@lidofinance/lsv-cli 1.7.0 → 1.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (182) hide show
  1. package/dist/abi/defi-wrapper/GenericStrategy.d.ts +308 -0
  2. package/dist/abi/defi-wrapper/GenericStrategy.js +409 -0
  3. package/dist/abi/defi-wrapper/GenericStrategy.js.map +1 -0
  4. package/dist/abi/defi-wrapper/index.d.ts +1 -0
  5. package/dist/abi/defi-wrapper/index.js +1 -0
  6. package/dist/abi/defi-wrapper/index.js.map +1 -1
  7. package/dist/abi/defi-wrapper/sources.d.ts +103 -0
  8. package/dist/abi/defi-wrapper/sources.js +104 -0
  9. package/dist/abi/defi-wrapper/sources.js.map +1 -0
  10. package/dist/configs/deployed.d.ts +5 -0
  11. package/dist/configs/deployed.js +20 -2
  12. package/dist/configs/deployed.js.map +1 -1
  13. package/dist/configs/envs.js +2 -0
  14. package/dist/configs/envs.js.map +1 -1
  15. package/dist/contracts/defi-wrapper/generic-strategy.d.ts +5 -0
  16. package/dist/contracts/defi-wrapper/generic-strategy.js +12 -0
  17. package/dist/contracts/defi-wrapper/generic-strategy.js.map +1 -0
  18. package/dist/contracts/defi-wrapper/index.d.ts +1 -0
  19. package/dist/contracts/defi-wrapper/index.js +1 -0
  20. package/dist/contracts/defi-wrapper/index.js.map +1 -1
  21. package/dist/features/defi-wrapper/defi-wrapper-factory.d.ts +3 -0
  22. package/dist/features/defi-wrapper/defi-wrapper-factory.js +4 -1
  23. package/dist/features/defi-wrapper/defi-wrapper-factory.js.map +1 -1
  24. package/dist/features/defi-wrapper/index.d.ts +1 -0
  25. package/dist/features/defi-wrapper/index.js +1 -0
  26. package/dist/features/defi-wrapper/index.js.map +1 -1
  27. package/dist/features/defi-wrapper/pool-info.d.ts +18 -1
  28. package/dist/features/defi-wrapper/pool-info.js +47 -3
  29. package/dist/features/defi-wrapper/pool-info.js.map +1 -1
  30. package/dist/features/defi-wrapper/timelock-roles.d.ts +5 -0
  31. package/dist/features/defi-wrapper/timelock-roles.js +43 -0
  32. package/dist/features/defi-wrapper/timelock-roles.js.map +1 -0
  33. package/dist/features/defi-wrapper/timelock.d.ts +1 -6
  34. package/dist/features/defi-wrapper/timelock.js +2 -45
  35. package/dist/features/defi-wrapper/timelock.js.map +1 -1
  36. package/dist/features/defi-wrapper/verify-contracts.d.ts +20 -0
  37. package/dist/features/defi-wrapper/verify-contracts.js +145 -0
  38. package/dist/features/defi-wrapper/verify-contracts.js.map +1 -0
  39. package/dist/features/utils/try-fetch.js +2 -0
  40. package/dist/features/utils/try-fetch.js.map +1 -1
  41. package/dist/programs/account/write.js +2 -1
  42. package/dist/programs/account/write.js.map +1 -1
  43. package/dist/programs/defi-wrapper/contracts/factory/write.js +77 -6
  44. package/dist/programs/defi-wrapper/contracts/factory/write.js.map +1 -1
  45. package/dist/programs/defi-wrapper/contracts/index.d.ts +1 -0
  46. package/dist/programs/defi-wrapper/contracts/index.js +1 -0
  47. package/dist/programs/defi-wrapper/contracts/index.js.map +1 -1
  48. package/dist/programs/defi-wrapper/contracts/strategy/config.d.ts +3 -0
  49. package/dist/programs/defi-wrapper/contracts/strategy/config.js +40 -0
  50. package/dist/programs/defi-wrapper/contracts/strategy/config.js.map +1 -0
  51. package/dist/programs/defi-wrapper/contracts/strategy/index.d.ts +3 -0
  52. package/dist/programs/defi-wrapper/contracts/strategy/index.js +4 -0
  53. package/dist/programs/defi-wrapper/contracts/strategy/index.js.map +1 -0
  54. package/dist/programs/defi-wrapper/contracts/strategy/main.d.ts +1 -0
  55. package/dist/programs/defi-wrapper/contracts/strategy/main.js +6 -0
  56. package/dist/programs/defi-wrapper/contracts/strategy/main.js.map +1 -0
  57. package/dist/programs/defi-wrapper/contracts/strategy/read.d.ts +1 -0
  58. package/dist/programs/defi-wrapper/contracts/strategy/read.js +30 -0
  59. package/dist/programs/defi-wrapper/contracts/strategy/read.js.map +1 -0
  60. package/dist/programs/defi-wrapper/contracts/strategy/write.d.ts +1 -0
  61. package/dist/programs/defi-wrapper/contracts/strategy/write.js +34 -0
  62. package/dist/programs/defi-wrapper/contracts/strategy/write.js.map +1 -0
  63. package/dist/programs/defi-wrapper/contracts/stv-steth-pool/write.js +25 -21
  64. package/dist/programs/defi-wrapper/contracts/stv-steth-pool/write.js.map +1 -1
  65. package/dist/programs/defi-wrapper/contracts/withdrawal-queue/write.js +3 -4
  66. package/dist/programs/defi-wrapper/contracts/withdrawal-queue/write.js.map +1 -1
  67. package/dist/programs/defi-wrapper/use-cases/distributor/write.js +1 -0
  68. package/dist/programs/defi-wrapper/use-cases/distributor/write.js.map +1 -1
  69. package/dist/programs/defi-wrapper/use-cases/timelock-governance/common/read.js +3 -3
  70. package/dist/programs/defi-wrapper/use-cases/timelock-governance/common/read.js.map +1 -1
  71. package/dist/programs/defi-wrapper/use-cases/timelock-governance/common/write.js +3 -3
  72. package/dist/programs/defi-wrapper/use-cases/timelock-governance/common/write.js.map +1 -1
  73. package/dist/programs/defi-wrapper/use-cases/timelock-governance/dashboard/write.js +3 -3
  74. package/dist/programs/defi-wrapper/use-cases/timelock-governance/dashboard/write.js.map +1 -1
  75. package/dist/programs/defi-wrapper/use-cases/timelock-governance/index.d.ts +1 -0
  76. package/dist/programs/defi-wrapper/use-cases/timelock-governance/index.js +1 -0
  77. package/dist/programs/defi-wrapper/use-cases/timelock-governance/index.js.map +1 -1
  78. package/dist/programs/defi-wrapper/use-cases/timelock-governance/pool/write.js +4 -4
  79. package/dist/programs/defi-wrapper/use-cases/timelock-governance/pool/write.js.map +1 -1
  80. package/dist/programs/defi-wrapper/use-cases/timelock-governance/proxy/write.js +3 -3
  81. package/dist/programs/defi-wrapper/use-cases/timelock-governance/proxy/write.js.map +1 -1
  82. package/dist/programs/defi-wrapper/use-cases/timelock-governance/strategy/index.d.ts +2 -0
  83. package/dist/programs/defi-wrapper/use-cases/timelock-governance/strategy/index.js +3 -0
  84. package/dist/programs/defi-wrapper/use-cases/timelock-governance/strategy/index.js.map +1 -0
  85. package/dist/programs/defi-wrapper/use-cases/timelock-governance/strategy/main.d.ts +1 -0
  86. package/dist/programs/defi-wrapper/use-cases/timelock-governance/strategy/main.js +6 -0
  87. package/dist/programs/defi-wrapper/use-cases/timelock-governance/strategy/main.js.map +1 -0
  88. package/dist/programs/defi-wrapper/use-cases/timelock-governance/strategy/write.d.ts +1 -0
  89. package/dist/programs/defi-wrapper/use-cases/timelock-governance/strategy/write.js +57 -0
  90. package/dist/programs/defi-wrapper/use-cases/timelock-governance/strategy/write.js.map +1 -0
  91. package/dist/programs/defi-wrapper/use-cases/timelock-governance/withdrawal-queue/write.js +4 -4
  92. package/dist/programs/defi-wrapper/use-cases/timelock-governance/withdrawal-queue/write.js.map +1 -1
  93. package/dist/programs/defi-wrapper/use-cases/wrapper-operations/read.js +32 -11
  94. package/dist/programs/defi-wrapper/use-cases/wrapper-operations/read.js.map +1 -1
  95. package/dist/programs/defi-wrapper/use-cases/wrapper-operations/write.js +14 -12
  96. package/dist/programs/defi-wrapper/use-cases/wrapper-operations/write.js.map +1 -1
  97. package/dist/programs/use-cases/consolidation/write.js +2 -0
  98. package/dist/programs/use-cases/consolidation/write.js.map +1 -1
  99. package/dist/providers/wallet.d.ts +88 -72
  100. package/dist/providers/wallet.js +74 -2
  101. package/dist/providers/wallet.js.map +1 -1
  102. package/dist/tests/integration/gas-estimation.test.d.ts +1 -0
  103. package/dist/tests/integration/gas-estimation.test.js +76 -0
  104. package/dist/tests/integration/gas-estimation.test.js.map +1 -0
  105. package/dist/tests/integration/helpers/test-client.d.ts +52 -52
  106. package/dist/tests/utils/arguments-security.test.d.ts +1 -0
  107. package/dist/tests/utils/arguments-security.test.js +34 -0
  108. package/dist/tests/utils/arguments-security.test.js.map +1 -0
  109. package/dist/tests/utils/arguments.test.js +2 -20
  110. package/dist/tests/utils/arguments.test.js.map +1 -1
  111. package/dist/tests/utils/cache-security.test.d.ts +1 -0
  112. package/dist/tests/utils/cache-security.test.js +62 -0
  113. package/dist/tests/utils/cache-security.test.js.map +1 -0
  114. package/dist/tests/utils/contract-write-stateoverride.test.d.ts +1 -0
  115. package/dist/tests/utils/contract-write-stateoverride.test.js +135 -0
  116. package/dist/tests/utils/contract-write-stateoverride.test.js.map +1 -0
  117. package/dist/tests/utils/data-validators.test.js +21 -5
  118. package/dist/tests/utils/data-validators.test.js.map +1 -1
  119. package/dist/tests/utils/deployed-security.test.d.ts +1 -0
  120. package/dist/tests/utils/deployed-security.test.js +51 -0
  121. package/dist/tests/utils/deployed-security.test.js.map +1 -0
  122. package/dist/tests/utils/get-confirmations.test.d.ts +1 -0
  123. package/dist/tests/utils/get-confirmations.test.js +40 -0
  124. package/dist/tests/utils/get-confirmations.test.js.map +1 -0
  125. package/dist/tests/utils/ipfs-security.test.d.ts +1 -0
  126. package/dist/tests/utils/ipfs-security.test.js +105 -0
  127. package/dist/tests/utils/ipfs-security.test.js.map +1 -0
  128. package/dist/tests/utils/public-client-gas-estimation.test.d.ts +1 -0
  129. package/dist/tests/utils/public-client-gas-estimation.test.js +231 -0
  130. package/dist/tests/utils/public-client-gas-estimation.test.js.map +1 -0
