Merge pull request #124 from Permissionless-Software-Foundation/ct-unstable

fix(blockbook): Removing final piece of blockbook

apidoc.json

@@ -0,0 +1,4 @@
+{
+    "sampleUrl": null
+
+  }

config/index.js

@@ -10,13 +10,18 @@ const config = {
     : 'secret-jwt-token',
 
   // Rate Limits
-  anonRateLimit: process.env.ANON_RATE_LIMIT ? Number(process.env.ANON_RATE_LIMIT) : 50,
+  anonRateLimit: process.env.ANON_RATE_LIMIT
+    ? Number(process.env.ANON_RATE_LIMIT)
+    : 500,
   whitelistRateLimit: process.env.WHITELIST_RATE_LIMIT
     ? Number(process.env.WHITELIST_RATE_LIMIT)
     : 10,
+  pointsPerMinute: process.env.POINTS_PER_MINUTE
+    ? Number(process.env.POINTS_PER_MINUTE)
+    : 10000,
   whitelistDomains: process.env.WHITELIST_DOMAINS
     ? process.env.WHITELIST_DOMAINS.split(',')
-    : ['fullstack.cash', 'psfoundation.cash']
+    : ['fullstack.cash', 'psfoundation.cash', '10.0.']
 }
 
 module.exports = config

package-lock.json

@@ -395,9 +395,9 @@
       }
     },
     "@psf/bch-js": {
-      "version": "4.15.21",
-      "resolved": "https://registry.npmjs.org/@psf/bch-js/-/bch-js-4.15.21.tgz",
-      "integrity": "sha512-htwod6Xa9Gbn21/EOJe2BhqcrD8bJaEOCHpLC9L6FcWPt4/sFxaRqeiPt55uljOCZwCIQk9KLIhIDWY0sgRycA==",
+      "version": "4.17.6",
+      "resolved": "https://registry.npmjs.org/@psf/bch-js/-/bch-js-4.17.6.tgz",
+      "integrity": "sha512-dXR3S7wHZEivB/1LvvuBaAxn8FRRQpBrLtLcuL8c1J9v82xMO+qVr6AwvsOjFzHmcswuT1jlzQ3X1XPAaRgb5w==",
       "requires": {
         "@psf/bip21": "^2.0.1",
         "@psf/bip32-utils": "^1.0.0",
@@ -931,23 +931,23 @@
       }
     },
     "@uppy/companion-client": {
-      "version": "1.8.2",
-      "resolved": "https://registry.npmjs.org/@uppy/companion-client/-/companion-client-1.8.2.tgz",
-      "integrity": "sha512-FBjAJU3xaWRqYXDBlrMDQKlRBqi4Ng54Dmnoe3hGSggfgBQAl9RzRAg0WvrGjaK3QjCTZPhzSdTpBrqDP22Rng==",
+      "version": "1.8.3",
+      "resolved": "https://registry.npmjs.org/@uppy/companion-client/-/companion-client-1.8.3.tgz",
+      "integrity": "sha512-IieE5DMmJC1rJrXHB2u1cO+r3BF7VqnezFAZj8gkNm7zBuplswKALlvwnXI+KU3TNs8isU55xK5yfF0ecglIEw==",
       "requires": {
-        "@uppy/utils": "^3.4.1",
+        "@uppy/utils": "^3.4.2",
         "namespace-emitter": "^2.0.1",
         "qs-stringify": "^1.1.0"
       }
     },
     "@uppy/core": {
-      "version": "1.16.1",
-      "resolved": "https://registry.npmjs.org/@uppy/core/-/core-1.16.1.tgz",
-      "integrity": "sha512-GI8baCa1S21j7KoCq0LK4MLD6sII8OvWVgp+auXNcZIbKa182dOMQRtk7bXVY0OzS1TxkIq0DAzDEUnP7MbnDg==",
+      "version": "1.16.2",
+      "resolved": "https://registry.npmjs.org/@uppy/core/-/core-1.16.2.tgz",
+      "integrity": "sha512-JWK03gXiMMZ+lSVj+v9FIFEOUbKyvRX4v2kaYhf0NqD1MssCwMQe4mvL2MNzjOaYFBwMRacDJh8Mvz2gbu2Vqw==",
       "requires": {
         "@transloadit/prettier-bytes": "0.0.7",
         "@uppy/store-default": "^1.2.5",
-        "@uppy/utils": "^3.4.1",
+        "@uppy/utils": "^3.4.2",
         "cuid": "^2.1.1",
         "lodash.throttle": "^4.1.1",
         "mime-match": "^1.0.2",
@@ -961,19 +961,19 @@
       "integrity": "sha512-jnf0U8cfb8Bhgt6yh86YRJO9EEnCyG9BgXZ8dPWWLybgC9Expw3Ah/s3T21tcdChgv4zzdhSACd0JKxCQowyYg=="
     },
     "@uppy/tus": {
-      "version": "1.8.5",
-      "resolved": "https://registry.npmjs.org/@uppy/tus/-/tus-1.8.5.tgz",
-      "integrity": "sha512-a5z+bpAyKKKRWNSOYtIMd2EAKsM7BLhd6hQg2YrQNFFzdwbxaeqmrjKIVW1EUBvg1if/ZZePEm0QevJvNwQs0g==",
+      "version": "1.8.6",
+      "resolved": "https://registry.npmjs.org/@uppy/tus/-/tus-1.8.6.tgz",
+      "integrity": "sha512-axK+TzRRvSkYZUIjfe6XCjfO5NPb/k8AC73p+MOKOzth1JHSZSJHqYi8+HY7T4aXgR86vWE/cE+wHsjvPhyCZw==",
       "requires": {
-        "@uppy/companion-client": "^1.8.2",
-        "@uppy/utils": "^3.4.1",
+        "@uppy/companion-client": "^1.8.3",
+        "@uppy/utils": "^3.4.2",
         "tus-js-client": "^2.1.1"
       }
     },
     "@uppy/utils": {
-      "version": "3.4.1",
-      "resolved": "https://registry.npmjs.org/@uppy/utils/-/utils-3.4.1.tgz",
-      "integrity": "sha512-9YVKjVRK/AmX3yV0GJsD5p/eHUzqn4+eXzsjv3wHahipKCo0o7Jwpw/7kl+bv12EHOOy5jPsATWkjn40aSWW8w==",
+      "version": "3.4.2",
+      "resolved": "https://registry.npmjs.org/@uppy/utils/-/utils-3.4.2.tgz",
+      "integrity": "sha512-PWLZgX4L+0tdBqImncuATDYb1M6RHgDfGDZCh2Qg+PTG+btyyZ4/GkOEwK5fJ4Gw1gNgWF0ewAFL28+oCrD7/Q==",
       "requires": {
         "abortcontroller-polyfill": "^1.4.0",
         "lodash.throttle": "^4.1.1"
@@ -5592,6 +5592,12 @@
       "integrity": "sha1-+CbJtOKoUR2E46yinbBeGk87cqk=",
       "dev": true
     },
+    "lodash.clonedeep": {
+      "version": "4.5.0",
+      "resolved": "https://registry.npmjs.org/lodash.clonedeep/-/lodash.clonedeep-4.5.0.tgz",
+      "integrity": "sha1-4j8/nE+Pvd6HJSnBBxhXoIblzO8=",
+      "dev": true
+    },
     "lodash.defaults": {
       "version": "4.2.0",
       "resolved": "https://registry.npmjs.org/lodash.defaults/-/lodash.defaults-4.2.0.tgz",
@@ -10924,9 +10930,12 @@
       "dev": true
     },
     "qs": {
-      "version": "6.9.6",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.9.6.tgz",
-      "integrity": "sha512-TIRk4aqYLNoJUbd+g2lEdz5kLWIuTMRagAXxl78Q0RiVjAOugHmeKNGdd3cwo/ktpf9aL9epCfFqWDEKysUlLQ=="
+      "version": "6.10.1",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.10.1.tgz",
+      "integrity": "sha512-M528Hph6wsSVOBiYUnGf+K/7w0hNshs/duGsNXPUCLH5XAqjEtiPGwNONLV0tBH8NoGb0mvD5JubnUTrujKDTg==",
+      "requires": {
+        "side-channel": "^1.0.4"
+      }
     },
     "qs-stringify": {
       "version": "1.2.1",
@@ -12884,9 +12893,9 @@
       }
     },
     "tape": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/tape/-/tape-5.2.1.tgz",
-      "integrity": "sha512-pjrC4M7OUCndgKNJ9AEy/WCfOd8Voux6pD/WlzRi0855ZZa66nPFlisCtPixA5Phh/V/tu6v8Q1cNRND9AcYMA==",
+      "version": "5.2.2",
+      "resolved": "https://registry.npmjs.org/tape/-/tape-5.2.2.tgz",
+      "integrity": "sha512-grXrzPC1ly2kyTMKdqxh5GiLpb0BpNctCuecTB0psHX4Gu0nc+uxWR4xKjTh/4CfQlH4zhvTM2/EXmHXp6v/uA==",
       "requires": {
         "call-bind": "^1.0.2",
         "deep-equal": "^2.0.5",

package.json

@@ -22,14 +22,14 @@
     "coverage": "nyc report --reporter=text-lcov | coveralls",
     "coverage:report": "export NETWORK=mainnet && nyc --reporter=html mocha --timeout 25000 test/v4/",
     "docs": "./node_modules/.bin/apidoc -i src/routes/v4 -o docs",
-    "test:temp1": "export NETWORK=mainnet && export TEST=integration && mocha --exit --timeout 25000 -g '#hydrateUtxosWL' test/v4/integration/",
-    "test:temp2": "mocha test/v4/rate-limits.js"
+    "test:temp1": "export NETWORK=mainnet && export TEST=integration && mocha --exit --timeout 25000 -g '#hydrateUtxos-' test/v4/integration/",
+    "test:temp2": "mocha test/v4/rate-limit2-unit.js"
   },
   "engines": {
     "node": ">=10.15.1"
   },
   "dependencies": {
-    "@psf/bch-js": "^4.15.21",
+    "@psf/bch-js": "^4.17.6",
     "apidoc": "^0.26.0",
     "axios": "^0.21.1",
     "bitcore-lib-cash": "^8.23.1",
@@ -66,6 +66,7 @@
     "eslint-plugin-prettier": "^3.1.0",
     "eslint-plugin-standard": "^4.0.0",
     "fs-extra": "^9.0.0",
+    "lodash.clonedeep": "^4.5.0",
     "nock": "^13.0.5",
     "nyc": "^15.0.0",
     "prettier": "^2.0.0",

src/app.js

@@ -3,7 +3,6 @@
 const express = require('express')
 
 // Middleware
-// const { routeRateLimit } = require("./middleware/route-ratelimit")
 const RateLimits = require('./middleware/route-ratelimit')
 const rateLimits = new RateLimits()
 
@@ -96,17 +95,36 @@ app.use('/', logReqInfo)
 
 const v4prefix = 'v4'
 
-// Inspect the header for a JWT token.
-app.use(`/${v4prefix}/`, jwtAuth.getTokenFromHeaders)
-
-// Instantiate the authorization middleware, used to implement pro-tier rate limiting.
-// Handles Anonymous and Basic Authorization schemes used by passport.js
+// START Rate Limits
 const auth = new AuthMW()
-app.use(`/${v4prefix}/`, auth.mw())
 
-// Rate limit on all v4 routes
-// Establish and enforce rate limits.
-app.use(`/${v4prefix}/`, rateLimits.rateLimitByResource)
+// Ensure req.locals and res.locals objects exist.
+app.use(`/${v4prefix}/`, rateLimits.populateLocals)
+
+// Allow users to turn off rate limits with an environment variable.
+const DO_NOT_USE_RATE_LIMITS = process.env.DO_NOT_USE_RATE_LIMITS || false
+
+console.log(`DO_NOT_USE_RATE_LIMITS: ${DO_NOT_USE_RATE_LIMITS}`)
+
+if (!DO_NOT_USE_RATE_LIMITS) {
+  console.log('Rate limits are being used')
+  // Inspect the header for a JWT token.
+  app.use(`/${v4prefix}/`, jwtAuth.getTokenFromHeaders)
+
+  // Instantiate the authorization middleware, used to implement pro-tier rate limiting.
+  // Handles Anonymous and Basic Authorization schemes used by passport.js
+  app.use(`/${v4prefix}/`, auth.mw())
+
+  // Experimental rate limits
+  app.use(`/${v4prefix}/`, rateLimits.applyRateLimits)
+
+  // Rate limit on all v4 routes
+  // Establish and enforce rate limits.
+  // app.use(`/${v4prefix}/`, rateLimits.rateLimitByResource)
+} else {
+  console.log('Rate limits are NOT being used')
+}
+// END Rate Limits
 
 // Connect v4 routes
 app.use(`/${v4prefix}/` + 'health-check', healthCheckV4)
@@ -171,9 +189,11 @@ server.listen(port)
 server.on('error', onError)
 server.on('listening', onListening)
 
-// Set the time before a timeout error is generated. This impacts testing and
-// the handling of timeout errors. Is 10 seconds too agressive?
-server.setTimeout(30 * 1000)
+// Set the time before a timeout error is generated.
+// 10 seconds is way too agressive. 30 Seconds was used for a while, but with
+// being able to set a timeout between UTXOs for tokenUtxoDetails, the timeout
+// needed to be extended.
+server.setTimeout(1000 * 60 * 5) // 5 minutes
 
 /**
  * Normalize a port into a number, string, or false.

src/middleware/auth.js

@@ -1,22 +1,25 @@
 /*
-  CT 2/4/20 Note: This library handles anonymous and Basic auth. This library
-  can be phased out with the chage to JWT tokens and the new rate-limit library.
-
-  Handle authorization for bypassing rate limits.
+  This library handles anonymous and Basic Authentication.
 
   1) Default is 'Anonymous Authentication', which unlocks the freemimum tier by
   default.
+
   2) Hard-coded 'Basic Authentication' is a token that does not expire and is
-  provided to buisiness partners.
+  provided for clients who run their own isolated infrastructure without rate
+  limits, but still need a way from preventing the random public from using
+  their API.
+
   3) JWT-based 'Local Authentication' is used for normal users that pay to
   access the premium pro-tier services.
 
   This file uses the passport npm library to check the header of each REST API
-  call for the prescence of a Basic authorization header:
+  call for the prescence of a Basic Authentication header:
   https://en.wikipedia.org/wiki/Basic_access_authentication
 
   If the header is found and validated, the req.locals.proLimit Boolean value
-  is set and passed to the route-ratelimits.ts middleware.
+  is set and passed to the route-ratelimit.js middleware. route-ratelimit.js
+  is for fine-grain JWT-based rate limits. If req.locals.proLimit is set to
+  true, then those rate limits will be skipped.
 */
 
 'use strict'
@@ -76,8 +79,9 @@ class AuthMW {
         req.locals.proLimit = false
 
         // Evaluate the username and password and set the rate limit accordingly.
-        // if (username === "BITBOX" && password === PRO_PASS) {
         if (username === 'fullstackcash') {
+          // Can set several different passwords in the environment variable.
+          // Loop through each one to see if one matches.
           for (let i = 0; i < PRO_PASS.length; i++) {
             const thisPass = PRO_PASS[i]
 

src/middleware/route-ratelimit.js

@@ -1,49 +1,62 @@
 /*
-  Sets the rate limits for the anonymous and paid tiers. Current rate limits:
-  - 1000 points in 60 seconds
-  - 10 points per call for paid tier (100 RPM)
-  - 50 points per call for anonymous tier (20 RPM)
+This file will replace the original rate-limit.js file.
 
-  Background:
-  The rate limits below were originially coded with the idea of charging on a
-  per-resource basis. However, that was confusing to end users trying to purchase
-  a subscription. So everything was simplied to two tiers: paid and anonymous
+Sets the rate limits for the anonymous and paid tiers. Current rate limits:
+- 10000 points in 60 seconds
+- 500 points per call for anonymous tier (20 RPM)
+- 100 points per call for tier 40 (100 RPM)
+- 40 points per call for tier 50 (250 RPM)
+- 16 points per call for tier 60 (625 RPM)
+
+The rate limit handling is designed for these four use cases:
+- Users who want to buy a JWT token for 24 hour access.
+- Users who want to buy different RPM tiers: 100, 250, 600
+- Basic Authentication which should not have any rate limits applied.
+- Local installations that do not want any authentication or rate limits at all.
+
+The Basic Auth use cases is considered when determining internal rate limits.
+The internal rate limits should not be applied to calls from those users.
+
+A lot of attention has been paid to passing rate-limit information for the user
+when they trigger an endpoint that makes a lot of internal API calls. Examples
+are hydrateUtxos() and getPublicKey(). These keeps things fair by charging the
+same for 'light' API calls and 'heavy' API calls.
+
+TODO:
+- Add code for applying rate limits to whitelist domains.
 */
 
-'use strict'
-
 // Public npm libraries.
 const jwt = require('jsonwebtoken')
+const Redis = require('ioredis')
+const { RateLimiterRedis } = require('rate-limiter-flexible')
 
 // local libraries.
 const wlogger = require('../util/winston-logging')
 const config = require('../../config')
 
-const ANON_LIMITS = config.anonRateLimit
-const WHITELIST_RATE_LIMIT = config.whitelistRateLimit
-const WHITELIST_DOMAINS = config.whitelistDomains
-const INTERNAL_RATE_LIMIT = 1
+let _this // Global pointer to instance of class, when 'this' context is lost.
 
-// Redis
+// Setup Redis to track rate limits for each user.
 const redisOptions = {
   enableOfflineQueue: false,
   port: process.env.REDIS_PORT ? process.env.REDIS_PORT : 6379,
   host: process.env.REDIS_HOST ? process.env.REDIS_HOST : '127.0.0.1'
 }
-console.log(`redisOptions: ${JSON.stringify(redisOptions, null, 2)}`)
-
-const Redis = require('ioredis')
 const redisClient = new Redis(redisOptions)
-
-// Rate limiter middleware lib.
-const { RateLimiterRedis } = require('rate-limiter-flexible')
 const rateLimitOptions = {
   storeClient: redisClient,
-  points: 1000, // Number of points
+  points: config.pointsPerMinute, // Number of points
   duration: 60 // Per minute (per 60 seconds)
 }
 
-let _this
+// Constants
+const ANON_LIMITS = config.anonRateLimit
+// const WHITELIST_RATE_LIMIT = config.whitelistRateLimit
+const WHITELIST_DOMAINS = config.whitelistDomains
+const WHITELIST_POINTS_TO_CONSUME = config.whitelistRateLimit
+const POINTS_PER_MINUTE = config.pointsPerMinute
+const INTERNAL_POINTS_TO_CONSUME = 10
 
 class RateLimits {
   constructor () {
@@ -54,157 +67,187 @@ class RateLimits {
     this.config = config
   }
 
-  // Used to disconnect from the Redis DB.
-  // Called by unit tests so that node.js thread doesn't live forever.
-  closeRedis () {
-    redisClient.disconnect()
-  }
-
-  async wipeRedis () {
-    await redisClient.flushdb()
-  }
-
-  // This is the new rate limit function that uses the rate-limiter-flexible npm
-  // library. It uses fine-grain rate limiting based on the resources being
-  // consumed.
-  async rateLimitByResource (req, res, next) {
+  // This is the main middleware funciton of this library. All other functions
+  // support this function.
+  async applyRateLimits (req, res, next) {
     try {
-      let userId
-      let decoded = {}
-
-      // Create a req.locals object if not passed in.
-      if (!req.locals) {
-        req.locals = {
-          // default values
-          jwtToken: '',
-          proLimit: false,
-          apiLevel: 0
-        }
+      // Exit if the user has already authenticated with Basic Authentication.
+      if (req.locals.proLimit) {
+        console.log('External call, basic auth, skipping rate limits.')
+        wlogger.debug(
+          'req.locals.proLimit = true; Using Basic Authentication instead of rate limits'
+        )
+        return next()
       }
 
-      // Create a res.locals object if it does not exist. This is used for
-      // debugging.
-      if (!res.locals) {
-        res.locals = {
-          rateLimitTriggered: false
+      // Determine if the call is an external or internal API call.
+      const isInternal = _this.checkInternalIp(req)
+      // console.log(`isInternal: ${isInternal}`)
+
+      // Determine if the call originates from another computer on the intranet.
+      const isWhitelistOrigin = _this.isInWhitelist(req)
+      // console.log('isWhitelistOrigin: ', isWhitelistOrigin)
+
+      // Handle the use case of internally-generated requests.
+      if (isInternal) {
+        // Internal API calls should pass the authentication data in through the
+        // the usrObj in the body.
+        if (req.body && req.body.usrObj) {
+          if (req.body.usrObj.proLimit) {
+            // console.log('Internal call, basic auth, skipping rate limits.')
+
+            // If this is an internal call that originated from a user using
+            // Basic Authentication, then skip rate-limits.
+            return next()
+          } else {
+            // console.log(
+            //   'Internal call, applying rate limits. Using JWT if available.'
+            // )
+
+            // Determine if user has exceeded their rate limits. Pass in the
+            // JWT token if one exists.
+            const hasExceededRateLimit = await _this.trackRateLimits(
+              req,
+              res,
+              req.body.usrObj.jwtToken
+            )
+
+            if (!hasExceededRateLimit) {
+              // Rate limits have not been exceeded. Processing can continue.
+              return next()
+            } else {
+              // trackRateLimits() returns the 'res' object with an error message
+              // and status code.
+              return hasExceededRateLimit
             }
           }
-
-      // Decode the JWT token if one exists.
-      if (req.locals.jwtToken) {
-        try {
-          decoded = _this.jwt.verify(
-            req.locals.jwtToken,
-            _this.config.apiTokenSecret
-          )
-          // console.log(`decoded: ${JSON.stringify(decoded, null, 2)}`)
-
-          userId = decoded.id
-        } catch (err) {
-          // This handler will be triggered if the JWT token does not match the
-          // token secret.
-          wlogger.error(
-            `Last three letters of token secret: ${_this.config.apiTokenSecret.slice(
-              -3
-            )}`
-          )
-          wlogger.error(
-            'Error trying to decode JWT token in route-ratelimit.js/newRateLimit(): ',
-            err
-          )
-        }
-        //
-      } else if (req.body && req.body.usrObj) {
-        // Same as above, but this code path is activated from internal calls to
-        // bch-js, like hydrateUtxo(), which passes the user object from the
-        // original API call.
-
-        try {
-          decoded = _this.jwt.verify(
-            req.body.usrObj.jwtToken,
-            _this.config.apiTokenSecret
-          )
-          // console.log(`decoded: ${JSON.stringify(decoded, null, 2)}`)
-
-          userId = decoded.id
-        } catch (err) {
-          // This handler will be triggered if the JWT token does not match the
-          // token secret.
-          wlogger.error(
-            'Error in route-ratelimit.js trying to decode JWT token in usrObj'
-          )
-        }
         } else {
-        wlogger.debug('No JWT token found!')
+          // This should be a corner case. Calls should not be going into this
+          // code path, so the system should throw up big warning signs when they
+          // do.
+          // This code path happens when an internal call is made but does not
+          // pass the usrObj. Legacy code needs to be refactored to use the usrObj
+          // and avoid this code path. This code path is 'pooled': all users
+          // share the same rate limits. Even at 1000 RPM, this pool will get
+          // exhausted easily.
+          // const warnMsg =
+          //   'Internal call. req.body.usrObj does not exist. Applying high-speed internal rate limits.'
+          // console.log(warnMsg)
+          // wlogger.info(warnMsg)
+
+          const defaultPayload = {
+            id: '98.76.54.32',
+            email: 'internal@bchtest.net',
+            apiLevel: 40,
+            rateLimit: 100,
+            pointsToConsume: INTERNAL_POINTS_TO_CONSUME,
+            duration: 30
           }
 
-      // Default value is 50 points per request = 20 RPM
-      let rateLimit = ANON_LIMITS
+          // Default values, in case there is an error.
+          const defaultJwt = _this.generateJwtToken(defaultPayload)
 
-      // Only evaluate the JWT token if the user is not using Basic Authentication.
-      if (!req.locals.proLimit) {
-        // Code here for the rate limiter is adapted from this example:
-        // https://github.com/animir/node-rate-limiter-flexible/wiki/Overall-example#authorized-and-not-authorized-users
-        try {
-          // The resource being consumed: full node, indexer, SLPDB, etc.
-          const resource = _this.getResource(req.url)
-          wlogger.debug(`resource: ${resource}`)
-
-          // Key will be the JWT ID if it exists, otherwise the IP address of the caller.
-          let key = userId || req.ip
-          res.locals.key = key // Feedback for tests.
-          // console.log(`key: ${key}`)
-
-          // const pointsToConsume = userId ? 1 : 30
-          decoded.resource = resource
-          let pointsToConsume = _this.calcPoints(decoded)
-          res.locals.pointsToConsume = pointsToConsume // Feedback for tests.
-
-          // Retrieve the origin.
-          let origin = req.get('origin')
-
-          // Handle calls coming from the intranet.
-          if (origin === undefined && key.indexOf('10.0.0.5') > -1) {
-            origin = 'slp-api'
-          }
-
-          wlogger.info(`origin: ${origin}`)
-
-          // If the request originates from one of the approved wallet apps, then
-          // apply paid-access rate limits.
-          // console.log(`origin: ${JSON.stringify(origin, null, 2)}`)
-          // console.log(`whitelist: ${JSON.stringify(WHITELIST_DOMAINS, null, 2)}`)
-          const isInWhitelist = _this.isInWhitelist(origin)
-          if (isInWhitelist) {
-            pointsToConsume = WHITELIST_RATE_LIMIT
-            res.locals.pointsToConsume = pointsToConsume // Feedback for tests.
-          }
-
-          // For internal calls, increase rate limits to as fast as possible.
-          if (
-            // Comment out the line below when running bch-js e2e rate limit tests.
-            key.toString().indexOf('::ffff:127.0.0.1') > -1 ||
-            // Do not comment out this line.
-            key.toString().indexOf('172.17.') > -1
-          ) {
-            pointsToConsume = INTERNAL_RATE_LIMIT
-            res.locals.pointsToConsume = pointsToConsume // Feedback for tests.
-          }
-
-          wlogger.info(
-            `User ${key} consuming ${pointsToConsume} point for resource ${resource}.`
+          // Track the rate limit for this user. Pass in the JWT token, if one
+          // is available.
+          const hasExceededRateLimit = await _this.trackRateLimits(
+            req,
+            res,
+            defaultJwt
           )
 
-          rateLimit = Math.floor(1000 / pointsToConsume)
+          if (!hasExceededRateLimit) {
+            // Rate limits have not been exceeded. Processing can continue.
+            return next()
+          } else {
+            // trackRateLimits() returns the 'res' object with an error message
+            // and status code.
+            return hasExceededRateLimit
+          }
+        }
+        //
+        //
+      } else {
+        // Handle the normal use-case of external requests
+        // console.log(
+        //   'External call, applying rate limits. Using JWT if available.'
+        // )
 
-          // Update the key so that rate limits track both the user and the resource.
-          key = `${key}-${resource}`
+        // For calls originating from a whitelist domain, apply a high-RPM
+        // JWT token to the call.
+        if (isWhitelistOrigin) {
+          const defaultPayload = {
+            id: '77.77.77.77',
+            email: 'whitelist@bchtest.net',
+            apiLevel: 40,
+            rateLimit: 100,
+            pointsToConsume: WHITELIST_POINTS_TO_CONSUME,
+            duration: 30
+          }
 
+          // Inject the high-RPM JWT token into the call.
+          req.locals.jwtToken = _this.generateJwtToken(defaultPayload)
+        }
+
+        // Track the rate limit for this user. Pass in the JWT token, if one
+        // is available.
+        const hasExceededRateLimit = await _this.trackRateLimits(
+          req,
+          res,
+          req.locals.jwtToken
+        )
+
+        if (!hasExceededRateLimit) {
+          // Rate limits have not been exceeded. Processing can continue.
+          return next()
+        } else {
+          // trackRateLimits() returns the 'res' object with an error message
+          // and status code.
+          return hasExceededRateLimit
+        }
+      }
+    } catch (err) {
+      wlogger.error('Error in route-ratelimit2.js/applyRateLimits(): ', err)
+    }
+
+    // By default, move to the next middleware.
+    next()
+  }
+
+  // A wrapper for Redis-based rate limiter.
+  // Will return false if the user has not exceeded the rate limit. Otherwise
+  // it will return the 'res' object with an error status and message, which
+  // should be returned by the middleware.
+  async trackRateLimits (req, res, jwtToken) {
+    // Anonymous rate limits are used by default.
+    let pointsToConsume = ANON_LIMITS
+    let key = req.ip // Use the IP address as the key, by default.
+
+    try {
+      // Decode the JWT token if it exists
+      if (jwtToken) {
+        const decoded = _this.decodeJwtToken(jwtToken)
+        // console.log(`decoded: ${JSON.stringify(decoded, null, 2)}`)
+
+        // Preferentially use the decoded ID in the JWT payload, as the key.
+        key = decoded.id
+
+        pointsToConsume = decoded.pointsToConsume
+      }
+      // console.log(`rate limit key: ${key}`)
+
+      // This function will throw an error if the user exceeds the rate limit.
+      // The 429 error response is handled by the catch().
       await _this.rateLimiter.consume(key, pointsToConsume)
+
+      res.locals.pointsToConsume = pointsToConsume // Feedback for tests.
+
+      // Signal that the user has not exceeded their rate limits.
+      return false
     } catch (err) {
       // console.log('err: ', err)
 
-          // Used for returning data for tests.
+      const rateLimit = Math.floor(POINTS_PER_MINUTE / pointsToConsume)
+
       res.locals.rateLimitTriggered = true
       // console.log('res.locals: ', res.locals)
 
@@ -215,87 +258,59 @@ class RateLimits {
       })
     }
   }
-    } catch (err) {
-      wlogger.error('Error in route-ratelimit.js/newRateLimit(): ', err)
-      // throw err
-    }
 
-    next()
+  // Attempts to decode a JWT token. Returns default values if it fails.
+  decodeJwtToken (jwtToken) {
+    const defaultPayload = {
+      id: '123.456.789.10',
+      email: 'test@bchtest.net',
+      apiLevel: 10,
+      rateLimit: 3,
+      pointsToConsume: ANON_LIMITS,
+      duration: 30
     }
 
