@tanakayuto/intmax402-express 0.2.0 → 0.2.2

package/dist/verify-payment.js

@@ -9,16 +9,24 @@ const intmax2_server_sdk_1 = require("intmax2-server-sdk");
 let client = null;
 let loginPromise = null;
 // Used txHash tracking with TTL for replay prevention
+// Value is expiry timestamp (ms), or PENDING (-1) while verification is in progress
+const PENDING = -1;
 const usedTxHashes = new Map();
 const TX_HASH_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
 function cleanupExpiredHashes() {
     const now = Date.now();
     for (const [hash, expiry] of usedTxHashes) {
+        // Skip PENDING entries (active verifications)
+        if (expiry === PENDING)
+            continue;
         if (now > expiry) {
             usedTxHashes.delete(hash);
         }
     }
 }
+// Start periodic cleanup (Fix 5: Map periodic cleanup)
+const cleanupInterval = setInterval(cleanupExpiredHashes, 60 * 60 * 1000); // 1 hour
+cleanupInterval.unref(); // Don't prevent process exit
 async function initPaymentVerifier(config) {
     if (client && client.isLoggedIn)
         return;
@@ -46,37 +54,54 @@ async function verifyPayment(txHash, expectedAmount, serverAddress, tokenIndex)
     if (!client || !client.isLoggedIn) {
         return { valid: false, error: "Payment verifier not initialized" };
     }
-    // Replay prevention: check if txHash was already used
+    // Replay prevention: check if txHash was already used (or pending)
     cleanupExpiredHashes();
     if (usedTxHashes.has(txHash)) {
         return { valid: false, error: "Transaction already used" };
     }
+    // Fix 1: Mark as PENDING immediately to prevent race conditions
+    usedTxHashes.set(txHash, PENDING);
     try {
-        // Fetch recent transfers (incoming)
-        const response = await client.fetchTransfers({ cursor: null, limit: 50 });
-        const transfers = response.items;
+        // Fix 3: Fetch up to 200 transfers using pagination
+        let response = await client.fetchTransfers({ cursor: null, limit: 100 });
+        let transfers = [...response.items];
+        // Check next page if not found yet and more items exist
+        if (!transfers.find((tx) => tx.digest === txHash) && response.pagination?.has_more && response.pagination?.next_cursor != null) {
+            const response2 = await client.fetchTransfers({ cursor: response.pagination.next_cursor, limit: 100 });
+            transfers = transfers.concat(response2.items);
+        }
         // Find matching transaction by digest
         const match = transfers.find((tx) => tx.digest === txHash);
         if (!match) {
+            // Fix 1: Rollback on validation failure
+            usedTxHashes.delete(txHash);
             return { valid: false, error: "Transaction not found in recent transfers" };
         }
         // Verify recipient matches server address
         if (match.to?.toLowerCase() !== serverAddress.toLowerCase()) {
+            // Fix 1: Rollback on validation failure
+            usedTxHashes.delete(txHash);
             return { valid: false, error: "Recipient does not match server address" };
         }
-        // Verify amount (compare as BigInt-safe string)
-        if (match.amount !== expectedAmount) {
+        // Fix 2: Verify amount using BigInt comparison (allows >= expectedAmount)
+        if (BigInt(match.amount) < BigInt(expectedAmount)) {
+            // Fix 1: Rollback on validation failure
+            usedTxHashes.delete(txHash);
             return { valid: false, error: `Amount mismatch: expected ${expectedAmount}, got ${match.amount}` };
         }
         // Verify token if specified
         if (tokenIndex !== undefined && match.tokenIndex !== tokenIndex) {
+            // Fix 1: Rollback on validation failure
+            usedTxHashes.delete(txHash);
             return { valid: false, error: `Token mismatch: expected index ${tokenIndex}, got ${match.tokenIndex}` };
         }
-        // Mark as used (replay prevention)
+        // Fix 1: Mark as used with proper expiry (replace PENDING)
         usedTxHashes.set(txHash, Date.now() + TX_HASH_TTL_MS);
         return { valid: true };
     }
     catch (err) {
+        // Fix 1: Rollback on error so the tx can be retried
+        usedTxHashes.delete(txHash);
         const message = err instanceof Error ? err.message : String(err);
         return { valid: false, error: `Payment verification failed: ${message}` };
     }

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@tanakayuto/intmax402-express",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "dependencies": {
-    "@tanakayuto/intmax402-core": "0.2.0",
+    "@tanakayuto/intmax402-core": "0.2.2",
     "ethers": "^6.16.0",
     "intmax2-server-sdk": "^1.5.2"
   },