ml-testing-toolkit 18.16.6 → 18.17.0-snapshot.11

package/.grype.yaml

@@ -1,13 +1,20 @@
 ignore:
-  # Ignore cross-spawn vulnerabilities by CVE ID due to false positive
-  # as grype looks at package-lock.json where it shows versions with
-  # vulnerabilities, npm ls shows only 7.0.6 verion is used
-  - vulnerability: CVE-2025-9230
-  - vulnerability: CVE-2025-9232
-  - vulnerability: CVE-2025-9231
-  - vulnerability: GHSA-3xgq-45jj-v275
-  - vulnerability: GHSA-5j98-mcp5-4vw2 # false positive report for glob 10.4.5, not found in package-lock.json
-  - vulnerability: CVE-2025-60876 # busybox and ssl_client from node 22.15.1 alpine image
+  # Remove this ignore after verifying CI builds fresh image
+  - vulnerability: GHSA-5j98-mcp5-4vw2
+    include-aliases: true
+  - vulnerability: CVE-2025-60876
+    reason: "No fixes available as of 2026-01-14 on Dockerfile base image 22.21.1-alpine3.23"
+  - vulnerability: CVE-2026-22184
+    reason: "No fixes available as of 2026-01-16 on Dockerfile base image 22.21.1-alpine3.23"
+  - vulnerability: CVE-2026-28309
+  - vulnerability: CVE-2025-59465
+  - vulnerability: CVE-2025-55131
+  - vulnerability: GHSA-r6q2-hw4h-h46w
+  - vulnerability: GHSA-8qq5-rm4j-mr97
+  - vulnerability: CVE-2025-55130
+  - vulnerability: CVE-2026-21637
+  - vulnerability: CVE-2025-59466
+  - vulnerability: GHSA-xxjr-mmjv-4gpg
 
 # Set output format defaults
 output:

package/.nvmrc

@@ -1 +1 @@
-22.15.1
+22.21.1

package/audit-ci.jsonc

@@ -4,6 +4,6 @@
   // Only use one of ["low": true, "moderate": true, "high": true, "critical": true]
   "moderate": true,
   "allowlist": [
-
+    "GHSA-xxjr-mmjv-4gpg"
   ]
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ml-testing-toolkit",
   "description": "Testing Toolkit for Mojaloop implementations",
-  "version": "18.16.6",
+  "version": "18.17.0-snapshot.11",
   "license": "Apache-2.0",
   "author": "Vijaya Kumar Guthi, ModusBox Inc. ",
   "contributors": [
@@ -78,22 +78,22 @@
     "@hapi/hapi": "21.4.4",
     "@hapi/inert": "7.1.0",
     "@hapi/vision": "7.0.3",
-    "@mojaloop/central-services-logger": "11.10.2",
+    "@mojaloop/central-services-logger": "11.10.3",
     "@mojaloop/central-services-metrics": "12.8.3",
     "@mojaloop/ml-schema-transformer-lib": "2.7.13",
-    "@mojaloop/ml-testing-toolkit-shared-lib": "14.3.1",
+    "@mojaloop/ml-testing-toolkit-shared-lib": "14.3.2",
     "@mojaloop/sdk-standard-components": "19.18.4",
     "@now-ims/hapi-now-auth": "2.1.0",
     "@types/socket.io": "3.0.2",
     "adm-zip": "0.5.16",
     "ajv-formats": "3.0.1",
     "atob": "2.1.2",
-    "axios": "1.13.2",
+    "axios": "1.13.3",
     "chai": "4.4.1",
     "connection-string": "^5.0.0",
     "cookie-parser": "1.4.7",
     "cookies": "0.9.1",
-    "cors": "2.8.5",
+    "cors": "2.8.6",
     "dotenv": "17.2.3",
     "express": "5.2.1",
     "express-validator": "7.3.1",
@@ -107,8 +107,8 @@
     "json-refs": "3.0.15",
     "json-rules-engine": "7.3.1",
     "jsonwebtoken": "9.0.3",
-    "lodash": "4.17.21",
-    "mongoose": "9.1.2",
+    "lodash": "4.17.23",
+    "mongoose": "9.1.5",
     "multer": "2.0.2",
     "mustache": "4.2.0",
     "mv": "2.1.1",

package/src/lib/db/adapters/dbAdapter.js

@@ -48,10 +48,7 @@ const getConnection = async () => {
     }
 
     // TLS/SSL support
-    const mongoOptions = {
-      useNewUrlParser: true,
-      useUnifiedTopology: true
-    }
+    const mongoOptions = {}
 
     if (systemConfig.DB.SSL_ENABLED) {
       mongoOptions.tls = true

package/src/lib/mocking/middleware-functions/ilpModel.js

@@ -30,6 +30,7 @@
 const { ilpFactory, ILP_VERSIONS } = require('@mojaloop/sdk-standard-components').Ilp
 const customLogger = require('../../requestLogger')
 const { logger } = require('../../logger')
+const objectStore = require('../../objectStore')
 
 let ilpObj = null
 let ilpV4Obj = null
@@ -140,8 +141,39 @@ const handleTransferIlp = (context, response) => {
       response.body.TxInfAndSts.ExctnConf = generatedFulfilment
     }
   }
+
+  customLogger.logMessage('debug', 'Generated callback body', { additionalData: { context, response } })
   if (context.request.method === 'get' && response.method === 'put' && pathMatch.test(response.path)) {
-    delete response.body.fulfilment
+    customLogger.logMessage('debug', 'Returning stored fulfilment if exists for transfer GET')
+    const transferId = response.path.match(pathMatch)[1]
+    customLogger.logMessage('debug', 'Fetching stored transfer for fulfilment', { additionalData: { transferId } })
+    // Use objectStore to get the stored transfer
+    const storedTransfer = objectStore.get('storedTransfers', transferId)
+    customLogger.logMessage('debug', 'Stored transfer fetched for fulfilment', { additionalData: { storedTransfer, context } })
+    // Check if stored request exists and is within 30 seconds
+    if (storedTransfer) {
+      if (storedTransfer.data?.request?.ilpPacket) {
+        customLogger.logMessage('debug', 'Stored transfer has ilpPacket. Generating fulfilment.', { additionalData: { transferId, ilpPacket: storedTransfer.data.request.ilpPacket } })
+        const generatedFulfilment = ilpObj.calculateFulfil(storedTransfer.data.request.ilpPacket).replace('"', '')
+        response.body.fulfilment = generatedFulfilment
+        customLogger.logMessage('debug', 'Fulfilment set in response body', { additionalData: { transferId, fulfilment: generatedFulfilment } })
+      } else if (storedTransfer.data?.request?.CdtTrfTxInf?.VrfctnOfTerms?.IlpV4PrepPacket) {
+        customLogger.logMessage('debug', 'Stored transfer has IlpV4PrepPacket. Generating fulfilment.', { additionalData: { transferId, IlpV4PrepPacket: storedTransfer.data.request.CdtTrfTxInf.VrfctnOfTerms.IlpV4PrepPacket } })
+        const generatedFulfilment = ilpV4Obj.calculateFulfil(storedTransfer.data.request.CdtTrfTxInf.VrfctnOfTerms.IlpV4PrepPacket).replace('"', '')
+        response.body.TxInfAndSts.ExctnConf = generatedFulfilment
+        customLogger.logMessage('debug', 'ExctnConf set in response body', { additionalData: { transferId, ExctnConf: generatedFulfilment } })
+      } else {
+        customLogger.logMessage('warn', 'No ILP packet or IlpV4PrepPacket found in stored transfer request', { additionalData: { transferId, storedTransfer } })
+      }
+      // Remove the stored transfer from objectStore
+      objectStore.get('storedTransfers', undefined) // Ensure init
+      objectStore.set('storedTransfers', {
+        ...objectStore.get('storedTransfers', undefined),
+        [transferId]: undefined
+      })
+    } else {
+      delete response.body.fulfilment
+    }
   }
 }
 

package/src/lib/mocking/openApiMockHandler.js

@@ -318,6 +318,25 @@ const generateAsyncCallback = async (item, context, req) => {
       return
     }
   } else {
+    // Store transfers early - right after validation
+    const transferPathMatch = /\/transfers(?:\/([^/]+))?$/
+    const fxTransferPathMatch = /\/fxTransfers(?:\/([^/]+))?$/
+    customLogger.logMessage('debug', 'Processing transfer request', { additionalData: { method: req.method, path: req.path }, request: req })
+    if (req.method === 'post' && (transferPathMatch.test(req.path) || fxTransferPathMatch.test(req.path))) {
+      const isFxTransfer = fxTransferPathMatch.test(req.path)
+      let transferId = (req.payload && req.payload.transferId) || (req.payload && req.payload.commitRequestId)
+      if (!transferId && req.payload && req.payload.CdtTrfTxInf && req.payload.CdtTrfTxInf.PmtId && req.payload.CdtTrfTxInf.PmtId.TxId) {
+        transferId = req.payload.CdtTrfTxInf.PmtId.TxId
+      }
+      customLogger.logMessage('debug', 'Storing transfer for validation', { additionalData: { transferId }, request: req })
+
+      // Use objectStore to store the transfer
+      objectStore.push('storedTransfers', transferId, {
+        request: req.payload,
+        type: isFxTransfer ? 'fxTransfer' : 'transfer'
+      })
+    }
+
     // Getting callback info from callback map file
     try {
       const cbMapRawdata = await utils.readFileAsync(item.callbackMapFile)
@@ -426,7 +445,7 @@ const generateAsyncCallback = async (item, context, req) => {
       return
     }
   }
-
+  customLogger.logMessage('debug', 'Generated callback body', { additionalData: { body: generatedCallback.body }, request: req })
   if (generatedCallback.body) {
     // Append ILP properties to callback
     const fulfilment = IlpModel.handleQuoteIlp(context, generatedCallback)

package/src/lib/objectStore.js

@@ -35,7 +35,8 @@ const storedObject = {
     transactions: {},
     inboundEnvironment: {},
     requests: {},
-    callbacks: {}
+    callbacks: {},
+    storedTransfers: {}
   }
 }
 
@@ -103,6 +104,7 @@ const clearOldObjects = () => {
   clear('callbacks', interval)
   clear('requestsHistory', interval)
   clear('callbacksHistory', interval)
+  clear('storedTransfers', interval)
 }
 
 const initObjectStore = (initConfig = null) => {