-  // Calculates the points consumed, based on the jwt information and the route
-  // requested.
-  calcPoints (jwtInfo) {
-    let retVal = ANON_LIMITS // By default, use anonymous tier.
-
     try {
-      // console.log(`jwtInfo: ${JSON.stringify(jwtInfo, null, 2)}`)
+      // Default values, in case there is an error.
+      const defaultJwt = _this.generateJwtToken(defaultPayload)
 
-      const apiLevel = jwtInfo.apiLevel
-      const resource = jwtInfo.resource
+      // Generate a default payload to use, if the decoding of the user-provided
+      // jwt fails.
+      let decoded = _this.jwt.verify(defaultJwt, _this.config.apiTokenSecret)
 
-      const level30Routes = ['insight', 'bitcore', 'blockbook', 'electrumx']
-      const level40Routes = ['slp']
-
-      wlogger.debug(`apiLevel: ${apiLevel}`)
-
-      // Only evaluate if user is using a JWT token.
-      if (jwtInfo.id) {
-        // SLP indexer routes
-        if (level40Routes.includes(resource)) {
-          if (apiLevel >= 40) retVal = 10
-          // else if (apiLevel >= 10) retVal = 10
-          else retVal = ANON_LIMITS
-
-          // Normal indexer routes
-        } else if (level30Routes.includes(resource)) {
-          if (apiLevel >= 30) retVal = 10
-          else retVal = ANON_LIMITS
-
-          // Full node tier
-        } else if (apiLevel >= 20) {
-          retVal = 10
-
-          // Free tier, full node only.
-        } else {
-          retVal = ANON_LIMITS
-        }
-      }
-
-      return retVal
-    } catch (err) {
-      wlogger.error('Error in route-ratelimit.js/calcPoints()')
-      // throw err
-      retVal = ANON_LIMITS
-    }
-
-    return retVal
-  }
-
-  // This function parses the req.url property to identify what resource
-  // the user is requesting.
-  // This was created as a function so that it can be unit tested. Not sure
-  // what kind of variations will be seen in production.
-  getResource (url) {
       try {
-      wlogger.debug(`url: ${JSON.stringify(url, null, 2)}`)
-
-      const splitUrl = url.split('/')
-      const resource = splitUrl[1]
-
-      return resource
+        decoded = _this.jwt.verify(jwtToken, _this.config.apiTokenSecret)
       } catch (err) {
-      wlogger.error('Error in getResource().')
-      throw err
+        wlogger.error('Error in route-ratelimit2.js/decodeJwtTokens(): ', err)
+      }
+
+      return decoded
+    } catch (err) {
+      wlogger.error(
+        'Unhandled error in route-ratelimit2.js/deocdeJwtToken: ',
+        err
+      )
+
+      // Making sure there is an exp property. Not sure if this will cause an
+      // issue, using a hard-coded value.
+      defaultPayload.exp = 1574269450
+
+      return defaultPayload
     }
   }
 
   // Returns a boolean if the origin of the request matches a domain in the
   // whitelist.
-  isInWhitelist (origin) {
+  isInWhitelist (req) {
     try {
       const retVal = false // Default value.
 
+      // Retrieve the origin.
+      const origin = req.get('origin')
+
+      if (!process.env.TEST) console.log('origin:', origin)
+
+      // If the origin is not determinable, return false.
       if (!origin) return false
 
       // console.log(`WHITELIST_DOMAINS: ${JSON.stringify(WHITELIST_DOMAINS, null, 2)}`)
@@ -303,9 +318,7 @@ class RateLimits {
       for (let i = 0; i < WHITELIST_DOMAINS.length; i++) {
         const thisDomain = WHITELIST_DOMAINS[i]
 
-        if (origin.toString().indexOf(thisDomain) > -1) {
-          return true
-        }
+        if (origin.includes(thisDomain)) return true
       }
 
       return retVal
@@ -316,6 +329,93 @@ class RateLimits {
       return false
     }
   }
+
+  // Checks the request object to see if it's IP address matches an internal
+  // IP address. That means the call is an internal API call and should be
+  // treated differently than an external API call.
+  checkInternalIp (req) {
+    try {
+      // Default value
+      let isInternal = false
+
+      const ip = req.ip
+
+      if (ip.includes('127.0.0.1')) isInternal = true
+
+      if (ip.includes('172.17.')) isInternal = true
+
+      // TODO: Add 192.168.
+
+      return isInternal
+    } catch (err) {
+      wlogger.error(
+        'Error in checkInternalIp(). Returning false be default. Err: ',
+        err
+      )
+      return false
+    }
+  }
+
+  // Used to disconnect from the Redis DB.
+  // Called by unit tests so that node.js thread doesn't live forever.
+  closeRedis () {
+    redisClient.disconnect()
+  }
+
+  // Clear the redis database. Used by unit tests.
+  async wipeRedis () {
+    await redisClient.flushdb()
+  }
+
+  // Generates a JWT token for testing purposes. This is not used in production.
+  // This function mirrors the kind of JWT token that would be generated by
+  // jwt-bch-api.
+  generateJwtToken (payload) {
+    try {
+      const jwtOptions = {
+        expiresIn: '30 days'
+      }
+
+      const token = _this.jwt.sign(
+        payload,
+        _this.config.apiTokenSecret,
+        jwtOptions
+      )
+
+      return token
+    } catch (err) {
+      console.error('Error in generateJwtToken()')
+      throw err
+    }
+  }
+
+  // Called when rate limits are not used.
+  populateLocals (req, res, next) {
+    try {
+      // Create a re*Q*.locals object if not passed in.
+      // req.locals.proLimit will be true if the user is using Basic Authentication.
+      if (!req.locals) {
+        req.locals = {
+          // default values
+          jwtToken: '',
+          proLimit: false,
+          apiLevel: 0
+        }
+      }
+
+      // Create a re*S*.locals object if it does not exist.
+      if (!res.locals) {
+        res.locals = {
+          rateLimitTriggered: false
+        }
+      }
+
+      next()
+    } catch (err) {
+      console.error('Error in populateLocals(): ', err)
+      throw err
+    }
+  }
 }
 
 module.exports = RateLimits

src/routes/v4/blockbook.js

@@ -1,521 +0,0 @@
-/*
-  Blockbook API route
-*/
-
-'use strict'
-
-const express = require('express')
-const axios = require('axios')
-const wlogger = require('../../util/winston-logging')
-
-const RouteUtils = require('../../util/route-utils')
-const routeUtils = new RouteUtils()
-
-// Library for easily switching the API paths to use different instances of
-// Blockbook.
-const BlockbookPath = require('../../util/blockbook-path')
-const BLOCKBOOKPATH = new BlockbookPath()
-// BLOCKBOOKPATH.toOpenBazaar()
-
-const router = express.Router()
-
-// Used for processing error messages before sending them to the user.
-const util = require('util')
-util.inspect.defaultOptions = { depth: 1 }
-
-const BCHJS = require('@psf/bch-js')
-const bchjs = new BCHJS()
-
-let _this
-
-class Blockbook {
-  constructor () {
-    _this = this
-
-    _this.axios = axios
-    _this.routeUtils = routeUtils
-    _this.bchjs = bchjs
-    _this.BLOCKBOOKPATH = BLOCKBOOKPATH
-
-    _this.router = router
-    _this.router.get('/', _this.root)
-    _this.router.get('/balance/:address', _this.balanceSingle)
-    _this.router.post('/balance', _this.balanceBulk)
-    _this.router.get('/utxos/:address', _this.utxosSingle)
-    _this.router.post('/utxos', _this.utxosBulk)
-    _this.router.get('/tx/:txid', _this.txSingle)
-    _this.router.post('/tx', _this.txBulk)
-  }
-
-  // DRY error handler.
-  errorHandler (err, res) {
-    // Attempt to decode the error message.
-    const { msg, status } = _this.routeUtils.decodeError(err)
-    if (msg) {
-      res.status(status)
-      return res.json({ error: msg })
-    }
-
-    res.status(500)
-    return res.json({ error: util.inspect(err) })
-  }
-
-  // Root API endpoint. Simply acknowledges that it exists.
-  root (req, res, next) {
-    return res.json({ status: 'address' })
-  }
-
-  // Query the Blockbook Node API for a balance on a single BCH address.
-  // Returns a Promise.
-  async balanceFromBlockbook (thisAddress) {
-    try {
-      // console.log(`BLOCKBOOK_URL: ${BLOCKBOOK_URL}`)
-
-      // Convert the address to a cashaddr without a prefix.
-      const addr = _this.bchjs.Address.toCashAddress(thisAddress)
-
-      const path = `${_this.BLOCKBOOKPATH.addrPath}${addr}`
-      // console.log(`path: ${path}`)
-
-      // Query the Blockbook Node API.
-      const options = {
-        method: 'get',
-        baseURL: path
-      }
-
-      const axiosResponse = await _this.axios.request(options)
-      const retData = axiosResponse.data
-      // console.log(`retData: ${util.inspect(retData)}`)
-
-      return retData
-    } catch (err) {
-      // Dev Note: Do not log error messages here. Throw them instead and let the
-      // parent function handle it.
-      wlogger.debug('Error in blockbook.js/balanceFromBlockbook()')
-      throw err
-    }
-  }
-
-  async balanceSingle (req, res, next) {
-    try {
-      const address = req.params.address
-
-      if (!address || address === '') {
-        res.status(400)
-        return res.json({ error: 'address can not be empty' })
-      }
-
-      // Reject if address is an array.
-      if (Array.isArray(address)) {
-        res.status(400)
-        return res.json({
-          error: 'address can not be an array. Use POST for bulk upload.'
-        })
-      }
-
-      wlogger.debug(
-        'Executing blockbook/balanceSingle with this address: ',
-        address
-      )
-
-      // Ensure the input is a valid BCH address.
-      try {
-        // const legacyAddr = bchjs.Address.toLegacyAddress(address)
-        _this.bchjs.Address.toLegacyAddress(address)
-      } catch (err) {
-        res.status(400)
-        return res.json({
-          error: `Invalid BCH address. Double check your address is valid: ${address}`
-        })
-      }
-
-      // Prevent a common user error. Ensure they are using the correct network address.
-      const networkIsValid = _this.routeUtils.validateNetwork(address)
-      if (!networkIsValid) {
-        res.status(400)
-        return res.json({
-          error:
-            'Invalid network. Trying to use a testnet address on mainnet, or vice versa.'
-        })
-      }
-
-      // Query the Blockbook Node API.
-      const retData = await _this.balanceFromBlockbook(address)
-
-      // Return the retrieved address information.
-      res.status(200)
-      return res.json(retData)
-    } catch (err) {
-      // Write out error to error log.
-      wlogger.error('Error in blockbook.js/balanceSingle().', err)
-
-      return _this.errorHandler(err, res)
-    }
-  }
-
-  // POST handler for bulk queries on address details
-  async balanceBulk (req, res, next) {
-    try {
-      let addresses = req.body.addresses
-      // const currentPage = req.body.page ? parseInt(req.body.page, 10) : 0
-
-      // Reject if addresses is not an array.
-      if (!Array.isArray(addresses)) {
-        res.status(400)
-        return res.json({
-          error: 'addresses needs to be an array. Use GET for single address.'
-        })
-      }
-
-      // Enforce array size rate limits
-      if (!_this.routeUtils.validateArraySize(req, addresses)) {
-        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
-        return res.json({
-          error: 'Array too large.'
-        })
-      }
-
-      wlogger.debug(
-        'Executing blockbook.js/balanceBulk with these addresses: ',
-        addresses
-      )
-
-      // Validate each element in the address array.
-      for (let i = 0; i < addresses.length; i++) {
-        const thisAddress = addresses[i]
-
-        // Ensure the input is a valid BCH address.
-        try {
-          _this.bchjs.Address.toLegacyAddress(thisAddress)
-        } catch (err) {
-          res.status(400)
-          return res.json({
-            error: `Invalid BCH address. Double check your address is valid: ${thisAddress}`
-          })
-        }
-
-        // Prevent a common user error. Ensure they are using the correct network address.
-        const networkIsValid = _this.routeUtils.validateNetwork(thisAddress)
-        if (!networkIsValid) {
-          res.status(400)
-          return res.json({
-            error: `Invalid network for address ${thisAddress}. Trying to use a testnet address on mainnet, or vice versa.`
-          })
-        }
-      }
-
-      // Loops through each address and creates an array of Promises, querying
-      // Insight API in parallel.
-      addresses = addresses.map(async (address, index) =>
-        // console.log(`address: ${address}`)
-        _this.balanceFromBlockbook(address)
-      )
-
-      // Wait for all parallel Insight requests to return.
-      const result = await _this.axios.all(addresses)
-
-      // Return the array of retrieved address information.
-      res.status(200)
-      return res.json(result)
-    } catch (err) {
-      wlogger.error('Error in blockbook.js/balanceBulk().', err)
-
-      return _this.errorHandler(err, res)
-    }
-  }
-
-  // Query the Blockbook API for utxos associated with a BCH address.
-  // Returns a Promise.
-  async utxosFromBlockbook (thisAddress) {
-    try {
-      // console.log(`BLOCKBOOK_URL: ${BLOCKBOOK_URL}`)
-
-      // Convert the address to a cashaddr without a prefix.
-      const addr = _this.bchjs.Address.toCashAddress(thisAddress)
-
-      const path = `${_this.BLOCKBOOKPATH.utxoPath}${addr}`
-      // console.log(`path: ${path}`)
-
-      // Query the Blockbook API.
-      // Query the Blockbook Node API.
-      const options = {
-        method: 'get',
-        baseURL: path
-      }
-      const axiosResponse = await _this.axios.request(options)
-      const retData = axiosResponse.data
-      // console.log(`retData: ${util.inspect(retData)}`)
-
-      // Add the satoshis property to each UTXO.
-      for (let i = 0; i < retData.length; i++) {
-        retData[i].satoshis = Number(retData[i].value)
-      }
-
-      return retData
-    } catch (err) {
-      // Dev Note: Do not log error messages here. Throw them instead and let the
-      // parent function handle it.
-      wlogger.debug('Error in blockbook.js/utxosFromBlockbook()')
-      throw err
-    }
-  }
-
-  // GET handler for single balance
-  async utxosSingle (req, res, next) {
-    try {
-      const address = req.params.address
-
-      if (!address || address === '') {
-        res.status(400)
-        return res.json({ error: 'address can not be empty' })
-      }
-
-      // Reject if address is an array.
-      if (Array.isArray(address)) {
-        res.status(400)
-        return res.json({
-          error: 'address can not be an array. Use POST for bulk upload.'
-        })
-      }
-
-      wlogger.debug(
-        'Executing blockbook/utxosSingle with this address: ',
-        address
-      )
-
-      // Ensure the input is a valid BCH address.
-      try {
-        // const legacyAddr = bchjs.Address.toLegacyAddress(address)
-        _this.bchjs.Address.toLegacyAddress(address)
-      } catch (err) {
-        res.status(400)
-        return res.json({
-          error: `Invalid BCH address. Double check your address is valid: ${address}`
-        })
-      }
-
-      // Prevent a common user error. Ensure they are using the correct network address.
-      const networkIsValid = _this.routeUtils.validateNetwork(address)
-      if (!networkIsValid) {
-        res.status(400)
-        return res.json({
-          error:
-            'Invalid network. Trying to use a testnet address on mainnet, or vice versa.'
-        })
-      }
-
-      // Query the Blockbook API.
-      const retData = await _this.utxosFromBlockbook(address)
-
-      // Return the retrieved address information.
-      res.status(200)
-      return res.json(retData)
-    } catch (err) {
-      // Write out error to error log.
-      wlogger.error('Error in blockbook.js/utxosSingle().', err)
-      return _this.errorHandler(err, res)
-    }
-  }
-
-  // POST handler for bulk queries on address utxos
-  async utxosBulk (req, res, next) {
-    try {
-      let addresses = req.body.addresses
-      // const currentPage = req.body.page ? parseInt(req.body.page, 10) : 0
-
-      // Reject if addresses is not an array.
-      if (!Array.isArray(addresses)) {
-        res.status(400)
-        return res.json({
-          error: 'addresses needs to be an array. Use GET for single address.'
-        })
-      }
-
-      // Enforce array size rate limits
-      if (!_this.routeUtils.validateArraySize(req, addresses)) {
-        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
-        return res.json({
-          error: 'Array too large.'
-        })
-      }
-
-      wlogger.debug(
-        'Executing blockbook.js/utxosBulk with these addresses: ',
-        addresses
-      )
-
-      // Validate each element in the address array.
-      for (let i = 0; i < addresses.length; i++) {
-        const thisAddress = addresses[i]
-
-        // Ensure the input is a valid BCH address.
-        try {
-          _this.bchjs.Address.toLegacyAddress(thisAddress)
-        } catch (err) {
-          res.status(400)
-          return res.json({
-            error: `Invalid BCH address. Double check your address is valid: ${thisAddress}`
-          })
-        }
-
-        // Prevent a common user error. Ensure they are using the correct network address.
-        const networkIsValid = _this.routeUtils.validateNetwork(thisAddress)
-        if (!networkIsValid) {
-          res.status(400)
-          return res.json({
-            error: `Invalid network for address ${thisAddress}. Trying to use a testnet address on mainnet, or vice versa.`
-          })
-        }
-      }
-
-      // Loops through each address and creates an array of Promises, querying
-      // Insight API in parallel.
-      addresses = addresses.map(async (address, index) =>
-        // console.log(`address: ${address}`)
-        _this.utxosFromBlockbook(address)
-      )
-
-      // Wait for all parallel Insight requests to return.
-      const result = await _this.axios.all(addresses)
-
-      // Return the array of retrieved address information.
-      res.status(200)
-      return res.json(result)
-    } catch (err) {
-      wlogger.error('Error in blockbook.js/utxosBulk().', err)
-      return _this.errorHandler(err, res)
-    }
-  }
-
-  // Query the Blockbook Node API for transactions on a single TXID.
-  // Returns a Promise.
-  async transactionsFromBlockbook (txid) {
-    try {
-      // console.log(`BLOCKBOOK_URL: ${BLOCKBOOK_URL}`)
-
-      const path = `${_this.BLOCKBOOKPATH.txPath}${txid}`
-      // console.log(`path: ${path}`)
-
-      // Query the Blockbook Node API.
-      const options = {
-        method: 'get',
-        baseURL: path
-      }
-      const axiosResponse = await _this.axios.request(options)
-      const retPromise = axiosResponse.data
-      // console.log(`retData: ${util.inspect(retData)}`)
-
-      return retPromise
-    } catch (err) {
-      // Dev Note: Do not log error messages here. Throw them instead and let the
-      // parent function handle it.
-      wlogger.debug('Error in blockbook.js/transactionsFromBlockbook()')
-      throw err
-    }
-  }
-
-  // GET handler for single transaction details.
-  async txSingle (req, res, next) {
-    try {
-      const txid = req.params.txid
-
-      if (!txid || txid === '') {
-        res.status(400)
-        return res.json({ error: 'txid can not be empty' })
-      }
-
-      // Reject if address is an array.
-      if (Array.isArray(txid)) {
-        res.status(400)
-        return res.json({
-          error: 'txid can not be an array. Use POST for bulk upload.'
-        })
-      }
-
-      // TODO: Add regex comparison of txid to ensure it's valid.
-      if (txid.length !== 64) {
-        res.status(400)
-        return res.json({
-          error: `txid must be of length 64 (not ${txid.length})`
-        })
-      }
-
-      wlogger.debug('Executing blockbook/txSingle with this txid: ', txid)
-
-      // Query the Blockbook Node API.
-      const retData = await _this.transactionsFromBlockbook(txid)
-
-      // Return the retrieved address information.
-      res.status(200)
-      return res.json(retData)
-    } catch (err) {
-      // Write out error to error log.
-      wlogger.error('Error in blockbook.js/txSingle().', err)
-
-      return _this.errorHandler(err, res)
-    }
-  }
-
-  // POST handler for bulk queries on tx details
-  async txBulk (req, res, next) {
-    try {
-      let txids = req.body.txids
-      // const currentPage = req.body.page ? parseInt(req.body.page, 10) : 0
-
-      // Reject if txids is not an array.
-      if (!Array.isArray(txids)) {
-        res.status(400)
-        return res.json({
-          error: 'txids need to be an array. Use GET for single address.'
-        })
-      }
-
-      // Enforce array size rate limits
-      if (!_this.routeUtils.validateArraySize(req, txids)) {
-        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
-        return res.json({
-          error: 'Array too large.'
-        })
-      }
-
-      wlogger.debug('Executing blockbook.js/txBulk with these txids: ', txids)
-
-      // Validate each element in the txids array.
-      for (let i = 0; i < txids.length; i++) {
-        const thisTxid = txids[i]
-
-        if (!thisTxid || thisTxid === '') {
-          res.status(400)
-          return res.json({ error: 'txid can not be empty' })
-        }
-
-        // TODO: Add regex comparison of txid to ensure it's valid.
-        if (thisTxid.length !== 64) {
-          res.status(400)
-          return res.json({
-            error: `txid must be of length 64 (not ${thisTxid.length})`
-          })
-        }
-      }
-
-      // Loops through each address and creates an array of Promises, querying
-      // Insight API in parallel.
-      txids = txids.map(async (txid, index) =>
-        // console.log(`address: ${address}`)
-        _this.transactionsFromBlockbook(txid)
-      )
-
-      // Wait for all parallel Insight requests to return.
-      const result = await _this.axios.all(txids)
-
-      // Return the array of retrieved address information.
-      res.status(200)
-      return res.json(result)
-    } catch (err) {
-      wlogger.error('Error in blockbook.js/txBulk().', err)
-      return _this.errorHandler(err, res)
-    }
-  }
-}
-
-module.exports = Blockbook

src/routes/v4/electrumx.js

@@ -284,7 +284,7 @@ class Electrum {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, addresses)) {
-        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -470,7 +470,7 @@ class Electrum {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, txids)) {
-        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           success: false,
           error: 'Array too large.'
@@ -726,7 +726,7 @@ class Electrum {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, heights)) {
-        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           success: false,
           error: 'Array too large.'
@@ -895,7 +895,7 @@ class Electrum {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, addresses)) {
-        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -1088,7 +1088,7 @@ class Electrum {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, addresses)) {
-        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -1281,7 +1281,7 @@ class Electrum {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, addresses)) {
-        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           error: 'Array too large.'
         })

src/routes/v4/encryption.js

@@ -114,16 +114,17 @@ class Encryption {
         })
       }
 
+      // console.log(
       wlogger.debug(
         'Executing encryption/getPublicKey with this address: ',
         cashAddr
       )
 
-      const rawTxData = await _this.bchjs.Electrumx.transactions(cashAddr, usrObj)
+      const rawTxData = await _this.bchjs.Electrumx.transactions([cashAddr], usrObj)
       // console.log(`rawTxData: ${JSON.stringify(rawTxData, null, 2)}`)
 
       // Extract just the TXIDs
-      const txids = rawTxData.transactions.map((elem) => elem.tx_hash)
+      const txids = rawTxData.transactions[0].transactions.map((elem) => elem.tx_hash)
       // console.log(`txids: ${JSON.stringify(txids, null, 2)}`)
 
       // throw error if there is no transaction history.
@@ -135,16 +136,14 @@ class Encryption {
       for (let i = 0; i < txids.length; i++) {
         const thisTx = txids[i]
 
-        // CT 2/24/21: I might want to convert this to the POST call, to take
-        // advantage of the usrObj. It does not get passed in a GET call.
         const txDetails = await _this.bchjs.RawTransactions.getRawTransaction(
-          thisTx,
+          [thisTx],
           true,
           usrObj
         )
         // console.log(`txDetails: ${JSON.stringify(txDetails, null, 2)}`)
 
-        const vin = txDetails.vin
+        const vin = txDetails[0].vin
 
         // Loop through each input.
         for (let j = 0; j < vin.length; j++) {
@@ -182,6 +181,7 @@ class Encryption {
         publicKey: 'not found'
       })
     } catch (err) {
+      // console.log('Error in encryption.js/getPublicKey().', err)
       wlogger.error('Error in encryption.js/getPublicKey().', err)
 
       return _this.errorHandler(err, res)

src/routes/v4/full-node/blockchain.js

@@ -53,6 +53,7 @@ class Blockchain {
     this.router.post('/getTxOutProof', this.getTxOutProofBulk)
     this.router.get('/verifyTxOutProof/:proof', this.verifyTxOutProofSingle)
     this.router.post('/verifyTxOutProof', this.verifyTxOutProofBulk)
+    this.router.post('/getBlock', this.getBlock)
   }
 
   root (req, res, next) {
@@ -284,7 +285,7 @@ class Blockchain {
 
       // Enforce array size rate limits
       if (!routeUtils.validateArraySize(req, hashes)) {
-        res.status(429) // https://github.com/Bitcoin-com/api.fullstack.cash/issues/330
+        res.status(400) // https://github.com/Bitcoin-com/api.fullstack.cash/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -457,7 +458,7 @@ class Blockchain {
 
       // Enforce array size rate limits
       if (!routeUtils.validateArraySize(req, txids)) {
-        res.status(429) // https://github.com/Bitcoin-com/api.fullstack.cash/issues/330
+        res.status(400) // https://github.com/Bitcoin-com/api.fullstack.cash/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -794,7 +795,7 @@ class Blockchain {
 
       // Enforce array size rate limits
       if (!routeUtils.validateArraySize(req, txids)) {
-        res.status(429) // https://github.com/Bitcoin-com/api.fullstack.cash/issues/330
+        res.status(400) // https://github.com/Bitcoin-com/api.fullstack.cash/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -888,7 +889,7 @@ class Blockchain {
 
       // Enforce array size rate limits
       if (!routeUtils.validateArraySize(req, proofs)) {
-        res.status(429) // https://github.com/Bitcoin-com/api.fullstack.cash/issues/330
+        res.status(400) // https://github.com/Bitcoin-com/api.fullstack.cash/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -937,6 +938,52 @@ class Blockchain {
       return _this.errorHandler(err, res)
     }
   }
+
+  /**
+   * @api {post} /blockchain/getBlock/ Get block details
+   * @apiName getBlock
+   * @apiGroup Blockchain
+   * @apiDescription Returns block details
+   *
+   * @apiExample Example usage:
+   * curl "https://api.fullstack.cash/v4/blockchain/getblock/" -X POST -H "Content-Type: application/json" --data-binary '{"blockhash":"000000000000000002a5fe0bdd6e3f04342a975c0f55e57f97e73bb90041676b","verbosity":0 }'
+   *
+   * @apiParam {String} blockhash Block hash (required)
+   * @apiParam {Number} verbosity Default 1 (optional)
+   *
+   */
+  async getBlock (req, res, next) {
+    try {
+      // Validate input parameter
+      const blockhash = req.body.blockhash
+      let verbosity = req.body.verbosity
+
+      // Default to a value of 1 if another verbosity level is not defined.
+      if (!verbosity && verbosity !== 0) verbosity = 1
+
+      if (!blockhash || blockhash === '') {
+        res.status(400)
+        return res.json({ error: 'blockhash can not be empty' })
+      }
+
+      // Axios options
+      const options = _this.routeUtils.getAxiosOptions()
+
+      options.data.id = 'getblock'
+      options.data.method = 'getblock'
+      options.data.params = [blockhash, verbosity]
+
+      const response = await _this.axios.request(options)
+
+      return res.json(response.data.result)
+    } catch (err) {
+      // Write out error to error log.
+      // logger.error(`Error in rawtransactions/decodeRawTransaction: `, err)
+      wlogger.error('Error in blockchain.js/getBlock()', err)
+
+      return _this.errorHandler(err, res)
+    }
+  }
 }
 
 module.exports = Blockchain

src/routes/v4/full-node/rawtransactions.js

@@ -118,7 +118,7 @@ class RawTransactions {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, hexes)) {
-        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -234,7 +234,7 @@ class RawTransactions {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, hexes)) {
-        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -324,20 +324,12 @@ class RawTransactions {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, txids)) {
-        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           error: 'Array too large.'
         })
       }
 