  131. package/dist/tests/utils/rate-limit-security.test.d.ts +1 -0
  132. package/dist/tests/utils/rate-limit-security.test.js +82 -0
  133. package/dist/tests/utils/rate-limit-security.test.js.map +1 -0
  134. package/dist/tests/utils/salt.test.d.ts +1 -0
  135. package/dist/tests/utils/salt.test.js +20 -0
  136. package/dist/tests/utils/salt.test.js.map +1 -0
  137. package/dist/utils/arguments.d.ts +2 -7
  138. package/dist/utils/arguments.js +21 -17
  139. package/dist/utils/arguments.js.map +1 -1
  140. package/dist/utils/cache.js +15 -13
  141. package/dist/utils/cache.js.map +1 -1
  142. package/dist/utils/data-validators.d.ts +3 -2
  143. package/dist/utils/data-validators.js +8 -11
  144. package/dist/utils/data-validators.js.map +1 -1
  145. package/dist/utils/fetch-cl.js +2 -1
  146. package/dist/utils/fetch-cl.js.map +1 -1
  147. package/dist/utils/index.d.ts +6 -5
  148. package/dist/utils/index.js +6 -5
  149. package/dist/utils/index.js.map +1 -1
  150. package/dist/utils/ipfs.js +18 -1
  151. package/dist/utils/ipfs.js.map +1 -1
  152. package/dist/utils/logging/console.d.ts +1 -0
  153. package/dist/utils/logging/console.js +23 -2
  154. package/dist/utils/logging/console.js.map +1 -1
  155. package/dist/utils/prompts/account.d.ts +1 -0
  156. package/dist/utils/prompts/account.js +13 -0
  157. package/dist/utils/prompts/account.js.map +1 -0
  158. package/dist/utils/prompts/index.d.ts +3 -0
  159. package/dist/utils/prompts/index.js +3 -0
  160. package/dist/utils/prompts/index.js.map +1 -1
  161. package/dist/utils/prompts/strategy.d.ts +15398 -0
  162. package/dist/utils/prompts/strategy.js +10 -0
  163. package/dist/utils/prompts/strategy.js.map +1 -0
  164. package/dist/utils/prompts/timelock-roles.d.ts +1 -0
  165. package/dist/utils/prompts/timelock-roles.js +13 -0
  166. package/dist/utils/prompts/timelock-roles.js.map +1 -0
  167. package/dist/utils/rate-limit.d.ts +6 -9
  168. package/dist/utils/rate-limit.js +27 -5
  169. package/dist/utils/rate-limit.js.map +1 -1
  170. package/dist/utils/salt.d.ts +3 -0
  171. package/dist/utils/salt.js +8 -0
  172. package/dist/utils/salt.js.map +1 -0
  173. package/dist/utils/transactions/tx-private-key.d.ts +2 -1
  174. package/dist/utils/transactions/tx-private-key.js +5 -8
  175. package/dist/utils/transactions/tx-private-key.js.map +1 -1
  176. package/dist/utils/transactions/tx-wc.js +3 -7
  177. package/dist/utils/transactions/tx-wc.js.map +1 -1
  178. package/dist/utils/transactions/utils.d.ts +1 -0
  179. package/dist/utils/transactions/utils.js +12 -0
  180. package/dist/utils/transactions/utils.js.map +1 -1
  181. package/dist/version/index.js +1 -1
  182. package/package.json +3 -2
@@ -0,0 +1,135 @@
1
+ /**
2
+ * End-to-end regression test for the balanceAwareTransport fix.
3
+ *
4
+ * Verifies that stateOverride is injected into eth_estimateGas even when the
5
+ * call originates from contract.write[method]() — the path that bypassed the
6
+ * old client.extend() override due to viem's bound-method closure bug.
7
+ *
8
+ * Uses real viem (createWalletClient, getContract, writeContract) with a mock
9
+ * at the fetch level so we can inspect the exact JSON-RPC payload sent to the
10
+ * node without needing a live chain.
11
+ */
12
+ import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
13
+ import { createWalletClient, getContract, parseAbi } from 'viem';
14
+ import { privateKeyToAccount } from 'viem/accounts';
15
+ import { balanceAwareTransport } from '../../providers/wallet.js';
16
+ const MAX_UINT256_HEX = '0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff';
17
+ const TEST_PRIVATE_KEY = '0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80';
18
+ const MOCK_CHAIN = {
19
+ id: 1337,
20
+ name: 'mocknet',
21
+ nativeCurrency: { name: 'ETH', symbol: 'ETH', decimals: 18 },
22
+ rpcUrls: { default: { http: ['http://localhost:8545'] } },
23
+ };
24
+ const CONTRACT_ADDRESS = '0x5FbDB2315678afecb367f032d93F642f64180aa3';
25
+ const RECIPIENT = '0x70997970C51812dc3A010C7d01b50e0d17dc79C8';
26
+ const ERC20_ABI = parseAbi([
27
+ 'function transfer(address to, uint256 amount) returns (bool)',
28
+ ]);
29
+ // Helpers -------------------------------------------------------------------
30
+ const jsonRpc = (id, result) => Response.json({ jsonrpc: '2.0', id, result }, { headers: { 'Content-Type': 'application/json' } });
31
+ /**
32
+ * Builds a fetch mock that answers every RPC call viem makes during
33
+ * contract.write (chainId, nonce, fee estimation, gas estimation, sendTx).
34
+ *
35
+ * The capturedEstimateGasCalls array is populated with the full JSON-RPC
36
+ * body of every eth_estimateGas request so the test can assert on it.
37
+ */
38
+ const buildFetchMock = (capturedEstimateGasCalls) => vi.fn(async (_url, init) => {
39
+ const body = JSON.parse(init?.body ?? '{}');
40
+ const { id, method } = body;
41
+ switch (method) {
42
+ case 'eth_chainId': {
43
+ return jsonRpc(id, `0x${MOCK_CHAIN.id.toString(16)}`);
44
+ }
45
+ case 'eth_getTransactionCount': {
46
+ return jsonRpc(id, '0x0');
47
+ }
48
+ // EIP-1559 fee history used by prepareTransactionRequest
49
+ case 'eth_feeHistory': {
50
+ return jsonRpc(id, {
51
+ baseFeePerGas: ['0x1', '0x1'],
52
+ gasUsedRatio: [0.5],
53
+ reward: [['0x1']],
54
+ oldestBlock: '0x1',
55
+ });
56
+ }
57
+ case 'eth_getBlockByNumber': {
58
+ return jsonRpc(id, {
59
+ baseFeePerGas: '0x1',
60
+ number: '0x1',
61
+ hash: `0x${'a'.repeat(64)}`,
62
+ transactions: [],
63
+ });
64
+ }
65
+ case 'eth_maxPriorityFeePerGas': {
66
+ return jsonRpc(id, '0x1');
67
+ }
68
+ case 'eth_estimateGas': {
69
+ capturedEstimateGasCalls.push(body);
70
+ return jsonRpc(id, '0x5208');
71
+ }
72
+ case 'eth_sendRawTransaction': {
73
+ return jsonRpc(id, `0x${'b'.repeat(64)}`);
74
+ }
75
+ default: {
76
+ return jsonRpc(id, null);
77
+ }
78
+ }
79
+ });
80
+ // Tests ---------------------------------------------------------------------
81
+ describe('contract.write — stateOverride injected via balanceAwareTransport', () => {
82
+ beforeEach(() => {
83
+ vi.clearAllMocks();
84
+ });
85
+ afterEach(() => {
86
+ vi.restoreAllMocks();
87
+ });
88
+ it('eth_estimateGas called by contract.write includes stateOverride for the sender', async () => {
89
+ const capturedEstimateGasCalls = [];
90
+ vi.spyOn(globalThis, 'fetch').mockImplementation(buildFetchMock(capturedEstimateGasCalls));
91
+ const account = privateKeyToAccount(TEST_PRIVATE_KEY);
92
+ const client = createWalletClient({
93
+ account,
94
+ chain: MOCK_CHAIN,
95
+ transport: balanceAwareTransport('http://localhost:8545'),
96
+ });
97
+ const contract = getContract({
98
+ client,
99
+ abi: ERC20_ABI,
100
+ address: CONTRACT_ADDRESS,
101
+ });
102
+ // This is the exact path that was broken: viem's bound writeContract →
103
+ // sendTransaction → prepareTransactionRequest → estimateGas never reached
104
+ // the client.extend() override. With transport-level interception it works.
105
+ await contract.write.transfer([RECIPIENT, 100n]);
106
+ expect(capturedEstimateGasCalls).toHaveLength(1);
107
+ const estimateGasParams = capturedEstimateGasCalls[0].params;
108
+ // params[0] = tx object, params[1] = blockTag, params[2] = stateOverride
109
+ expect(estimateGasParams).toHaveLength(3);
110
+ expect(estimateGasParams[2]).toMatchObject({
111
+ [account.address]: { balance: MAX_UINT256_HEX },
112
+ });
113
+ });
114
+ it('walletClient.sendTransaction also injects stateOverride (non-contract path)', async () => {
115
+ const capturedEstimateGasCalls = [];
116
+ vi.spyOn(globalThis, 'fetch').mockImplementation(buildFetchMock(capturedEstimateGasCalls));
117
+ const account = privateKeyToAccount(TEST_PRIVATE_KEY);
118
+ const client = createWalletClient({
119
+ account,
120
+ chain: MOCK_CHAIN,
121
+ transport: balanceAwareTransport('http://localhost:8545'),
122
+ });
123
+ await client.sendTransaction({
124
+ to: RECIPIENT,
125
+ value: 0n,
126
+ });
127
+ expect(capturedEstimateGasCalls).toHaveLength(1);
128
+ const estimateGasParams = capturedEstimateGasCalls[0].params;
129
+ expect(estimateGasParams).toHaveLength(3);
130
+ expect(estimateGasParams[2]).toMatchObject({
131
+ [account.address]: { balance: MAX_UINT256_HEX },
132
+ });
133
+ });
134
+ });
135
+ //# sourceMappingURL=contract-write-stateoverride.test.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"contract-write-stateoverride.test.js","sourceRoot":"","sources":["../../../tests/utils/contract-write-stateoverride.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,QAAQ,EAAc,MAAM,MAAM,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,MAAM,eAAe,GACnB,oEAAoE,CAAC;AAEvE,MAAM,gBAAgB,GACpB,oEAAoE,CAAC;AAEvE,MAAM,UAAU,GAAU;IACxB,EAAE,EAAE,IAAI;IACR,IAAI,EAAE,SAAS;IACf,cAAc,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE;IAC5D,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,uBAAuB,CAAC,EAAE,EAAE;CAC1D,CAAC;AAEF,MAAM,gBAAgB,GAAG,4CAA4C,CAAC;AACtE,MAAM,SAAS,GAAG,4CAA4C,CAAC;AAE/D,MAAM,SAAS,GAAG,QAAQ,CAAC;IACzB,8DAA8D;CAC/D,CAAC,CAAC;AAEH,8EAA8E;AAE9E,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,MAAe,EAAE,EAAE,CAC9C,QAAQ,CAAC,IAAI,CACX,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAC9B,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACpD,CAAC;AAEJ;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,CAAC,wBAAmC,EAAE,EAAE,CAC7D,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,IAAkB,EAAE,EAAE;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAE,IAAI,EAAE,IAAe,IAAI,IAAI,CAAC,CAAC;IACxD,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAE5B,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,OAAO,OAAO,CAAC,EAAE,EAAE,KAAK,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,KAAK,yBAAyB,CAAC,CAAC,CAAC;YAC/B,OAAO,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QAED,yDAAyD;QACzD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,OAAO,OAAO,CAAC,EAAE,EAAE;gBACjB,aAAa,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;gBAC7B,YAAY,EAAE,CAAC,GAAG,CAAC;gBACnB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBACjB,WAAW,EAAE,KAAK;aACnB,CAAC,CAAC;QACL,CAAC;QAED,KAAK,sBAAsB,CAAC,CAAC,CAAC;YAC5B,OAAO,OAAO,CAAC,EAAE,EAAE;gBACjB,aAAa,EAAE,KAAK;gBACpB,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;gBAC3B,YAAY,EAAE,EAAE;aACjB,CAAC,CAAC;QACL,CAAC;QAED,KAAK,0BAA0B,CAAC,CAAC,CAAC;YAChC,OAAO,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QAED,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpC,OAAO,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAED,KAAK,wBAAwB,CAAC,CAAC,CAAC;YAC9B,OAAO,OAAO,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,CAAC,CAAC,CAAC;YACR,OAAO,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,8EAA8E;AAE9E,QAAQ,CAAC,mEAAmE,EAAE,GAAG,EAAE;IACjF,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,wBAAwB,GAAU,EAAE,CAAC;QAC3C,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAC9C,cAAc,CAAC,wBAAwB,CAAiB,CACzD,CAAC;QAEF,MAAM,OAAO,GAAG,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QAEtD,MAAM,MAAM,GAAG,kBAAkB,CAAC;YAChC,OAAO;YACP,KAAK,EAAE,UAAU;YACjB,SAAS,EAAE,qBAAqB,CAAC,uBAAuB,CAAC;SAC1D,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,WAAW,CAAC;YAC3B,MAAM;YACN,GAAG,EAAE,SAAS;YACd,OAAO,EAAE,gBAAgB;SAC1B,CAAC,CAAC;QAEH,uEAAuE;QACvE,0EAA0E;QAC1E,4EAA4E;QAC5E,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QAEjD,MAAM,CAAC,wBAAwB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAEjD,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7D,yEAAyE;QACzE,MAAM,CAAC,iBAAiB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YACzC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE;SAChD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,wBAAwB,GAAU,EAAE,CAAC;QAC3C,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAC9C,cAAc,CAAC,wBAAwB,CAAiB,CACzD,CAAC;QAEF,MAAM,OAAO,GAAG,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QAEtD,MAAM,MAAM,GAAG,kBAAkB,CAAC;YAChC,OAAO;YACP,KAAK,EAAE,UAAU;YACjB,SAAS,EAAE,qBAAqB,CAAC,uBAAuB,CAAC;SAC1D,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,eAAe,CAAC;YAC3B,EAAE,EAAE,SAAS;YACb,KAAK,EAAE,EAAE;SACV,CAAC,CAAC;QAEH,MAAM,CAAC,wBAAwB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAEjD,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7D,MAAM,CAAC,iBAAiB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YACzC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE;SAChD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
@@ -1,6 +1,26 @@
1
1
  import { describe, expect, test } from 'vitest';
2
- import { validateConfig, isValidUrl, transformAddressesToArray, validateAddressesMap, validateAddressMap, } from '../../utils/data-validators.js';
2
+ import { assertSafeUrl, validateConfig, transformAddressesToArray, validateAddressesMap, validateAddressMap, } from '../../utils/data-validators.js';
3
3
  describe('data-validators', () => {
4
+ describe('assertSafeUrl', () => {
5
+ test('passes for http URL', () => {
6
+ expect(() => assertSafeUrl('http://example.com', 'url')).not.toThrow();
7
+ });
8
+ test('passes for https URL', () => {
9
+ expect(() => assertSafeUrl('https://example.com/path?q=1', 'url')).not.toThrow();
10
+ });
11
+ test('throws for invalid URL', () => {
12
+ expect(() => assertSafeUrl('not-a-url', 'callback URL')).toThrow('callback URL: invalid URL: not-a-url');
13
+ });
14
+ test('throws for ftp scheme', () => {
15
+ expect(() => assertSafeUrl('ftp://example.com', 'url')).toThrow('unsupported URL scheme "ftp:" (only http/https allowed)');
16
+ });
17
+ test('throws for file scheme', () => {
18
+ expect(() => assertSafeUrl('file:///etc/passwd', 'url')).toThrow('unsupported URL scheme "file:" (only http/https allowed)');
19
+ });
20
+ test('includes label in error message', () => {
21
+ expect(() => assertSafeUrl('ftp://example.com', 'my label')).toThrow('my label:');
22
+ });
23
+ });
4
24
  test('validateConfig detects NaN', () => {
5
25
  const errors = validateConfig({ CHAIN_ID: Number.NaN, DEPLOYED: 'true' });
6
26
  expect(errors).toHaveProperty('CHAIN_ID');
@@ -9,10 +29,6 @@ describe('data-validators', () => {
9
29
  const errors = validateConfig({ CHAIN_ID: 1, DEPLOYED: 'true' });
10
30
  expect(errors).toEqual({});
11
31
  });
12
- test('isValidUrl works', () => {
13
- expect(isValidUrl('https://example.com')).toBe(true);
14
- expect(isValidUrl('not a url')).toBe(false);
15
- });
16
32
  test('transformAddressesToArray', () => {
17
33
  const role1 = '0x0000000000000000000000000000000000000001';
18
34
  const role2 = '0x0000000000000000000000000000000000000002';
@@ -1 +1 @@
1
- {"version":3,"file":"data-validators.test.js","sourceRoot":"","sources":["../../../tests/utils/data-validators.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAEhD,OAAO,EACL,cAAc,EACd,UAAU,EACV,yBAAyB,EACzB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AAExC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,IAAI,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACtC,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC7C,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAC5B,MAAM,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACrC,MAAM,KAAK,GAAG,4CAA4C,CAAC;QAC3D,MAAM,KAAK,GAAG,4CAA4C,CAAC;QAE3D,MAAM,KAAK,GAAqB;YAC9B;gBACE,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,4CAA4C;aACtD;YACD;gBACE,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,4CAA4C;aACtD;YACD;gBACE,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,4CAA4C;aACtD;SACF,CAAC;QACF,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,CAAC,KAAK,CAAC,EAAE;gBACP,4CAA4C;gBAC5C,4CAA4C;aAC7C;YACD,CAAC,KAAK,CAAC,EAAE,CAAC,4CAA4C,CAAC;SACxD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gDAAgD,EAAE,GAAG,EAAE;QAC1D,MAAM,MAAM,GAAG,oBAAoB,CAAC;YAClC,IAAI,EAAE,CAAC,4CAA4C,EAAE,OAAO,CAAC;SAC9D,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC;YAChC,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
