8114021061

Committed 01 Mar 2024 04:14PM UTC coverage: 93.908% (-0.01%) from 93.922%

Build # 8114021061

Build Type

Pull #1235

github

Committed by

fmrsabino

Commit Message

CI condition

Pull Request Pull Request #1235: Add support for Database certificate pinning

Run Details

1693 of 2018 branches covered (83.89%)

Branch coverage included in aggregate %.

1 of 1 new or added line in 1 file covered. (100.0%)

9 existing lines in 1 file now uncovered.

6199 of 6386 relevant lines covered (97.07%)

351.18 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

79.02

/src/domain/alerts/alerts.repository.ts

import { Inject, Injectable } from '@nestjs/common';
import { Hex } from 'viem';
import { IAlertsRepository } from '@/domain/alerts/alerts.repository.interface';
import { IAlertsApi } from '@/domain/interfaces/alerts-api.interface';
import { AlertsRegistration } from '@/domain/alerts/entities/alerts.entity';
import { AlertLog } from '@/routes/alerts/entities/alert.dto.entity';
import { DelayModifierDecoder } from '@/domain/alerts/contracts/decoders/delay-modifier-decoder.helper';
import { SafeDecoder } from '@/domain/contracts/decoders/safe-decoder.helper';
import { MultiSendDecoder } from '@/domain/contracts/decoders/multi-send-decoder.helper';
import { IEmailApi } from '@/domain/interfaces/email-api.interface';
import { IAccountRepository } from '@/domain/account/account.repository.interface';
import { ILoggingService, LoggingService } from '@/logging/logging.interface';
import { IConfigurationService } from '@/config/configuration.service.interface';
import { ISafeRepository } from '@/domain/safe/safe.repository.interface';
import { Safe } from '@/domain/safe/entities/safe.entity';
import { UrlGeneratorHelper } from '@/domain/alerts/urls/url-generator.helper';
import { IChainsRepository } from '@/domain/chains/chains.repository.interface';
import { ISubscriptionRepository } from '@/domain/subscriptions/subscription.repository.interface';
import { SubscriptionRepository } from '@/domain/subscriptions/subscription.repository';
import { Account } from '@/domain/account/entities/account.entity';

@Injectable()
export class AlertsRepository implements IAlertsRepository {
  private static readonly UNKNOWN_TX_EMAIL_SUBJECT = 'Malicious transaction';
  private static readonly RECOVERY_TX_EMAIL_SUBJECT = 'Recovery attempt';

  constructor(
    @Inject(IAlertsApi)
    private readonly alertsApi: IAlertsApi,
    @Inject(IEmailApi)
    private readonly emailApi: IEmailApi,
    @Inject(IAccountRepository)
    private readonly accountRepository: IAccountRepository,
    private readonly urlGenerator: UrlGeneratorHelper,
    private readonly delayModifierDecoder: DelayModifierDecoder,
    private readonly safeDecoder: SafeDecoder,
    private readonly multiSendDecoder: MultiSendDecoder,
    @Inject(LoggingService)
    private readonly loggingService: ILoggingService,
    @Inject(IConfigurationService)
    private readonly configurationService: IConfigurationService,
    @Inject(ISafeRepository)
    private readonly safeRepository: ISafeRepository,
    @Inject(IChainsRepository)
    private readonly chainRepository: IChainsRepository,
    @Inject(ISubscriptionRepository)
    private readonly subscriptionRepository: ISubscriptionRepository,
  ) {}

  async addContract(contract: AlertsRegistration): Promise<void> {
    await this.alertsApi.addContract(contract);
  }

  async handleAlertLog(chainId: string, log: AlertLog): Promise<void> {
    const moduleAddress = log.address;

    const { safes } = await this.safeRepository.getSafesByModule({
      chainId,
      moduleAddress,
    });

    if (safes.length === 0) {
      this.loggingService.debug(
        `An alert for a module that is not activated on a Safe was received. moduleAddress=${moduleAddress}`,
      );
      return;
    }

