24610434941

Committed 18 Apr 2026 05:52PM UTC coverage: 65.886% (+3.1%) from 62.807%

Build # 24610434941

Build Type

push

github

Committed by

web-flow

Commit Message

fix: OpenNode callback accepts unauthenticated requests (#454)

* fix: parse form-encoded body on OpenNode callback route

* fix: validate OpenNode webhook signature before processing

* test: add unit tests for OpenNode callback controller and route

* fix: align amountPaid and test missing OPENNODE_API_KEY

* fix: reject malformed OpenNode hashed_order

* fix: avoid logging sensitive OpenNode callback fields

* fix: validate opennode callback body with zod

* test: add opennode callback integration scenarios

* test: verify paid opennode callback completes invoice

---------

Co-authored-by: Ricardo Cabral <me@ricardocabral.io>

Coverage Stats

857 of 1395 branches covered (61.43%)

Branch coverage included in aggregate %.

42 of 42 new or added lines in 3 files covered. (100.0%)

404 existing lines in 37 files now uncovered.

2239 of 3304 relevant lines covered (67.77%)

10.58 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

77.78

/src/utils/transform.ts

import {
  always,
  applySpec,
  cond,
  equals,
  ifElse,
  is,
  isNil,
  multiply,
  path,
  pathSatisfies,
  pipe,
  prop,
  propSatisfies,
  T,
} from 'ramda'
import { bech32 } from 'bech32'

import { Invoice, InvoiceStatus, InvoiceUnit } from '../@types/invoice'
import { User } from '../@types/user'

export const toJSON = (input: any) => JSON.stringify(input)

export const toBuffer = (input: any) => Buffer.from(input, 'hex')

export const fromBuffer = (input: Buffer) => input.toString('hex')

export const toBigInt = (input: string | number): bigint => BigInt(input)

export const fromBigInt = (input: bigint) => input.toString()

const addTime = (ms: number) => (input: Date) => new Date(input.getTime() + ms)

export const fromDBInvoice = applySpec<Invoice>({
  id: prop('id') as () => string,
  pubkey: pipe(prop('pubkey') as () => Buffer, fromBuffer),
  bolt11: prop('bolt11'),
  amountRequested: pipe(prop('amount_requested') as () => string, toBigInt),
  amountPaid: ifElse(
    propSatisfies(isNil, 'amount_paid'),
    always(undefined),
    pipe(prop('amount_paid') as () => string, toBigInt),
  ),
  unit: prop('unit'),
  status: prop('status'),
  description: prop('description'),
  confirmedAt: prop('confirmed_at'),
  expiresAt: prop('expires_at'),
  updatedAt: prop('updated_at'),
  createdAt: prop('created_at'),
  verifyURL: prop('verify_url'),
})

export const fromDBUser = applySpec<User>({
  pubkey: pipe(prop('pubkey') as () => Buffer, fromBuffer),
  isAdmitted: prop('is_admitted'),
  isVanished: prop('is_vanished'),
  balance: prop('balance'),
  createdAt: prop('created_at'),
  updatedAt: prop('updated_at'),
})

export const fromBech32 = (input: string) => {
  const { prefix, words } = bech32.decode(input)
  if (!input.startsWith(prefix)) {
    throw new Error(`Bech32 invalid prefix: ${prefix}`)
  }

  return Buffer.from(bech32.fromWords(words).slice(0, 32)).toString('hex')
}

export const toBech32 =
  (prefix: string) =>
  (input: string): string => {
    return bech32.encode(prefix, bech32.toWords(Buffer.from(input, 'hex')))
  }

export const toDate = (input: string | number) => new Date(input)

export const fromZebedeeInvoice = applySpec<Invoice>({
  id: prop('id'),
  pubkey: prop('internalId'),
  bolt11: path(['invoice', 'request']),
  amountRequested: pipe(prop('amount') as () => string, toBigInt),
  description: prop('description'),
  unit: prop('unit'),
  status: prop('status'),
  expiresAt: ifElse(propSatisfies(is(String), 'expiresAt'), pipe(prop('expiresAt'), toDate), always(null)),
  confirmedAt: ifElse(propSatisfies(is(String), 'confirmedAt'), pipe(prop('confirmedAt'), toDate), always(null)),
  createdAt: ifElse(propSatisfies(is(String), 'createdAt'), pipe(prop('createdAt'), toDate), always(null)),
  rawResponse: toJSON,
})

export const fromNodelessInvoice = applySpec<Invoice>({
  id: prop('id'),
  pubkey: path(['metadata', 'requestId']),
  bolt11: prop('lightningInvoice'),
  amountRequested: pipe(prop('satsAmount') as () => number, toBigInt),
  description: path(['metadata', 'description']),
  unit: path(['metadata', 'unit']),
  status: pipe(
    prop('status'),
    cond([
      [equals('new'), always(InvoiceStatus.PENDING)],
      [equals('pending_confirmation'), always(InvoiceStatus.PENDING)],
      [equals('underpaid'), always(InvoiceStatus.PENDING)],
      [equals('in_flight'), always(InvoiceStatus.PENDING)],
      [equals('paid'), always(InvoiceStatus.COMPLETED)],
      [equals('overpaid'), always(InvoiceStatus.COMPLETED)],
      [equals('expired'), always(InvoiceStatus.EXPIRED)],
    ]),
  ),
  expiresAt: ifElse(
    propSatisfies(is(String), 'expiresAt'),
    pipe(prop('expiresAt'), toDate),
    ifElse(propSatisfies(is(String), 'createdAt'), pipe(prop('createdAt'), toDate, addTime(15 * 60000)), always(null)),
  ),
  confirmedAt: cond([
    [propSatisfies(is(String), 'paidAt'), pipe(prop('paidAt'), toDate)],
    [T, always(null)],
  ]),
  createdAt: ifElse(propSatisfies(is(String), 'createdAt'), pipe(prop('createdAt'), toDate), always(null)),
  // rawResponse: toJSON,
})

export const fromOpenNodeInvoice = applySpec<Invoice>({
  id: prop('id'),
  pubkey: prop('order_id'),
  bolt11: ifElse(
    pathSatisfies(is(String), ['lightning_invoice', 'payreq']),
    path(['lightning_invoice', 'payreq']),
    path(['lightning', 'payreq']),
  ),
  amountRequested: pipe(
    ifElse(propSatisfies(is(Number), 'amount'), prop('amount'), prop('price')) as () => number,
    toBigInt,
  ),
  description: prop('description'),
  unit: always(InvoiceUnit.SATS),
  status: pipe(
    prop('status'),
    cond([
      [equals('expired'), always(InvoiceStatus.EXPIRED)],
      [equals('refunded'), always(InvoiceStatus.EXPIRED)],
      [equals('unpaid'), always(InvoiceStatus.PENDING)],
      [equals('processing'), always(InvoiceStatus.PENDING)],
      [equals('underpaid'), always(InvoiceStatus.PENDING)],
      [equals('paid'), always(InvoiceStatus.COMPLETED)],
    ]),
  ),
  expiresAt: pipe(
    cond([
      [pathSatisfies(is(String), ['lightning', 'expires_at']), path(['lightning', 'expires_at'])],
      [
        pathSatisfies(is(Number), ['lightning_invoice', 'expires_at']),
        pipe(path(['lightning_invoice', 'expires_at']), multiply(1000)),
      ],
    ]),
    toDate,
  ),
  confirmedAt: cond([
    [propSatisfies(equals('paid'), 'status'), () => new Date()],
    [T, always(null)],
  ]),
  createdAt: pipe(
    ifElse(propSatisfies(is(Number), 'created_at'), pipe(prop('created_at'), multiply(1000)), prop('created_at')),
    toDate,
  ),
  rawResponse: toJSON,
})

1	import {	2✔
2	always,
3	applySpec,
4	cond,
5	equals,
6	ifElse,
7	is,
8	isNil,
9	multiply,
10	path,
11	pathSatisfies,
12	pipe,
13	prop,
14	propSatisfies,
15	T,
16	} from 'ramda'
17	import { bech32 } from 'bech32'	2✔
18
19	import { Invoice, InvoiceStatus, InvoiceUnit } from '../@types/invoice'	2✔
20	import { User } from '../@types/user'
21
22	export const toJSON = (input: any) => JSON.stringify(input)	33✔
23
24	export const toBuffer = (input: any) => Buffer.from(input, 'hex')	337✔
25
26	export const fromBuffer = (input: Buffer) => input.toString('hex')	117✔
27
28	export const toBigInt = (input: string \| number): bigint => BigInt(input)	11✔
29
30	export const fromBigInt = (input: bigint) => input.toString()	2✔
31
32	const addTime = (ms: number) => (input: Date) => new Date(input.getTime() + ms)	5✔
33
34	export const fromDBInvoice = applySpec<Invoice>({	2✔
35	id: prop('id') as () => string,
36	pubkey: pipe(prop('pubkey') as () => Buffer, fromBuffer),
37	bolt11: prop('bolt11'),
38	amountRequested: pipe(prop('amount_requested') as () => string, toBigInt),
39	amountPaid: ifElse(
40	propSatisfies(isNil, 'amount_paid'),
41	always(undefined),
42	pipe(prop('amount_paid') as () => string, toBigInt),
43	),
44	unit: prop('unit'),
45	status: prop('status'),
46	description: prop('description'),
47	confirmedAt: prop('confirmed_at'),
48	expiresAt: prop('expires_at'),
49	updatedAt: prop('updated_at'),
50	createdAt: prop('created_at'),
51	verifyURL: prop('verify_url'),
52	})
53
54	export const fromDBUser = applySpec<User>({	2✔
55	pubkey: pipe(prop('pubkey') as () => Buffer, fromBuffer),
56	isAdmitted: prop('is_admitted'),
57	isVanished: prop('is_vanished'),
58	balance: prop('balance'),
59	createdAt: prop('created_at'),
60	updatedAt: prop('updated_at'),
61	})
62
63	export const fromBech32 = (input: string) => {	2✔
64	const { prefix, words } = bech32.decode(input)	1✔
UNCOV 65	if (!input.startsWith(prefix)) {	×
UNCOV 66	throw new Error(`Bech32 invalid prefix: ${prefix}`)	×
67	}
68
UNCOV 69	return Buffer.from(bech32.fromWords(words).slice(0, 32)).toString('hex')	×
70	}
71
72	export const toBech32 =	2✔
73	(prefix: string) =>	2✔
74	(input: string): string => {	8✔
75	return bech32.encode(prefix, bech32.toWords(Buffer.from(input, 'hex')))	8✔
76	}
77
78	export const toDate = (input: string \| number) => new Date(input)	17✔
79
80	export const fromZebedeeInvoice = applySpec<Invoice>({	2✔
81	id: prop('id'),
82	pubkey: prop('internalId'),
83	bolt11: path(['invoice', 'request']),
84	amountRequested: pipe(prop('amount') as () => string, toBigInt),
85	description: prop('description'),
86	unit: prop('unit'),
87	status: prop('status'),
88	expiresAt: ifElse(propSatisfies(is(String), 'expiresAt'), pipe(prop('expiresAt'), toDate), always(null)),
89	confirmedAt: ifElse(propSatisfies(is(String), 'confirmedAt'), pipe(prop('confirmedAt'), toDate), always(null)),
90	createdAt: ifElse(propSatisfies(is(String), 'createdAt'), pipe(prop('createdAt'), toDate), always(null)),
91	rawResponse: toJSON,
92	})
93
94	export const fromNodelessInvoice = applySpec<Invoice>({	2✔
95	id: prop('id'),
96	pubkey: path(['metadata', 'requestId']),
97	bolt11: prop('lightningInvoice'),
98	amountRequested: pipe(prop('satsAmount') as () => number, toBigInt),
99	description: path(['metadata', 'description']),
100	unit: path(['metadata', 'unit']),
101	status: pipe(
102	prop('status'),
103	cond([
104	[equals('new'), always(InvoiceStatus.PENDING)],
105	[equals('pending_confirmation'), always(InvoiceStatus.PENDING)],
106	[equals('underpaid'), always(InvoiceStatus.PENDING)],
107	[equals('in_flight'), always(InvoiceStatus.PENDING)],
108	[equals('paid'), always(InvoiceStatus.COMPLETED)],
109	[equals('overpaid'), always(InvoiceStatus.COMPLETED)],
110	[equals('expired'), always(InvoiceStatus.EXPIRED)],
111	]),
112	),
113	expiresAt: ifElse(
114	propSatisfies(is(String), 'expiresAt'),
115	pipe(prop('expiresAt'), toDate),
116	ifElse(propSatisfies(is(String), 'createdAt'), pipe(prop('createdAt'), toDate, addTime(15 * 60000)), always(null)),
117	),
118	confirmedAt: cond([
119	[propSatisfies(is(String), 'paidAt'), pipe(prop('paidAt'), toDate)],
120	[T, always(null)],
121	]),
122	createdAt: ifElse(propSatisfies(is(String), 'createdAt'), pipe(prop('createdAt'), toDate), always(null)),
123	// rawResponse: toJSON,
124	})
125
126	export const fromOpenNodeInvoice = applySpec<Invoice>({	2✔
127	id: prop('id'),
128	pubkey: prop('order_id'),
129	bolt11: ifElse(
130	pathSatisfies(is(String), ['lightning_invoice', 'payreq']),
131	path(['lightning_invoice', 'payreq']),
132	path(['lightning', 'payreq']),
133	),
134	amountRequested: pipe(
135	ifElse(propSatisfies(is(Number), 'amount'), prop('amount'), prop('price')) as () => number,
136	toBigInt,
137	),
138	description: prop('description'),
139	unit: always(InvoiceUnit.SATS),
140	status: pipe(
141	prop('status'),
142	cond([
143	[equals('expired'), always(InvoiceStatus.EXPIRED)],
144	[equals('refunded'), always(InvoiceStatus.EXPIRED)],
145	[equals('unpaid'), always(InvoiceStatus.PENDING)],
146	[equals('processing'), always(InvoiceStatus.PENDING)],
147	[equals('underpaid'), always(InvoiceStatus.PENDING)],
148	[equals('paid'), always(InvoiceStatus.COMPLETED)],
149	]),
150	),
151	expiresAt: pipe(
152	cond([
153	[pathSatisfies(is(String), ['lightning', 'expires_at']), path(['lightning', 'expires_at'])],
154	[
155	pathSatisfies(is(Number), ['lightning_invoice', 'expires_at']),
156	pipe(path(['lightning_invoice', 'expires_at']), multiply(1000)),
157	],
158	]),
159	toDate,
160	),
161	confirmedAt: cond([
UNCOV 162	[propSatisfies(equals('paid'), 'status'), () => new Date()],	×
163	[T, always(null)],
164	]),
165	createdAt: pipe(
166	ifElse(propSatisfies(is(Number), 'created_at'), pipe(prop('created_at'), multiply(1000)), prop('created_at')),
167	toDate,
168	),
169	rawResponse: toJSON,
170	})

cameri / nostream / 24610434941

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous