badmfck-api-server 4.0.74 → 4.0.75

package/dist/apiServer/APIService.js

@@ -95,7 +95,7 @@ async function Initializer(services) {
 }
 exports.Initializer = Initializer;
 class APIService extends BaseService_1.BaseService {
-    version = "4.0.72";
+    version = "4.0.75";
     options;
     monitor = null;
     started = new Date();

package/dist/apiServer/external/MicroserviceClient.js

@@ -35,7 +35,7 @@ class MicroserviceClient extends BaseService_1.BaseService {
     }
     async requestMicroserviceCall(req) {
         const url = this.options.host + "/__ms_host_control/receiver";
-        const ts = process.hrtime.bigint().toString();
+        const ts = Date.now().toString();
         const nonce = crypto_1.default.randomBytes(12).toString("hex");
         const headers = {
             "Content-Type": "application/json",
@@ -58,11 +58,9 @@ class MicroserviceClient extends BaseService_1.BaseService {
             enc: encrypted.toString("base64")
         }, { headers });
         if (!resp.ok)
-            return { ...DefaultErrors_1.default.BAD_REQUEST, details: resp.details, stack: [resp.error] };
+            return { ...DefaultErrors_1.default.BAD_REQUEST, details: resp.details };
         const body = resp.data;
-        if (body && typeof body === "object" && "error" in body)
-            return body.error;
-        return body.data ?? null;
+        return (body && typeof body === "object" && "error" in body) ? body.error : (body.data ?? null);
     }
 }
 exports.MicroserviceClient = MicroserviceClient;

package/dist/apiServer/external/MicroserviceHost.js

@@ -27,11 +27,17 @@ class MicroserviceHost extends BaseService_1.BaseService {
         const ts = req.headers["x-microservice-ts"];
         if (!nonce || !ts)
             return { ...DefaultErrors_1.default.BAD_REQUEST, details: "missing headers" };
-        const checkCall = MicroserviceHost.#calls.has(nonce + "|" + ts);
-        if (checkCall)
+        const requestTime = parseInt(ts);
+        const now = Date.now();
+        if (isNaN(requestTime) || Math.abs(now - requestTime) > 1000 * 60 * 2) {
+            return { ...DefaultErrors_1.default.BAD_REQUEST, details: "timestamp out of range" };
+        }
+        const callKey = `${nonce}|${ts}`;
+        if (MicroserviceHost.#calls.has(callKey)) {
             return { ...DefaultErrors_1.default.BAD_REQUEST, details: "replay attack detected" };
-        MicroserviceHost.#calls.add(nonce + "|" + ts);
-        if (MicroserviceHost.#calls.size > 10000) {
+        }
+        MicroserviceHost.#calls.add(callKey);
+        if (MicroserviceHost.#calls.size > 5000) {
             const iterator = MicroserviceHost.#calls.values();
             for (let i = 0; i < 100; i++) {
                 const val = iterator.next().value;
@@ -52,17 +58,13 @@ class MicroserviceHost extends BaseService_1.BaseService {
             decipher.setAuthTag(tag);
             const decrypted = Buffer.concat([decipher.update(enc), decipher.final()]);
             const request = JSON.parse(decrypted.toString("utf8"));
-            if (!request || !request.requestName) {
-                return { ...DefaultErrors_1.default.BAD_REQUEST, details: "invalid request object" };
-            }
-            const reqCall = this.options.requests.find(r => r.name === request.requestName);
-            if (!reqCall) {
-                return { ...DefaultErrors_1.default.BAD_REQUEST, details: "request not found: " + request.requestName };
-            }
+            const reqCall = this.options.requests.find(r => r.name === request?.requestName);
+            if (!reqCall)
+                return { ...DefaultErrors_1.default.BAD_REQUEST, details: "method not found" };
             return await reqCall.request(request.requestData);
         }
         catch (e) {
-            return { ...DefaultErrors_1.default.BAD_REQUEST, details: "decryption failed or invalid json" };
+            return { ...DefaultErrors_1.default.BAD_REQUEST, details: "decryption error" };
         }
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "badmfck-api-server",
-  "version": "4.0.74",
+  "version": "4.0.75",
   "description": "Simple API http server based on express",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",