fix: fix request header validation

package.json

@@ -1,6 +1,6 @@
 {
   "name": "sims",
-  "version": "12.2.0",
+  "version": "12.3.0-snapshot.2",
   "description": "A super-simple fsp simulator",
   "main": "src/index.js",
   "author": "ModusBox",
@@ -27,6 +27,12 @@
     "lint:fix": "npm run standard -- --fix",
     "start": "node src/index.js",
     "test": "echo \"Error: no test specified\" && exit 1",
+    "docker:build": "docker build --build-arg NODE_VERSION=\"$(cat .nvmrc)-alpine\" -t mojaloop/simulator:local .",
+    "docker:up": "docker-compose -f docker-compose.yml up",
+    "docker:stop": "docker-compose -f docker-compose.yml stop",
+    "docker:rm": "docker-compose -f docker-compose.yml rm -f -v",
+    "docker:down": "docker-compose -f docker-compose.yml down -v",
+    "docker:clean": "docker-compose -f docker-compose.yml down --rmi local",
     "audit:fix": "npm audit fix",
     "audit:check": "npx audit-ci --config ./audit-ci.jsonc",
     "dep:check": "npx ncu -e 2",
@@ -50,7 +56,7 @@
     "@mojaloop/central-services-metrics": "12.0.8",
     "@mojaloop/central-services-shared": "18.5.0",
     "@mojaloop/event-sdk": "^14.1.1",
-    "@mojaloop/sdk-standard-components": "18.2.0",
+    "@mojaloop/sdk-standard-components": "18.2.1",
     "axios": "1.7.2",
     "base64url": "3.0.1",
     "blipp": "4.0.2",

src/acceptheaderpayee/handler.js

@@ -143,7 +143,7 @@ exports.getPartiesByTypeAndId = function (req, h) {
         httpsAgent: new https.Agent({
           rejectUnauthorized: false
         }),
-        data: JSON.stringify(correlationCache.get(req.params.id))
+        data: correlationCache.get(req.params.id)
       }
 
       // Logger.isInfoEnabled && Logger.info((new Date().toISOString()), 'Executing PUT', url)
@@ -232,7 +232,7 @@ exports.postQuotes = function (req, h) {
         httpsAgent: new https.Agent({
           rejectUnauthorized: false
         }),
-        data: JSON.stringify(quotesResponse)
+        data: quotesResponse
       }
       // Logger.isInfoEnabled && Logger.info((new Date().toISOString()), 'Executing PUT', url)
       const res = await request(url, opts, req.span)
@@ -314,7 +314,7 @@ exports.postTransfers = async function (req, h) {
         httpsAgent: new https.Agent({
           rejectUnauthorized: false
         }),
-        data: JSON.stringify(transfersResponse)
+        data: transfersResponse
       }
 
       // Logger.isInfoEnabled && Logger.info(`Executing PUT: [${url}], HEADERS: [${JSON.stringify(opts.headers)}], BODY: [${JSON.stringify(transfersResponse)}]`)

