Feature/sec101 by alexjavabraz · Pull Request #455 · rsksmart/2wp-api

alexjavabraz · 2026-02-12T21:19:22Z

No description provided.

…, function or class Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

github-actions · 2026-02-12T21:19:33Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details

Scanned Files

sonarqubecloud · 2026-02-12T21:21:27Z

Quality Gate failed

Failed conditions
0.0% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud

Copilot

Pull request overview

Adds a request security layer to the LoopBack app by enforcing an API key + payload-hash check, and introduces response caching keyed by request + payload hash to allow replaying identical requests without re-executing handlers.

Changes:

Added requestSecurityMiddleware to validate api_key and x-payload-hash, and to cache/replay responses.
Updated application bootstrap to register the new middleware and to configure CORS origins/headers.
Removed the /logs controller and added acceptance coverage for the new middleware behavior.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
src/middleware/request-security.middleware.ts	Implements API key + payload hash verification and response caching/replay.
src/application.ts	Registers the new middleware and adds CORS configuration driven by `CORS_ORIGIN`.
src/controllers/logs.controller.ts	Removes the `/logs` endpoint implementation.
src/tests/unit/api-information.controller.unit.ts	Minor unit test structure/format changes.
src/tests/acceptance/request-security.acceptance.ts	Adds acceptance tests for request security + caching.

Copilot · 2026-02-12T21:26:22Z

src/application.ts

+      ...options,
+      rest: {
+        cors: {
+          origin: [corsOrigins],


cors.origin is being set to [corsOrigins], which produces a nested array (string[][]). LoopBack/Express CORS expects a string or string[], so this will likely prevent origin matching and break CORS. Use origin: corsOrigins (or a single string) instead.

Suggested change

origin: [corsOrigins],

origin: corsOrigins,

Copilot · 2026-02-12T21:26:23Z

src/application.ts

+    this.middleware(requestSecurityMiddleware, {
+      group: 'requestSecurity',
+      upstreamGroups: RestMiddlewareGroups.PARSE_PARAMS,
+      downstreamGroups: RestMiddlewareGroups.INVOKE_METHOD,
+    });


The request security middleware is registered unconditionally for the whole app, but requestSecurityMiddleware throws 500 when REQUEST_API_KEY/REQUEST_SALT are not set. Existing acceptance tests (and local dev) start the app without those env vars (see setupApplication()), so all requests will fail. Consider enabling this middleware only when the env vars are present / in specific environments, or updating the shared test bootstrap to set the required env vars.

Suggested change

this.middleware(requestSecurityMiddleware, {

group: 'requestSecurity',

upstreamGroups: RestMiddlewareGroups.PARSE_PARAMS,

downstreamGroups: RestMiddlewareGroups.INVOKE_METHOD,

});

if (process.env.REQUEST_API_KEY && process.env.REQUEST_SALT) {

this.middleware(requestSecurityMiddleware, {

group: 'requestSecurity',

upstreamGroups: RestMiddlewareGroups.PARSE_PARAMS,

downstreamGroups: RestMiddlewareGroups.INVOKE_METHOD,

});

}

Copilot · 2026-02-12T21:26:23Z

src/middleware/request-security.middleware.ts

+  if (result === undefined) {
+    const contentType = getContentType(response.getHeader('content-type'));
+
+    storeCachedResponse(cacheKey, {
+      type: 'raw',
+      statusCode: response.statusCode,
+      contentType,
+      payload: concatChunks(responseChunks),
+    });
+
+    return result;
+  }
+
+  storeCachedResponse(cacheKey, {
+    type: 'result',
+    result,
+  });


Caching result when it is non-undefined is unsafe because many controllers return the Express Response object (after calling res.send()), which is tied to a specific request and cannot be reused. This will cache and later return a stale Response instance instead of replaying bytes, breaking cached responses for endpoints that return Promise<Response>. Prefer caching/replaying the captured raw response when the response has been written/ended (e.g., response.headersSent / response.writableEnded or result === response) and avoid storing Response objects in the cache.

Copilot · 2026-02-12T21:26:23Z

src/middleware/request-security.middleware.ts

+  if (!expectedApiKey) {
+    throw new HttpErrors.InternalServerError();
+  }
+
+  if (!rootstockSalt) {
+    throw new HttpErrors.InternalServerError();
+  }
+
+  const providedApiKey = request.header(API_KEY_HEADER);
+  if (!providedApiKey) {
+    throw new HttpErrors.Unauthorized();
+  }
+
+  if (!secureStringCompare(providedApiKey, expectedApiKey)) {
+    throw new HttpErrors.Unauthorized();
+  }
+
+  const providedPayloadHash = request.header(PAYLOAD_HASH_HEADER);
+  if (!providedPayloadHash) {
+    throw new HttpErrors.Unauthorized();
+  }
+
+  const normalizedPayloadHash = providedPayloadHash.toLowerCase();
+  const payload = getRequestPayload(request);
+  const expectedPayloadHash = sha256(sha256(payload + rootstockSalt));
+
+  if (!secureStringCompare(normalizedPayloadHash, expectedPayloadHash)) {
+    throw new HttpErrors.Unauthorized();
+  }


All Unauthorized/InternalServerError errors are thrown without messages. The new acceptance tests assert specific messages (e.g., missing api_key vs invalid api key), and without explicit messages LoopBack will return the generic "Unauthorized" text. Provide explicit error messages (and ideally differentiate missing vs invalid headers) so clients/tests can reliably understand failures.

Copilot · 2026-02-12T21:26:23Z

src/middleware/request-security.middleware.ts

+    appendChunk(chunk, args[0] as BufferEncoding | undefined);
+    return originalWrite(chunk as never, ...(args as never[]));
+  }) as typeof response.write;
+
+  response.end = ((chunk?: unknown, ...args: unknown[]) => {
+    appendChunk(chunk, args[0] as BufferEncoding | undefined);


The response.write/response.end wrappers assume args[0] is always a BufferEncoding, but Node allows passing a callback as the second argument (e.g., res.end('ok', cb)). In that case Buffer.from(chunk, encoding) will receive a function and can throw. Parse the overloads safely (only treat args[0] as encoding when it’s a string) before calling Buffer.from.

Suggested change

appendChunk(chunk, args[0] as BufferEncoding | undefined);

return originalWrite(chunk as never, ...(args as never[]));

}) as typeof response.write;

response.end = ((chunk?: unknown, ...args: unknown[]) => {

appendChunk(chunk, args[0] as BufferEncoding | undefined);

const encoding =

typeof args[0] === 'string' ? (args[0] as BufferEncoding) : undefined;

appendChunk(chunk, encoding);

return originalWrite(chunk as never, ...(args as never[]));

}) as typeof response.write;

response.end = ((chunk?: unknown, ...args: unknown[]) => {

let actualChunk = chunk;

let encoding: BufferEncoding | undefined;

// Handle res.end(cb) overload: first argument is a callback, no body.

if (typeof actualChunk === 'function') {

actualChunk = undefined;

} else if (typeof args[0] === 'string') {

encoding = args[0] as BufferEncoding;

}

appendChunk(actualChunk, encoding);

Copilot · 2026-02-12T21:26:23Z

src/__tests__/acceptance/request-security.acceptance.ts

+
+  it('replays cached response for repeated /logs payload hash', async () => {
+    const body = {
+      type: 'error',
+      operation: 'peginNative',
+      location: 'frontend register',
+      error: {
+        message: 'wallet timeout',
+        code: 504,
+      },
+    };
+    const payloadHash = hashJsonPayload(body);
+
+    await client
+      .post('/logs')
+      .set('api_key', apiKey)
+      .set('x-payload-hash', payloadHash)
+      .send(body)
+      .expect(200);
+
+    await client
+      .post('/logs')
+      .set('api_key', apiKey)
+      .set('x-payload-hash', payloadHash)
+      .send(body)
+      .expect(200)
+      .expect('x-payload-hash-cache', 'HIT');
+  });


This test posts to /logs, but src/controllers/logs.controller.ts has been removed in this PR, so the route will return 404 and this caching assertion won’t be valid. Either restore/replace the /logs endpoint or update/remove this test to target an existing route.

Suggested change

it('replays cached response for repeated /logs payload hash', async () => {

const body = {

type: 'error',

operation: 'peginNative',

location: 'frontend register',

error: {

message: 'wallet timeout',

code: 504,

},

};

const payloadHash = hashJsonPayload(body);

await client

.post('/logs')

.set('api_key', apiKey)

.set('x-payload-hash', payloadHash)

.send(body)

.expect(200);

await client

.post('/logs')

.set('api_key', apiKey)

.set('x-payload-hash', payloadHash)

.send(body)

.expect(200)

.expect('x-payload-hash-cache', 'HIT');

});

alexjavabraz and others added 10 commits February 12, 2026 09:00

adding CORS testing

1d08c50

returning extra info

a327f57

setting cors

026e2f4

adding security validations

4978dbc

Potential fix for code scanning alert no. 87: Unused variable, import…

918f8f1

…, function or class Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

caching responses and removing error details

25f1632

adding cors configuration dynamically

058b13a

fixing unit tests

adab3b8

removing logs collector

dc1947f

removinig unused value

309dea0

alexjavabraz self-assigned this Feb 12, 2026

Copilot AI review requested due to automatic review settings February 12, 2026 21:19

Copilot started reviewing on behalf of alexjavabraz February 12, 2026 21:19 View session

alexjavabraz closed this Feb 12, 2026

Copilot AI reviewed Feb 12, 2026

View reviewed changes

alexjavabraz deleted the feature/sec101 branch February 13, 2026 00:21

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature/sec101#455

Feature/sec101#455
alexjavabraz wants to merge 10 commits intomainfrom
feature/sec101

alexjavabraz commented Feb 12, 2026

Uh oh!

github-actions bot commented Feb 12, 2026

Uh oh!

sonarqubecloud bot commented Feb 12, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

-    appendChunk(chunk, args[0] as BufferEncoding | undefined);
-    return originalWrite(chunk as never, ...(args as never[]));
-  }) as typeof response.write;
-  response.end = ((chunk?: unknown, ...args: unknown[]) => {
-    appendChunk(chunk, args[0] as BufferEncoding | undefined);
+    const encoding =
+      typeof args[0] === 'string' ? (args[0] as BufferEncoding) : undefined;
+    appendChunk(chunk, encoding);
+    return originalWrite(chunk as never, ...(args as never[]));
+  }) as typeof response.write;
+  response.end = ((chunk?: unknown, ...args: unknown[]) => {
+    let actualChunk = chunk;
+    let encoding: BufferEncoding | undefined;
+    // Handle res.end(cb) overload: first argument is a callback, no body.
+    if (typeof actualChunk === 'function') {
+      actualChunk = undefined;
+    } else if (typeof args[0] === 'string') {
+      encoding = args[0] as BufferEncoding;
+    }
+    appendChunk(actualChunk, encoding);

Conversation

alexjavabraz commented Feb 12, 2026

Uh oh!

github-actions bot commented Feb 12, 2026

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

sonarqubecloud bot commented Feb 12, 2026

Quality Gate failed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants