@bitpay-labs/bitcore-wallet-service 11.5.2

package/src/lib/routes/helpers/error.ts

@@ -0,0 +1,51 @@
+import express from 'express';
+import { ClientError } from '../../errors/clienterror';
+import logger from '../../logger';
+
+export class ApiErrorHelper {
+  disableLogs: boolean;
+
+  setOpts(opts: { disableLogs?: boolean }) {
+    this.disableLogs = opts.disableLogs ?? this.disableLogs;
+    return this;
+  }
+
+  returnError(err: any, res: express.Response, req: express.Request): void {
+    // make sure headers have not been sent as this leads to an uncaught error
+    if (res.headersSent) {
+      return;
+    }
+    if (err instanceof ClientError) {
+      const status = err.code == 'NOT_AUTHORIZED' ? 401 : 400;
+      if (!this.disableLogs) logger.info('Client Err: ' + status + ' ' + req.url + ' ' + JSON.stringify(err));
+
+      const clientError: { code: string; message: string; messageData?: object } = {
+        code: err.code,
+        message: err.message
+      };
+      if (err.messageData) clientError.messageData = err.messageData;
+      res
+        .status(status)
+        .json(clientError)
+        .end();
+    } else {
+      let code = 500;
+      let message;
+      if (typeof err?.code === 'number' || typeof err?.statusCode === 'number') {
+        code = err.code || err.statusCode;
+        message = err.message || err.body;
+      }
+
+      const m = message || err.toString();
+
+      if (!this.disableLogs) logger.error(req.url + ' :' + code + ':' + m);
+
+      res
+        .status(code || 500)
+        .json({ error: m })
+        .end();
+    }
+  }
+};
+
+export const error = new ApiErrorHelper();

package/src/lib/routes/helpers/index.ts

@@ -0,0 +1 @@
+export * from './error';

package/src/lib/routes/middleware/authRequest.ts

@@ -0,0 +1,117 @@
+import express from 'express';
+import * as Types from '../../../types/expressapp';
+import { Utils } from '../../common/utils';
+import { ClientError } from '../../errors/clienterror';
+import { Errors } from '../../errors/errordefinitions';
+import { Copayer } from '../../model';
+import { WalletService, checkRequired } from '../../server';
+import { Storage } from '../../storage';
+import { error } from '../helpers';
+
+export function getCredentials(req: express.Request): Types.ApiCredentials {
+  const identity = req.header('x-identity');
+  if (!identity) return;
+
+  return {
+    copayerId: identity,
+    signature: req.header('x-signature'),
+    session: req.header('x-session')
+  };
+};
+
+export function getMessage(req: express.Request): string {
+  return req.method.toLowerCase() + '|' + req.url + '|' + JSON.stringify(req.body);
+};
+
+async function withSession(storage: Storage, opts): Promise<Copayer> {
+  if (!checkRequired(opts, ['copayerId', 'session'])) {
+    return;
+  }
+
+  const copayer = await new Promise<Copayer>((resolve, reject) => {
+    storage.getSession(opts.copayerId, (err, s) => {
+      if (err) {
+        return reject(err);
+      }
+
+      const isValid = s && s.id === opts.session && s.isValid();
+      if (!isValid) {
+        return reject(Errors.NOT_AUTHORIZED.withMessage('Session expired'));
+      }
+
+      storage.fetchCopayerLookup(opts.copayerId, (err, copayer) => {
+        if (err) {
+          return reject(err);
+        }
+        if (!copayer) {
+          return reject(Errors.NOT_AUTHORIZED.withMessage('Copayer not found'));
+        }
+
+        return resolve(copayer);
+      });
+    });
+  });
+
+  return copayer;
+};
+
+async function withSignature(storage: Storage, opts): Promise<Copayer> {
+  if (!checkRequired(opts, ['copayerId', 'message', 'signature'])) {
+    return;
+  }
+
+  const copayer = await new Promise<Copayer>((resolve, reject) => {
+    storage.fetchCopayerLookup(opts.copayerId, (err, copayer) => {
+      if (err) {
+        return reject(err);
+      }
+      if (!copayer) {
+        return reject(Errors.NOT_AUTHORIZED.withMessage('Copayer not found'));
+      }
+      return resolve(copayer);
+    });
+  });
+
+  const isValid = !!copayer.requestPubKeys.find(pubKey => Utils.verifyMessage(opts.message, opts.signature, pubKey.key));
+  if (!isValid) {
+    throw Errors.NOT_AUTHORIZED.withMessage('Invalid signature');
+  }
+
+  return copayer;
+};
+
+
+export function authRequest(opts?: Types.AuthRequestOpts): express.RequestHandler {
+  opts = opts || {};
+
+  return async function(req, res, next) {
+    try {
+      const storage = WalletService.getStorage();
+      const credentials = getCredentials(req);
+      if (!credentials) {
+        throw Errors.NOT_AUTHORIZED;
+      }
+
+    
+      const auth = {
+        copayerId: credentials.copayerId,
+        message: getMessage(req),
+        signature: credentials.signature,
+        clientVersion: req.header('x-client-version'),
+        userAgent: req.header('user-agent'),
+        walletId: req.header('x-wallet-id'),
+        session: opts.allowSession ? credentials.session : undefined
+      };
+
+      const copayer = await (auth.session ? withSession(storage, auth) : withSignature(storage, auth));
+      req.copayer = copayer;
+    } catch (err) {
+      if (err instanceof ClientError) {
+        return error.returnError(err, res, req);
+      }
+      return error.returnError(new ClientError({ code: 'INTERNAL_ERROR' }), res, req);
+    }
+
+    return next();
+  };
+};

package/src/lib/routes/middleware/authTssRequest.ts

@@ -0,0 +1,66 @@
+import express from 'express';
+import { Utils } from '../../common/utils';
+import { ClientError } from '../../errors/clienterror';
+import { Errors } from '../../errors/errordefinitions';
+import { WalletService, checkRequired } from '../../server';
+import { error } from '../helpers';
+import { getCredentials, getMessage } from './authRequest';
+
+
+/**
+ * Middleware to authenticate TSS requests and attach the TSS session to the request.
+ * It checks if the request has valid credentials, verifies the signature,
+ * and retrieves the TSS session based on the request path.
+ */
+export function authTssRequest(): express.RequestHandler {
+
+  return async function(req, res, next) {
+    try {
+      const storage = WalletService.getStorage();
+      const credentials = getCredentials(req);
+      if (!checkRequired(credentials, ['copayerId', 'signature'])) {
+        throw Errors.NOT_AUTHORIZED;
+      }
+    
+      const {
+        copayerId,
+        signature
+      } = credentials;
+      
+      const { id } = req.params as { [key: string]: string };
+      let session;
+      let partyId = null;
+      let pubKey = null;
+      if (req.path.includes('/tss/keygen/')) {
+        session = await storage.fetchTssKeyGenSession({ id });
+        partyId = session?.participants.indexOf(copayerId);
+        pubKey = partyId > -1 ? session.rounds[0][partyId].messages.publicKey : null;
+      } else if (req.path.includes('/tss/sign/')) {
+        session = await storage.fetchTssSigSession({ id });
+        partyId = session?.participants.find(p => p.copayerId === copayerId)?.partyId;
+        pubKey = partyId == null ? null : session.rounds[0].find(r => r.fromPartyId === partyId).messages.publicKey;
+      }
+
+      if (!session) {
+        throw Errors.NOT_AUTHORIZED.withMessage('Session not found');
+      }
+      if (!pubKey) {
+        throw Errors.NOT_AUTHORIZED.withMessage('Copayer not found in session');
+      }
+
+      const message = getMessage(req);
+      const isValid = !!Utils.verifyMessage(message, signature, pubKey);
+      if (!isValid) {
+        throw Errors.NOT_AUTHORIZED.withMessage('Invalid signature');
+      }
+    
+      req.session = session;
+      return next();
+    } catch (err) {
+      if (err instanceof ClientError) {
+        return error.returnError(err, res, req);
+      }
+      return error.returnError(new ClientError({ code: 'INTERNAL_ERROR' }), res, req);
+    }
+  };
+};

package/src/lib/routes/middleware/createWalletLimiter.ts

@@ -0,0 +1,21 @@
+import RateLimit from 'express-rate-limit';
+import { Defaults } from '../../common/defaults';
+import logger from '../../logger';
+
+let _createWalletLimiter: RateLimit | undefined;
+
+export function createWalletLimiter(opts: { ignoreRateLimiter?: boolean }) {
+  opts = opts || {};
+  if (opts.ignoreRateLimiter) {
+    return function(req, res, next) {
+      next();
+    };
+  } else {
+    if (!_createWalletLimiter) {
+      const reqPerHour = ((Defaults.RateLimit.createWallet.max / Defaults.RateLimit.createWallet.windowMs) * 60 * 60 * 1000).toFixed(2);
+      logger.info('Limiting wallet creation per IP: %o req/h', reqPerHour);
+      _createWalletLimiter = new RateLimit(Defaults.RateLimit.createWallet);
+    }
+    return _createWalletLimiter;
+  }
+};

package/src/lib/routes/middleware/log.ts

@@ -0,0 +1,63 @@
+import express from 'express';
+import { formatTimestamp, logger } from '../../logger';
+
+type TimedRequest = {
+  startTime?: Date;
+  walletId?: string;
+  isSupportStaff?: boolean;
+} & express.Request;
+
+function LogObj(logOut: { [key: string]: string }) {
+  logger.info(
+    `${logOut.support}${logOut.time} | ${logOut.ip} | ${logOut.userAgent || 'na'}  |  ${logOut.walletId || '-'}  | ${
+      logOut.phase
+    } | ${logOut.took} | ${logOut.method} | ${logOut.status} | ${logOut.url} | ${logOut.openConnections} open`
+  );
+}
+
+let openConnections = 0;
+
+function LogPhase(req: TimedRequest, res: express.Response, phase: string) {
+  const ip = req.header('CF-Connecting-IP') || req.socket.remoteAddress || req.hostname;
+  const time = req.startTime ? req.startTime : new Date();
+  const ua = req.headers['user-agent'] || '-';
+  const ver = req.headers['x-client-version'] || '-';
+  const support = req.isSupportStaff ? 'SUPPORT:' : '';
+  const logOut = {
+    support,
+    time: formatTimestamp(time),
+    walletId: req.walletId,
+    userAgent: ua + ':' + ver,
+    ip: ip.padStart(22, ' '),
+    phase: phase.padStart(8, ' '),
+    method: req.method.padStart(6, ' '),
+    status: '...'.padStart(5, ' '),
+    url: `${req.baseUrl}${req.url}`,
+    took: '...'.padStart(10, ' '),
+    openConnections: openConnections.toString().padStart(6, ' ')
+  };
+  if (req.startTime && ['END', 'CLOSED'].includes(phase)) {
+    const endTime = new Date();
+    const startTime = req.startTime ? req.startTime : endTime;
+    const totalTime = endTime.getTime() - startTime.getTime();
+    const totalTimeMsg = `${totalTime} ms`.padStart(10, ' ');
+    logOut.took = totalTimeMsg.padStart(10, ' ');
+    logOut.status = res.statusCode.toString().padStart(5, ' ');
+  }
+  LogObj(logOut);
+}
+export function LogMiddleware() {
+  return (req: TimedRequest, res: express.Response, next: express.NextFunction) => {
+    req.startTime = new Date();
+    openConnections++;
+    // LogPhase(req, res, 'START');
+    res.on('finish', () => {
+      LogPhase(req, res, 'END');
+    });
+    res.on('close', () => {
+      openConnections--;
+      LogPhase(req, res, 'CLOSED');
+    });
+    next();
+  };
+}

package/src/lib/routes/middleware/verifyTssMessage.ts

@@ -0,0 +1,37 @@
+import { utils as tssUtils } from '@bitpay-labs/bitcore-tss';
+import { Errors } from '../../errors/errordefinitions';
+import { ITssKeyMessageObject } from '../../model/tsskeygen';
+import { ITssSigMessageObject } from '../../model/tsssign';
+
+
+export async function verifyTssMessage(req, res, next) {
+  try {
+    const { message }: { message: ITssKeyMessageObject | ITssSigMessageObject } = req.body;
+    const { publicKey } = message || {};
+    if (!publicKey) {
+      return res.status(400).send(Errors.TSS_PUBKEY_MISSING);
+    }
+
+    if (!message.broadcastMessages?.length && !message.p2pMessages?.length) {
+      return res.status(400).send(Errors.TSS_INVALID_MESSAGE);
+    }
+
+    for (const m of message.broadcastMessages) {
+      if (!tssUtils.verifySignedData(m.payload, publicKey)) {
+        return res.status(400).send(Errors.TSS_INVALID_MESSAGE_SIG);
+      };
+    }
+    for (const m of message.p2pMessages) {
+      // Note: We can't verify individual p2p messages any more than this.
+      //  `m.payload.signature` is for the unencrypted message.
+      //  Only the recipients can verify on the client side.
+      if (!m.payload || !m.payload.encryptedMessage || !m.payload.signature) {
+        return res.status(400).send(Errors.TSS_INVALID_MESSAGE_SIG);
+      }
+    }
+    return next();
+  } catch {
+    return res.status(400).send(Errors.TSS_INVALID_MESSAGE);
+  }
+};
+

package/src/lib/routes/tss.ts

@@ -0,0 +1,123 @@
+import express from 'express';
+import * as Types from '../../types/expressapp';
+import { TssKeyGen, TssSign } from '../tss';
+import { authRequest } from './middleware/authRequest';
+import { authTssRequest } from './middleware/authTssRequest';
+import { createWalletLimiter } from './middleware/createWalletLimiter';
+import { verifyTssMessage } from './middleware/verifyTssMessage';
+
+
+interface TssRouterOpts {
+  returnError: Types.ReturnErrorFn;
+  opts: {
+    ignoreRateLimiter?: boolean;
+  };
+};
+
+export class TssRouter {
+  router: express.Router;
+
+  constructor(params: TssRouterOpts) {
+    const { returnError, opts } = params;
+    const router = express.Router();
+    
+    router.post('/v1/tss/keygen/:id', createWalletLimiter(opts), verifyTssMessage, async function(req, res) {
+      try {
+        const id = req.params.id;
+        const { message, n, password } = req.body;
+        const copayerId = req.headers['x-identity'];
+        await TssKeyGen.processMessage({ id, message, n, password, copayerId });
+        return res.send();
+      } catch (err) {
+        return returnError(err ?? 'unknown', res, req);
+      }
+    });
+
+    router.get('/v1/tss/keygen/:id/:round', authTssRequest(), async function(req, res) {
+      try {
+        const { id, round } = req.params as { [key: string]: string };
+        const copayerId = req.headers['x-identity'];
+        if (round === 'secret') {
+          const secret = await TssKeyGen.getBwsJoinSecret({ id, copayerId });
+          return res.json({ secret });
+        }
+        const { messages, publicKey } = await TssKeyGen.getMessagesForParty({ id, round: parseInt(round), copayerId });
+        return res.json({ messages, publicKey });
+      } catch (err) {
+        return returnError(err ?? 'unknown', res, req);
+      }
+    });
+
+    router.post('/v1/tss/keygen/:id/store', authTssRequest(), async function(req, res) {
+      try {
+        const id = req.params.id;
+        const copayerId = req.headers['x-identity'];
+        const message = req.body;
+
+        await TssKeyGen.storeKey({ id, message, copayerId });
+        return res.send();
+      } catch (err) {
+        return returnError(err ?? 'unknown', res, req);
+      }
+    });
+
+    router.post('/v1/tss/keygen/:id/secret', authTssRequest(), async function(req, res) {
+      try {
+        const id = req.params.id;
+        const { secret } = req.body;
+        const copayerId = req.headers['x-identity'];
+        await TssKeyGen.storeBwsJoinSecret({ id, secret, copayerId });
+        return res.send();
+      } catch (err) {
+        return returnError(err ?? 'unknown', res, req);
+      }
+    });
+
+    router.get('/v1/tss/keygen/:id/secret', authTssRequest(), async function(req, res) {
+      try {
+        const id = req.params.id;
+        const copayerId = req.headers['x-identity'];
+        const secret = await TssKeyGen.getBwsJoinSecret({ id, copayerId });
+        return res.json({ secret });
+      } catch (err) {
+        return returnError(err ?? 'unknown', res, req);
+      }
+    });
+
+    router.post('/v1/tss/sign/:id', authRequest(), verifyTssMessage, async function(req, res) {
+      try {
+        const id = req.params.id;
+        const { message, m } = req.body;
+        const copayerId = req.headers['x-identity'];
+        await TssSign.processMessage({ id, message, m, copayerId });
+        return res.send();
+      } catch (err) {
+        return returnError(err ?? 'unknown', res, req);
+      }
+    });
+
+    router.get('/v1/tss/sign/:id/:round', authTssRequest(), async function(req, res) {
+      try {
+        const { id, round } = req.params as { [key: string]: string };
+        const copayerId = req.headers['x-identity'];
+        const { messages, signature } = await TssSign.getMessagesForParty({ id, round: parseInt(round), copayerId });
+        return res.json({ messages, signature });
+      } catch (err) {
+        return returnError(err ?? 'unknown', res, req);
+      }
+    });
+
+    router.post('/v1/tss/sign/:id/store', authTssRequest(), async function(req, res) {
+      try {
+        const id = req.params.id;
+        const { signature } = req.body;
+        await TssSign.storeSignature({ id, signature });
+        return res.send();
+      } catch (err) {
+        return returnError(err ?? 'unknown', res, req);
+      }
+    });
+
+    this.router = router;
+  }
+};