Merge pull request #632 from sommy92/somzilla_issues

Implement somzilla issues #492, #493, #495

Author: Jambox11

src/common/http/index.ts

@@ -0,0 +1,2 @@
+export { createRequestIdAwareAxios } from './request-id-axios';
+export { requestIdAwareFetch } from './request-id-fetch';

src/common/http/request-id-axios.spec.ts

@@ -0,0 +1,65 @@
+/**
+ * Request-id-aware Axios — unit tests
+ *
+ * Covers:
+ *  - Adds x-request-id header when a request ID is active in context
+ *  - Omits x-request-id header when no request ID is active
+ *  - Preserves existing headers on the outgoing request
+ */
+import { createRequestIdAwareAxios } from './request-id-axios';
+import { RequestContextService } from '../request-context/request-context.service';
+
+describe('createRequestIdAwareAxios', () => {
+  /** Create a client with a custom adapter that captures the final headers. */
+  async function captureHeaders(
+    requestId: string | null,
+    extraHeaders?: Record<string, string>,
+  ): Promise<Record<string, string> | undefined> {
+    const client = createRequestIdAwareAxios({ baseURL: 'https://example.com' });
+    let captured: Record<string, string> | undefined;
+
+    // Override the adapter to capture the config before the real HTTP call
+    (client as any).defaults.adapter = (config: any) => {
+      const h: Record<string, string> = {};
+      // AxiosHeaders is iterable via forEach
+      if (typeof config.headers?.forEach === 'function') {
+        config.headers.forEach((v: string, k: string) => { h[k] = v; });
+      } else if (config.headers) {
+        Object.assign(h, config.headers);
+      }
+      captured = h;
+      return Promise.resolve({ data: null, status: 200, statusText: 'OK', headers: {}, config });
+    };
+
+    const action = async () => {
+      await client.get('/test', extraHeaders ? { headers: extraHeaders } : undefined);
+    };
+
+    if (requestId) {
+      await RequestContextService.run({ requestId }, action);
+    } else {
+      await action();
+    }
+
+    return captured;
+  }
+
+  it('adds x-request-id header when a request ID is active in context', async () => {
+    const headers = await captureHeaders('ctx-req-001');
+    expect(headers).toBeDefined();
+    expect(headers!['x-request-id']).toBe('ctx-req-001');
+  });
+
+  it('omits x-request-id header when no request ID is active', async () => {
+    const headers = await captureHeaders(null);
+    expect(headers).toBeDefined();
+    expect(headers!['x-request-id']).toBeUndefined();
+  });
+
+  it('preserves existing custom headers on the outgoing request', async () => {
+    const headers = await captureHeaders('req-with-custom', { 'x-custom': 'my-value' });
+    expect(headers).toBeDefined();
+    expect(headers!['x-request-id']).toBe('req-with-custom');
+    expect(headers!['x-custom']).toBe('my-value');
+  });
+});

src/common/http/request-id-axios.ts

@@ -0,0 +1,45 @@
+import axios, { AxiosInstance, CreateAxiosDefaults } from 'axios';
+import { RequestContextService } from '../request-context/request-context.service';
+
+/**
+ * Creates a pre-configured Axios instance that automatically propagates the
+ * `x-request-id` header on every outbound HTTP request.
+ *
+ * The request ID is read from the current AsyncLocalStorage context
+ * (populated by the request-logging middleware).  When no request ID is
+ * active the header is omitted so downstream services behave normally.
+ *
+ * Usage:
+ * ```typescript
+ * import { createRequestIdAwareAxios } from '../common/http/request-id-axios';
+ *
+ * const http = createRequestIdAwareAxios({ baseURL: 'https://horizon.example.com' });
+ * const res = await http.get('/transactions/abc');
+ * // ^ automatically includes `x-request-id: <current-id>` in the request headers
+ * ```
+ *
+ * @param config  Optional Axios configuration (baseURL, timeout, headers, …)
+ * @returns       A configured Axios instance
+ */
+export function createRequestIdAwareAxios(
+  config?: CreateAxiosDefaults,
+): AxiosInstance {
+  const instance = axios.create(config);
+
+  instance.interceptors.request.use(
+    (reqConfig) => {
+      const requestId = RequestContextService.getCurrentRequestId();
+      if (requestId && reqConfig.headers) {
+        // Axios 1.x uses AxiosHeaders — set header via direct property assignment
+        (reqConfig.headers as Record<string, unknown>)['x-request-id'] = requestId;
+      } else if (requestId) {
+        // Fallback for when headers object is absent
+        (reqConfig as any).headers = { 'x-request-id': requestId };
+      }
+      return reqConfig;
+    },
+    (error) => Promise.reject(error),
+  );
+
+  return instance;
+}

src/common/http/request-id-fetch.spec.ts

@@ -0,0 +1,51 @@
+/**
+ * Request-id-aware fetch — unit tests
+ *
+ * Covers:
+ *  - Adds x-request-id header when a request ID is active in context
+ *  - Omits x-request-id header when no request ID is active
+ *  - Preserves existing custom headers
+ */
+import { requestIdAwareFetch } from './request-id-fetch';
+import { RequestContextService } from '../request-context/request-context.service';
+
+// Mock the global fetch
+const mockFetch = jest.fn();
+global.fetch = mockFetch as any;
+
+describe('requestIdAwareFetch', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockFetch.mockResolvedValue(new Response('ok', { status: 200 }));
+  });
+
+  it('adds x-request-id header when a request ID is active in context', async () => {
+    await RequestContextService.run({ requestId: 'fetch-req-001' }, async () => {
+      await requestIdAwareFetch('https://example.com/api');
+    });
+
+    const callHeaders = mockFetch.mock.calls[0][1]?.headers;
+    expect(callHeaders).toBeDefined();
+    expect(callHeaders.get('x-request-id')).toBe('fetch-req-001');
+  });
+
+  it('omits x-request-id header when no request ID is active', async () => {
+    await requestIdAwareFetch('https://example.com/api');
+
+    const callHeaders = mockFetch.mock.calls[0][1]?.headers;
+    expect(callHeaders).toBeDefined();
+    expect(callHeaders.has('x-request-id')).toBe(false);
+  });
+
+  it('preserves existing custom headers on the outgoing request', async () => {
+    await RequestContextService.run({ requestId: 'req-ctx' }, async () => {
+      await requestIdAwareFetch('https://example.com/api', {
+        headers: { 'x-custom': 'my-value' },
+      });
+    });
+
+    const callHeaders = mockFetch.mock.calls[0][1]?.headers;
+    expect(callHeaders.get('x-request-id')).toBe('req-ctx');
+    expect(callHeaders.get('x-custom')).toBe('my-value');
+  });
+});

src/common/http/request-id-fetch.ts

@@ -0,0 +1,33 @@
+import { RequestContextService } from '../request-context/request-context.service';
+
+/**
+ * Wraps the built-in `fetch` so that every outbound request automatically
+ * includes the current `x-request-id` header (when one is active in
+ * AsyncLocalStorage).
+ *
+ * Usage — replace global fetch:
+ * ```typescript
+ * import { requestIdAwareFetch } from '../common/http/request-id-fetch';
+ *
+ * const response = await requestIdAwareFetch('https://friendbot.example.com', {
+ *   method: 'GET',
+ * });
+ * ```
+ *
+ * @param input   URL or Request object
+ * @param init    Optional init overrides (headers, method, etc.)
+ * @returns       Same as the native `fetch` — a Promise<Response>
+ */
+export async function requestIdAwareFetch(
+  input: RequestInfo | URL,
+  init?: RequestInit,
+): Promise<Response> {
+  const requestId = RequestContextService.getCurrentRequestId();
+  const headers = new Headers(init?.headers);
+
+  if (requestId && !headers.has('x-request-id')) {
+    headers.set('x-request-id', requestId);
+  }
+
+  return fetch(input, { ...init, headers });
+}

src/common/interceptors/index.ts

@@ -0,0 +1 @@
+export { ResponseSanitizerInterceptor } from './response-sanitizer.interceptor';

src/common/interceptors/response-sanitizer.interceptor.spec.ts

@@ -0,0 +1,137 @@
+/**
+ * ResponseSanitizerInterceptor — unit tests
+ *
+ * Covers:
+ *  - Strips privateKey from response body
+ *  - Strips encryptedSecret from response body
+ *  - Strips nested sensitive fields
+ *  - Passes through non-sensitive fields unchanged
+ *  - Handles null/undefined responses
+ *  - Handles array responses
+ */
+import { ResponseSanitizerInterceptor } from './response-sanitizer.interceptor';
+import { ExecutionContext, CallHandler } from '@nestjs/common';
+import { of } from 'rxjs';
+import { firstValueFrom } from 'rxjs';
+
+describe('ResponseSanitizerInterceptor', () => {
+  let interceptor: ResponseSanitizerInterceptor;
+
+  beforeEach(() => {
+    interceptor = new ResponseSanitizerInterceptor();
+  });
+
+  function mockContext(): ExecutionContext {
+    return {
+      switchToHttp: () => ({
+        getRequest: () => ({}),
+        getResponse: () => ({}),
+      }),
+      getHandler: () => ({}),
+      getClass: () => ({}),
+    } as ExecutionContext;
+  }
+
+  function callHandler(responseBody: unknown): CallHandler {
+    return { handle: () => of(responseBody) };
+  }
+
+  it('strips privateKey from the response body', async () => {
+    const body = {
+      wallet: { id: 'wallet-1', publicKey: 'GABC' },
+      privateKey: 'S-secret-key',
+      isNewWallet: true,
+    };
+
+    const result = await firstValueFrom(
+      interceptor.intercept(mockContext(), callHandler(body)),
+    );
+
+    expect(result.privateKey).toBe('[REDACTED]');
+    expect(result.wallet.id).toBe('wallet-1');
+    expect(result.isNewWallet).toBe(true);
+  });
+
+  it('strips encryptedSecret from the response body', async () => {
+    const body = {
+      wallet: {
+        id: 'wallet-1',
+        encryptedSecret: 'enc-very-secret',
+        publicKey: 'GABC',
+      },
+    };
+
+    const result = await firstValueFrom(
+      interceptor.intercept(mockContext(), callHandler(body)),
+    );
+
+    expect(result.wallet.encryptedSecret).toBe('[REDACTED]');
+    expect(result.wallet.publicKey).toBe('GABC');
+  });
+
+  it('strips nested sensitive fields deep in the response', async () => {
+    const body = {
+      data: {
+        items: [
+          { privateKey: 'S-key-1', name: 'item1' },
+          { encryptedSecret: 'enc-2', name: 'item2' },
+        ],
+      },
+    };
+
+    const result = await firstValueFrom(
+      interceptor.intercept(mockContext(), callHandler(body)),
+    );
+
+    expect(result.data.items[0].privateKey).toBe('[REDACTED]');
+    expect(result.data.items[0].name).toBe('item1');
+    expect(result.data.items[1].encryptedSecret).toBe('[REDACTED]');
+    expect(result.data.items[1].name).toBe('item2');
+  });
+
+  it('passes through non-sensitive fields unchanged', async () => {
+    const body = {
+      wallet: { id: 'w-1', publicKey: 'GABC', status: 'ACTIVE' },
+      isNewWallet: false,
+      idempotencyKey: 'key-123',
+    };
+
+    const result = await firstValueFrom(
+      interceptor.intercept(mockContext(), callHandler(body)),
+    );
+
+    expect(result.wallet.id).toBe('w-1');
+    expect(result.wallet.publicKey).toBe('GABC');
+    expect(result.wallet.status).toBe('ACTIVE');
+    expect(result.isNewWallet).toBe(false);
+    expect(result.idempotencyKey).toBe('key-123');
+  });
+
+  it('handles null and undefined responses', async () => {
+    const nullResult = await firstValueFrom(
+      interceptor.intercept(mockContext(), callHandler(null)),
+    );
+    expect(nullResult).toBeNull();
+
+    const undefinedResult = await firstValueFrom(
+      interceptor.intercept(mockContext(), callHandler(undefined)),
+    );
+    expect(undefinedResult).toBeUndefined();
+  });
+
+  it('handles array responses', async () => {
+    const body = [
+      { privateKey: 'S-key-1', publicKey: 'GABC' },
+      { privateKey: 'S-key-2', publicKey: 'GDEF' },
+    ];
+
+    const result = await firstValueFrom(
+      interceptor.intercept(mockContext(), callHandler(body)),
+    );
+
+    expect(result[0].privateKey).toBe('[REDACTED]');
+    expect(result[0].publicKey).toBe('GABC');
+    expect(result[1].privateKey).toBe('[REDACTED]');
+    expect(result[1].publicKey).toBe('GDEF');
+  });
+});