@bsv/overlay 0.1.12 → 0.1.14

package/src/Engine.ts

@@ -15,6 +15,7 @@ import { SyncConfiguration } from './SyncConfiguration.js'
 import { Advertisement } from './Advertisement.js'
 import { OverlayGASPRemote } from './GASP/OverlayGASPRemote.js'
 import { OverlayGASPStorage } from './GASP/OverlayGASPStorage.js'
+import { URL } from "url"
 
 /**
  * Am engine for running BSV Overlay Services (topic managers and lookup services).
@@ -34,6 +35,7 @@ export class Engine {
    * @param {SyncConfiguration} syncConfiguration — Configuration object describing historical synchronization of topics.
    * @param {boolean} logTime - Enables / disables the timing logs for various operations in the Overlay submit route.
    * @param {string} logPrefix - Supports overriding the log prefix with a custom string.
+   * @param {boolean} throwOnBroadcastFailure - Enables / disables throwing an error when a transaction broadcast failure is detected.
    */
   constructor(
     public managers: { [key: string]: TopicManager },
@@ -47,7 +49,8 @@ export class Engine {
     public advertiser?: Advertiser,
     public syncConfiguration?: SyncConfiguration,
     public logTime = false,
-    public logPrefix = '[OVERLAY_ENGINE] '
+    public logPrefix = '[OVERLAY_ENGINE] ',
+    public throwOnBroadcastFailure = false
   ) {
     // To encourage synchronization of overlay services, the SHIP sync strategy is used by default for all overlay topics, except for 'tm_ship' and 'tm_slap'.
     // For these two topics, any existing trackers are combined with the provided shipTrackers and slapTrackers omitting any duplicates.
@@ -122,7 +125,7 @@ export class Engine {
     this.endTime(`chainTracker_${txid.substring(0, 10)}`)
 
     const steak: STEAK = {}
-    let admissableOutputs: AdmittanceInstructions = { outputsToAdmit: [], coinsToRetain: [] }
+    let admissibleOutputs: AdmittanceInstructions = { outputsToAdmit: [], coinsToRetain: [] }
     const previousCoins: number[] = []
 
     // Parallelize the topic processing
@@ -179,7 +182,7 @@ export class Engine {
       const admissibleOutputsPromise = (async () => {
         try {
           this.startTime(`identifyAdmissibleOutputs_${txid.substring(0, 10)}`)
-          admissableOutputs = await this.managers[topic].identifyAdmissibleOutputs(taggedBEEF.beef, previousCoins)
+          admissibleOutputs = await this.managers[topic].identifyAdmissibleOutputs(taggedBEEF.beef, previousCoins)
           this.endTime(`identifyAdmissibleOutputs_${txid.substring(0, 10)}`)
         } catch (_) {
           steak[topic] = { outputsToAdmit: [], coinsToRetain: [] }
@@ -189,7 +192,7 @@ export class Engine {
       // Wait for both tasks to complete
       await Promise.all([markSpentPromises, admissibleOutputsPromise])
       // Keep track of what outputs were admitted for what topic
-      steak[topic] = admissableOutputs
+      steak[topic] = admissibleOutputs
     })
 
     await Promise.all(topicPromises)
@@ -198,8 +201,10 @@ export class Engine {
     this.startTime(`broadcast_${txid.substring(0, 10)}`)
     if (mode !== 'historical-tx' && this.broadcaster !== undefined) {
       const response = await this.broadcaster.broadcast(tx)
-      if (isBroadcastFailure(response)) {
-        throw new Error(`Failed to broadcast transaction! Error: ${response.description}`)
+      if (isBroadcastFailure(response) && this.throwOnBroadcastFailure) {
+        const e = new Error(`Failed to broadcast transaction! Error: ${response.description}`);
+        (e as any).more = response.more
+        throw e
       }
     }
     this.endTime(`broadcast_${txid.substring(0, 10)}`)
@@ -212,7 +217,7 @@ export class Engine {
 
     for (const topic of taggedBEEF.topics) {
       // Keep track of which outputs to admit, mark as stale, or retain
-      const outputsToAdmit: number[] = admissableOutputs.outputsToAdmit
+      const outputsToAdmit: number[] = admissibleOutputs.outputsToAdmit
       const staleCoins: Array<{
         txid: string
         outputIndex: number
@@ -227,7 +232,7 @@ export class Engine {
       for (const inputIndex of previousCoins) {
         const previousTXID = tx.inputs[inputIndex].sourceTXID || tx.inputs[inputIndex].sourceTransaction?.id('hex') as string
         const previousOutputIndex = tx.inputs[inputIndex].sourceOutputIndex
-        if (!admissableOutputs.coinsToRetain.includes(inputIndex)) {
+        if (!admissibleOutputs.coinsToRetain.includes(inputIndex)) {
           staleCoins.push({
             txid: previousTXID,
             outputIndex: previousOutputIndex
@@ -464,7 +469,7 @@ export class Engine {
    * @returns {Promise<void>} A promise that resolves when the synchronization process is complete.
    */
   async syncAdvertisements(): Promise<void> {
-    if (this.advertiser === undefined) {
+    if (this.advertiser === undefined || !this.hostingURL || !this.isValidUrl(this.hostingURL)) {
       return
     }
     const advertiser = this.advertiser
@@ -945,6 +950,60 @@ export class Engine {
     const documentation = await this.lookupServices[provider]?.getDocumentation?.()
     return documentation !== undefined ? documentation : 'No documentation found!'
   }
+
+  /**
+   * Validates a URL to ensure it does not match disallowed patterns:
+   * - Contains "http:" protocol
+   * - Contains "localhost" (with or without a port)
+   * - Internal or non-routable IP addresses (e.g., 192.168.x.x, 10.x.x.x, 172.16.x.x to 172.31.x.x)
+   * - Non-routable IPs like 127.x.x.x, 0.0.0.0, or IPv6 loopback (::1)
+   *
+   * @param url - The URL string to validate
+   * @returns {boolean} - Returns `false` if the URL violates any of the conditions `true` otherwise
+   */
+  private isValidUrl(url: string): boolean {
+    try {
+      const parsedUrl = new URL(url)
+
+      // Disallow http:
+      if (parsedUrl.protocol === "http:") {
+        return false
+      }
+
+      // Disallow localhost with or without a port
+      if (/^localhost(:\d+)?$/i.test(parsedUrl.hostname)) {
+        return false
+      }
+
+      // Disallow internal and non-routable IP addresses
+      const ipAddress = parsedUrl.hostname
+
+      // Regex for non-routable IPv4 IPs
+      const nonRoutableIpv4Patterns = [
+        /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/, // Loopback IPs
+        /^10\.\d{1,3}\.\d{1,3}\.\d{1,3}$/, // 10.x.x.x private IPs
+        /^192\.168\.\d{1,3}\.\d{1,3}$/,    // 192.168.x.x private IPs
+        /^172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}$/, // 172.16.x.x to 172.31.x.x private IPs
+        /^0\.0\.0\.0$/                      // Non-routable address
+      ]
+
+      // Check for IPv4 matches
+      if (nonRoutableIpv4Patterns.some((pattern) => pattern.test(ipAddress))) {
+        return false
+      }
+
+      // Check for non-routable IPv6 addresses explicitly
+      if (ipAddress === "[::1]") {
+        return false
+      }
+
+      // If none of the disallowed conditions matched, the URL is valid
+      return true
+    } catch (error) {
+      // If the input is not a valid URL, return false
+      return false
+    }
+  }
 }
 
