@bitpay-labs/bitcore-wallet-service 11.11.2 → 11.11.4

package/test/expressapp.test.ts

@@ -13,6 +13,7 @@ import { ExpressApp } from '../src/lib/expressapp';
 import { ClientError } from '../src/lib/errors/clienterror';
 import { BitcoreLib } from '@bitpay-labs/crypto-wallet-core';
 import * as TestData from './testdata';
+import { Stats } from '../src/lib/stats';
 
 const Defaults = Common.Defaults;
 const should = chai.should();
@@ -65,6 +66,104 @@ describe('ExpressApp', function() {
         httpServer.close();
       });
 
+      describe('Public query validation', function() {
+        let runStats, getFiatRate;
+
+        beforeEach(function() {
+          runStats = sandbox.stub(Stats.prototype, 'run').callsArgWith(0, null, {});
+          getFiatRate = sinon.stub().callsArgWith(1, null, {});
+          sandbox.stub(WalletService, 'initialize').callsArg(1);
+          sandbox.stub(WalletService, 'getInstance').returns({ getFiatRate } as any);
+        });
+
+        const targets = [
+          { path: '/v1/stats/', parameter: 'network' },
+          { path: '/v1/stats/', parameter: 'coin' },
+          { path: '/v1/fiatrates/USD/', parameter: 'coin' }
+        ];
+
+        for (const { path, parameter } of targets) {
+          const value = parameter === 'network' ? 'livenet' : 'btc';
+          // Cover operator objects, bracket arrays, and duplicate parameters.
+          const invalidQueries = [
+            `${parameter}[$regex]=.*`,
+            `${parameter}[]=${value}`,
+            `${parameter}=${value}&${parameter}=${value}`
+          ];
+          for (const query of invalidQueries) {
+            it(`should reject ${path}?${query} before accessing data`, function(done) {
+              start(ExpressApp, function() {
+                request({ url: testHost + ':' + testPort + config.basePath + path + '?' + query, json: true }, function(err, res, body) {
+                  should.not.exist(err);
+                  res.statusCode.should.equal(400);
+                  body.code.should.equal('BADREQUEST');
+                  runStats.called.should.equal(false);
+                  getFiatRate.called.should.equal(false);
+                  done();
+                });
+              });
+            });
+          }
+        }
+
+        for (const query of ['', '?coin=&network=']) {
+          it(`should preserve stats defaults for ${query || 'omitted parameters'}`, function(done) {
+            start(ExpressApp, function() {
+              request({ url: testHost + ':' + testPort + config.basePath + '/v1/stats/' + query, json: true }, function(err, res) {
+                should.not.exist(err);
+                res.statusCode.should.equal(200);
+                runStats.calledOnce.should.equal(true);
+                runStats.firstCall.thisValue.coin.should.equal('btc');
+                runStats.firstCall.thisValue.network.should.equal('livenet');
+                done();
+              });
+            });
+          });
+        }
+
+        it('should pass valid stats filters through unchanged', function(done) {
+          start(ExpressApp, function() {
+            const query = '?coin=eth&network=testnet&from=2026-01-01&to=2026-02-01';
+            request({ url: testHost + ':' + testPort + config.basePath + '/v1/stats/' + query, json: true }, function(err, res) {
+              should.not.exist(err);
+              res.statusCode.should.equal(200);
+              runStats.calledOnce.should.equal(true);
+              const stats = runStats.firstCall.thisValue;
+              stats.coin.should.equal('eth');
+              stats.network.should.equal('testnet');
+              stats.from.should.equal('2026-01-01');
+              stats.to.should.equal('2026-02-01');
+              done();
+            });
+          });
+        });
+
+        for (const query of ['', '?coin=']) {
+          it(`should preserve the fiat coin default for ${query || 'omitted parameters'}`, function(done) {
+            start(ExpressApp, function() {
+              request({ url: testHost + ':' + testPort + config.basePath + '/v1/fiatrates/USD/' + query, json: true }, function(err, res) {
+                should.not.exist(err);
+                res.statusCode.should.equal(200);
+                getFiatRate.calledOnceWithExactly({ code: 'USD', coin: 'btc', ts: null }, sinon.match.func).should.equal(true);
+                done();
+              });
+            });
+          });
+        }
+
+        it('should pass a valid fiat coin and numeric timestamp through unchanged', function(done) {
+          start(ExpressApp, function() {
+            const query = '?coin=eth&ts=1700000000000';
+            request({ url: testHost + ':' + testPort + config.basePath + '/v1/fiatrates/EUR/' + query, json: true }, function(err, res) {
+              should.not.exist(err);
+              res.statusCode.should.equal(200);
+              getFiatRate.calledOnceWithExactly({ code: 'EUR', coin: 'eth', ts: 1700000000000 }, sinon.match.func).should.equal(true);
+              done();
+            });
+          });
+        });
+      });
+
       it('/v2/wallets', function(done) {
         const server = {
           getStatus: sinon.stub().callsArgWith(1, null, {}),
@@ -638,6 +737,37 @@ describe('ExpressApp', function() {
         });
       });
 
+      describe('Transak routes', function() {
+        it('/v1/service/transak/orderDetails should check the order against the authenticated wallet', function(done) {
+          const transakGetOrderDetails = sinon.stub().resolves({ data: { status: 'COMPLETED' } });
+          const server = {
+            walletId: 'authenticatedWalletId',
+            externalServices: { transak: { transakGetOrderDetails } },
+          };
+          sandbox.stub(WalletService, 'initialize').callsArg(1);
+          sandbox.stub(WalletService, 'getInstanceWithAuth').callsArgWith(1, null, server);
+          start(ExpressApp, function() {
+            const requestOptions = {
+              url: testHost + ':' + testPort + config.basePath + '/v1/service/transak/orderDetails',
+              method: 'post',
+              json: { env: 'sandbox', orderId: 'order1', walletId: 'someOtherWalletId' },
+              headers: {
+                'x-identity': 'identity',
+                'x-signature': 'signature'
+              }
+            };
+            request(requestOptions, function(err, res, body) {
+              should.not.exist(err);
+              res.statusCode.should.equal(200);
+              body.data.status.should.equal('COMPLETED');
+              transakGetOrderDetails.calledOnce.should.equal(true);
+              transakGetOrderDetails.firstCall.args[1].should.equal('authenticatedWalletId');
+              done();
+            });
+          });
+        });
+      });
+
       describe('Moralis routes (wallet-authenticated or public)', function() {
         const whitelistedOrigin = 'https://whitelisted-dapp.example';
         let originalMoralisConfig;

package/test/integration/externalservices/coinGecko.test.ts

@@ -224,6 +224,37 @@ describe('CoinGecko integration', function() {
       should.exist(data);
     });
 
+    it('should use the Arc platform for token lists and contract lookups', async () => {
+      forceGlobalCacheMisses();
+      const tokenAddress = '0x3600000000000000000000000000000000000000';
+      const otherToken = { chainId: 5042, address: '0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+        name: 'Arc Test Token', symbol: 'TEST', decimals: 6, logoURI: '' };
+      const tokenList = [{ chainId: 5042, address: tokenAddress, symbol: 'USDC', decimals: 6 }, otherToken];
+      fakeRequest = createCoinGeckoRequestStub({
+        onTokenList: platformId => {
+          platformId.should.equal('arc');
+          return { tokens: tokenList };
+        },
+        onCoinContract: (platformId, address) => {
+          platformId.should.equal('arc');
+          address.should.equal(tokenAddress);
+          return { id: 'usd-coin', symbol: 'usdc', asset_platform_id: 'arc' };
+        },
+        onMarketChart: id => {
+          id.should.equal('usd-coin');
+          return { prices: [[1, 1]] };
+        }
+      });
+      cg().request = fakeRequest;
+
+      const tokens = await getTokens({ params: { chain: 'arc' } });
+      tokens.should.deep.equal([otherToken]);
+      cg().storage.checkAndUseGlobalCache.onSecondCall().callsFake((_key, _duration, cb) => cb(null, tokenList, null));
+      (await getTokens({ params: { chain: 'arc' } })).should.deep.equal([otherToken]);
+      const rates = await getFiatRates({ coin: 'USDC', chain: 'arc', tokenAddress });
+      rates.should.deep.equal([{ ts: 1, rate: 1 }]);
+    });
+
     it('should map chain aliases to the correct token list platform', async () => {
       forceGlobalCacheMisses();
 
@@ -315,6 +346,15 @@ describe('CoinGecko integration', function() {
       data[0].low52w.should.equal(90);
     });
 
+    it('should resolve native Arc market stats and fiat rates to USDC', async () => {
+      const getSpy = sandbox.spy(fakeRequest, 'get');
+      await getMarketStats({ coin: 'arc' });
+      parseRequestedIdsFromMarketsUrl(getSpy.firstCall.args[0]).should.deep.equal(['usd-coin']);
+
+      await getFiatRates({ coin: 'arc' });
+      matchCoinIdFromMarketChartUrl(getSpy.lastCall.args[0]).should.equal('usd-coin');
+    });
+
     it('should reject non-default coin symbols without tokenAddress', async () => {
       try {
         await getMarketStats({ coin: 'WBTC' });
@@ -829,7 +869,7 @@ describe('CoinGecko integration', function() {
       should.exist(data);
       Object.keys(data)
         .sort()
-        .should.deep.equal(['bch', 'btc', 'doge', 'eth', 'ltc', 'pol', 'sol', 'xrp']);
+        .should.deep.equal(['arc', 'bch', 'btc', 'doge', 'eth', 'ltc', 'pol', 'sol', 'xrp']);
     });
 
     it('should reject overly long coin symbols', async () => {
@@ -922,7 +962,7 @@ describe('CoinGecko integration', function() {
       should.exist(data);
       Object.keys(data)
         .sort()
-        .should.deep.equal(['bch', 'btc', 'doge', 'eth', 'ltc', 'pol', 'sol', 'xrp']);
+        .should.deep.equal(['arc', 'bch', 'btc', 'doge', 'eth', 'ltc', 'pol', 'sol', 'xrp']);
 
       data.btc.should.deep.equal([
         { ts: 1, rate: 100 },