src/acceptheaderpayee/routes.js

@@ -83,7 +83,7 @@ module.exports = [
           'fspiop-http-method': Joi.string().optional(),
           traceparent: Joi.string().optional(),
           tracestate: Joi.string().optional()
-        }).unknown(false).options({ stripUnknown: true }),
+        }).unknown(true).options({ stripUnknown: true }),
         failAction: (request, h, err) => { throw err }
       }
     }
@@ -114,7 +114,7 @@ module.exports = [
           'fspiop-http-method': Joi.string().optional(),
           traceparent: Joi.string().optional(),
           tracestate: Joi.string().optional()
-        }).unknown(false).options({ stripUnknown: true }),
+        }).unknown(true).options({ stripUnknown: true }),
         payload: Joi.object({
           quoteId: Joi.string().guid().required().description('Id of quote').label('@ Quote Id must be in a valid GUID format. @'),
           transactionId: Joi.string().guid().required().description('Id of transaction').label('@ Transaction Id must be in a valid GUID format. @'),
@@ -214,7 +214,7 @@ module.exports = [
           'fspiop-http-method': Joi.string().optional(),
           traceparent: Joi.string().optional(),
           tracestate: Joi.string().optional()
-        }).unknown(false).options({ stripUnknown: true }),
+        }).unknown(true).options({ stripUnknown: true }),
         payload: Joi.object({
           transferId: Joi.string().guid().required().description('Id of transfer').label('@ Transfer Id must be in a valid GUID format. @'),
           payeeFsp: Joi.string().required().min(1).max(32).description('Financial Service Provider of Payee').label('@ A valid Payee FSP number must be supplied. @'),
@@ -261,7 +261,7 @@ module.exports = [
           'fspiop-http-method': Joi.string().optional(),
           traceparent: Joi.string().optional(),
           tracestate: Joi.string().optional()
-        }).unknown(false).options({ stripUnknown: true }),
+        }).unknown(true).options({ stripUnknown: true }),
         params: Joi.object({
           id: Joi.string().required().description('path')
         }),
@@ -303,7 +303,7 @@ module.exports = [
           'fspiop-http-method': Joi.string().optional(),
           traceparent: Joi.string().optional(),
           tracestate: Joi.string().optional()
-        }).unknown(false).options({ stripUnknown: true }),
+        }).unknown(true).options({ stripUnknown: true }),
         params: Joi.object({
           id: Joi.string().required().description('path')
         }),

src/bulkQuotes/handler.js

@@ -35,8 +35,8 @@ const Sdk = require('@mojaloop/sdk-standard-components')
 const ErrorHandler = require('@mojaloop/central-services-error-handling')
 const Metrics = require('../lib/metrics')
 const base64url = require('base64url')
-const Config = require('../lib/config')
 
+const hubName = process.env.HUB_NAME || 'Hub'
 const quotesEndpoint = process.env.QUOTES_ENDPOINT || 'http://localhost:1080'
 const signature = process.env.MOCK_JWS_SIGNATURE || 'abcJjvNrkyK2KBieDUbGfhaBUn75aDUATNF4joqA8OLs4QgSD7i6EO8BIdy6Crph3LnXnTM20Ai1Z6nt0zliS_qPPLU9_vi6qLb15FOkl64DQs9hnfoGeo2tcjZJ88gm19uLY_s27AJqC1GH1B8E2emLrwQMDMikwQcYvXoyLrL7LL3CjaLMKdzR7KTcQi1tCK4sNg0noIQLpV3eA61kess'
 const ilpSecret = process.env.ILP_SECRET || 'Quaixohyaesahju3thivuiChai5cahng'
@@ -146,13 +146,13 @@ exports.postBulkQuotes = function (request, h) {
           'FSPIOP-URI': `/bulkQuotes/${bulkQuoteRequest.bulkQuoteId}`
         },
         transformRequest: [(data, headers) => {
-          delete headers.common.Accept
-          return data
+          headers.delete('Accept')
+          return JSON.stringify(data)
         }],
         httpsAgent: new https.Agent({
           rejectUnauthorized: false
         }),
-        data: JSON.stringify(bulkQuotesResponse)
+        data: bulkQuotesResponse
       }
       // Logger.isInfoEnabled && Logger.info((new Date().toISOString()), 'Executing PUT', url)
       const res = await sendRequest(url, opts, request.span)
@@ -268,13 +268,13 @@ exports.getBulkQuotesById = function (request, h) {
             'FSPIOP-URI': `/bulkQuotes/${request.params.id}`
           },
           transformRequest: [(data, headers) => {
-            delete headers.common.Accept
-            return data
+            headers.delete('Accept')
+            return JSON.stringify(data)
           }],
           httpsAgent: new https.Agent({
             rejectUnauthorized: false
           }),
-          data: JSON.stringify(responseData)
+          data: responseData
         }
         // Logger.isInfoEnabled && Logger.info((new Date().toISOString()), 'Executing PUT', url)
         const res = await sendRequest(url, opts, request.span)
@@ -315,7 +315,7 @@ const sendErrorCallback = async (fspiopError, bulkQuoteId, headers, span) => {
     const protectedHeader = {
       alg: 'RS256',
       'FSPIOP-Source': `${headers['fspiop-source']}`,
-      'FSPIOP-Destination': Config.HUB_NAME,
+      'FSPIOP-Destination': hubName,
       'FSPIOP-URI': `/bulkQuotes/${bulkQuoteId}/error`,
       'FSPIOP-HTTP-Method': 'PUT',
       Date: ''
@@ -329,30 +329,30 @@ const sendErrorCallback = async (fspiopError, bulkQuoteId, headers, span) => {
       headers: {
         'Content-Type': 'application/vnd.interoperability.quotes+json;version=1.0',
         'FSPIOP-Source': headers['fspiop-source'],
-        'FSPIOP-Destination': Config.HUB_NAME,
+        'FSPIOP-Destination': hubName,
         Date: new Date().toUTCString(),
         'FSPIOP-Signature': `${JSON.stringify(fspiopSignature)}`,
         'FSPIOP-HTTP-Method': 'PUT',
         'FSPIOP-URI': `/bulkQuotes/${bulkQuoteId}/error`
       },
       transformRequest: [(data, headers) => {
-        delete headers.common.Accept
-        return data
+        headers.delete('Accept')
+        return JSON.stringify(data)
       }],
       httpsAgent: new https.Agent({
         rejectUnauthorized: false
       }),
-      data: JSON.stringify(fspiopError.toApiErrorObject())
+      data: fspiopError.toApiErrorObject()
     }
     const res = await sendRequest(url, opts, span)
     if (res.status !== Enums.Http.ReturnCodes.OK.CODE) {
       throw new Error(`Failed to send. Result: ${res}`)
     }
 
-    histTimerEnd({ success: true, fsp: 'payee', operation: 'sendErrorCallback', source: headers['fspiop-source'], destination: Config.HUB_NAME })
+    histTimerEnd({ success: true, fsp: 'payee', operation: 'sendErrorCallback', source: headers['fspiop-source'], destination: hubName })
   } catch (err) {
     Logger.isErrorEnabled && Logger.error(err)
-    histTimerEnd({ success: false, fsp: 'payee', operation: 'sendErrorCallback', source: headers['fspiop-source'], destination: Config.HUB_NAME })
+    histTimerEnd({ success: false, fsp: 'payee', operation: 'sendErrorCallback', source: headers['fspiop-source'], destination: hubName })
   }
 }
 

src/bulkQuotes/routes.js

@@ -54,7 +54,7 @@ module.exports = [
           'fspiop-http-method': Joi.string().optional(),
           traceparent: Joi.string().optional(),
           tracestate: Joi.string().optional()
-        }).unknown(false).options({ stripUnknown: true }),
+        }).unknown(true).options({ stripUnknown: true }),
         payload: Joi.object({
           bulkQuoteId: Joi.string().guid().required().description('Id of bulkQuote').label('@ BulkQuote Id must be in a valid GUID format. @'),
           payer: Joi.object().required().keys({
@@ -162,7 +162,7 @@ module.exports = [
           'fspiop-http-method': Joi.string().optional(),
           traceparent: Joi.string().optional(),
           tracestate: Joi.string().optional()
-        }).unknown(false).options({ stripUnknown: true }),
+        }).unknown(true).options({ stripUnknown: true }),
         params: Joi.object({
           id: Joi.string().guid().required().description('path')
         }),
@@ -195,7 +195,7 @@ module.exports = [
           'fspiop-http-method': Joi.string().optional(),
           traceparent: Joi.string().optional(),
           tracestate: Joi.string().optional()
-        }).unknown(false).options({ stripUnknown: true }),
+        }).unknown(true).options({ stripUnknown: true }),
         params: Joi.object({
           id: Joi.string().required().description('path')
         }),
@@ -282,7 +282,7 @@ module.exports = [
           'fspiop-http-method': Joi.string().optional(),
           traceparent: Joi.string().optional(),
           tracestate: Joi.string().optional()
-        }).unknown(false).options({ stripUnknown: true }),
+        }).unknown(true).options({ stripUnknown: true }),
         params: Joi.object({
           id: Joi.string().required().description('path')
         }),

src/bulkTransfers/handler.js

@@ -101,13 +101,13 @@ exports.postBulkTransfers = async function (req, h) {
           // tracestate: req.headers.tracestate ? req.headers.tracestate : undefined
         },
         transformRequest: [(data, headers) => {
-          delete headers.common.Accept
-          return data
+          headers.delete('Accept')
+          return JSON.stringify(data)
         }],
         httpsAgent: new https.Agent({
           rejectUnauthorized: false
         }),
-        data: JSON.stringify(bulkTransferResponse)
+        data: bulkTransferResponse
       }
       // Logger.isInfoEnabled && Logger.info(`Executing PUT: [${url}], HEADERS: [${JSON.stringify(opts.headers)}], BODY: [${JSON.stringify(bulkTransferResponse)}]`)
       const res = await request(url, opts, req.span)

src/bulkTransfers/routes.js

@@ -56,7 +56,7 @@ module.exports = [
           'fspiop-http-method': Joi.string().optional(),
           traceparent: Joi.string().optional(),
           tracestate: Joi.string().optional()
-        }).unknown(false).options({ stripUnknown: true }),
+        }).unknown(true).options({ stripUnknown: true }),
         payload: Joi.object({
           bulkTransferId: Joi.string().guid().required().description('Id of bulk transfer').label('@ Bulk Transfer Id must be in a valid GUID format. @'),
           bulkQuoteId: Joi.string().guid().required().description('Id of bulk quote').label('@ Bulk Quote Id must be in a valid GUID format. @'),
@@ -114,7 +114,7 @@ module.exports = [
           'fspiop-http-method': Joi.string().optional(),
           traceparent: Joi.string().optional(),
           tracestate: Joi.string().optional()
-        }).unknown(false).options({ stripUnknown: true }),
+        }).unknown(true).options({ stripUnknown: true }),
         params: Joi.object({
           id: Joi.string().required().description('path')
         }),
@@ -175,7 +175,7 @@ module.exports = [
           'fspiop-http-method': Joi.string().optional(),
           traceparent: Joi.string().optional(),
           tracestate: Joi.string().optional()
-        }).unknown(false).options({ stripUnknown: true }),
+        }).unknown(true).options({ stripUnknown: true }),
         params: Joi.object({
           id: Joi.string().required().description('path')
         }),

src/bulkTransfersNegative/routes.js

@@ -57,7 +57,7 @@ module.exports = [
           'fspiop-http-method': Joi.string().optional(),
           traceparent: Joi.string().optional(),
           tracestate: Joi.string().optional()
-        }).unknown(false).options({ stripUnknown: true }),
+        }).unknown(true).options({ stripUnknown: true }),
         payload: Joi.object({
           bulkTransferId: Joi.string().guid().required().description('Id of bulk transfer').label('@ Bulk Transfer Id must be in a valid GUID format. @'),
           bulkQuoteId: Joi.string().guid().required().description('Id of bulk quote').label('@ Bulk Quote Id must be in a valid GUID format. @'),
@@ -114,7 +114,7 @@ module.exports = [
           'fspiop-http-method': Joi.string().optional(),
           traceparent: Joi.string().optional(),
           tracestate: Joi.string().optional()
-        }).unknown(false).options({ stripUnknown: true }),
+        }).unknown(true).options({ stripUnknown: true }),
         params: Joi.object({
           id: Joi.string().required().description('path')
         }),
@@ -175,7 +175,7 @@ module.exports = [
           'fspiop-http-method': Joi.string().optional(),
           traceparent: Joi.string().optional(),
           tracestate: Joi.string().optional()
-        }).unknown(false).options({ stripUnknown: true }),
+        }).unknown(true).options({ stripUnknown: true }),
         params: Joi.object({
           id: Joi.string().required().description('path')
         }),