 //////////

package/src/__tests/Engine.test.ts

@@ -7,6 +7,8 @@ import { Storage } from '../storage/Storage'
 import { Transaction, Utils } from '@bsv/sdk'
 import { Output } from '../Output'
 import { SyncConfiguration } from '../SyncConfiguration'
+import { TaggedBEEF } from '../TaggedBEEF.js'
+import { Advertiser } from '../Advertiser.js'
 
 const mockChainTracker = {
   isValidRootForHeight: jest.fn(async () => true)
@@ -24,13 +26,37 @@ const mockOutput: Output = {
   outputIndex: 0,
   outputScript: exampleTX.outputs[0].lockingScript.toBinary(),
   topic: 'hello',
-  satoshis: exampleTX.outputs[0].satoshis,
+  satoshis: exampleTX.outputs[0].satoshis as number,
   beef: exampleBeef,
   spent: false,
   outputsConsumed: [],
   consumedBy: []
 }
 
+const invalidHostingUrls = [
+  "http://example.com",               // Invalid: http
+  "https://localhost:3000",           // Invalid: localhost
+  "https://192.168.1.1",              // Invalid: internal private IP
+  "https://127.0.0.1",                // Invalid: loopback IP
+  "https://0.0.0.0",                  // Invalid: non-routable IP
+  "http://172.16.0.1",                // Invalid: private IP
+  "[::1]"
+]
+
+
+const validHostingUrls = [
+  "https://example.com",              // Valid: public URL
+  "https://8.8.8.8",                  // Valid: public routable IP
+  "https://255.255.255.255",          // Valid: public routable IP
+]
+
+const mockAdvertiser: Advertiser = {
+  createAdvertisements: jest.fn(async (): Promise<TaggedBEEF> => ({ beef: [0, 1, 2], topics: [] })),
+  revokeAdvertisements: jest.fn(async (): Promise<TaggedBEEF> => ({ beef: [0, 1, 2], topics: [] })),
+  findAllAdvertisements: jest.fn(async () => []),
+  parseAdvertisement: jest.fn()
+}
+
 describe('BSV Overlay Services Engine', () => {
   beforeEach(() => {
     jest.clearAllMocks()
@@ -66,6 +92,74 @@ describe('BSV Overlay Services Engine', () => {
       findUTXOsForTopic: jest.fn()
     }
   })
+
+  it('engine.syncAdvertisements should return void when invalid hostingURL is provided', async () => {
+    for (const url of invalidHostingUrls) {
+      const engine = new Engine(
+        { tm_helloworld: mockTopicManager },
+        { ls_helloworld: mockLookupService },
+        mockStorageEngine,
+        mockChainTracker,
+        url, // Invalid hostingURL
+        ['tracker1'], // shipTrackers
+        ['tracker2'], // slapTrackers
+        undefined,
+        mockAdvertiser,
+        undefined
+      )
+
+      engine.submit = jest.fn(async (taggedBEEF: TaggedBEEF, onSteakReady: any, mode?: string) => ({ outputsToAdmit: [] }))
+
+      // Call the method that would normally trigger syncAdvertisements
+      const result = await engine.syncAdvertisements()
+
+      expect(result).toBeUndefined()
+
+      // Verify that Advertiser methods are NOT called
+      expect(mockAdvertiser.createAdvertisements).not.toHaveBeenCalled()
+      expect(mockAdvertiser.findAllAdvertisements).not.toHaveBeenCalledWith('SHIP') // Assuming 'SHIP' is expected
+
+      console.log('Got past', url)
+    }
+  })
+
+  it('should allow engine.syncAdvertisements to proceed with valid hostingURLs', async () => {
+    const mockAdvertiser: Advertiser = {
+      createAdvertisements: jest.fn().mockResolvedValue({ tag: 'MOCK_TAG', data: Buffer.from('mock data') }),
+      findAllAdvertisements: jest.fn().mockResolvedValue([]),
+      revokeAdvertisements: jest.fn().mockResolvedValue({ tag: 'MOCK_REVOKE_TAG', data: Buffer.from('revocation data') }),
+      parseAdvertisement: jest.fn().mockReturnValue({
+        protocol: 'SHIP',
+        topicOrServiceName: 'mock-topic',
+        timestamp: Date.now(),
+      }),
+    }
+
+    for (const url of validHostingUrls) {
+      const engine = new Engine(
+        { tm_helloworld: mockTopicManager },
+        { ls_helloworld: mockLookupService },
+        mockStorageEngine,
+        mockChainTracker,
+        url, // Valid hostingURL
+        ['tracker1'], // shipTrackers
+        ['tracker2'], // slapTrackers
+        undefined,
+        mockAdvertiser, // Pass the mock Advertiser
+        undefined
+      )
+
+      // Call the method that would normally trigger syncAdvertisements
+      engine.submit = jest.fn(async (taggedBEEF: TaggedBEEF, onSteakReady: any, mode?: string) => ({ outputsToAdmit: [] }))
+      const result = await engine.syncAdvertisements()
+      expect(engine.submit).toHaveBeenCalled()
+
+      // Verify that Advertiser methods are called
+      expect(mockAdvertiser.createAdvertisements).toHaveBeenCalled()
+      expect(mockAdvertiser.findAllAdvertisements).toHaveBeenCalledWith('SHIP') // Assuming 'SHIP' is expected
+    }
+  })
+
   it('Uses SHIP sync configuration by default if no syncConfiguration was provided', () => {
     const engine = new Engine(
       { tm_helloworld: mockTopicManager },

package/dist/cjs/src/SHIPAdvertisement.js

@@ -1,3 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=SHIPAdvertisement.js.map

package/dist/cjs/src/SHIPAdvertisement.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"SHIPAdvertisement.js","sourceRoot":"","sources":["../../../src/SHIPAdvertisement.ts"],"names":[],"mappings":""}

package/dist/cjs/src/SLAPAdvertisement.js

@@ -1,3 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=SLAPAdvertisement.js.map

package/dist/cjs/src/SLAPAdvertisement.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"SLAPAdvertisement.js","sourceRoot":"","sources":["../../../src/SLAPAdvertisement.ts"],"names":[],"mappings":""}

package/dist/esm/src/SHIPAdvertisement.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=SHIPAdvertisement.js.map

package/dist/esm/src/SHIPAdvertisement.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"SHIPAdvertisement.js","sourceRoot":"","sources":["../../../src/SHIPAdvertisement.ts"],"names":[],"mappings":""}

package/dist/esm/src/SLAPAdvertisement.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=SLAPAdvertisement.js.map

package/dist/esm/src/SLAPAdvertisement.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"SLAPAdvertisement.js","sourceRoot":"","sources":["../../../src/SLAPAdvertisement.ts"],"names":[],"mappings":""}

package/dist/types/src/SHIPAdvertisement.d.ts

@@ -1,9 +0,0 @@
-export interface SHIPAdvertisement {
-    protocol: 'SHIP';
-    identityKey: string;
-    domain: string;
-    topic: string;
-    beef?: number[];
-    outputIndex?: number;
-}
-//# sourceMappingURL=SHIPAdvertisement.d.ts.map

package/dist/types/src/SHIPAdvertisement.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"SHIPAdvertisement.d.ts","sourceRoot":"","sources":["../../../src/SHIPAdvertisement.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB"}

package/dist/types/src/SLAPAdvertisement.d.ts

@@ -1,9 +0,0 @@
-export interface SLAPAdvertisement {
-    protocol: 'SLAP';
-    identityKey: string;
-    domain: string;
-    service: string;
-    beef?: number[];
-    outputIndex?: number;
-}
-//# sourceMappingURL=SLAPAdvertisement.d.ts.map

package/dist/types/src/SLAPAdvertisement.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"SLAPAdvertisement.d.ts","sourceRoot":"","sources":["../../../src/SLAPAdvertisement.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB"}