@bounded-sh/server 0.0.52 → 0.0.53-next.1

package/dist/index.mjs

@@ -58,7 +58,7 @@ const BOUNDED_PROGRAM_MAINNET = 'poof4b5pk1L9tmThvBmaABjcyjfhFGbMbQP5BXk2QZp';
 const BOUNDED_PROGRAM_DEVNET = 'taro6CvKqwrYrDc16ufYgzQ2NZcyyVKStffbtudrhRu';
 const COMPUTE_BUDGET_PROGRAM = 'ComputeBudget111111111111111111111111111111';
 const SYSTEM_PROGRAM_ID = '11111111111111111111111111111111';
-const SUPPORTED_SOLANA_NETWORKS = ['solana_devnet', 'solana_mainnet', 'surfnet'];
+const SUPPORTED_SOLANA_NETWORKS = ['solana_devnet', 'solana_mainnet'];
 const SUPPORTED_SOLANA_NETWORK_SET = new Set(SUPPORTED_SOLANA_NETWORKS);
 const ALLOWED_SERVER_TX_PROGRAMS = new Set([
     BOUNDED_PROGRAM_MAINNET,
@@ -1080,6 +1080,11 @@ async function createWalletClient(opts) {
 const DEFAULT_WEBHOOK_KEYS_URL = "https://realtime.bounded.sh/.well-known/bounded-webhook-keys.json";
 const DEFAULT_MAX_SKEW_SECONDS = 300;
 const DEFAULT_CACHE_TTL_MS = 300000;
+// Negative-cache TTL for unknown key ids (audit U-053): bounds how often a
+// forged X-Bounded-Key-Id can force a refetch of the hosted keys endpoint. A
+// genuinely rotated key waits at most one TTL before a refresh is retried.
+const DEFAULT_UNKNOWN_KEY_TTL_MS = 60000;
+const UNKNOWN_KEY_CACHE_MAX = 256;
 class WebhookVerificationError extends Error {
     constructor(message) {
         super(message);
@@ -1122,9 +1127,32 @@ function utf8Bytes(text) {
     return bytes;
 }
 const keyCache = new Map();
-/** Clear the in-memory key cache (mainly for tests). */
+// ---------------------------------------------------------------------------
+// Negative cache for unknown key ids (audit U-053)
+//
+// Maps `${keysUrl}\n${keyId}` -> the epoch ms until which a forced refresh for
+// that key id is suppressed. Without it, every request carrying an unknown
+// X-Bounded-Key-Id would evict the key cache and force one fetch of the hosted
+// keys endpoint — N forged calls = N upstream fetches (refetch DoS). With it,
+// a repeated unknown key id costs at most one refresh per TTL window, while a
+// genuinely rotated key waits at most one TTL. Bounded size; when full, the
+// oldest-inserted entry is evicted (LRU-ish; entries are re-inserted on
+// update, so Map insertion order approximates recency).
+// ---------------------------------------------------------------------------
+const unknownKeyCache = new Map();
+function recordUnknownKey(cacheKey, notFoundUntil) {
+    unknownKeyCache.delete(cacheKey);
+    unknownKeyCache.set(cacheKey, notFoundUntil);
+    if (unknownKeyCache.size > UNKNOWN_KEY_CACHE_MAX) {
+        const oldest = unknownKeyCache.keys().next().value;
+        if (oldest !== undefined)
+            unknownKeyCache.delete(oldest);
+    }
+}
+/** Clear the in-memory key caches, including the unknown-key negative cache (mainly for tests). */
 function clearWebhookKeyCache() {
     keyCache.clear();
+    unknownKeyCache.clear();
 }
 async function loadKeys(keysUrl, cacheTtlMs, fetchImpl, now) {
     const cached = keyCache.get(keysUrl);
@@ -1202,7 +1230,7 @@ function clearWebhookReplayCache() {
  * @throws {WebhookVerificationError} if anything fails verification.
  */
 async function verifyWebhook(rawBody, headers, opts = {}) {
-    var _a, _b, _c, _d, _e, _f;
+    var _a, _b, _c, _d, _e, _f, _g;
     // Resolution order: explicit opts.keysUrl > the configured Bounded network's
     // hosted keys (so a staging receiver verifies staging-signed deliveries
     // without passing keysUrl) > the production default (fail-closed when the
@@ -1210,8 +1238,9 @@ async function verifyWebhook(rawBody, headers, opts = {}) {
     const keysUrl = (_b = (_a = opts.keysUrl) !== null && _a !== void 0 ? _a : getWebhookKeysUrl()) !== null && _b !== void 0 ? _b : DEFAULT_WEBHOOK_KEYS_URL;
     const maxSkew = (_c = opts.maxSkewSeconds) !== null && _c !== void 0 ? _c : DEFAULT_MAX_SKEW_SECONDS;
     const cacheTtlMs = (_d = opts.cacheTtlMs) !== null && _d !== void 0 ? _d : DEFAULT_CACHE_TTL_MS;
-    const fetchImpl = (_e = opts.fetchImpl) !== null && _e !== void 0 ? _e : globalThis.fetch;
-    const now = (_f = opts.now) !== null && _f !== void 0 ? _f : Date.now;
+    const unknownKeyTtlMs = (_e = opts.unknownKeyTtlMs) !== null && _e !== void 0 ? _e : DEFAULT_UNKNOWN_KEY_TTL_MS;
+    const fetchImpl = (_f = opts.fetchImpl) !== null && _f !== void 0 ? _f : globalThis.fetch;
+    const now = (_g = opts.now) !== null && _g !== void 0 ? _g : Date.now;
     if (typeof fetchImpl !== "function") {
         throw new WebhookVerificationError("No fetch implementation available; pass opts.fetchImpl.");
     }
@@ -1232,11 +1261,22 @@ async function verifyWebhook(rawBody, headers, opts = {}) {
     const keys = await loadKeys(keysUrl, cacheTtlMs, fetchImpl, now);
     let key = keys.find((k) => k.id === keyId);
     // Cache-miss tolerance: a freshly-rotated key may not be cached yet. Force a
-    // single refresh before giving up.
+    // single refresh before giving up — unless this key id recently failed a
+    // refresh, in which case the negative cache (audit U-053) suppresses the
+    // refetch so forged unknown key ids cannot force one upstream fetch per
+    // request.
     if (!key) {
+        const unknownCacheKey = `${keysUrl}\n${keyId}`;
+        const notFoundUntil = unknownKeyCache.get(unknownCacheKey);
+        if (notFoundUntil !== undefined && notFoundUntil > now()) {
+            throw new WebhookVerificationError(`No public key found for key id "${keyId}".`);
+        }
         keyCache.delete(keysUrl);
         const refreshed = await loadKeys(keysUrl, cacheTtlMs, fetchImpl, now);
         key = refreshed.find((k) => k.id === keyId);
+        if (!key) {
+            recordUnknownKey(unknownCacheKey, now() + unknownKeyTtlMs);
+        }
     }
     if (!key) {
         throw new WebhookVerificationError(`No public key found for key id "${keyId}".`);
@@ -1265,7 +1305,7 @@ async function verifyWebhook(rawBody, headers, opts = {}) {
     try {
         payload = JSON.parse(rawBody);
     }
-    catch (_g) {
+    catch (_h) {
         throw new WebhookVerificationError("Webhook body is not valid JSON.");
     }
     if (!payload ||