@mojaloop/sdk-scheme-adapter 24.15.1 → 24.15.3

package/.grype.yaml

@@ -5,6 +5,7 @@ ignore:
   - vulnerability: CVE-2025-9230
   - vulnerability: CVE-2025-9231
   - vulnerability: CVE-2025-9232
+  - vulnerability: GHSA-9965-vmph-33xx # validator 13.15.15
 
 
 # Set output format defaults

package/CHANGELOG.md

@@ -1,4 +1,24 @@
 # Changelog: [mojaloop/sdk-scheme-adapter](https://github.com/mojaloop/sdk-scheme-adapter)
+### [24.15.3](https://github.com/mojaloop/sdk-scheme-adapter/compare/v24.15.2...v24.15.3) (2025-11-11)
+
+
+### Chore
+
+* **sbom:** update sbom [skip ci] ([b87dfbd](https://github.com/mojaloop/sdk-scheme-adapter/commit/b87dfbd1098208de521e4dc522bb5105387b2a88))
+
+
+### Tests
+
+* re-enable code coverage pi29 ([#627](https://github.com/mojaloop/sdk-scheme-adapter/issues/627)) ([5c69d9a](https://github.com/mojaloop/sdk-scheme-adapter/commit/5c69d9a08dc5d2e2bd30a458de4a98dbcef8886f))
+
+### [24.15.2](https://github.com/mojaloop/sdk-scheme-adapter/compare/v24.15.1...v24.15.2) (2025-10-17)
+
+
+### Chore
+
+* adjust retry logic ([#621](https://github.com/mojaloop/sdk-scheme-adapter/issues/621)) ([ce2b72d](https://github.com/mojaloop/sdk-scheme-adapter/commit/ce2b72d33fff72e3b3566390c150fdfbe3b8d24b))
+* **sbom:** update sbom [skip ci] ([e50b0d1](https://github.com/mojaloop/sdk-scheme-adapter/commit/e50b0d1c16a7e84e36691ad2fe3949e555fb2f14))
+
 ### [24.15.1](https://github.com/mojaloop/sdk-scheme-adapter/compare/v24.15.0...v24.15.1) (2025-10-08)
 
 

package/modules/api-svc/jest.config.js

@@ -5,10 +5,10 @@ module.exports = {
     ],
     coverageThreshold: {
         global: {
-            statements: 90,
-            functions: 90,
-            branches: 90,
-            lines: 90
+            statements: 74,
+            functions: 71,
+            branches: 57,
+            lines: 74
         }
     },
     clearMocks: true,

package/modules/api-svc/package.json

@@ -28,6 +28,8 @@
     "test": "yarn run test:unit",
     "test:unit": "jest --runInBand --ci --reporters=default --reporters=jest-junit --env=node test/unit/ --setupFilesAfterEnv=./test/unit/setup.js",
     "test:xunit": "JEST_JUNIT_OUTPUT_DIR=../test/reports/ JEST_JUNIT_OUTPUT_NAME=xunit-api-svc.xml yarn run test:unit -- --reporters=jest-junit",
+    "test:coverage": "jest --runInBand --ci --coverage --env=node test/unit/ --setupFilesAfterEnv=./test/unit/setup.js",
+    "test:coverage-check": "jest --runInBand --ci --coverage --env=node test/unit/ --setupFilesAfterEnv=./test/unit/setup.js",
     "test:integration": "jest --ci --reporters=default --reporters=jest-junit --env=node test/integration/",
     "test:integration-pm4ml": "jest --ci --reporters=default --reporters=jest-junit --env=node test/integration-pm4ml/",
     "test:pm4ml-run-mock-servers": "node test/integration-pm4ml/mockServers/index.js",
@@ -64,18 +66,18 @@
   },
   "dependencies": {
     "@koa/cors": "5.0.0",
-    "@mojaloop/api-snippets": "18.2.0",
-    "@mojaloop/central-services-error-handling": "13.1.3",
+    "@mojaloop/api-snippets": "18.2.1",
+    "@mojaloop/central-services-error-handling": "13.1.4",
     "@mojaloop/central-services-logger": "11.10.1",
-    "@mojaloop/central-services-metrics": "12.8.0",
-    "@mojaloop/central-services-shared": "18.34.1",
-    "@mojaloop/event-sdk": "14.8.0",
+    "@mojaloop/central-services-metrics": "12.8.1",
+    "@mojaloop/central-services-shared": "18.34.3",
+    "@mojaloop/event-sdk": "14.8.1",
     "@mojaloop/logging-bc-client-lib": "0.5.8",
     "@mojaloop/ml-schema-transformer-lib": "2.7.8",
     "@mojaloop/sdk-scheme-adapter-private-shared-lib": "workspace:^",
     "@mojaloop/sdk-standard-components": "19.18.0",
     "ajv": "8.17.1",
-    "axios": "1.12.2",
+    "axios": "1.13.2",
     "body-parser": "2.2.0",
     "co-body": "6.2.0",
     "dotenv": "17.2.3",
@@ -87,8 +89,8 @@
     "js-yaml": "4.1.0",
     "json-schema-ref-parser": "9.0.9",
     "knex": "3.1.0",
-    "koa": "3.0.1",
-    "koa-body": "6.0.1",
+    "koa": "3.1.1",
+    "koa-body": "7.0.0",
     "lodash": "4.17.21",
     "module-alias": "2.2.3",
     "oauth2-server": "4.0.0-dev.2",
@@ -96,14 +98,14 @@
     "prom-client": "15.1.3",
     "promise-timeout": "1.3.0",
     "random-word-slugs": "0.1.7",
-    "redis": "5.8.3",
+    "redis": "5.9.0",
     "retry": "^0.13.1",
     "uuidv4": "6.2.13",
     "ws": "8.18.3"
   },
   "devDependencies": {
-    "@babel/core": "7.28.4",
-    "@babel/preset-env": "7.28.3",
+    "@babel/core": "7.28.5",
+    "@babel/preset-env": "7.28.5",
     "@redocly/openapi-cli": "1.0.0-beta.95",
     "@types/jest": "30.0.0",
     "@types/retry": "^0",
@@ -117,7 +119,7 @@
     "jest-junit": "16.0.0",
     "npm-check-updates": "16.7.10",
     "openapi-response-validator": "12.1.3",
-    "openapi-typescript": "7.9.1",
+    "openapi-typescript": "7.10.1",
     "redis-mock": "0.56.3",
     "replace": "1.2.2",
     "standard-version": "9.5.0",

package/modules/api-svc/src/lib/model/InboundTransfersModel.js

@@ -36,6 +36,7 @@ const dto = require('../dto');
 const shared = require('./lib/shared');
 const { BackendRequests, HTTPResponseError } = require('./lib/requests');
 const { SDKStateEnum, CacheKeyPrefixes } = require('./common');
+const { extractStatusCodeFromError } = require('../utils');
 
 const TRACESTATE_KEY_CALLBACK_START_TS = 'tx_callback_start_ts';
 
@@ -1075,6 +1076,13 @@ class InboundTransfersModel {
                             log.verbose(`putFxTransfersNotification attempt ${currentAttempt} succeeded for conversionId ${conversionId}`);
                             resolve();
                         } catch (err) {
+                            // Don't retry on 4xx errors
+                            let status = extractStatusCodeFromError(err);
+                            if (status && Number(status) >= 400 && Number(status) < 500) {
+                                log.warn(`putFxTransfersNotification attempt ${currentAttempt} got 4xx error (${status}), not retrying`, err);
+                                resolve();
+                                return;
+                            }
                             log.warn(`putFxTransfersNotification attempt ${currentAttempt} threw error, retrying...`, err);
                             if (!operation.retry(err)) {
                                 log.verbose(`putFxTransfersNotification giving up after ${currentAttempt} attempts`);
@@ -1159,6 +1167,13 @@ class InboundTransfersModel {
                             log.verbose(`putTransfersNotification attempt ${currentAttempt} succeeded for transferId ${transferId}`);
                             resolve();
                         } catch (err) {
+                            // Don't retry on 4xx errors
+                            let status = extractStatusCodeFromError(err);
+                            if (status && Number(status) >= 400 && Number(status) < 500) {
+                                log.warn(`putTransfersNotification attempt ${currentAttempt} got 4xx error (${status}), not retrying`, err);
+                                resolve();
+                                return;
+                            }
                             this._logger.warn(`putTransfersNotification attempt ${currentAttempt} threw error, retrying...`, err);
                             if (!operation.retry(err)) {
                                 log.verbose(`putTransfersNotification giving up after ${currentAttempt} attempts`);