-      // stub response object
-      // const returnResponse = {
-      //   status: 100,
-      //   json: {
-      //     error: ''
-      //   }
-      // }
-
       // Validate each txid in the array.
       for (let i = 0; i < txids.length; i++) {
         const txid = txids[i]
@@ -448,7 +440,7 @@ class RawTransactions {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, hexes)) {
-        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           error: 'Array too large.'
         })

src/routes/v4/route-utils.js

@@ -1,192 +0,0 @@
-/*
-  A private library of utility functions used by several different routes.
-*/
-
-'use strict'
-
-const axios = require('axios')
-const wlogger = require('../../util/winston-logging')
-
-const util = require('util')
-util.inspect.defaultOptions = { depth: 1 }
-
-const BCHJS = require('@psf/bch-js')
-const bchjs = new BCHJS()
-
-module.exports = {
-  validateNetwork, // Prevents a common user error
-  setEnvVars, // Allows RPC variables to be set dynamically based on changing env vars.
-  decodeError, // Extract and interpret error messages.
-  validateArraySize, // Ensure the passed array meets rate limiting requirements.
-  getAxiosOptions
-}
-
-// This function expects the Request Express.js object and an array as input.
-// The array is then validated against freemium and pro-tier rate limiting
-// requirements. A boolean is returned to indicate if the array size if valid
-// or not.
-function validateArraySize (req, array) {
-  const FREEMIUM_INPUT_SIZE = 20
-  const PRO_INPUT_SIZE = 20
-
-  if (req.locals && req.locals.proLimit) {
-    if (array.length <= PRO_INPUT_SIZE) return true
-  } else if (array.length <= FREEMIUM_INPUT_SIZE) {
-    return true
-  }
-
-  return false
-}
-
-// Returns true if user-provided cash address matches the correct network,
-// mainnet or testnet. If NETWORK env var is not defined, it returns false.
-// This prevent a common user-error issue that is easy to make: passing a
-// testnet address into rest.bitcoin.com or passing a mainnet address into
-// trest.bitcoin.com.
-function validateNetwork (addr) {
-  try {
-    const network = process.env.NETWORK
-
-    // Return false if NETWORK is not defined.
-    if (!network || network === '') {
-      console.log('Warning: NETWORK environment variable is not defined!')
-      return false
-    }
-
-    // Convert the user-provided address to a cashaddress, for easy detection
-    // of the intended network.
-    const cashAddr = bchjs.Address.toCashAddress(addr)
-
-    // Return true if the network and address both match testnet
-    const addrIsTest = bchjs.Address.isTestnetAddress(cashAddr)
-    if (network === 'testnet' && addrIsTest) return true
-
-    // Return true if the network and address both match mainnet
-    const addrIsMain = bchjs.Address.isMainnetAddress(cashAddr)
-    if (network === 'mainnet' && addrIsMain) return true
-
-    return false
-  } catch (err) {
-    wlogger.error('Error in validateNetwork()')
-    return false
-  }
-}
-
-// Dynamically set these based on env vars. Allows unit testing.
-function setEnvVars () {
-  const BitboxHTTP = axios.create({
-    baseURL: process.env.RPC_BASEURL,
-    timeout: 15000
-  })
-  const username = process.env.RPC_USERNAME
-  const password = process.env.RPC_PASSWORD
-
-  const requestConfig = {
-    method: 'post',
-    auth: {
-      username: username,
-      password: password
-    },
-    data: {
-      jsonrpc: '1.0'
-    }
-  }
-
-  return { BitboxHTTP, username, password, requestConfig }
-}
-
-// Axios options used when calling axios.post() to talk with a full node.
-function getAxiosOptions () {
-  return {
-    method: 'post',
-    baseURL: process.env.RPC_BASEURL,
-    timeout: 15000,
-    auth: {
-      username: process.env.RPC_USERNAME,
-      password: process.env.RPC_PASSWORD
-    },
-    data: {
-      jsonrpc: '1.0'
-    }
-  }
-}
-
-// Error messages returned by a full node can be burried pretty deep inside the
-// error object returned by Axios. This function attempts to extract and interpret
-// error messages.
-// Returns an object. If successful, obj.msg is a string.
-// If there is a failure, obj.msg is false.
-function decodeError (err) {
-  try {
-    // Attempt to extract the full node error message.
-    if (
-      err.response &&
-      err.response.data &&
-      err.response.data.error &&
-      err.response.data.error.message
-    ) {
-      return { msg: err.response.data.error.message, status: 400 }
-    }
-
-    // Attempt to extract the Insight error message
-    if (err.response && err.response.data) {
-      return { msg: err.response.data, status: err.response.status }
-    }
-
-    // console.log(`err.message: ${err.message}`)
-    // console.log(`err: `, err)
-
-    // Attempt to detect a network connection error.
-    if (err.message && err.message.indexOf('ENOTFOUND') > -1) {
-      return {
-        msg:
-          'Network error: Could not communicate with full node or other external service.',
-        status: 503
-      }
-    }
-
-    // Different kind of network error
-    if (err.message && err.message.indexOf('ENETUNREACH') > -1) {
-      return {
-        msg:
-          'Network error: Could not communicate with full node or other external service.',
-        status: 503
-      }
-    }
-
-    // Different kind of network error
-    if (err.message && err.message.indexOf('EAI_AGAIN') > -1) {
-      return {
-        msg:
-          'Network error: Could not communicate with full node or other external service.',
-        status: 503
-      }
-    }
-
-    // Axios timeout (aborted) error, or service is down (connection refused).
-    if (
-      err.code &&
-      (err.code === 'ECONNABORTED' || err.code === 'ECONNREFUSED')
-    ) {
-      return {
-        msg:
-          'Network error: Could not communicate with full node or other external service.',
-        status: 503
-      }
-    }
-
-    // Handle general Error objects.
-    if (err.message) {
-      return {
-        message: err.message,
-        status: 422
-      }
-    }
-
-    return { msg: false, status: 500 }
-  } catch (err) {
-    console.error('unhandled error in route-utils.js/decodeError(): ', err)
-    wlogger.error('unhandled error in route-utils.js/decodeError(): ', err)
-    return { msg: false, status: 500 }
-  }
-}

src/routes/v4/slp.js

@@ -36,9 +36,13 @@ util.inspect.defaultOptions = { depth: 5 }
 // Determine the Access password for a private instance of SLPDB.
 // https://gist.github.com/christroutner/fc717ca704dec3dded8b52fae387eab2
 // Password for General Purpose (GP) SLPDB.
-const SLPDB_PASS_GP = process.env.SLPDB_PASS_GP ? process.env.SLPDB_PASS_GP : 'BITBOX'
+const SLPDB_PASS_GP = process.env.SLPDB_PASS_GP
+  ? process.env.SLPDB_PASS_GP
+  : 'BITBOX'
 // Password for Whitelist (WL) SLPDB.
-const SLPDB_PASS_WL = process.env.SLPDB_PASS_WL ? process.env.SLPDB_PASS_WL : 'BITBOX'
+const SLPDB_PASS_WL = process.env.SLPDB_PASS_WL
+  ? process.env.SLPDB_PASS_WL
+  : 'BITBOX'
 
 // const rawtransactions = require('./full-node/rawtransactions')
 const RawTransactions = require('./full-node/rawtransactions')
@@ -46,7 +50,7 @@ const rawTransactions = new RawTransactions()
 
 // Setup REST and TREST URLs used by slpjs
 // Dev note: this allows for unit tests to mock the URL.
-if (!process.env.REST_URL) process.env.REST_URL = 'https://bchn.fullstack.cash/v4/'
+if (!process.env.REST_URL) { process.env.REST_URL = 'https://bchn.fullstack.cash/v4/' }
 if (!process.env.TREST_URL) {
   process.env.TREST_URL = 'https://testnet.fullstack.cash/v4/'
 }
@@ -100,8 +104,13 @@ class Slp {
 
   // DRY error handler.
   errorHandler (err, res) {
+    // console.error('Entering slp.js/errorHandler(). err: ', err)
+
     // Attempt to decode the error message.
     const { msg, status } = _this.routeUtils.decodeError(err)
+    console.log('slp.js/errorHandler msg from decodeError: ', msg)
+    console.log('slp.js/errorHandler status from decodeError: ', status)
+
     if (msg) {
       res.status(status)
       return res.json({ error: msg })
@@ -215,7 +224,7 @@ class Slp {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, tokenIds)) {
-        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -545,7 +554,7 @@ class Slp {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, addresses)) {
-        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -914,7 +923,7 @@ class Slp {
 
     // Enforce array size rate limits
     if (!_this.routeUtils.validateArraySize(req, addresses)) {
-      res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+      res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
       return res.json({
         error: 'Array too large.'
       })
@@ -975,7 +984,7 @@ class Slp {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, txids)) {
-        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -1403,7 +1412,7 @@ class Slp {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, txids)) {
-        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -1982,7 +1991,9 @@ class Slp {
       // Extract a delay value if the user passed it in.
       const usrObjIn = req.body.usrObj
       let utxoDelay = 0
-      if (usrObjIn && usrObjIn.utxoDelay) { utxoDelay = usrObjIn.utxoDelay }
+      if (usrObjIn && usrObjIn.utxoDelay) {
+        utxoDelay = usrObjIn.utxoDelay
+      }
 
       // console.log('req: ', req)
       // console.log(`req._remoteAddress: ${req._remoteAddress}`)
@@ -2031,7 +2042,10 @@ class Slp {
         const theseUtxos = utxos[i].utxos
 
         // Get SLP token details.
-        const details = await _this.bchjs.SLP.Utils.tokenUtxoDetails(theseUtxos, usrObj)
+        const details = await _this.bchjs.SLP.Utils.tokenUtxoDetails(
+          theseUtxos,
+          usrObj
+        )
         // console.log('details: ', details)
 
         // Replace the original UTXO data with the hydrated data.
@@ -2042,12 +2056,13 @@ class Slp {
       return res.json({ slpUtxos: utxos })
     } catch (err) {
       wlogger.error('Error in slp.js/hydrateUtxos().', err)
-      console.error('Error in slp.js/hydrateUtxos().', err)
+      // console.error('Error in slp.js/hydrateUtxos().', err)
 
       // Decode the error message.
       const { msg, status } = routeUtils.decodeError(err)
-      console.log('msg: ', msg)
-      console.log('status: ', status)
+      // console.log('msg: ', msg)
+      // console.log('status: ', status)
+
       if (msg) {
         res.status(status)
         return res.json({ error: msg, message: msg, success: false })
@@ -2082,6 +2097,23 @@ class Slp {
     try {
       const utxos = req.body.utxos
 
+      // Extract a delay value if the user passed it in.
+      const usrObjIn = req.body.usrObj
+      let utxoDelay = 0
+      if (usrObjIn && usrObjIn.utxoDelay) {
+        utxoDelay = usrObjIn.utxoDelay
+      }
+
+      // Generate a user object that can be passed along with internal calls
+      // from bch-js.
+      const usrObj = {
+        ip: req._remoteAddress,
+        jwtToken: req.locals.jwtToken,
+        proLimit: req.locals.proLimit,
+        apiLevel: req.locals.apiLevel,
+        utxoDelay
+      }
+
       // Validate inputs
       if (!Array.isArray(utxos)) {
         res.status(422)
@@ -2117,7 +2149,10 @@ class Slp {
         // console.log(`theseUtxos: ${JSON.stringify(theseUtxos, null, 2)}`)
 
         // Get SLP token details.
-        const details = await _this.bchjs.SLP.Utils.tokenUtxoDetailsWL(theseUtxos)
+        const details = await _this.bchjs.SLP.Utils.tokenUtxoDetailsWL(
+          theseUtxos,
+          usrObj
+        )
         // console.log('details : ', details)
 
         // Replace the original UTXO data with the hydrated data.

src/routes/v4/util.js

@@ -4,7 +4,9 @@ const express = require('express')
 const router = express.Router()
 const axios = require('axios')
 
-const routeUtils = require('./route-utils')
+const RouteUtils = require('../../util/route-utils')
+const routeUtils = new RouteUtils()
+
 const wlogger = require('../../util/winston-logging')
 
 const util = require('util')
@@ -141,7 +143,7 @@ class UtilRoute {
 
       // Enforce array size rate limits
       if (!routeUtils.validateArraySize(req, addresses)) {
-        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           error: 'Array too large.'
         })

src/routes/v4/xpub.js

@@ -5,8 +5,10 @@
 'use strict'
 
 const express = require('express')
-// const axios = require('axios')
-const routeUtils = require('./route-utils')
+
+const RouteUtils = require('../../util/route-utils')
+const routeUtils = new RouteUtils()
+
 const wlogger = require('../../util/winston-logging')
 
 // const router = express.Router()

src/util/route-utils.js

@@ -154,6 +154,23 @@ class RouteUtils {
         }
       }
 
+      // Handle 429 errors thrown by nginx
+      if (err.error) {
+        // console.log('decodeError: err: ', err)
+
+        if (err.error.includes('429 Too Many Requests')) {
+          const internalMsg =
+            '429 error thrown by nginx caught by route-utils.js/decodeError()'
+          console.error(internalMsg)
+          wlogger.error(internalMsg)
+
+          return {
+            msg: '429 Too Many Requests',
+            status: 429
+          }
+        }
+      }
+
       // Handle general Error objects.
       if (err.message) {
         return {
@@ -169,6 +186,29 @@ class RouteUtils {
       return { msg: false, status: 500 }
     }
   }
+
+  // Dynamically set these based on env vars. Allows unit testing.
+  setEnvVars () {
+    const BitboxHTTP = axios.create({
+      baseURL: process.env.RPC_BASEURL,
+      timeout: 15000
+    })
+    const username = process.env.RPC_USERNAME
+    const password = process.env.RPC_PASSWORD
+
+    const requestConfig = {
+      method: 'post',
+      auth: {
+        username: username,
+        password: password
+      },
+      data: {
+        jsonrpc: '1.0'
+      }
+    }
+
+    return { BitboxHTTP, username, password, requestConfig }
+  }
 }
 
 module.exports = RouteUtils

test/v4/a01-electrumx.js

@@ -594,7 +594,7 @@ describe('#Electrumx', () => {
       assert.isArray(result.transactions)
     })
 
-    it('should throw 429 error if txid array is too large', async () => {
+    it('should throw 400 error if txid array is too large', async () => {
       const testArray = []
       for (var i = 0; i < 25; i++) testArray.push('')
 
@@ -603,7 +603,7 @@ describe('#Electrumx', () => {
       const result = await electrumxRoute.transactionDetailsBulk(req, res)
       // console.log(`result: ${util.inspect(result)}`)
 
-      expectRouteError(res, result, 'Array too large', 429)
+      expectRouteError(res, result, 'Array too large', 400)
     })
 
     it('should get details for a single txid', async () => {
@@ -841,7 +841,7 @@ describe('#Electrumx', () => {
       assert.isArray(result.headers)
     })
 
-    it('should throw 429 error if heights array is too large', async () => {
+    it('should throw 400 error if heights array is too large', async () => {
       const testArray = []
       for (var i = 0; i < 25; i++) testArray.push('')
 
@@ -849,7 +849,7 @@ describe('#Electrumx', () => {
 
       const result = await electrumxRoute.blockHeadersBulk(req, res)
 
-      expectRouteError(res, result, 'Array too large', 429)
+      expectRouteError(res, result, 'Array too large', 400)
     })
 
     it('should get details for a single height', async () => {

test/v4/blockchain.js

@@ -1823,4 +1823,204 @@ describe('#BlockchainRouter', () => {
       assert.equal(result.length, 2)
     })
   })
+
+  describe('#getBlock()', () => {
+    it('returns proper error when downstream service stalls', async () => {
+      // Mock the timeout error.
+      sandbox.stub(uut.axios, 'request').throws({ code: 'ECONNABORTED' })
+
+      req.body.blockhash =
+        '000000202ed2723e7590e2b937f6821a99d6764cb8799bf30f8e300000000000000000001d311c02df9a1e3f57b8dbdcf97ec8dbc3109a26779724c63e560b29ad9ea501e2af955d286403183049e39c1e000000067139f230701a2819a76795564bd2f67ded7eeae68596f368eddb3dd5bc54e59320e896f71d61cfc3ae3d4a90fca08b1aa35ba91256d8939d2cad11e638c0081f66724abdef55cf7b8b9fed064bce0369171434f8b289c1330ccef765f8e97a2c0d794d81aafb535855f7daa6bb51e40f77c6b59d7af7f62d0eb726a4fc4df82353d56fcbda7c7ea6bd935d61af8fb3b295637e6f323b10231135b3f10a034cfb238f635830c0595e52c6c31247cf677b555f7a287076e20cd0e1d3cc9af7260f02b700'
+
+      const result = await uut.getBlock(req, res)
+      // console.log(`result: ${JSON.stringify(result, null, 2)}`)
+
+      assert.isAbove(res.statusCode, 499, 'HTTP status code 503 expected.')
+      assert.include(
+        result.error,
+        'Could not communicate with full node',
+        'Error message expected'
+      )
+    })
+
+    it('returns proper error when downstream service is down', async () => {
+      // Mock the timeout error.
+      sandbox.stub(uut.axios, 'request').throws({ code: 'ECONNREFUSED' })
+
+      req.body.blockhash =
+        '000000202ed2723e7590e2b937f6821a99d6764cb8799bf30f8e300000000000000000001d311c02df9a1e3f57b8dbdcf97ec8dbc3109a26779724c63e560b29ad9ea501e2af955d286403183049e39c1e000000067139f230701a2819a76795564bd2f67ded7eeae68596f368eddb3dd5bc54e59320e896f71d61cfc3ae3d4a90fca08b1aa35ba91256d8939d2cad11e638c0081f66724abdef55cf7b8b9fed064bce0369171434f8b289c1330ccef765f8e97a2c0d794d81aafb535855f7daa6bb51e40f77c6b59d7af7f62d0eb726a4fc4df82353d56fcbda7c7ea6bd935d61af8fb3b295637e6f323b10231135b3f10a034cfb238f635830c0595e52c6c31247cf677b555f7a287076e20cd0e1d3cc9af7260f02b700'
+      const result = await uut.getBlock(req, res)
+      // console.log(`result: ${JSON.stringify(result, null, 2)}`)
+
+      assert.isAbove(res.statusCode, 499, 'HTTP status code 503 expected.')
+      assert.include(
+        result.error,
+        'Could not communicate with full node',
+        'Error message expected'
+      )
+    })
+
+    it('should throw 400 if blockhash is empty', async () => {
+      const result = await uut.getBlock(req, res)
+      // console.log(`result: ${util.inspect(result)}`)
+
+      assert.hasAllKeys(result, ['error'])
+      assert.include(result.error, 'blockhash can not be empty')
+    })
+
+    it('should return block info with verbosity 0', async () => {
+      // Mock the RPC call for unit tests.
+      if (process.env.TEST === 'unit') {
+        sandbox
+          .stub(uut.axios, 'request')
+          .resolves({ data: { result: mockData.mockBlockInfo.verbosity0 } })
+      }
+
+      req.body.blockhash =
+        '0000000000000000008e8d83cba6d45a9314bc2ef4538d4e0577c6bed8593536'
+      req.body.verbosity = 0
+
+      const result = await uut.getBlock(req, res)
+      // console.log(`result: ${JSON.stringify(result, null, 2)}`)
+
+      assert.isString(result)
+    })
+
+    it('should return block info with verbosity 1', async () => {
+      // Mock the RPC call for unit tests.
+      if (process.env.TEST === 'unit') {
+        sandbox
+          .stub(uut.axios, 'request')
+          .resolves({ data: { result: mockData.mockBlockInfo.verbosity1 } })
+      }
+
+      req.body.blockhash =
+        '0000000000000000008e8d83cba6d45a9314bc2ef4538d4e0577c6bed8593536'
+      req.body.verbosity = 1
+
+      const result = await uut.getBlock(req, res)
+      // console.log(`result: ${JSON.stringify(result, null, 2)}`)
+
+      assert.property(result, 'hash', 'hash property expected')
+      assert.property(
+        result,
+        'confirmations',
+        'confirmations property expected'
+      )
+      assert.property(result, 'size', 'size property expected')
+      assert.property(result, 'height', 'height property expected')
+      assert.property(result, 'version', 'version property expected')
+      assert.property(result, 'versionHex', 'versionHex property expected')
+      assert.property(result, 'merkleroot', 'merkleroot property expected')
+      assert.property(result, 'tx', 'tx property expected')
+      assert.property(result, 'time', 'time property expected')
+      assert.property(result, 'mediantime', 'mediantime property expected')
+      assert.property(result, 'nonce', 'nonce property expected')
+      assert.property(result, 'bits', 'bits property expected')
+      assert.property(result, 'difficulty', 'difficulty property expected')
+      assert.property(result, 'chainwork', 'chainwork property expected')
+      assert.property(result, 'nTx', 'nTx property expected')
+      assert.property(
+        result,
+        'previousblockhash',
+        'previousblockhash property expected'
+      )
+      assert.property(
+        result,
+        'nextblockhash',
+        'nextblockhash property expected'
+      )
+    })
+
+    it('should return block info with verbosity 2', async () => {
+      // Mock the RPC call for unit tests.
+      if (process.env.TEST === 'unit') {
+        sandbox
+          .stub(uut.axios, 'request')
+          .resolves({ data: { result: mockData.mockBlockInfo.verbosity1 } })
+      }
+
+      req.body.blockhash =
+        '0000000000000000008e8d83cba6d45a9314bc2ef4538d4e0577c6bed8593536'
+      req.body.verbosity = 2
+
+      const result = await uut.getBlock(req, res)
+      // console.log(`result: ${JSON.stringify(result, null, 2)}`)
+
+      assert.property(result, 'hash', 'hash property expected')
+      assert.property(
+        result,
+        'confirmations',
+        'confirmations property expected'
+      )
+      assert.property(result, 'size', 'size property expected')
+      assert.property(result, 'height', 'height property expected')
+      assert.property(result, 'version', 'version property expected')
+      assert.property(result, 'versionHex', 'versionHex property expected')
+      assert.property(result, 'merkleroot', 'merkleroot property expected')
+      assert.property(result, 'tx', 'tx property expected')
+      assert.property(result, 'time', 'time property expected')
+      assert.property(result, 'mediantime', 'mediantime property expected')
+      assert.property(result, 'nonce', 'nonce property expected')
+      assert.property(result, 'bits', 'bits property expected')
+      assert.property(result, 'difficulty', 'difficulty property expected')
+      assert.property(result, 'chainwork', 'chainwork property expected')
+      assert.property(result, 'nTx', 'nTx property expected')
+      assert.property(
+        result,
+        'previousblockhash',
+        'previousblockhash property expected'
+      )
+      assert.property(
+        result,
+        'nextblockhash',
+        'nextblockhash property expected'
+      )
+    })
+
+    it('should return block info without verbosity especified', async () => {
+      // Mock the RPC call for unit tests.
+      if (process.env.TEST === 'unit') {
+        sandbox
+          .stub(uut.axios, 'request')
+          .resolves({ data: { result: mockData.mockBlockInfo.verbosity1 } })
+      }
+
+      req.body.blockhash =
+        '0000000000000000008e8d83cba6d45a9314bc2ef4538d4e0577c6bed8593536'
+
+      const result = await uut.getBlock(req, res)
+      // console.log(`result: ${JSON.stringify(result, null, 2)}`)
+
+      assert.property(result, 'hash', 'hash property expected')
+      assert.property(
+        result,
+        'confirmations',
+        'confirmations property expected'
+      )
+      assert.property(result, 'size', 'size property expected')
+      assert.property(result, 'height', 'height property expected')
+      assert.property(result, 'version', 'version property expected')
+      assert.property(result, 'versionHex', 'versionHex property expected')
+      assert.property(result, 'merkleroot', 'merkleroot property expected')
+      assert.property(result, 'tx', 'tx property expected')
+      assert.property(result, 'time', 'time property expected')
+      assert.property(result, 'mediantime', 'mediantime property expected')
+      assert.property(result, 'nonce', 'nonce property expected')
+      assert.property(result, 'bits', 'bits property expected')
+      assert.property(result, 'difficulty', 'difficulty property expected')
+      assert.property(result, 'chainwork', 'chainwork property expected')
+      assert.property(result, 'nTx', 'nTx property expected')
+      assert.property(
+        result,
+        'previousblockhash',
+        'previousblockhash property expected'
+      )
+      assert.property(
+        result,
+        'nextblockhash',
+        'nextblockhash property expected'
+      )
+    })
+  })
 })

test/v4/encryption.js

@@ -82,7 +82,7 @@ describe('#Encryption Router', () => {
           .resolves(mockData.mockFulcrumTxHistory)
         sandbox
           .stub(encryptionRoute.bchjs.RawTransactions, 'getRawTransaction')
-          .resolves(mockData.mockTxDetails2)
+          .resolves([mockData.mockTxDetails2])
       }
 
       const result = await encryptionRoute.getPublicKey(req, res)
@@ -110,7 +110,7 @@ describe('#Encryption Router', () => {
       }
 
       const result = await encryptionRoute.getPublicKey(req, res)
-      // console.log(`result: ${JSON.stringify(result, null, 2)}`)
+      console.log(`result: ${JSON.stringify(result, null, 2)}`)
 
       assert.property(result, 'success')
       assert.equal(result.success, false)
@@ -130,7 +130,7 @@ describe('#Encryption Router', () => {
           .resolves(mockData.mockFulcrumNoSendBalance)
         sandbox
           .stub(encryptionRoute.bchjs.RawTransactions, 'getRawTransaction')
-          .resolves(mockData.mockNoSendTx)
+          .resolves([mockData.mockNoSendTx])
       }
 
       const result = await encryptionRoute.getPublicKey(req, res)

test/v4/mocks/blockchain-mock.js

@@ -285,7 +285,86 @@ const mockAncestors = [
   'e68dad4a7292105cfa84fcaef7f99e5d4f2ece9613ca625d4d2ebf61efa84118',
   'fe94caf5da672be3772d2304a6272eb8bc3d3f5cb4a886f39b7981e1485cf74b'
 ]
-
+const mockBlockInfo = {
+  verbosity0: '20000000',
+  verbosity1: {
+    hash: '00000000c937983704a73af28acdec37b049d214adbda81d7e2a3dd146f6ed09',
+    confirmations: 1,
+    size: 3725,
+    strippedsize: 3725,
+    weight: 3725,
+    height: 6725,
+    version: 1,
+    versionHex: '00000000',
+    merkleroot: 'xxxx',
+    tx: [
+      '2afb8264508e2bf3e5288ccad01ed2ab766745b6b9747666b519d59212012c01',
+      '18f40b1ae56bba3fa1934b737fbe46ed8d5ca40fa9aed95073eeb5a119530cd3',
+      '349720d878547752607a69eb19e330592fee271fb5376cdfd811bee423558ed8',
+      '35571c80e7d0e9247b467454ef147d1d5833c775bc2d4164b1bebd4c1f69164f',
+      '480937e8efacdafeeb97d401ff0dd9ea8e8ddb27244cefa67a03621315bdb0e6',
+      '523327469d0b90c0de9a905c2fe6e227278fc5b55b9d9911ca151e1c26647065',
+      '61de4af971d94dbc741762f21dcef08b74b62863a56a1cb3496becdd8d47a858',
+      '69f70a288403b5bba23030ccd05d2e5cb00394620fdae3b050cff9432cc590ce',
+      '94472a90fbdba2eb2cba68308415181faedf3585c66b89efcbdb927a0c10ba23',
+      'bc6f781f9e2f2df460f89995c5e1c7224e48ccbe1aa2a575961f3f5330259864',
+      'f2d945a79bec5454a9ab4d570a150d81124daa308f1c81106a977d6413476944'
+    ],
+    time: 111,
+    mediantime: 111,
+    nonce: 111,
+    bits: '1d00ffff',
+    difficulty: 99.999,
+    chainwork: 'xxxx',
+    nTx: 1,
+    previousblockhash:
+      '00000000c937983704a73af28acdec37b049d214adbda81d7e2a3dd146f6ed09',
+    nextblockhash:
+      '00000000c937983704a73af28acdec37b049d214adbda81d7e2a3dd146f6ed09'
+  },
+  verbosity2: {
+    hash: '00000000c937983704a73af28acdec37b049d214adbda81d7e2a3dd146f6ed09',
+    confirmations: 1,
+    size: 3725,
+    strippedsize: 3725,
+    weight: 3725,
+    height: 6725,
+    version: 1,
+    versionHex: '00000000',
+    merkleroot: 'xxxx',
+    tx: [
+      {
+        hex:
+          '01000000010000000000000000000000000000000000000000000000000000000000000000ffffffff0704ffff001d0104ffffffff0100f2052a0100000043410496b538e853519c726a2c91e61ec11600ae1390813a627c66fb8be7947be63c52da7589379515d4e0a604f8141781e62294721166bf621e73a82cbf2342c858eeac00000000',
+        txid:
+          '0e3e2357e806b6cdb1f70b54c3a3a17b6714ee1f0e68bebb44a74b1efd512098',
+        hash:
+          '0e3e2357e806b6cdb1f70b54c3a3a17b6714ee1f0e68bebb44a74b1efd512098',
+        size: 134,
+        version: 1,
+        locktime: 0,
+        vin: [],
+        vout: [],
+        blockhash:
+          '00000000839a8e6886ab5951d76f411475428afc90947ee320161bbf18eb6048',
+        confirmations: 581882,
+        time: 1231469665,
+        blocktime: 1231469665
+      }
+    ],
+    time: 111,
+    mediantime: 111,
+    nonce: 111,
+    bits: '1d00ffff',
+    difficulty: 99.999,
+    chainwork: 'xxxx',
+    nTx: 1,
+    previousblockhash:
+      '00000000c937983704a73af28acdec37b049d214adbda81d7e2a3dd146f6ed09',
+    nextblockhash:
+      '00000000c937983704a73af28acdec37b049d214adbda81d7e2a3dd146f6ed09'
+  }
+}
 module.exports = {
   mockBlockHash,
   mockBlockchainInfo,
@@ -296,5 +375,6 @@ module.exports = {
   mockBlockHeader,
   mockTxOut,
   mockTxOutProof,
-  mockAncestors
+  mockAncestors,
+  mockBlockInfo
 }

test/v4/mocks/encryption-mocks.js

@@ -53,6 +53,8 @@ const mockNoSendTx = {
 
 const mockFulcrumTxHistory = {
   success: true,
+  transactions: [
+    {
       transactions: [
         {
           height: 511463,
@@ -115,6 +117,8 @@ const mockFulcrumTxHistory = {
             'c42f8f16d3baa2ee343ea89ef110dfe094992379d08edd30887b8ca7ee671c9a'
         }
       ]
+    }
+  ]
 }
 
 const mockTxDetails2 = {
@@ -159,11 +163,18 @@ const mockTxDetails2 = {
 
 const mockFulcrumNoTxHistory = {
   success: true,
-  transactions: []
+  transactions: [
+    {
+      transactions: [],
+      address: 'bitcoincash:qrgqqkky28jdkv3w0ctrah0mz3jcsnsklc34gtukrh'
+    }
+  ]
 }
 
 const mockFulcrumNoSendBalance = {
   success: true,
+  transactions: [
+    {
       transactions: [
         {
           height: 633578,
@@ -171,6 +182,8 @@ const mockFulcrumNoSendBalance = {
             'a3b62cd4f4c56ba52139179db14bffd4ab22a2e077f3c62bd5cf0541bfcaf023'
         }
       ]
+    }
+  ]
 }
 
