Merge pull request #240 from OlaGreat/fix/evidence-integrity-async-leak

Fix/evidence integrity async leak

Author: dDevAhmed

package-lock.json

@@ -48,6 +48,7 @@
     "ethers": "^6.16.0",
     "ioredis": "^5.9.3",
     "jsonwebtoken": "^9.0.3",
+    "multiformats": "^14.0.0",
     "nestjs-pino": "^4.1.0",
     "passport": "^0.7.0",
     "passport-jwt": "^4.0.1",
@@ -103,6 +104,9 @@
     "transform": {
       "^.+\\.(t|j)s$": "ts-jest"
     },
+    "moduleNameMapper": {
+      "^multiformats/(.*)$": "<rootDir>/__mocks__/multiformats.js"
+    },
     "collectCoverageFrom": [
       "**/*.(t|j)s"
     ],

package.json

@@ -0,0 +1,10 @@
+// Stub for ESM-only multiformats package used in Jest tests.
+// The real implementation is mocked at the module level in tests that use cid-verifier.
+module.exports = {
+  CID: {
+    parse: jest.fn(),
+  },
+  sha256: {
+    digest: jest.fn(),
+  },
+};

src/__mocks__/multiformats.js

@@ -0,0 +1,101 @@
+import { EvidenceIntegrityMiddleware } from "./evidence-integrity.middleware";
+import * as cidVerifier from "../../storage/cid-verifier";
+
+describe("EvidenceIntegrityMiddleware", () => {
+  let middleware: EvidenceIntegrityMiddleware;
+  let mockReq: any;
+  let mockRes: any;
+  let mockNext: jest.Mock;
+
+  beforeEach(() => {
+    middleware = new EvidenceIntegrityMiddleware();
+    mockNext = jest.fn();
+    mockRes = {
+      status: jest.fn().mockReturnThis(),
+      json: jest.fn().mockReturnThis(),
+    };
+  });
+
+  it("should call next() when no file is present", async () => {
+    mockReq = { body: { cid: "bafybeiabc123" } };
+    await middleware.use(mockReq, mockRes, mockNext);
+    expect(mockNext).toHaveBeenCalledTimes(1);
+    expect(mockRes.status).not.toHaveBeenCalled();
+  });
+
+  it("should call next() when no cid is present", async () => {
+    mockReq = { file: { buffer: Buffer.from("data") }, body: {} };
+    await middleware.use(mockReq, mockRes, mockNext);
+    expect(mockNext).toHaveBeenCalledTimes(1);
+    expect(mockRes.status).not.toHaveBeenCalled();
+  });
+
+  it("should call next() when both file and cid are absent", async () => {
+    mockReq = { body: {} };
+    await middleware.use(mockReq, mockRes, mockNext);
+    expect(mockNext).toHaveBeenCalledTimes(1);
+  });
+
+  it("should call next() when CID integrity check passes", async () => {
+    mockReq = {
+      file: { buffer: Buffer.from("valid content") },
+      body: { cid: "bafybeiabc123" },
+    };
+    jest.spyOn(cidVerifier, "verifyCIDIntegrity").mockResolvedValue(true);
+
+    await middleware.use(mockReq, mockRes, mockNext);
+
+    expect(cidVerifier.verifyCIDIntegrity).toHaveBeenCalledWith(
+      mockReq.file.buffer,
+      mockReq.body.cid,
+    );
+    expect(mockNext).toHaveBeenCalledTimes(1);
+    expect(mockRes.status).not.toHaveBeenCalled();
+  });
+
+  it("should return 400 when CID integrity check fails", async () => {
+    mockReq = {
+      file: { buffer: Buffer.from("tampered content") },
+      body: { cid: "bafybeiabc123" },
+    };
+    jest.spyOn(cidVerifier, "verifyCIDIntegrity").mockResolvedValue(false);
+
+    await middleware.use(mockReq, mockRes, mockNext);
+
+    expect(mockRes.status).toHaveBeenCalledWith(400);
+    expect(mockRes.json).toHaveBeenCalledWith({
+      message: "Evidence integrity verification failed",
+    });
+    expect(mockNext).not.toHaveBeenCalled();
+  });
+
+  it("should return 500 when verifyCIDIntegrity throws an error", async () => {
+    mockReq = {
+      file: { buffer: Buffer.from("content") },
+      body: { cid: "bafybeiabc123" },
+    };
+    jest
+      .spyOn(cidVerifier, "verifyCIDIntegrity")
+      .mockRejectedValue(new Error("Unexpected failure"));
+
+    await middleware.use(mockReq, mockRes, mockNext);
+
+    expect(mockRes.status).toHaveBeenCalledWith(500);
+    expect(mockRes.json).toHaveBeenCalledWith({
+      message: "Evidence integrity verification encountered an error",
+    });
+    expect(mockNext).not.toHaveBeenCalled();
+  });
+
+  it("should not call next() after sending a 400 response", async () => {
+    mockReq = {
+      file: { buffer: Buffer.from("bad") },
+      body: { cid: "bafybeiabc123" },
+    };
+    jest.spyOn(cidVerifier, "verifyCIDIntegrity").mockResolvedValue(false);
+
+    await middleware.use(mockReq, mockRes, mockNext);
+
+    expect(mockNext).not.toHaveBeenCalled();
+  });
+});

src/common/middleware/evidence-integrity.middleware.spec.ts

@@ -5,26 +5,34 @@ import { verifyCIDIntegrity } from "../../storage/cid-verifier";
 export class EvidenceIntegrityMiddleware implements NestMiddleware {
   private readonly logger = new Logger(EvidenceIntegrityMiddleware.name);
 
-  use(req: any, res: any, next: () => void) {
+  async use(req: any, res: any, next: () => void): Promise<void> {
     const file = req.file;
-    const cid = req.body.cid;
+    const cid = req.body?.cid;
 
     if (!file || !cid) {
       return next();
     }
 
-    const isValid = verifyCIDIntegrity(file.buffer, cid);
+    try {
+      const isValid = await verifyCIDIntegrity(file.buffer, cid);
 
-    if (!isValid) {
-      this.logger.warn(
-        `Evidence hash mismatch detected. CID: ${cid}`
-      );
+      if (!isValid) {
+        this.logger.warn(`Evidence hash mismatch detected. CID: ${cid}`);
+        res.status(400).json({
+          message: "Evidence integrity verification failed",
+        });
+        return;
+      }
 
-      return res.status(400).json({
-        message: "Evidence integrity verification failed",
+      next();
+    } catch (error) {
+      this.logger.error(
+        `Evidence integrity check threw an error. CID: ${cid}`,
+        error instanceof Error ? error.stack : String(error),
+      );
+      res.status(500).json({
+        message: "Evidence integrity verification encountered an error",
       });
     }
-
-    next();
   }
 }