package/modules/api-svc/src/lib/utils.js

@@ -92,9 +92,28 @@ const generateTraceparent = (traceId = randomBytes(16).toString('hex'), traceFla
     return `00-${traceId}-${spanId}-${traceFlags.toLowerCase()}`;
 };
 
+/** Extracts the HTTP status code from various error object structures
+ * @param {object} err - The error object to extract the status code from
+ * @returns {number|undefined} - The extracted status code, or undefined if not found
+ */
+const extractStatusCodeFromError = (err) => {
+    let status = err?.response?.status || err?.statusCode;
+    if (!status && err?.response?.statusCode) {
+        status = err.response.statusCode;
+    }
+    if (!status && err?.status) {
+        status = err.status;
+    }
+    if (!status && err?.output?.statusCode) {
+        status = err.output.statusCode;
+    }
+    return status;
+};
+
 module.exports = {
     createAuthClient,
     generateTraceparent,
     isValidTraceFlags,
-    transformHeadersIsoToFspiop
+    transformHeadersIsoToFspiop,
+    extractStatusCodeFromError
 };

package/modules/api-svc/test/unit/lib/model/InboundTransfersModel.test.js

@@ -41,6 +41,7 @@ jest.mock('~/lib/model/lib/requests',() => require('./mockedLibRequests'));
 
 const randomUUID = require('@mojaloop/central-services-shared').Util.id({type: 'ulid'});
 const { MojaloopRequests, Ilp } = require('@mojaloop/sdk-standard-components');
+const axios = require('axios');
 const { logger } = require('~/lib/logger');
 const { BackendRequests, HTTPResponseError } = require('~/lib/model/lib/requests');
 const Cache = require('~/lib/cache');
@@ -1426,4 +1427,218 @@ describe('inboundModel', () => {
         });
         // todo: add error case tests
     });
+    describe('sendNotificationToPayee: retry logic for 4xx errors', () => {
+        const transferId = '1234';
+        let cache;
+
+        beforeEach(async () => {
+            cache = new Cache({
+                cacheUrl: 'redis://dummy:1234',
+                logger,
+                unsubscribeTimeoutMs: 5000
+            });
+            await cache.connect();
+        });
+
+        afterEach(async () => {
+            await cache.disconnect();
+        });
+
+        test('does not retry notification to fsp backend on 4xx error', async () => {
+            const error = new axios.AxiosError(
+                'Bad Request',
+                'ERR_BAD_REQUEST',
+                {
+                    method: 'put',
+                    url: '/transfersNotification',
+                    headers: {},
+                    data: {},
+                },
+                {},
+                {
+                    status: 400,
+                    statusText: 'Bad Request',
+                    headers: {},
+                    config: {},
+                    data: {
+                        statusCode: '400',
+                        message: 'Bad Request'
+                    }
+                }
+            );
+            const mockFn = jest.fn().mockRejectedValue(error);
+            BackendRequests.__putTransfersNotification = mockFn;
+
+            const notif = JSON.parse(JSON.stringify(notificationToPayee));
+            const model = new Model({
+                ...config,
+                cache,
+                logger,
+                backendRequestRetry: {
+                    enabled: true,
+                    maxRetries: 3,
+                    retryDelayMs: 10,
+                    maxRetryDelayMs: 20,
+                    backoffFactor: 1
+                }
+            });
+
+            await model.sendNotificationToPayee(notif.data, transferId);
+            // Should only be called once, no retry
+            expect(BackendRequests.__putTransfersNotification).toHaveBeenCalledTimes(1);
+        });
+
+        test('does not retry notification to fsp backend on 404 error', async () => {
+
+            const error = new axios.AxiosError(
+                'Not Found',
+                'ERR_BAD_REQUEST',
+                {
+                    method: 'put',
+                    url: '/transfersNotification',
+                    headers: {},
+                    data: {},
+                },
+                {},
+                {
+                    status: 404,
+                    statusText: 'Not Found',
+                    headers: {},
+                    config: {},
+                    data: {
+                        statusCode: '404',
+                        message: 'Not Found'
+                    }
+                }
+            );
+            const mockFn = jest.fn().mockRejectedValue(error);
+            BackendRequests.__putTransfersNotification = mockFn;
+
+            const notif = JSON.parse(JSON.stringify(notificationToPayee));
+            const model = new Model({
+                ...config,
+                cache,
+                logger,
+                backendRequestRetry: {
+                    enabled: true,
+                    maxRetries: 3,
+                    retryDelayMs: 10,
+                    maxRetryDelayMs: 20,
+                    backoffFactor: 1
+                }
+            });
+
+            await model.sendNotificationToPayee(notif.data, transferId);
+            // Should only be called once, no retry
+            expect(BackendRequests.__putTransfersNotification).toHaveBeenCalledTimes(1);
+        });
+    });
+
+    describe('sendFxPutNotificationToBackend: retry logic for 4xx errors', () => {
+        const conversionId = '1234';
+        let cache;
+
+        beforeEach(async () => {
+            cache = new Cache({
+                cacheUrl: 'redis://dummy:1234',
+                logger,
+                unsubscribeTimeoutMs: 5000
+            });
+            await cache.connect();
+        });
+
+        afterEach(async () => {
+            await cache.disconnect();
+        });
+
+        test('does not retry notification to backend on 4xx error', async () => {
+            const error = new axios.AxiosError(
+                'Bad Request',
+                'ERR_BAD_REQUEST',
+                {
+                    method: 'put',
+                    url: '/fxTransfersNotification',
+                    headers: {},
+                    data: {},
+                },
+                {},
+                {
+                    status: 400,
+                    statusText: 'Bad Request',
+                    headers: {},
+                    config: {},
+                    data: {
+                        statusCode: '400',
+                        message: 'Bad Request'
+                    }
+                }
+            );
+            const mockFn = jest.fn().mockRejectedValue(error);
+            BackendRequests.__putFxTransfersNotification = mockFn;
+
+            const notif = JSON.parse(JSON.stringify(fxNotificationToBackend));
+            const model = new Model({
+                ...config,
+                cache,
+                logger,
+                backendRequestRetry: {
+                    enabled: true,
+                    maxRetries: 3,
+                    retryDelayMs: 10,
+                    maxRetryDelayMs: 20,
+                    backoffFactor: 1
+                }
+            });
+            model.saveFxState = jest.fn().mockReturnValue(Promise.resolve({}));
+
+            await model.sendFxPutNotificationToBackend(notif.data, conversionId);
+            // Should only be called once, no retry
+            expect(BackendRequests.__putFxTransfersNotification).toHaveBeenCalledTimes(1);
+        });
+
+        test('does not retry notification to backend on 404 error', async () => {
+            const error = new axios.AxiosError(
+                'Not Found',
+                'ERR_BAD_REQUEST',
+                {
+                    method: 'put',
+                    url: '/fxTransfersNotification',
+                    headers: {},
+                    data: {},
+                },
+                {},
+                {
+                    status: 404,
+                    statusText: 'Not Found',
+                    headers: {},
+                    config: {},
+                    data: {
+                        statusCode: '404',
+                        message: 'Not Found'
+                    }
+                }
+            );
+            const mockFn = jest.fn().mockRejectedValue(error);
+            BackendRequests.__putFxTransfersNotification = mockFn;
+
+            const notif = JSON.parse(JSON.stringify(fxNotificationToBackend));
+            const model = new Model({
+                ...config,
+                cache,
+                logger,
+                backendRequestRetry: {
+                    enabled: true,
+                    maxRetries: 3,
+                    retryDelayMs: 10,
+                    maxRetryDelayMs: 20,
+                    backoffFactor: 1
+                }
+            });
+            model.saveFxState = jest.fn().mockReturnValue(Promise.resolve({}));
+
+            await model.sendFxPutNotificationToBackend(notif.data, conversionId);
+            // Should only be called once, no retry
+            expect(BackendRequests.__putFxTransfersNotification).toHaveBeenCalledTimes(1);
+        });
+    });
 });

package/modules/outbound-command-event-handler/jest.config.js

@@ -20,10 +20,10 @@ module.exports = {
   clearMocks: true,
   coverageThreshold: {
     "global": {
-      "branches": 75,
-      "functions": 80,
-      "lines": 80,
-      "statements": -10
+      "branches": 14,
+      "functions": 44,
+      "lines": 30,
+      "statements": -525
     }
   },
   moduleNameMapper: pathsToModuleNameMapper(compilerOptions.paths, { prefix: '<rootDir>/' })

package/modules/outbound-command-event-handler/package.json

@@ -34,15 +34,15 @@
     "test:xunit": "JEST_JUNIT_OUTPUT_DIR=../test/reports/ JEST_JUNIT_OUTPUT_NAME=xunit-command.xml yarn run test:unit -- --reporters=jest-junit",
     "test:integration": "jest --runInBand --passWithNoTests --testMatch '**/test/integration/**/*.test.ts' ",
     "test:coverage": "jest --passWithNoTests --coverage --testMatch '**/test/unit/**/*.test.ts'",
-    "test:coverage-check:skip": "jest --coverage --testMatch '**/test/unit/**/*.test.ts'",
+    "test:coverage-check": "jest --runInBand --coverage --testMatch '**/test/unit/**/*.test.ts'",
     "dep:check": "ncu -e 2",
     "dep:update": "ncu -u",
     "release": "standard-version --skip.changelog --releaseCommitMessageFormat 'chore(release): {{currentTag}} [skip ci]'",
     "snapshot": "standard-version --no-verify --skip.changelog --prerelease snapshot --releaseCommitMessageFormat 'chore(snapshot): {{currentTag}}'"
   },
   "dependencies": {
-    "@mojaloop/api-snippets": "18.2.0",
-    "@mojaloop/central-services-shared": "18.34.1",
+    "@mojaloop/api-snippets": "18.2.1",
+    "@mojaloop/central-services-shared": "18.34.3",
     "@mojaloop/logging-bc-client-lib": "0.5.8",
     "@mojaloop/logging-bc-public-types-lib": "0.5.6",
     "@mojaloop/sdk-scheme-adapter-private-shared-lib": "workspace:^",
@@ -51,22 +51,22 @@
     "convict": "6.2.4",
     "express": "4.21.2",
     "openapi-backend": "5.15.0",
-    "redis": "5.8.3",
+    "redis": "5.9.0",
     "swagger-ui-express": "5.0.1",
     "yamljs": "0.3.0"
   },
   "devDependencies": {
-    "@eslint/compat": "1.4.0",
+    "@eslint/compat": "1.4.1",
     "@types/convict": "6.1.6",
-    "@types/express": "5.0.3",
+    "@types/express": "5.0.5",
     "@types/jest": "30.0.0",
-    "@types/node": "24.7.0",
+    "@types/node": "24.10.0",
     "@types/node-cache": "4.2.5",
     "@types/supertest": "6.0.3",
     "@types/swagger-ui-express": "4.1.8",
     "@types/yamljs": "0.2.34",
-    "@typescript-eslint/eslint-plugin": "8.46.0",
-    "@typescript-eslint/parser": "8.46.0",
+    "@typescript-eslint/eslint-plugin": "8.46.3",
+    "@typescript-eslint/parser": "8.46.3",
     "copyfiles": "2.4.1",
     "eslint": "9.15.0",
     "jest": "29.7.0",
@@ -74,7 +74,7 @@
     "npm-check-updates": "16.7.10",
     "replace": "1.2.2",
     "standard-version": "9.5.0",
-    "ts-jest": "29.4.4",
+    "ts-jest": "29.4.5",
     "ts-node": "10.9.2",
     "typescript": "5.9.3"
   },