 module.exports = {

test/v4/rate-limit-unit.js

@@ -0,0 +1,506 @@
+/*
+  Unit tests for the route-ratelimit2.js middleware.
+*/
+
+'use strict'
+
+// Public npm libraries.
+const assert = require('chai').assert
+const sinon = require('sinon')
+const cloneDeep = require('lodash.clonedeep')
+
+const config = require('../../config')
+
+// Mocking data.
+const { mockReq, mockRes, mockNext } = require('./mocks/express-mocks')
+
+// Libraries under test
+const RateLimits = require('../../src/middleware/route-ratelimit')
+let uut = new RateLimits()
+
+let req, res, next
+
+describe('#rate-routelimit', () => {
+  let sandbox
+
+  before(async () => {
+    if (!process.env.JWT_AUTH_SERVER) {
+      process.env.JWT_AUTH_SERVER = 'http://fakeurl.com/'
+    }
+
+    // Wipe the Redis DB, which prevents false negatives when running integration
+    // tests back-to-back.
+    await uut.wipeRedis()
+  })
+
+  // Setup the mocks before each test.
+  beforeEach(() => {
+    // Mock the req and res objects used by Express routes.
+    req = cloneDeep(mockReq)
+    res = cloneDeep(mockRes)
+    next = mockNext
+
+    // Explicitly reset the parmas and body.
+    req.params = {}
+    req.body = {}
+    req.query = {}
+    req.locals = {}
+
+    sandbox = sinon.createSandbox()
+
+    uut = new RateLimits()
+  })
+
+  afterEach(() => {
+    sandbox.restore()
+  })
+
+  after(() => {
+    uut.closeRedis()
+  })
+
+  describe('#checkInternalIp', () => {
+    it('should return true for a request from localhost', () => {
+      req.ip = '::ffff:127.0.0.1'
+
+      const result = uut.checkInternalIp(req)
+
+      assert.equal(result, true)
+    })
+
+    it('should return true for a request from a Docker container', () => {
+      req.ip = '172.17.0.3'
+
+      const result = uut.checkInternalIp(req)
+
+      assert.equal(result, true)
+    })
+
+    it('should return false for a random ip address', () => {
+      req.ip = '123.456.7.8'
+
+      const result = uut.checkInternalIp(req)
+
+      assert.equal(result, false)
+    })
+
+    it('should return false when an error is encountered', () => {
+      req.ip = 4
+
+      const result = uut.checkInternalIp(req)
+
+      assert.equal(result, false)
+    })
+  })
+
+  describe('#isInWhitelist', () => {
+    it('should return false when no argument is passed in', () => {
+      const result = uut.isInWhitelist()
+
+      assert.equal(result, false)
+    })
+
+    it('should return false when origin is not in the whitelist', () => {
+      req.origin = 'blah.com'
+      req.get = sandbox.stub().returns(req.origin)
+
+      const result = uut.isInWhitelist(req)
+
+      assert.equal(result, false)
+
+      // Used to appease linter. Remove these.
+      res.blah = 4
+      next()
+    })
+
+    it('should return true when origin is in the whitelist', () => {
+      req.origin = 'message.fullstack.cash'
+      req.get = sandbox.stub().returns(req.origin)
+
+      const result = uut.isInWhitelist(req)
+
+      assert.equal(result, true)
+    })
+  })
+
+  describe('#decodeJwtToken', () => {
+    it('should return the default JWT payload if decoding fails', () => {
+      const jwt =
+        'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjVlODhhY2JmMDIyMWMxMDAxMmFkOTNmZiIsImVtYWlsIjoiY2hyaXMudHJvdXRuZXJAZ21haWwuY29tIiwiYXBpTGV2ZWwiOjQwLCJyYXRlTGltaXQiOjMsImlhdCI6MTYxNTE1NzA4NywiZXhwIjoxNjE3NzQ5MDg3fQ.RLNGuYAa-CcLdhTGD27tDeaxT6-GIdeR8T4JWZZLDZA'
+
+      const result = uut.decodeJwtToken(jwt)
+      // console.log('result: ', result)
+
+      assert.property(result, 'id')
+      // assert.equal(result.id, '123.456.789.10')
+      assert.property(result, 'email')
+      // assert.equal(result.email, 'test@bchtest.net')
+      // assert.property(result, 'pointsToConsume')
+      // assert.equal(result.pointsToConsume, config.anonRateLimit)
+      // assert.property(result, 'duration')
+      // assert.equal(result.duration, 30)
+      assert.property(result, 'exp')
+    })
+
+    it('should return the default JWT payload if no input is given', () => {
+      const result = uut.decodeJwtToken()
+      // console.log('result: ', result)
+
+      assert.property(result, 'id')
+      assert.equal(result.id, '123.456.789.10')
+      assert.property(result, 'email')
+      assert.equal(result.email, 'test@bchtest.net')
+      assert.property(result, 'pointsToConsume')
+      assert.equal(result.pointsToConsume, config.anonRateLimit)
+      assert.property(result, 'duration')
+      assert.equal(result.duration, 30)
+      assert.property(result, 'exp')
+    })
+
+    it('should correctly decode a JWT token', () => {
+      // Generate a new JWT token for the test.
+      const jwtPayload = {
+        id: '5dade3f5739e6c0ff034b9a1',
+        pointsToConsume: 10,
+        email: 'gooduser@test.com',
+        apiLevel: 40,
+        rateLimit: 100,
+        duration: 30
+      }
+      const jwtToken = uut.generateJwtToken(jwtPayload)
+
+      const result = uut.decodeJwtToken(jwtToken)
+      // console.log('result: ', result)
+
+      assert.property(result, 'id')
+      assert.equal(result.id, jwtPayload.id)
+      assert.property(result, 'email')
+      assert.equal(result.email, jwtPayload.email)
+      assert.property(result, 'pointsToConsume')
+      assert.equal(result.pointsToConsume, jwtPayload.pointsToConsume)
+      assert.property(result, 'duration')
+      assert.equal(result.duration, jwtPayload.duration)
+      assert.property(result, 'exp')
+    })
+
+    it('should return the default payload if there is an unhandled error', () => {
+      // Force an error.
+      sandbox.stub(uut, 'generateJwtToken').throws(new Error('test error'))
+
+      const result = uut.decodeJwtToken()
+      // console.log('result: ', result)
+
+      assert.property(result, 'id')
+      assert.equal(result.id, '123.456.789.10')
+      assert.property(result, 'email')
+      assert.equal(result.email, 'test@bchtest.net')
+      assert.property(result, 'pointsToConsume')
+      assert.equal(result.pointsToConsume, config.anonRateLimit)
+      assert.property(result, 'duration')
+      assert.equal(result.duration, 30)
+      assert.property(result, 'exp')
+    })
+  })
+
+  describe('#trackRateLimits', () => {
+    it('should apply anonymous rate limits if no JWT token is provided', async () => {
+      req.ip = '127.0.0.1'
+
+      const result = await uut.trackRateLimits(req, res)
+      // console.log(`result: `, result)
+
+      // console.log('res.locals.pointsToConsume: ', res.locals.pointsToConsume)
+
+      assert.equal(result, false, 'Rate limits not exceeded')
+      assert.equal(
+        res.locals.pointsToConsume,
+        config.anonRateLimit,
+        'Anonymous rate limits applied'
+      )
+    })
+
+    it('should apply 100 RPM rate limits when JWT token is provided', async () => {
+      // Generate a new JWT token for the test.
+      const jwtPayload = {
+        id: '5dade3f5739e6c0ff034b9a1',
+        pointsToConsume: 10
+      }
+      const jwtToken = uut.generateJwtToken(jwtPayload)
+
+      const result = await uut.trackRateLimits(req, res, jwtToken)
+      // console.log(`result: `, result)
+
+      // console.log('res.locals.pointsToConsume: ', res.locals.pointsToConsume)
+
+      assert.equal(result, false, 'Rate limits not exceeded')
+      assert.equal(res.locals.pointsToConsume, 10, '100 RPM limits applied')
+    })
+  })
+
+  describe('#applyRateLimits', () => {
+    it('should skip rate limits if basic auth token is used', async () => {
+      req.locals.proLimit = true
+
+      // console.log('next.callCount: ', next.callCount)
+      const startCallCount = next.callCount
+
+      await uut.applyRateLimits(req, res, next)
+
+      // console.log('next.callCount: ', next.callCount)
+      const endCallCount = next.callCount
+
+      assert.isAbove(
+        endCallCount,
+        startCallCount,
+        'Expecting next() to be called'
+      )
+    })
+
+    it('should skip rate limits if internal call passes basic auth token', async () => {
+      req.ip = '127.0.0.1'
+      req.body.usrObj = {
+        proLimit: true
+      }
+
+      // console.log('next.callCount: ', next.callCount)
+      const startCallCount = next.callCount
+
+      await uut.applyRateLimits(req, res, next)
+
+      // console.log('next.callCount: ', next.callCount)
+      const endCallCount = next.callCount
+
+      assert.isAbove(
+        endCallCount,
+        startCallCount,
+        'Expecting next() to be called'
+      )
+    })
+
+    it('should apply rate limits to anonymous users', async () => {
+      req.ip = '123.456.7.8'
+
+      // console.log('next.callCount: ', next.callCount)
+      const startCallCount = next.callCount
+
+      await uut.applyRateLimits(req, res, next)
+
+      // console.log('next.callCount: ', next.callCount)
+      const endCallCount = next.callCount
+
+      assert.isAbove(
+        endCallCount,
+        startCallCount,
+        'Expecting next() to be called'
+      )
+
+      assert.equal(
+        res.locals.pointsToConsume,
+        config.anonRateLimit,
+        'Anonymous rate limits applied'
+      )
+    })
+
+    it('should return 429 error when anonymous users exceed rate limit', async () => {
+      req.ip = '123.456.7.8'
+
+      // force req.locals.jwtToken to be empty.
+      req.locals.jwtToken = undefined
+
+      let val
+      for (let i = 0; i < 25; i++) {
+        // console.log('req.locals: ', req.locals)
+        val = await uut.applyRateLimits(req, res, next)
+      }
+      // console.log('val: ', val)
+
+      assert.property(val, 'error')
+      assert.include(
+        val.error,
+        'Too many requests. Your limits are currently 20 requests per minute.'
+      )
+
+      assert.equal(res.locals.rateLimitTriggered, true, 'Rate limits triggered')
+
+      assert.equal(
+        res.locals.pointsToConsume,
+        config.anonRateLimit,
+        'Anonymous rate limits applied'
+      )
+    })
+
+    it('should apply rate limits when JWT token is provided', async () => {
+      // Generate a new JWT token for the test.
+      const jwtPayload = {
+        id: '5dade3f5739e6c0ff034b9a1',
+        pointsToConsume: 10
+      }
+      const jwtToken = uut.generateJwtToken(jwtPayload)
+
+      req.ip = '123.456.7.8'
+      req.locals.jwtToken = jwtToken
+
+      // console.log('next.callCount: ', next.callCount)
+      const startCallCount = next.callCount
+
+      await uut.applyRateLimits(req, res, next)
+
+      // console.log('next.callCount: ', next.callCount)
+      const endCallCount = next.callCount
+
+      assert.isAbove(
+        endCallCount,
+        startCallCount,
+        'Expecting next() to be called'
+      )
+
+      assert.equal(
+        res.locals.pointsToConsume,
+        10,
+        'Anonymous rate limits applied'
+      )
+    })
+
+    it('should apply internal rate limits to internal calls', async () => {
+      req.ip = '127.0.0.1'
+
+      // console.log('next.callCount: ', next.callCount)
+      const startCallCount = next.callCount
+
+      await uut.applyRateLimits(req, res, next)
+
+      // console.log('next.callCount: ', next.callCount)
+      const endCallCount = next.callCount
+
+      assert.isAbove(
+        endCallCount,
+        startCallCount,
+        'Expecting next() to be called'
+      )
+
+      assert.equal(
+        res.locals.pointsToConsume,
+        10,
+        'Internal rate limits applied'
+      )
+    })
+
+    it('should return 429 error when internal calls exceed interal rate limit', async () => {
+      req.ip = '127.0.0.1'
+
+      let val
+      for (let i = 0; i < 1025; i++) {
+        val = await uut.applyRateLimits(req, res, next)
+      }
+
+      assert.property(val, 'error')
+      assert.include(
+        val.error,
+        'Too many requests. Your limits are currently 1000 requests per minute.'
+      )
+
+      assert.equal(res.locals.rateLimitTriggered, true, 'Rate limits triggered')
+
+      assert.equal(
+        res.locals.pointsToConsume,
+        10,
+        'Internal rate limits applied'
+      )
+    })
+
+    it('should apply JWT rate limits to internal calls when JWT passes through', async () => {
+      // Generate a new JWT token for the test.
+      const jwtPayload = {
+        id: '5dade3f5739e6c0ff034b9a1',
+        pointsToConsume: 10
+      }
+      const jwtToken = uut.generateJwtToken(jwtPayload)
+
+      req.ip = '127.0.0.1'
+      req.body.usrObj = {
+        jwtToken
+      }
+
+      // console.log('next.callCount: ', next.callCount)
+      const startCallCount = next.callCount
+
+      await uut.applyRateLimits(req, res, next)
+
+      // console.log('next.callCount: ', next.callCount)
+      const endCallCount = next.callCount
+
+      assert.isAbove(
+        endCallCount,
+        startCallCount,
+        'Expecting next() to be called'
+      )
+
+      assert.equal(
+        res.locals.pointsToConsume,
+        10,
+        'User JWT rate limits applied'
+      )
+    })
+
+    it('should return 429 error when internal calls using JWT pass-through exceeds rate limit', async () => {
+      // Generate a new JWT token for the test.
+      const jwtPayload = {
+        id: '5dade3f5739e6c0ff034b9a1',
+        pointsToConsume: 100
+      }
+      const jwtToken = uut.generateJwtToken(jwtPayload)
+
+      req.ip = '127.0.0.1'
+      req.body.usrObj = {
+        jwtToken
+      }
+
+      try {
+        let val
+        for (let i = 0; i < 120; i++) {
+          val = await uut.applyRateLimits(req, res, next)
+        }
+        // console.log('val: ', val)
+
+        assert.property(val, 'error')
+        assert.include(
+          val.error,
+          'Too many requests. Your limits are currently 100 requests per minute.'
+        )
+
+        assert.equal(
+          res.locals.pointsToConsume,
+          100,
+          'User JWT rate limits applied'
+        )
+      } catch (err) {
+        console.log('err: ', err)
+        assert.fail('Unexpected result')
+      }
+    })
+
+    it('should move to the next middleware when encountering an unexpected internal error', async () => {
+      // Force the creation of the res and req locals property. Covers an
+      // otherwise untested code path.
+      req.locals = undefined
+      res.locals = undefined
+
+      // Force an error
+      sandbox.stub(uut, 'checkInternalIp').throws(new Error('test error'))
+
+      // console.log('next.callCount: ', next.callCount)
+      const startCallCount = next.callCount
+
+      await uut.applyRateLimits(req, res, next)
+
+      // console.log('next.callCount: ', next.callCount)
+      const endCallCount = next.callCount
+
+      assert.isAbove(
+        endCallCount,
+        startCallCount,
+        'Expecting next() to be called'
+      )
+    })
+  })
+})