1
+ {"version":3,"file":"data-validators.test.js","sourceRoot":"","sources":["../../../tests/utils/data-validators.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAEhD,OAAO,EACL,aAAa,EACb,cAAc,EACd,yBAAyB,EACzB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AAExC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE;YAC/B,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACzE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE;YAChC,MAAM,CAAC,GAAG,EAAE,CACV,aAAa,CAAC,8BAA8B,EAAE,KAAK,CAAC,CACrD,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,wBAAwB,EAAE,GAAG,EAAE;YAClC,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,CAC9D,sCAAsC,CACvC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,uBAAuB,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAC7D,yDAAyD,CAC1D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,wBAAwB,EAAE,GAAG,EAAE;YAClC,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAC9D,0DAA0D,CAC3D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,iCAAiC,EAAE,GAAG,EAAE;YAC3C,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAClE,WAAW,CACZ,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACtC,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC7C,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACrC,MAAM,KAAK,GAAG,4CAA4C,CAAC;QAC3D,MAAM,KAAK,GAAG,4CAA4C,CAAC;QAE3D,MAAM,KAAK,GAAqB;YAC9B;gBACE,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,4CAA4C;aACtD;YACD;gBACE,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,4CAA4C;aACtD;YACD;gBACE,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,4CAA4C;aACtD;SACF,CAAC;QACF,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,CAAC,KAAK,CAAC,EAAE;gBACP,4CAA4C;gBAC5C,4CAA4C;aAC7C;YACD,CAAC,KAAK,CAAC,EAAE,CAAC,4CAA4C,CAAC;SACxD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gDAAgD,EAAE,GAAG,EAAE;QAC1D,MAAM,MAAM,GAAG,oBAAoB,CAAC;YAClC,IAAI,EAAE,CAAC,4CAA4C,EAAE,OAAO,CAAC;SAC9D,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC;YAChC,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
@@ -0,0 +1 @@
1
+ export {};
@@ -0,0 +1,51 @@
1
+ import { describe, test, expect, vi, beforeEach } from 'vitest';
2
+ const mockEnvs = vi.hoisted(() => {
3
+ return {};
4
+ });
5
+ // Mock envs to control DEPLOYED value
6
+ vi.mock('../../configs/envs.js', () => ({
7
+ envs: new Proxy(mockEnvs, {
8
+ get: (_target, prop) => mockEnvs[prop],
9
+ }),
10
+ }));
11
+ // Mock fs calls so we don't hit actual filesystem
12
+ vi.mock('node:fs', async (importOriginal) => {
13
+ const actual = (await importOriginal());
14
+ return {
15
+ ...actual,
16
+ lstatSync: vi.fn(() => ({ isFile: () => true })),
17
+ readFileSync: vi.fn(() => '{"networkId": 1}'),
18
+ };
19
+ });
20
+ import { importDeployFile } from '../../configs/deployed.js';
21
+ beforeEach(() => {
22
+ vi.clearAllMocks();
23
+ // Clear all keys from mockEnvs
24
+ for (const key of Object.keys(mockEnvs)) {
25
+ delete mockEnvs[key];
26
+ }
27
+ });
28
+ describe('path traversal prevention (H4)', () => {
29
+ test('rejects path traversal with ../', () => {
30
+ mockEnvs.DEPLOYED = '../../etc/passwd';
31
+ expect(() => importDeployFile()).toThrow('Path traversal detected');
32
+ });
33
+ test('rejects path traversal with absolute path escape', () => {
34
+ mockEnvs.DEPLOYED = '../../../etc/shadow';
35
+ expect(() => importDeployFile()).toThrow('Path traversal detected');
36
+ });
37
+ test('allows valid filename in configs dir', () => {
38
+ mockEnvs.DEPLOYED = 'deployed-hoodi-vaults.json';
39
+ const result = importDeployFile();
40
+ expect(result).toEqual({ networkId: 1 });
41
+ });
42
+ test('allows subdirectory within configs', () => {
43
+ mockEnvs.DEPLOYED = 'subdir/deployed.json';
44
+ const result = importDeployFile();
45
+ expect(result).toEqual({ networkId: 1 });
46
+ });
47
+ test('throws when DEPLOYED is not set', () => {
48
+ expect(() => importDeployFile()).toThrow('Deployed contracts file is not set');
49
+ });
50
+ });
51
+ //# sourceMappingURL=deployed-security.test.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"deployed-security.test.js","sourceRoot":"","sources":["../../../tests/utils/deployed-security.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEhE,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;IAC/B,OAAO,EAAwC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,sCAAsC;AACtC,EAAE,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,CAAC;IACtC,IAAI,EAAE,IAAI,KAAK,CAAC,QAAQ,EAAE;QACxB,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAc,CAAC;KACjD,CAAC;CACH,CAAC,CAAC,CAAC;AAEJ,kDAAkD;AAClD,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC1C,MAAM,MAAM,GAAG,CAAC,MAAM,cAAc,EAAE,CAAQ,CAAC;IAC/C,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAChD,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC;KAC9C,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,UAAU,CAAC,GAAG,EAAE;IACd,EAAE,CAAC,aAAa,EAAE,CAAC;IACnB,+BAA+B;IAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,IAAI,CAAC,iCAAiC,EAAE,GAAG,EAAE;QAC3C,QAAQ,CAAC,QAAQ,GAAG,kBAAkB,CAAC;QACvC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC5D,QAAQ,CAAC,QAAQ,GAAG,qBAAqB,CAAC;QAC1C,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAChD,QAAQ,CAAC,QAAQ,GAAG,4BAA4B,CAAC;QACjD,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC9C,QAAQ,CAAC,QAAQ,GAAG,sBAAsB,CAAC;QAC3C,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iCAAiC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,CACtC,oCAAoC,CACrC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