    // Recovery module is deployed per Safe so we can assume that it is only enabled on one
    const safeAddress = safes[0];
    const subscribedAccounts = await this._getSubscribedAccounts({
      chainId,
      safeAddress,
    });
    if (subscribedAccounts.length === 0) {
      this.loggingService.debug(
        `An alert for a Safe with no associated emails was received. moduleAddress=${moduleAddress}, safeAddress=${safeAddress}`,
      );
      return;
    }

    try {
      const safe = await this.safeRepository.getSafe({
        chainId,
        address: safeAddress,
      });

      const decodedEvent = this.delayModifierDecoder.decodeEventLog({
        data: log.data as Hex,
        topics: log.topics as [Hex, Hex, Hex],
      });
      const decodedTransactions = this._decodeTransactionAdded(
        decodedEvent.args.data,
      );

      const newSafeState = await this._mapSafeSetup({
        safe,
        decodedTransactions,
      });

      await this._notifySafeSetup({
        chainId,
        newSafeState,
        accountsToNotify: subscribedAccounts,
      });
    } catch {
      await this._notifyUnknownTransaction({
        chainId,
        safeAddress,
        accountsToNotify: subscribedAccounts,
      });
    }
  }

  /**
   * Gets all the subscribed accounts to CATEGORY_ACCOUNT_RECOVERY for a given safe
   *
   * @param args.chainId - the chain id where the safe is deployed
   * @param args.safeAddress - the safe address to which the accounts should be retrieved
   *
   * @private
   */
  private async _getSubscribedAccounts(args: {
    chainId: string;
    safeAddress: string;
  }): Promise<Account[]> {
    const accounts = await this.accountRepository.getAccounts({
      chainId: args.chainId,
      safeAddress: args.safeAddress,
      onlyVerified: true,
    });

    const subscribedAccounts = accounts.map(async (account) => {
      const accountSubscriptions =
        await this.subscriptionRepository.getSubscriptions({
          chainId: account.chainId,
          safeAddress: account.safeAddress,
          signer: account.signer,
        });
      return accountSubscriptions.some(
        (subscription) =>
          subscription.key === SubscriptionRepository.CATEGORY_ACCOUNT_RECOVERY,
      )
        ? account
        : null;
    });

    return (await Promise.all(subscribedAccounts)).filter(
      (account): account is Account => account !== null,
    );
  }

  private _decodeTransactionAdded(
    data: Hex,
  ): Array<ReturnType<typeof this._decodeRecoveryTransaction>> {
    try {
      return this.multiSendDecoder
        .mapMultiSendTransactions(data)
        .flatMap((multiSend) => {
          return this._decodeRecoveryTransaction(multiSend.data);
        });
    } catch {
      return [this._decodeRecoveryTransaction(data)];
    }
  }

  private _decodeRecoveryTransaction(
    data: Hex,
  ): ReturnType<typeof this.safeDecoder.decodeFunctionData> {
    const decoded = this.safeDecoder.decodeFunctionData({ data });

    const isRecoveryTransaction = [
      'addOwnerWithThreshold',
      'removeOwner',
      'swapOwner',
      'changeThreshold',
    ].includes(decoded.functionName);

    if (!isRecoveryTransaction) {
      throw new Error('Unknown recovery transaction');
    }

    return decoded;
  }

  private async _mapSafeSetup(args: {
    safe: Safe;
    decodedTransactions: Array<ReturnType<SafeDecoder['decodeFunctionData']>>;
  }): Promise<Safe> {
    return args.decodedTransactions.reduce((newSafe, decodedTransaction) => {
      switch (decodedTransaction.functionName) {
        case 'addOwnerWithThreshold': {
          const [ownerToAdd, newThreshold] = decodedTransaction.args;

          newSafe.owners.push(ownerToAdd);
          newSafe.threshold = Number(newThreshold);
          break;
        }
        case 'removeOwner': {
          const [, ownerToRemove, newThreshold] = decodedTransaction.args;

          newSafe.owners = newSafe.owners.filter((owner) => {
            return owner.toLowerCase() !== ownerToRemove.toLowerCase();
          });
          newSafe.threshold = Number(newThreshold);
          break;
        }
        case 'swapOwner': {
          const [, ownerToRemove, ownerToAdd] = decodedTransaction.args;

          newSafe.owners = newSafe.owners.map((owner) => {
            return owner.toLowerCase() === ownerToRemove.toLowerCase()
              ? ownerToAdd
              : owner;
          });
          break;
        }
        case 'changeThreshold': {
          const [newThreshold] = decodedTransaction.args;

          newSafe.threshold = Number(newThreshold);
          break;
        }
        default: {
          throw new Error(
            `Unknown recovery transaction ${decodedTransaction?.functionName}`,
          );
        }
      }

      return newSafe;
    }, structuredClone(args.safe));
  }

  private async _notifyUnknownTransaction(args: {
    safeAddress: string;
    chainId: string;
    accountsToNotify: Account[];
  }): Promise<void> {
    const chain = await this.chainRepository.getChain(args.chainId);
    const webAppUrl = this.urlGenerator.addressToSafeWebAppUrl({
      chain,
      safeAddress: args.safeAddress,
    });

    const emailActions = args.accountsToNotify.map((account) => {
      const unsubscriptionUrl = this.urlGenerator.unsubscriptionSafeWebAppUrl({
        unsubscriptionToken: account.unsubscriptionToken,
      });
      return this.emailApi.createMessage({
        to: [account.emailAddress.value],
        template: this.configurationService.getOrThrow<string>(
          'email.templates.unknownRecoveryTx',
        ),
        subject: AlertsRepository.UNKNOWN_TX_EMAIL_SUBJECT,
        substitutions: {
          webAppUrl,
          unsubscriptionUrl,
        },
      });
    });

    Promise.allSettled(emailActions)
      .then((results) => {
        results.forEach((result, index) => {
          if (result.status === 'rejected') {
            const signer = args.accountsToNotify.at(index)?.signer;
            this.loggingService.warn(
              `Error sending email to user with account ${signer}, for Safe ${args.safeAddress} on chain ${args.chainId}`,
            );
          }
        });
      })
      .catch((reason) => {
        this.loggingService.warn(reason);
      });
  }

  private async _notifySafeSetup(args: {
    chainId: string;
    newSafeState: Safe;
    accountsToNotify: Account[];
  }): Promise<void> {
    const chain = await this.chainRepository.getChain(args.chainId);

    const webAppUrl = this.urlGenerator.addressToSafeWebAppUrl({
      chain,
      safeAddress: args.newSafeState.address,
    });
    const owners = args.newSafeState.owners.map((address) => {
      return {
        address,
        explorerUrl: this.urlGenerator.addressToExplorerUrl({
          chain,
          address,
        }),
      };
    });

    const emailActions = args.accountsToNotify.map((account) => {
      const unsubscriptionUrl = this.urlGenerator.unsubscriptionSafeWebAppUrl({
        unsubscriptionToken: account.unsubscriptionToken,
      });
      return this.emailApi.createMessage({
        to: [account.emailAddress.value],
        template: this.configurationService.getOrThrow<string>(
          'email.templates.recoveryTx',
        ),
        subject: AlertsRepository.RECOVERY_TX_EMAIL_SUBJECT,
        substitutions: {
          webAppUrl,
          owners,
          threshold: args.newSafeState.threshold.toString(),
          unsubscriptionUrl,
        },
      });
    });

    Promise.allSettled(emailActions)
      .then((results) => {
        results.forEach((result, index) => {
          if (result.status === 'rejected') {
            const signer = args.accountsToNotify.at(index)?.signer;
            this.loggingService.warn(
              `Error sending email to user with account ${signer}, for Safe ${args.newSafeState.address} on chain ${args.chainId}`,
            );
          }
        });
      })
      .catch((reason) => {
        this.loggingService.warn(reason);
      });
  }
}