test/v4/rate-limits.js

@@ -1,487 +0,0 @@
-'use strict'
-
-const chai = require('chai')
-const assert = chai.assert
-const sinon = require('sinon')
-
-// Used for debugging.
-const util = require('util')
-util.inspect.defaultOptions = { depth: 1 }
-
-// Mocking data.
-const { mockReq, mockRes, mockNext } = require('./mocks/express-mocks')
-
-// Libraries under test
-const RateLimits = require('../../src/middleware/route-ratelimit')
-let rateLimits = new RateLimits()
-
-// const controlRoute = require('../../src/routes/v4/full-node/control')
-const jwtAuth = require('../../src/middleware/jwt-auth')
-
-let req, res, next
-// let originalEnvVars // Used during transition from integration to unit tests.
-
-// JWT token used in tests.
-const jwt = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjVkYWRlM2Y1NzM5ZTZjMGZmMDM0YjlhMSIsImlhdCI6MTU3MTY3NzQ1MCwiZXhwIjoxNTc0MjY5NDUwfQ.SSz7F7ETyBB3eoNG2VKCzPOhddtB-vrtmEoj7PxicrQ'
-
-describe('#route-ratelimits & jwt-auth', () => {
-  let sandbox
-
-  before(async () => {
-    // Save existing environment variables.
-    // originalEnvVars = {
-    //   BITCOINCOM_BASEURL: process.env.BITCOINCOM_BASEURL,
-    //   RPC_BASEURL: process.env.RPC_BASEURL,
-    //   RPC_USERNAME: process.env.RPC_USERNAME,
-    //   RPC_PASSWORD: process.env.RPC_PASSWORD
-    // }
-
-    if (!process.env.JWT_AUTH_SERVER) { process.env.JWT_AUTH_SERVER = 'http://fakeurl.com/' }
-
-    // Wipe the Redis DB, which prevents false negatives when running integration
-    // tests back-to-back.
-    await rateLimits.wipeRedis()
-  })
-
-  // Setup the mocks before each test.
-  beforeEach(() => {
-    // Mock the req and res objects used by Express routes.
-    req = Object.assign({}, mockReq)
-    res = Object.assign({}, mockRes)
-    next = mockNext
-
-    // Explicitly reset the parmas and body.
-    req.params = {}
-    req.body = {}
-    req.query = {}
-    req.locals = {}
-
-    sandbox = sinon.createSandbox()
-  })
-
-  afterEach(() => {
-    sandbox.restore()
-  })
-
-  after(() => {
-    rateLimits.closeRedis()
-  })
-
-  describe('#jwt-auth.js', () => {
-    describe('#getTokenFromHeaders', () => {
-      it('should populate the req.locals object correctly', () => {
-        // Initialize req.locals
-        req.locals = {
-          proLimit: false,
-          apiLevel: 0
-        }
-
-        const header = `Token ${jwt}`
-        req.headers.authorization = header
-
-        jwtAuth.getTokenFromHeaders(req, res, next)
-
-        // console.log(`req.locals: ${JSON.stringify(req.locals, null, 2)}`)
-
-        assert.property(req.locals, 'proLimit')
-        assert.property(req.locals, 'apiLevel')
-        assert.property(req.locals, 'jwtToken')
-        assert.equal(req.locals.jwtToken, jwt)
-      })
-    })
-  })
-
-  describe('#getResource', () => {
-    it('should decode a blockchain request', () => {
-      const url =
-        '/blockchain/getTxOut/62a3ea958a463a372bc0caf2c374a7f60be9c624be63a0db8db78f05809df6d8/0?include_mempool=true'
-
-      const result = rateLimits.getResource(url)
-      // console.log(`result: ${JSON.stringify(result, null, 2)}`)
-
-      assert.equal(result, 'blockchain')
-    })
-  })
-
-  describe('#calcPoints', () => {
-    it('should return 50 points for anonymous user', () => {
-      const result = rateLimits.calcPoints()
-      // console.log(`result: ${result}`)
-
-      assert.equal(result, 50)
-    })
-
-    it('should return 50 points for free tier requesting full node access', () => {
-      const jwtInfo = {
-        apiLevel: 10,
-        resource: 'blockchain',
-        id: '5e3a0415eb29a962da2708b4'
-      }
-
-      const result = rateLimits.calcPoints(jwtInfo)
-      assert.equal(result, 50)
-    })
-
-    it('should return 50 points for free tier requesting indexer access', () => {
-      const jwtInfo = {
-        apiLevel: 10,
-        resource: 'blockbook',
-        id: '5e3a0415eb29a962da2708b4'
-      }
-
-      const result = rateLimits.calcPoints(jwtInfo)
-      assert.equal(result, 50)
-    })
-
-    it('should return 50 points for free tier requesting SLPDB access', () => {
-      const jwtInfo = {
-        apiLevel: 10,
-        resource: 'slp',
-        id: '5e3a0415eb29a962da2708b4'
-      }
-
-      const result = rateLimits.calcPoints(jwtInfo)
-      assert.equal(result, 50)
-    })
-
-    it('should return 10 points for full node tier requesting full node access', () => {
-      const jwtInfo = {
-        apiLevel: 20,
-        resource: 'blockchain',
-        id: '5e3a0415eb29a962da2708b4'
-      }
-
-      const result = rateLimits.calcPoints(jwtInfo)
-      assert.equal(result, 10)
-    })
-
-    it('should return 50 points for full-node tier requesting indexer access', () => {
-      const jwtInfo = {
-        apiLevel: 20,
-        resource: 'blockbook',
-        id: '5e3a0415eb29a962da2708b4'
-      }
-
-      const result = rateLimits.calcPoints(jwtInfo)
-      assert.equal(result, 50)
-    })
-
-    it('should return 50 points for full node tier requesting SLPDB access', () => {
-      const jwtInfo = {
-        apiLevel: 20,
-        resource: 'slp',
-        id: '5e3a0415eb29a962da2708b4'
-      }
-
-      const result = rateLimits.calcPoints(jwtInfo)
-      assert.equal(result, 50)
-    })
-
-    it('should return 10 point for indexer tier requesting full node access', () => {
-      const jwtInfo = {
-        apiLevel: 30,
-        resource: 'blockchain',
-        id: '5e3a0415eb29a962da2708b4'
-      }
-
-      const result = rateLimits.calcPoints(jwtInfo)
-      assert.equal(result, 10)
-    })
-
-    it('should return 10 points for indexer tier requesting indexer access', () => {
-      const jwtInfo = {
-        apiLevel: 30,
-        resource: 'blockbook',
-        id: '5e3a0415eb29a962da2708b4'
-      }
-
-      const result = rateLimits.calcPoints(jwtInfo)
-      assert.equal(result, 10)
-    })
-
-    it('should return 50 points for indexer tier requesting SLPDB access', () => {
-      const jwtInfo = {
-        apiLevel: 30,
-        resource: 'slp',
-        id: '5e3a0415eb29a962da2708b4'
-      }
-
-      const result = rateLimits.calcPoints(jwtInfo)
-      assert.equal(result, 50)
-    })
-
-    it('should return 10 point for SLP tier requesting full node access', () => {
-      const jwtInfo = {
-        apiLevel: 40,
-        resource: 'blockchain',
-        id: '5e3a0415eb29a962da2708b4'
-      }
-
-      const result = rateLimits.calcPoints(jwtInfo)
-      assert.equal(result, 10)
-    })
-
-    it('should return 10 points for SLP tier requesting indexer access', () => {
-      const jwtInfo = {
-        apiLevel: 40,
-        resource: 'blockbook',
-        id: '5e3a0415eb29a962da2708b4'
-      }
-
-      const result = rateLimits.calcPoints(jwtInfo)
-      assert.equal(result, 10)
-    })
-
-    it('should return 10 points for SLP tier requesting SLPDB access', () => {
-      const jwtInfo = {
-        apiLevel: 40,
-        resource: 'slp',
-        id: '5e3a0415eb29a962da2708b4'
-      }
-
-      const result = rateLimits.calcPoints(jwtInfo)
-      assert.equal(result, 10)
-    })
-  })
-
-  describe('#rateLimitByResource', () => {
-    // NOTE: this test will fail if you run multiple integration tests in a
-    // short period. Because it talks to the Redis DB.
-    it('should pass through rate-limit middleware', async () => {
-      req.baseUrl = '/v4'
-      req.path = '/control/getNetworkInfo'
-      req.url = req.path
-      req.method = 'GET'
-
-      // Call the route twice to trigger the rate handling.
-      await rateLimits.rateLimitByResource(req, res, next)
-      await rateLimits.rateLimitByResource(req, res, next)
-
-      // next() will be called if rate-limit is not triggered
-      assert.equal(next.called, true)
-    })
-
-    it('should trigger rate-limit handler if rate limits exceeds 5 request per minute', async () => {
-      req.baseUrl = '/v4'
-      req.path = '/control/getNetworkInfo'
-      req.url = req.path
-      req.method = 'GET'
-
-      for (let i = 0; i < 5; i++) {
-        next.reset() // reset the stubbed next() function.
-
-        await rateLimits.rateLimitByResource(req, res, next)
-        // console.log(`next() called: ${next.called}`)
-      }
-
-      // Note: next() will be called unless the rate-limit kicks in.
-      assert.equal(
-        next.called,
-        false,
-        'next should not be called if rate limit was triggered.'
-      )
-    })
-
-    it('should NOT trigger rate-limit for free-tier at 5 RPM', async () => {
-      // Create a new instance of the rate limit so we start with zeroed tracking.
-      rateLimits = new RateLimits()
-
-      req.baseUrl = '/v4'
-      req.path = '/control/getNetworkInfo'
-      req.url = req.path
-      req.method = 'GET'
-
-      req.locals.jwtToken = 'some-token'
-
-      const jwtInfo = {
-        apiLevel: 10,
-        id: '5e3a0415eb29a962da2708b1'
-      }
-
-      // Mock the call to the jwt library.
-      sandbox.stub(rateLimits.jwt, 'verify').returns(jwtInfo)
-
-      for (let i = 0; i < 5; i++) {
-        next.reset() // reset the stubbed next() function.
-
-        await rateLimits.rateLimitByResource(req, res, next)
-        // console.log(`next() called: ${next.called}`)
-      }
-
-      // console.log(`req.locals after test: ${util.inspect(req.locals)}`)
-
-      // Note: next() will be called unless the rate-limit kicks in.
-      assert.equal(
-        next.called,
-        true,
-        'next should be called if rate limit was not triggered.'
-      )
-    })
-
-    it('should trigger rate-limit for free tier after 20 RPM', async () => {
-      // Create a new instance of the rate limit so we start with zeroed tracking.
-      rateLimits = new RateLimits()
-
-      req.baseUrl = '/v4'
-      req.path = '/control/getNetworkInfo'
-      req.url = req.path
-      req.method = 'GET'
-
-      req.locals.jwtToken = 'some-token'
-
-      const jwtInfo = {
-        apiLevel: 10,
-        id: '5e3a0415eb29a962da2708b2'
-      }
-
-      // Mock the call to the jwt library.
-      sandbox.stub(rateLimits.jwt, 'verify').returns(jwtInfo)
-
-      for (let i = 0; i < 22; i++) {
-        next.reset() // reset the stubbed next() function.
-
-        await rateLimits.rateLimitByResource(req, res, next)
-        // console.log(`next() called: ${next.called}`)
-      }
-
-      // Note: next() will be called unless the rate-limit kicks in.
-      assert.equal(
-        next.called,
-        false,
-        'next should not be called if rate limit was triggered.'
-      )
-    })
-
-    it('should NOT trigger rate-limit handler for indexer-tier at 25 RPM', async () => {
-      // Create a new instance of the rate limit so we start with zeroed tracking.
-      rateLimits = new RateLimits()
-
-      req.baseUrl = '/v4'
-      req.path = '/control/getNetworkInfo'
-      req.url = req.path
-      req.method = 'GET'
-
-      req.locals.jwtToken = 'some-token'
-
-      const jwtInfo = {
-        apiLevel: 20,
-        id: '5e3a0415eb29a962da2708b3'
-      }
-
-      // Mock the call to the jwt library.
-      sandbox.stub(rateLimits.jwt, 'verify').returns(jwtInfo)
-
-      for (let i = 0; i < 25; i++) {
-        next.reset() // reset the stubbed next() function.
-
-        await rateLimits.rateLimitByResource(req, res, next)
-        // console.log(`next() called: ${next.called}`)
-      }
-
-      // console.log(`req.locals after test: ${util.inspect(req.locals)}`)
-
-      // Note: next() will be called unless the rate-limit kicks in.
-      assert.equal(
-        next.called,
-        true,
-        'next should be called if rate limit was not triggered.'
-      )
-    })
-
-    it('should still rate-limit at a higher RPM for pro-tier', async () => {
-      // Create a new instance of the rate limit so we start with zeroed tracking.
-      rateLimits = new RateLimits()
-
-      req.baseUrl = '/v4'
-      req.path = '/control/getNetworkInfo'
-      req.url = req.path
-      req.method = 'GET'
-
-      req.locals.jwtToken = 'some-token'
-
-      const jwtInfo = {
-        apiLevel: 20,
-        id: '5e3a0415eb29a962da2708b5'
-      }
-
-      // Mock the call to the jwt library.
-      sandbox.stub(rateLimits.jwt, 'verify').returns(jwtInfo)
-
-      for (let i = 0; i < 150; i++) {
-        next.reset() // reset the stubbed next() function.
-
-        await rateLimits.rateLimitByResource(req, res, next)
-        // console.log(`next() called: ${next.called}`)
-      }
-
-      // console.log(`req.locals after test: ${util.inspect(req.locals)}`)
-
-      // Note: next() will be called unless the rate-limit kicks in.
-      assert.equal(
-        next.called,
-        false,
-        'next should NOT be called if rate limit was triggered.'
-      )
-    })
-
-    // CT 2/24/21 This test may have been invalidated by the interal IP address
-    // passing that I implemented to get hydrateUtxos() working properly.
-    // I'm commenting this out until I can study the side effects of this change,
-    // and why exactly this test is breaking.
-    // it('should handle misconfigured token secret', async () => {
-    //   // Create a new instance of the rate limit so we start with zeroed tracking.
-    //   rateLimits = new RateLimits()
-    //
-    //   req.baseUrl = '/v4'
-    //   req.path = '/control/getNetworkInfo'
-    //   req.url = req.path
-    //   req.method = 'GET'
-    //
-    //   req.locals.jwtToken = 'some-token'
-    //
-    //   next.reset() // reset the stubbed next() function.
-    //
-    //   await rateLimits.rateLimitByResource(req, res, next)
-    //
-    //   // Issues with token secret should treat incoming requests as anonymous
-    //   // calls with 50 points, or 20 RPM.
-    //   assert.equal(res.locals.pointsToConsume, 50)
-    // })
-  })
-
-  describe('#isInWhitelist', () => {
-    it('should return false when no argument is passed in', () => {
-      const result = rateLimits.isInWhitelist()
-
-      assert.equal(result, false)
-    })
-
-    it('should return false when origin is not in the whitelist', () => {
-      const origin = 'blah.com'
-
-      const result = rateLimits.isInWhitelist(origin)
-
-      assert.equal(result, false)
-    })
-
-    it('should return true when origin is in the whitelist', () => {
-      const origin = 'message.fullstack.cash'
-
-      const result = rateLimits.isInWhitelist(origin)
-
-      assert.equal(result, true)
-    })
-  })
-})
-
-// Generates a Basic authorization header.
-// function generateAuthHeader (pass) {
-//   // https://en.wikipedia.org/wiki/Basic_access_authentication
-//   const username = 'BITBOX'
-//   const combined = `${username}:${pass}`
-//
-//   var base64Credential = Buffer.from(combined).toString('base64')
-//   var readyCredential = `Basic ${base64Credential}`
-//
-//   return readyCredential
-// }