature is not a string', function(done) {
+          post({
+            copayers: [
+              { copayerId: idA, signature: 1 },
+              { copayerId: idA, signature: [sign(idA)] },
+              { copayerId: idB, signature: {} },
+              { copayerId: idB }
+            ]
+          }, function(err, res, body) {
+            should.not.exist(err);
+            res.statusCode.should.equal(200);
+            body.should.deep.equal([]);
+            storage.fetchCopayerLookup.callCount.should.equal(4);
+            done();
+          });
+        });
+
+        it('treats a copayer that fails to load as not found', function(done) {
+          storage.fetchCopayerLookup.withArgs(idB).rejects(new Error('lookup failed'));
+          post({
+            copayers: [
+              { copayerId: idA, signature: sign(idA) },
+              { copayerId: idB, signature: sign(idB) }
+            ]
+          }, function(err, res, body) {
+            should.not.exist(err);
+            res.statusCode.should.equal(200);
+            body.should.deep.equal([idA]);
+            done();
+          });
+        });
+
+        it('looks up only copayer ids that are strings', function(done) {
+          post({
+            copayers: [
+              { copayerId: { id: idB }, signature: sign(idB) },
+              { copayerId: [idB], signature: sign(idB) },
+              { copayerId: 1, signature: sign(idB) },
+              { signature: sign(idB) },
+              { copayerId: idA, signature: sign(idA) }
+            ]
+          }, function(err, res, body) {
+            should.not.exist(err);
+            res.statusCode.should.equal(200);
+            body.should.deep.equal([idA]);
+            storage.fetchCopayerLookup.args.should.deep.equal([[idA]]);
+            done();
+          });
+        });
+
+        it('skips copayers that are not objects', function(done) {
+          post({
+            copayers: [null, idB, { copayerId: idA, signature: sign(idA) }]
+          }, function(err, res, body) {
+            should.not.exist(err);
+            res.statusCode.should.equal(200);
+            body.should.deep.equal([idA]);
+            storage.fetchCopayerLookup.args.should.deep.equal([[idA]]);
+            done();
+          });
+        });
+      });
+
       describe('Clear cache', function() {
         it('/v1/clearcache/', function(done) {
           const resolveStub = sinon.stub().callsFake( () => { return Promise.resolve(true);});