1	import { Inject, Injectable } from '@nestjs/common';	82✔
2	import { Hex } from 'viem';
3	import { IAlertsRepository } from '@/domain/alerts/alerts.repository.interface';
4	import { IAlertsApi } from '@/domain/interfaces/alerts-api.interface';	82✔
5	import { AlertsRegistration } from '@/domain/alerts/entities/alerts.entity';
6	import { AlertLog } from '@/routes/alerts/entities/alert.dto.entity';
7	import { DelayModifierDecoder } from '@/domain/alerts/contracts/decoders/delay-modifier-decoder.helper';	82✔
8	import { SafeDecoder } from '@/domain/contracts/decoders/safe-decoder.helper';	82✔
9	import { MultiSendDecoder } from '@/domain/contracts/decoders/multi-send-decoder.helper';	82✔
10	import { IEmailApi } from '@/domain/interfaces/email-api.interface';	82✔
11	import { IAccountRepository } from '@/domain/account/account.repository.interface';	82✔
12	import { ILoggingService, LoggingService } from '@/logging/logging.interface';	82✔
13	import { IConfigurationService } from '@/config/configuration.service.interface';	82✔
14	import { ISafeRepository } from '@/domain/safe/safe.repository.interface';	82✔
15	import { Safe } from '@/domain/safe/entities/safe.entity';
16	import { UrlGeneratorHelper } from '@/domain/alerts/urls/url-generator.helper';	82✔
17	import { IChainsRepository } from '@/domain/chains/chains.repository.interface';	82✔
18	import { ISubscriptionRepository } from '@/domain/subscriptions/subscription.repository.interface';	82✔
19	import { SubscriptionRepository } from '@/domain/subscriptions/subscription.repository';	82✔
20	import { Account } from '@/domain/account/entities/account.entity';
21
22	@Injectable()
23	export class AlertsRepository implements IAlertsRepository {	82✔
24	private static readonly UNKNOWN_TX_EMAIL_SUBJECT = 'Malicious transaction';	82✔
25	private static readonly RECOVERY_TX_EMAIL_SUBJECT = 'Recovery attempt';	82✔
26
27	constructor(
28	@Inject(IAlertsApi)
29	private readonly alertsApi: IAlertsApi,	1,022✔
30	@Inject(IEmailApi)
31	private readonly emailApi: IEmailApi,	1,022✔
32	@Inject(IAccountRepository)
33	private readonly accountRepository: IAccountRepository,	1,022✔
34	private readonly urlGenerator: UrlGeneratorHelper,	1,022✔
35	private readonly delayModifierDecoder: DelayModifierDecoder,	1,022✔
36	private readonly safeDecoder: SafeDecoder,	1,022✔
37	private readonly multiSendDecoder: MultiSendDecoder,	1,022✔
38	@Inject(LoggingService)
39	private readonly loggingService: ILoggingService,	1,022✔
40	@Inject(IConfigurationService)
41	private readonly configurationService: IConfigurationService,	1,022✔
42	@Inject(ISafeRepository)
43	private readonly safeRepository: ISafeRepository,	1,022✔
44	@Inject(IChainsRepository)
45	private readonly chainRepository: IChainsRepository,	1,022✔
46	@Inject(ISubscriptionRepository)
47	private readonly subscriptionRepository: ISubscriptionRepository,	1,022✔
48	) {}
49
50	async addContract(contract: AlertsRegistration): Promise<void> {
51	await this.alertsApi.addContract(contract);	6✔
52	}
53
54	async handleAlertLog(chainId: string, log: AlertLog): Promise<void> {
55	const moduleAddress = log.address;	48✔
56
57	const { safes } = await this.safeRepository.getSafesByModule({	48✔
58	chainId,
59	moduleAddress,
60	});
61
62	if (safes.length === 0) {	32!
UNCOV 63	this.loggingService.debug(	×
64	`An alert for a module that is not activated on a Safe was received. moduleAddress=${moduleAddress}`,
65	);
UNCOV 66	return;	×
67	}
68
69	// Recovery module is deployed per Safe so we can assume that it is only enabled on one
70	const safeAddress = safes[0];	32✔
71	const subscribedAccounts = await this._getSubscribedAccounts({	32✔
72	chainId,
73	safeAddress,
74	});
75	if (subscribedAccounts.length === 0) {	32✔
76	this.loggingService.debug(	2✔
