fix: put-transfers-backend

.grype.yaml

@@ -11,6 +11,12 @@ ignore:
   - vulnerability: "CVE-2025-23167"
     package:
       name: "node"
+  # Ignore validator URL validation bypass - no patch available yet
+  # Vulnerability: isURL() function can be bypassed using protocol delimiter differences
+  # Severity: Medium (CVSS 6.1) - Waiting for upstream fix
+  - vulnerability: "GHSA-9965-vmph-33xx"
+    package:
+      name: "validator"
 
 
 # Set output format defaults

.nvmrc

@@ -1 +1 @@
-18.20.6
+22.15.1

Dockerfile

@@ -34,6 +34,9 @@ RUN apk del build-dependencies
 FROM node:${NODE_VERSION}
 WORKDIR /opt/app
 
+# Update packages to get latest security fixes including OpenSSL
+RUN apk upgrade --no-cache
+
 # Create empty log file & link stdout to the application log file
 RUN mkdir ./logs && touch ./logs/combined.log
 RUN ln -sf /dev/stdout ./logs/combined.log

audit-ci.jsonc

@@ -12,6 +12,8 @@
     "GHSA-3xgq-45jj-v275", // https://github.com/advisories/GHSA-3xgq-45jj-v275
     "GHSA-phwq-j96m-2c2q", // https://github.com/advisories/GHSA-phwq-j96m-2c2q
     "GHSA-ghr5-ch3p-vcr6", // https://github.com/advisories/GHSA-ghr5-ch3p-vcr6
-    "GHSA-cgfm-xwp7-2cvr" // https://github.com/advisories/GHSA-cgfm-xwp7-2cvr
+    "GHSA-cgfm-xwp7-2cvr", // https://github.com/advisories/GHSA-cgfm-xwp7-2cvr
+    "GHSA-9965-vmph-33xx", // https://github.com/advisories/GHSA-9965-vmph-33xx
+    "GHSA-fjxv-7rqg-78g4" // https://github.com/advisories/GHSA-fjxv-7rqg-78g4
   ]
 }

handlers/backend.js

@@ -10,66 +10,21 @@ const init = (config, logger, options = undefined) => {
   const router = express.Router()
 
   const handleCallback = (resource, req, res) => {
-    const histTimerEnd = options.metrics.getHistogram(
-      'ing_callbackHandler',
-      'Ingress - Operation handler',
-      ['success', 'operation']
-    ).startTimer()
     const currentTime = Date.now()
     const path = req.path
     const httpMethod = req.method.toLowerCase()
     const isErrorOperation = path.endsWith('error')
-    const operation = `fspiop_${httpMethod}_${resource}`
-    const operationE2e = `${operation}_end2end`
-    const operationRequest = `${operation}_request`
-    const operationResponse = `${operation}_response`
-    const tracestate = TraceUtils.getTraceStateMap(req.headers)
-
-    if (tracestate === undefined || tracestate[TRACESTATE_KEY_END2END_START_TS] === undefined || tracestate[TRACESTATE_KEY_CALLBACK_START_TS] === undefined) {
-      return res.status(400).send(`${TRACESTATE_KEY_END2END_START_TS} or ${TRACESTATE_KEY_CALLBACK_START_TS} key/values not found in tracestate`)
-    }
-
-    const e2eDelta = currentTime - tracestate[TRACESTATE_KEY_END2END_START_TS]
-    const requestDelta = tracestate[TRACESTATE_KEY_CALLBACK_START_TS] - tracestate[TRACESTATE_KEY_END2END_START_TS]
-    const responseDelta = currentTime - tracestate[TRACESTATE_KEY_CALLBACK_START_TS]
-
-    const performanceHistogram = options.metrics.getHistogram(
-      'tx_cb_perf',
-      'Metrics for callbacks',
-      ['success', 'operation']
-    )
-
-    performanceHistogram.observe({
-      success: (!isErrorOperation).toString(),
-      operation: operationE2e
-    }, e2eDelta / 1000)
-    performanceHistogram.observe({
-      success: (!isErrorOperation).toString(),
-      operation: operationRequest
-    }, requestDelta / 1000)
-    performanceHistogram.observe({
-      success: (!isErrorOperation).toString(),
-      operation: operationResponse
-    }, responseDelta / 1000)
+    const operation = `backend_${httpMethod}_${resource}`
 
     logger.isDebugEnabled && logger.debug(
       {
-        traceparent: req.headers.traceparent,
-        tracestate,
         operation,
         path,
         isErrorOperation,
         serverHandlingTime: currentTime,
-        [operationE2e]: e2eDelta,
-        [operationRequest]: requestDelta,
-        [operationResponse]: responseDelta
       }
     )
-    const traceId = TraceUtils.getTraceId(req.headers)
-    const channel = '/' + traceId + '/' + req.method + req.path
-    console.log('Handled PUT Callback request', channel)
-    options.wsServer.notify(channel, isErrorOperation ? 'ERROR_CALLBACK_RECEIVED' : 'SUCCESS_CALLBACK_RECEIVED')
-    histTimerEnd({ success: true, operation })
+    console.log(`Handled ${operation}`)
     return res.status(202).end()
   }
 
@@ -191,14 +146,34 @@ const init = (config, logger, options = undefined) => {
     return handleCallback('parties', req, res)
   })
 
+  router.put('/parties/:type/:id/error', (req, res) => {
+    return handleCallback('parties', req, res)
+  })
+
   router.put('/quotes/:id', (req, res) => {
     return handleCallback('quotes', req, res)
   })
 
+  router.put('/quotes/:id/error', (req, res) => {
+    return handleCallback('quotes', req, res)
+  })
+
   router.put('/transfers/:id', (req, res) => {
     return handleCallback('transfers', req, res)
   })
 
+  router.put('/transfers/:id/error', (req, res) => {
+    return handleCallback('transfers', req, res)
+  })
+
+  router.put('/fxTransfers/:id', (req, res) => {
+    return handleCallback('fxTransfers', req, res)
+  })
+
+  router.put('/fxTransfers/:id/error', (req, res) => {
+    return handleCallback('fxTransfers', req, res)
+  })
+
   return {
     name: 'backend',
     basepath: '/backend',