@bitpay-labs/bitcore-wallet-service 11.11.2 → 11.11.3

package/src/lib/tss.ts

@@ -1,6 +1,7 @@
 import { EventEmitter } from 'events';
 import { BitcoreLib } from '@bitpay-labs/crypto-wallet-core';
 import { Constants } from './common/constants';
+import { Utils } from './common/utils';
 import { Errors } from './errors/errordefinitions';
 import logger from './logger';
 import { TssKeyGenModel } from './model/tsskeygen';
@@ -553,7 +554,10 @@ class TssKeyGenClass {
     // }
   }
 
-  /** Store the BWS join secret for the TSS keygen session */
+  /**
+   * Store the BWS join secret for the TSS keygen session
+   * @deprecated Use storeBwsJoinSecrets instead.
+   */
   async storeBwsJoinSecret(params: {
     /** Session ID */
     id: string;
@@ -587,10 +591,77 @@ class TssKeyGenClass {
     }
   }
 
-  /** Get the BWS join secret for the TSS keygen session */
+  /**
+   * Store the party-encrypted BWS join secrets for a wallet on `chain`:`network` created with the TSS key.
+   * This can be called after the key generation session has expired to create additional wallets (e.g. other EVM chains) for the same key.
+   */
+  async storeBwsJoinSecrets(params: {
+    /** Session ID */
+    id: string;
+    /** Blockchain (e.g., 'btc', 'eth') */
+    chain: string;
+    /** Network (e.g., 'livenet', 'testnet') */
+    network: string;
+    /** Party encrypted BWS join secrets, keyed by partyId or by the party's keygen session copayer ID */
+    secrets: { [party: string]: string };
+    /** Copayer ID of the submitting party (must be the session creator) */
+    copayerId: string;
+  }) {
+    const { id, copayerId } = params;
+    const { chain, network } = getSecretChainNetwork(params.chain, params.network);
+    if (!params.secrets || typeof params.secrets !== 'object' || Array.isArray(params.secrets)) {
+      throw Errors.TSS_GENERIC_ERROR.withMessage('Invalid BWS join secrets provided');
+    }
+    const storage = WalletService.getStorage();
+    const session = await storage.fetchTssKeyGenSession({ id });
+
+    if (!session) {
+      throw Errors.TSS_SESSION_NOT_FOUND;
+    }
+
+    if (session.participants.indexOf(copayerId) !== 0) {
+      throw Errors.TSS_GENERIC_ERROR.withMessage('Only the session creator can store the BWS join secret');
+    }
+
+    // Only store secrets keyed by partyId for the other parties (1..n-1)
+    const secrets: { [partyId: number]: string } = {};
+    for (const [party, secret] of Object.entries(params.secrets)) {
+      const partyId = /^\d+$/.test(party) ? parseInt(party) : session.participants.indexOf(party);
+      if (!(partyId > 0 && partyId < session.n) || typeof secret !== 'string' || !secret) {
+        throw Errors.TSS_GENERIC_ERROR.withMessage('Invalid BWS join secret for party ' + party);
+      }
+      if (secrets[partyId]) {
+        // Malformed secrets objects may be keyed by both partyId (number) and copayerId (string).
+        // While this technically won't break anything (only 1 secret will be stored), it indicates
+        // a malformation which could signal a broader issue with the client.
+        throw Errors.TSS_GENERIC_ERROR.withMessage('Multiple BWS join secret for party ' + party);
+      }
+      secrets[partyId] = secret;
+    }
+
+    if (Object.keys(secrets).length !== session.n - 1) {
+      throw Errors.TSS_GENERIC_ERROR.withMessage('Missing BWS join secrets for some parties');
+    }
+
+    const result = await storage.storeTssKeyBwsJoinSecrets({ id, chain, network, secrets });
+    if (!result.result.ok) {
+      logger.error('Failed to store TSS key generation BWS join secrets %o %o', id, result);
+      throw Errors.TSS_GENERIC_ERROR.withMessage('Failed to store TSS key generation BWS join secrets');
+    }
+  }
+
+  /**
+   * Get the BWS join secret for the TSS keygen session.
+   * If chain & network are given, returns the requesting party's encrypted secret for that chain & network.
+   * Otherwise, returns the legacy (< v1.3) unencrypted secret.
+   */
   async getBwsJoinSecret(params: {
     /** Session ID */
     id: string;
+    /** Blockchain (e.g., 'btc', 'eth'). Omitted by legacy clients */
+    chain?: string;
+    /** Network (e.g., 'livenet', 'testnet'). Omitted by legacy clients */
+    network?: string;
     /** Copayer ID of the requesting party */
     copayerId: string;
   }): Promise<string> {
@@ -600,16 +671,42 @@ class TssKeyGenClass {
     if (!session) {
       throw Errors.TSS_SESSION_NOT_FOUND;
     }
-    if (session.participants.indexOf(copayerId) === -1) {
+    const partyId = session.participants.indexOf(copayerId);
+    if (partyId === -1) {
       throw Errors.TSS_NON_PARTICIPANT;
     }
-    if (!session.bwsJoinSecret) {
+
+    if (params.chain == null && params.network == null) {
+      // Legacy clients don't send chain & network
+      if (!session.bwsJoinSecret) {
+        throw Errors.TSS_BWS_JOIN_SECRET_NOT_FOUND;
+      }
+      return session.bwsJoinSecret;
+    }
+
+    // Note: sessions < v1.3 can have chain-specific secrets too (i.e. wallets created with an existing TSS key)
+    const { chain, network } = getSecretChainNetwork(params.chain, params.network);
+    const secret = session.bwsJoinSecrets?.[`${chain}:${network}`]?.[partyId];
+    if (typeof secret !== 'string') {
       throw Errors.TSS_BWS_JOIN_SECRET_NOT_FOUND;
     }
-    return session.bwsJoinSecret;
+    return secret;
   }
 };
 
+/** Validate and normalize the chain & network used to key the BWS join secrets */
+function getSecretChainNetwork(chain: string, network: string) {
+  chain = typeof chain === 'string' ? chain.toLowerCase() : chain;
+  if (!Utils.checkValueInCollection(chain, Constants.CHAINS)) {
+    throw Errors.TSS_GENERIC_ERROR.withMessage('Invalid chain provided');
+  }
+  network = typeof network === 'string' ? Utils.getNetworkName(chain, Utils.getGenericName(network.toLowerCase())) : network;
+  if (!Utils.checkValueInCollection(network, Constants.NETWORKS[chain])) {
+    throw Errors.TSS_GENERIC_ERROR.withMessage('Invalid network provided');
+  }
+  return { chain, network };
+}
+
 export const TssKeyGen = new TssKeyGenClass();
 
 class TssSignClass {
@@ -748,7 +845,8 @@ class TssSignClass {
       if (session.isExpired()) {
         throw Errors.TSS_SESSION_EXPIRED;
       }
-      if (!this._isValidBroadcastMessage({ message }) && !this._isValidP2pMessage({ message })) {
+      // 1-of-N sessions won't have messages for other recipients
+      if (session.m > 1 && !this._isValidBroadcastMessage({ message }) && !this._isValidP2pMessage({ message })) {
         throw Errors.TSS_INVALID_MESSAGE.withMessage('Invalid message provided');
       }
 
@@ -903,8 +1001,10 @@ class TssSignClass {
     id: string;
     /** Signature to store */
     signature: ITssSigMessageObject['signature'];
+    /** Copayer ID of the sender */
+    copayerId: string;
   }): Promise<void> {
-    const { id, signature } = params;
+    const { id, signature, copayerId } = params;
     if (!signature) {
       throw Errors.TSS_NO_FINAL_SIGNATURE;
     }
@@ -917,6 +1017,10 @@ class TssSignClass {
     if (!session) {
       throw Errors.TSS_SESSION_NOT_FOUND;
     }
+    const party = session.participants.find(p => p.copayerId === copayerId);
+    if (!party) {
+      throw Errors.TSS_NON_PARTICIPANT;
+    }
 
     const verifySig = (sig1, sig2) => {
       return sig1.r === sig2.r &&

package/test/expressapp.test.ts

@@ -13,6 +13,7 @@ import { ExpressApp } from '../src/lib/expressapp';
 import { ClientError } from '../src/lib/errors/clienterror';
 import { BitcoreLib } from '@bitpay-labs/crypto-wallet-core';
 import * as TestData from './testdata';
+import { Stats } from '../src/lib/stats';
 
 const Defaults = Common.Defaults;
 const should = chai.should();
@@ -65,6 +66,104 @@ describe('ExpressApp', function() {
         httpServer.close();
       });
 
+      describe('Public query validation', function() {
+        let runStats, getFiatRate;
+
+        beforeEach(function() {
+          runStats = sandbox.stub(Stats.prototype, 'run').callsArgWith(0, null, {});
+          getFiatRate = sinon.stub().callsArgWith(1, null, {});
+          sandbox.stub(WalletService, 'initialize').callsArg(1);
+          sandbox.stub(WalletService, 'getInstance').returns({ getFiatRate } as any);
+        });
+
+        const targets = [
+          { path: '/v1/stats/', parameter: 'network' },
+          { path: '/v1/stats/', parameter: 'coin' },
+          { path: '/v1/fiatrates/USD/', parameter: 'coin' }
+        ];
+
+        for (const { path, parameter } of targets) {
+          const value = parameter === 'network' ? 'livenet' : 'btc';
+          // Cover operator objects, bracket arrays, and duplicate parameters.
+          const invalidQueries = [
+            `${parameter}[$regex]=.*`,
+            `${parameter}[]=${value}`,
+            `${parameter}=${value}&${parameter}=${value}`
+          ];
+          for (const query of invalidQueries) {
+            it(`should reject ${path}?${query} before accessing data`, function(done) {
+              start(ExpressApp, function() {
+                request({ url: testHost + ':' + testPort + config.basePath + path + '?' + query, json: true }, function(err, res, body) {
+                  should.not.exist(err);
+                  res.statusCode.should.equal(400);
+                  body.code.should.equal('BADREQUEST');
+                  runStats.called.should.equal(false);
+                  getFiatRate.called.should.equal(false);
+                  done();
+                });
+              });
+            });
+          }
+        }
+
+        for (const query of ['', '?coin=&network=']) {
+          it(`should preserve stats defaults for ${query || 'omitted parameters'}`, function(done) {
+            start(ExpressApp, function() {
+              request({ url: testHost + ':' + testPort + config.basePath + '/v1/stats/' + query, json: true }, function(err, res) {
+                should.not.exist(err);
+                res.statusCode.should.equal(200);
+                runStats.calledOnce.should.equal(true);
+                runStats.firstCall.thisValue.coin.should.equal('btc');
+                runStats.firstCall.thisValue.network.should.equal('livenet');
+                done();
+              });
+            });
+          });
+        }
+
+        it('should pass valid stats filters through unchanged', function(done) {
+          start(ExpressApp, function() {
+            const query = '?coin=eth&network=testnet&from=2026-01-01&to=2026-02-01';
+            request({ url: testHost + ':' + testPort + config.basePath + '/v1/stats/' + query, json: true }, function(err, res) {
+              should.not.exist(err);
+              res.statusCode.should.equal(200);
+              runStats.calledOnce.should.equal(true);
+              const stats = runStats.firstCall.thisValue;
+              stats.coin.should.equal('eth');
+              stats.network.should.equal('testnet');
+              stats.from.should.equal('2026-01-01');
+              stats.to.should.equal('2026-02-01');
+              done();
+            });
+          });
+        });
+
+        for (const query of ['', '?coin=']) {
+          it(`should preserve the fiat coin default for ${query || 'omitted parameters'}`, function(done) {
+            start(ExpressApp, function() {
+              request({ url: testHost + ':' + testPort + config.basePath + '/v1/fiatrates/USD/' + query, json: true }, function(err, res) {
+                should.not.exist(err);
+                res.statusCode.should.equal(200);
+                getFiatRate.calledOnceWithExactly({ code: 'USD', coin: 'btc', ts: null }, sinon.match.func).should.equal(true);
+                done();
+              });
+            });
+          });
+        }
+
+        it('should pass a valid fiat coin and numeric timestamp through unchanged', function(done) {
+          start(ExpressApp, function() {
+            const query = '?coin=eth&ts=1700000000000';
+            request({ url: testHost + ':' + testPort + config.basePath + '/v1/fiatrates/EUR/' + query, json: true }, function(err, res) {
+              should.not.exist(err);
+              res.statusCode.should.equal(200);
+              getFiatRate.calledOnceWithExactly({ code: 'EUR', coin: 'eth', ts: 1700000000000 }, sinon.match.func).should.equal(true);
+              done();
+            });
+          });
+        });
+      });
+
       it('/v2/wallets', function(done) {
         const server = {
           getStatus: sinon.stub().callsArgWith(1, null, {}),

package/test/integration/server.test.ts

@@ -21,6 +21,7 @@ import * as TestData from '../testdata';
 import helpers from './helpers';
 import { ClientError } from '../../src/lib/errors/clienterror';
 import { ExpressApp } from '../../src/lib/expressapp';
+import { type JoinWalletOpts } from '../../src/lib/server';
 
 const should = chai.should();
 config.moralis = config.moralis ?? {
@@ -1120,7 +1121,7 @@ describe('Wallet service', function() {
           xPubKey: TestData.copayers[0].xPubKey_44H_0H_0H,
           requestPubKey: TestData.copayers[0].pubKey_1H_0,
         };
-        server.joinWallet(copayerOpts, function(err) {
+        server.joinWallet(copayerOpts as JoinWalletOpts, function(err) {
           should.exist(err);
           err.message.should.contain('argument: copayerSignature missing');
           done();
@@ -1774,6 +1775,57 @@ describe('Wallet service', function() {
         wallet.copayers.length.should.equal(0);
       });
     });
+
+    describe('TSS wallets (concurrent join)', function() {
+      it('should keep a copayer that joins while the wallet is being registered', async function() {
+        const server = new WalletService();
+        const copayerIds = [0, 1].map(i => Model.Copayer.xPubToCopayerId('btc', TestData.copayers[i].xPubKey_44H_0H_0H));
+
+        const session = TssKeyGenModel.create({
+          id: 'tss-join-during-register-test-session',
+          message: { partyId: 0, broadcastMessages: [], p2pMessages: [], publicKey: 'dummy', round: 0 },
+          n: 2,
+          copayerId: copayerIds[0],
+          version: Defaults.TSS_KEYGEN_SCHEME_VERSION
+        });
+        session.participants[1] = copayerIds[1];
+        session.sharedPublicKey = 'dummy-shared-public-key';
+        await server.storage.db.collection('tss_keygen').deleteMany({ id: session.id });
+        await server.storage.storeTssKeyGenSession({ doc: session });
+
+        const walletId = await util.promisify(server.createWallet).call(server, {
+          name: 'tss wallet',
+          m: 1,
+          n: 1,
+          pubKey: TestData.keyPair.pub,
+          coin: 'btc',
+          tssKeyId: session.id,
+        });
+        const [creatorOpts, joinerOpts] = [0, 1].map(i => helpers.getSignedCopayerOpts({
+          walletId,
+          name: 'copayer ' + (i + 1),
+          xPubKey: TestData.copayers[i].xPubKey_44H_0H_0H,
+          requestPubKey: TestData.copayers[i].pubKey_1H_0,
+        }));
+        const { copayerId } = await util.promisify(server.joinWallet).call(server, creatorOpts);
+        const creatorServer = await helpers.getAuthServer(copayerId);
+        creatorServer.checkWalletSync = function(a, b, simple, cb) {
+          if (simple) return cb(null, false);
+          return cb(null, true);
+        };
+
+        blockchainExplorer.register = sinon.stub().callsFake((wallet, cb) => server.joinWallet(joinerOpts, cb));
+        await util.promisify(creatorServer.getStatus).call(creatorServer, { includeExtendedInfo: true });
+
+        blockchainExplorer.register.calledOnce.should.equal(true);
+        const registeredWallet = blockchainExplorer.register.firstCall.args[0];
+        const wallet = await util.promisify(server.storage.fetchWallet).call(server.storage, walletId);
+        wallet.copayers.length.should.equal(2);
+        wallet.beRegistered.should.equal(true);
+        wallet.beAuthPrivateKey2.should.equal(registeredWallet.beAuthPrivateKey2);
+        wallet.beAuthPublicKey2.should.equal(registeredWallet.beAuthPublicKey2);
+      });
+    });
   });
 
   describe('#removeWallet', function() {