77	`An alert for a Safe with no associated emails was received. moduleAddress=${moduleAddress}, safeAddress=${safeAddress}`,
78	);
79	return;	2✔
80	}
81
82	try {	30✔
83	const safe = await this.safeRepository.getSafe({	30✔
84	chainId,
85	address: safeAddress,
86	});
87
88	const decodedEvent = this.delayModifierDecoder.decodeEventLog({	30✔
89	data: log.data as Hex,
90	topics: log.topics as [Hex, Hex, Hex],
91	});
92	const decodedTransactions = this._decodeTransactionAdded(	30✔
93	decodedEvent.args.data,
94	);
95
96	const newSafeState = await this._mapSafeSetup({	18✔
97	safe,
98	decodedTransactions,
99	});
100
101	await this._notifySafeSetup({	18✔
102	chainId,
103	newSafeState,
104	accountsToNotify: subscribedAccounts,
105	});
106	} catch {
107	await this._notifyUnknownTransaction({	12✔
108	chainId,
109	safeAddress,
110	accountsToNotify: subscribedAccounts,
111	});
112	}
113	}
114
115	/**
116	* Gets all the subscribed accounts to CATEGORY_ACCOUNT_RECOVERY for a given safe
117	*
118	* @param args.chainId - the chain id where the safe is deployed
119	* @param args.safeAddress - the safe address to which the accounts should be retrieved
120	*
121	* @private
122	*/
123	private async _getSubscribedAccounts(args: {
124	chainId: string;
125	safeAddress: string;
126	}): Promise<Account[]> {
127	const accounts = await this.accountRepository.getAccounts({	32✔
128	chainId: args.chainId,
129	safeAddress: args.safeAddress,
130	onlyVerified: true,
131	});
132
133	const subscribedAccounts = accounts.map(async (account) => {	32✔
134	const accountSubscriptions =
135	await this.subscriptionRepository.getSubscriptions({	38✔
136	chainId: account.chainId,
137	safeAddress: account.safeAddress,
138	signer: account.signer,
139	});
140	return accountSubscriptions.some(	38✔
141	(subscription) =>
142	subscription.key === SubscriptionRepository.CATEGORY_ACCOUNT_RECOVERY,	38✔
143	)
144	? account
145	: null;
146	});
147
148	return (await Promise.all(subscribedAccounts)).filter(	32✔
149	(account): account is Account => account !== null,	38✔
150	);
151	}
152
153	private _decodeTransactionAdded(
154	data: Hex,
155	): Array<ReturnType<typeof this._decodeRecoveryTransaction>> {
156	try {	30✔
157	return this.multiSendDecoder	30✔
158	.mapMultiSendTransactions(data)
159	.flatMap((multiSend) => {
160	return this._decodeRecoveryTransaction(multiSend.data);	16✔
161	});
162	} catch {
163	return [this._decodeRecoveryTransaction(data)];	28✔
164	}
165	}
166
167	private _decodeRecoveryTransaction(
168	data: Hex,
169	): ReturnType<typeof this.safeDecoder.decodeFunctionData> {
170	const decoded = this.safeDecoder.decodeFunctionData({ data });	44✔
171
172	const isRecoveryTransaction = [	38✔
173	'addOwnerWithThreshold',
174	'removeOwner',
175	'swapOwner',
176	'changeThreshold',
177	].includes(decoded.functionName);
178
179	if (!isRecoveryTransaction) {	38✔
180	throw new Error('Unknown recovery transaction');	12✔
181	}
182
183	return decoded;	26✔
184	}
185
186	private async _mapSafeSetup(args: {
187	safe: Safe;
188	decodedTransactions: Array<ReturnType<SafeDecoder['decodeFunctionData']>>;
189	}): Promise<Safe> {
190	return args.decodedTransactions.reduce((newSafe, decodedTransaction) => {	18✔
191	switch (decodedTransaction.functionName) {	20!
192	case 'addOwnerWithThreshold': {
193	const [ownerToAdd, newThreshold] = decodedTransaction.args;	12✔
194
195	newSafe.owners.push(ownerToAdd);	12✔
196	newSafe.threshold = Number(newThreshold);	12✔
197	break;	12✔
198	}
199	case 'removeOwner': {
200	const [, ownerToRemove, newThreshold] = decodedTransaction.args;	4✔
201
202	newSafe.owners = newSafe.owners.filter((owner) => {	4✔
203	return owner.toLowerCase() !== ownerToRemove.toLowerCase();	14✔
204	});
205	newSafe.threshold = Number(newThreshold);	4✔
206	break;	4✔
207	}
208	case 'swapOwner': {