@@ -0,0 +1 @@
1
+ export {};
@@ -0,0 +1,40 @@
1
+ import { describe, test, expect, beforeEach, afterEach } from 'vitest';
2
+ import { getConfirmations } from '../../utils/transactions/utils.js';
3
+ describe('getConfirmations (H5)', () => {
4
+ const originalEnv = process.env;
5
+ beforeEach(() => {
6
+ process.env = { ...originalEnv };
7
+ delete process.env.CONFIRMATIONS;
8
+ });
9
+ afterEach(() => {
10
+ process.env = originalEnv;
11
+ });
12
+ test('returns default (3) when CONFIRMATIONS not set', () => {
13
+ expect(getConfirmations()).toBe(3);
14
+ });
15
+ test('returns parsed integer when valid', () => {
16
+ process.env.CONFIRMATIONS = '5';
17
+ expect(getConfirmations()).toBe(5);
18
+ });
19
+ test('returns 1 when set to minimum', () => {
20
+ process.env.CONFIRMATIONS = '1';
21
+ expect(getConfirmations()).toBe(1);
22
+ });
23
+ test('rejects 0 confirmations (reorg attack vector)', () => {
24
+ process.env.CONFIRMATIONS = '0';
25
+ expect(() => getConfirmations()).toThrow('must be an integer >= 1');
26
+ });
27
+ test('rejects negative confirmations', () => {
28
+ process.env.CONFIRMATIONS = '-1';
29
+ expect(() => getConfirmations()).toThrow('must be an integer >= 1');
30
+ });
31
+ test('rejects non-integer confirmations', () => {
32
+ process.env.CONFIRMATIONS = '2.5';
33
+ expect(() => getConfirmations()).toThrow('must be an integer >= 1');
34
+ });
35
+ test('rejects non-numeric confirmations', () => {
36
+ process.env.CONFIRMATIONS = 'abc';
37
+ expect(() => getConfirmations()).toThrow('must be an integer >= 1');
38
+ });
39
+ });
40
+ //# sourceMappingURL=get-confirmations.test.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"get-confirmations.test.js","sourceRoot":"","sources":["../../../tests/utils/get-confirmations.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAErE,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC;IAEhC,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,CAAC,GAAG,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,CAAC,GAAG,GAAG,WAAW,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gDAAgD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC7C,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,GAAG,CAAC;QAChC,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACzC,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,GAAG,CAAC;QAChC,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACzD,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,GAAG,CAAC;QAChC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gCAAgC,EAAE,GAAG,EAAE;QAC1C,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC;QACjC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC7C,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,KAAK,CAAC;QAClC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC7C,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,KAAK,CAAC;QAClC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
@@ -0,0 +1 @@
1
+ export {};
@@ -0,0 +1,105 @@
1
+ import { describe, test, expect, vi, beforeEach } from 'vitest';
2
+ vi.mock('multiformats/cid', () => {
3
+ class MockCID {
4
+ str;
5
+ constructor(str) {
6
+ this.str = str;
7
+ }
8
+ toString() {
9
+ return this.str;
10
+ }
11
+ equals(other) {
12
+ return other && other.str === this.str;
13
+ }
14
+ static parse(str) {
15
+ if (str === 'INVALID_CID' || str.includes('..'))
16
+ throw new Error('Invalid CID');
17
+ return new MockCID(str);
18
+ }
19
+ }
20
+ return { CID: MockCID };
21
+ });
22
+ vi.mock('blockstore-core', () => ({ MemoryBlockstore: vi.fn() }));
23
+ vi.mock('ipfs-unixfs-importer', () => ({ importer: vi.fn() }));
24
+ vi.mock('../../utils/logging/console.js', () => ({
25
+ logInfo: vi.fn(),
26
+ logTable: vi.fn(),
27
+ }));
28
+ import * as ipfs from '../../utils/ipfs.js';
29
+ beforeEach(() => {
30
+ vi.clearAllMocks();
31
+ globalThis.fetch = vi.fn();
32
+ });
33
+ describe('IPFS SSRF guards (H2/H3)', () => {
34
+ test('fetchIPFSDirect rejects non-http/https gateway', async () => {
35
+ await expect(ipfs.fetchIPFSDirect({ cid: 'abc', gateway: 'file:///etc/passwd' })).rejects.toThrow('unsupported URL scheme "file:"');
36
+ });
37
+ test('fetchIPFSDirect rejects ftp gateway', async () => {
38
+ await expect(
39
+ // eslint-disable-next-line sonarjs/no-clear-text-protocols
40
+ ipfs.fetchIPFSDirect({ cid: 'abc', gateway: 'ftp://evil.com' })).rejects.toThrow('unsupported URL scheme "ftp:"');
41
+ });
42
+ test('fetchIPFSDirect rejects invalid gateway URL', async () => {
43
+ await expect(ipfs.fetchIPFSDirect({ cid: 'abc', gateway: 'not-a-url' })).rejects.toThrow('invalid URL');
44
+ });
45
+ test('fetchIPFSBuffer rejects non-http/https gateway', async () => {
46
+ await expect(ipfs.fetchIPFSBuffer({ cid: 'abc', gateway: 'file:///etc/passwd' })).rejects.toThrow('unsupported URL scheme "file:"');
47
+ });
48
+ test('fetchIPFSDirect allows https gateway', async () => {
49
+ globalThis.fetch.mockResolvedValueOnce({
50
+ ok: true,
51
+ text: async () => '{"x":1}',
52
+ });
53
+ const result = await ipfs.fetchIPFSDirect({
54
+ cid: 'abc',
55
+ gateway: 'https://ipfs.io/ipfs',
56
+ });
57
+ expect(result).toEqual({ x: 1 });
58
+ });
59
+ test('fetchIPFSDirect allows http gateway', async () => {
60
+ globalThis.fetch.mockResolvedValueOnce({
61
+ ok: true,
62
+ text: async () => '{"y":2}',
63
+ });
64
+ const result = await ipfs.fetchIPFSDirect({
65
+ cid: 'abc',
66
+ gateway: 'http://localhost:5001/ipfs',
67
+ });
68
+ expect(result).toEqual({ y: 2 });
69
+ });
70
+ test('pinToIPFS rejects non-http/https upload URL', async () => {
71
+ await expect(ipfs.pinToIPFS({
72
+ uploadUrl: 'file:///tmp/upload',
73
+ fileContent: '{}',
74
+ })).rejects.toThrow('unsupported URL scheme "file:"');
75
+ });
76
+ test('pinToIPFS rejects invalid upload URL', async () => {
77
+ await expect(ipfs.pinToIPFS({
78
+ uploadUrl: 'not-a-url',
79
+ fileContent: '{}',
80
+ })).rejects.toThrow('invalid URL');
81
+ });
82
+ test('pinToIPFS allows https upload URL', async () => {
83
+ globalThis.fetch.mockResolvedValueOnce({
84
+ ok: true,
85
+ json: async () => ({ IpfsHash: 'Qm123' }),
86
+ });
87
+ const result = await ipfs.pinToIPFS({
88
+ uploadUrl: 'https://api.pinata.cloud/pinning/pinFileToIPFS',
89
+ fileContent: '{}',
90
+ });
91
+ expect(result).toEqual({ IpfsHash: 'Qm123' });
92
+ });
93
+ });
94
+ describe('IPFS CID validation (M6)', () => {
95
+ test('fetchIPFSDirectAndVerify rejects invalid CID', async () => {
96
+ await expect(ipfs.fetchIPFSDirectAndVerify('INVALID_CID')).rejects.toThrow('Invalid IPFS CID: INVALID_CID');
97
+ });
98
+ test('fetchIPFSWithCacheAndVerify rejects path-traversal CID before fs access', async () => {
99
+ await expect(ipfs.fetchIPFSWithCacheAndVerify('../../../etc/passwd')).rejects.toThrow('Invalid IPFS CID');
100
+ });
101
+ test('fetchIPFSWithCacheAndVerify validates gateway URL', async () => {
102
+ await expect(ipfs.fetchIPFSWithCacheAndVerify('validcid', 'file:///etc/passwd')).rejects.toThrow('unsupported URL scheme "file:"');
103
+ });
104
+ });
105
+ //# sourceMappingURL=ipfs-security.test.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"ipfs-security.test.js","sourceRoot":"","sources":["../../../tests/utils/ipfs-security.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEhE,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAC/B,MAAM,OAAO;QACX,GAAG,CAAS;QACZ,YAAY,GAAW;YACrB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACjB,CAAC;QACD,QAAQ;YACN,OAAO,IAAI,CAAC,GAAG,CAAC;QAClB,CAAC;QACD,MAAM,CAAC,KAAU;YACf,OAAO,KAAK,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC;QACzC,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,GAAW;YACtB,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;YACjC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;KACF;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAClE,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/D,EAAE,CAAC,IAAI,CAAC,gCAAgC,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE;IAChB,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE;CAClB,CAAC,CAAC,CAAC;AAEJ,OAAO,KAAK,IAAI,MAAM,qBAAqB,CAAC;AAG5C,UAAU,CAAC,GAAG,EAAE;IACd,EAAE,CAAC,aAAa,EAAE,CAAC;IACnB,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,EAAS,CAAC;AACpC,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,IAAI,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,MAAM,CACV,IAAI,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CACpE,CAAC,OAAO,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,MAAM;QACV,2DAA2D;QAC3D,IAAI,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAChE,CAAC,OAAO,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,MAAM,CACV,IAAI,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAC3D,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,MAAM,CACV,IAAI,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CACpE,CAAC,OAAO,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACrD,UAAU,CAAC,KAAc,CAAC,qBAAqB,CAAC;YAC/C,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC;YACxC,GAAG,EAAE,KAAK;YACV,OAAO,EAAE,sBAAsB;SAChC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACpD,UAAU,CAAC,KAAc,CAAC,qBAAqB,CAAC;YAC/C,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC;YACxC,GAAG,EAAE,KAAK;YACV,OAAO,EAAE,4BAA4B;SACtC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,MAAM,CACV,IAAI,CAAC,SAAS,CAAC;YACb,SAAS,EAAE,oBAAoB;YAC/B,WAAW,EAAE,IAAI;SAClB,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,MAAM,CACV,IAAI,CAAC,SAAS,CAAC;YACb,SAAS,EAAE,WAAW;YACtB,WAAW,EAAE,IAAI;SAClB,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QAClD,UAAU,CAAC,KAAc,CAAC,qBAAqB,CAAC;YAC/C,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC;YAClC,SAAS,EAAE,gDAAgD;YAC3D,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,IAAI,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACxE,+BAA+B,CAChC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,MAAM,CACV,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC,CACxD,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,MAAM,CACV,IAAI,CAAC,2BAA2B,CAAC,UAAU,EAAE,oBAAoB,CAAC,CACnE,CAAC,OAAO,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}