209	const [, ownerToRemove, ownerToAdd] = decodedTransaction.args;	2✔
210
211	newSafe.owners = newSafe.owners.map((owner) => {	2✔
212	return owner.toLowerCase() === ownerToRemove.toLowerCase()	6✔
213	? ownerToAdd
214	: owner;
215	});
216	break;	2✔
217	}
218	case 'changeThreshold': {
219	const [newThreshold] = decodedTransaction.args;	2✔
220
221	newSafe.threshold = Number(newThreshold);	2✔
222	break;	2✔
223	}
224	default: {
UNCOV 225	throw new Error(	×
226	`Unknown recovery transaction ${decodedTransaction?.functionName}`,	×
227	);
228	}
229	}
230
231	return newSafe;	20✔
232	}, structuredClone(args.safe));
233	}
234
235	private async _notifyUnknownTransaction(args: {
236	safeAddress: string;
237	chainId: string;
238	accountsToNotify: Account[];
239	}): Promise<void> {
240	const chain = await this.chainRepository.getChain(args.chainId);	12✔
241	const webAppUrl = this.urlGenerator.addressToSafeWebAppUrl({	12✔
242	chain,
243	safeAddress: args.safeAddress,
244	});
245
246	const emailActions = args.accountsToNotify.map((account) => {	12✔
247	const unsubscriptionUrl = this.urlGenerator.unsubscriptionSafeWebAppUrl({	12✔
248	unsubscriptionToken: account.unsubscriptionToken,
249	});
250	return this.emailApi.createMessage({	12✔
251	to: [account.emailAddress.value],
252	template: this.configurationService.getOrThrow<string>(
253	'email.templates.unknownRecoveryTx',
254	),
255	subject: AlertsRepository.UNKNOWN_TX_EMAIL_SUBJECT,
256	substitutions: {
257	webAppUrl,
258	unsubscriptionUrl,
259	},
260	});
261	});
262
263	Promise.allSettled(emailActions)	12✔
264	.then((results) => {
265	results.forEach((result, index) => {	12✔
266	if (result.status === 'rejected') {	12!
UNCOV 267	const signer = args.accountsToNotify.at(index)?.signer;	×
UNCOV 268	this.loggingService.warn(	×
269	`Error sending email to user with account ${signer}, for Safe ${args.safeAddress} on chain ${args.chainId}`,
270	);
271	}
272	});
273	})
274	.catch((reason) => {
UNCOV 275	this.loggingService.warn(reason);	×
276	});
277	}
278
279	private async _notifySafeSetup(args: {
280	chainId: string;
281	newSafeState: Safe;
282	accountsToNotify: Account[];
283	}): Promise<void> {
284	const chain = await this.chainRepository.getChain(args.chainId);	18✔
285
286	const webAppUrl = this.urlGenerator.addressToSafeWebAppUrl({	18✔
287	chain,
288	safeAddress: args.newSafeState.address,
289	});
290	const owners = args.newSafeState.owners.map((address) => {	18✔
291	return {	38✔
292	address,
293	explorerUrl: this.urlGenerator.addressToExplorerUrl({
294	chain,
295	address,
296	}),
297	};
298	});
299
300	const emailActions = args.accountsToNotify.map((account) => {	18✔
301	const unsubscriptionUrl = this.urlGenerator.unsubscriptionSafeWebAppUrl({	22✔
302	unsubscriptionToken: account.unsubscriptionToken,
303	});
304	return this.emailApi.createMessage({	22✔
305	to: [account.emailAddress.value],
306	template: this.configurationService.getOrThrow<string>(
307	'email.templates.recoveryTx',
308	),
309	subject: AlertsRepository.RECOVERY_TX_EMAIL_SUBJECT,
310	substitutions: {
311	webAppUrl,
312	owners,
313	threshold: args.newSafeState.threshold.toString(),
314	unsubscriptionUrl,
315	},
316	});
317	});
318
319	Promise.allSettled(emailActions)	18✔
320	.then((results) => {
321	results.forEach((result, index) => {	18✔
322	if (result.status === 'rejected') {	22!
UNCOV 323	const signer = args.accountsToNotify.at(index)?.signer;	×
UNCOV 324	this.loggingService.warn(	×
325	`Error sending email to user with account ${signer}, for Safe ${args.newSafeState.address} on chain ${args.chainId}`,
326	);
327	}
328	});
329	})
330	.catch((reason) => {
UNCOV 331	this.loggingService.warn(reason);	×
332	});
333	}
334	}

safe-global / safe-client-gateway / 8114021061

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous