Bumping internal rate limits

.gitignore

@@ -30,7 +30,6 @@ start-fullstack-abc.sh
 start-fullstack-bchn.sh
 start-ss-main.sh
 start-decatur-bchn.sh
-shell-scripts/
 
 coverage
 start-my-infra

README.md

@@ -82,20 +82,6 @@ installation.
 
 `docker-compose up`
 
-## Rate Limits
-The rate limits for [api.fullstack.cash](https://api.fullstack.cash) are controlled by a JWT token. You can increase your rate limits by [purchasing a JWT token](https://https://fullstack.cash). If you're using bch-js, [check the readme for instructions on increasing rate limits](https://github.com/Permissionless-Software-Foundation/bch-js#api-key). For interacting with bch-api directly, you can then include the JWT token in the HTTP header like this:
-
-- `Authorization: Token <JWT token>`
-
-### cURL example
-Here is an example using curl for using the JWT token when making a call to the REST API:
-
-```
-export BCHJSTOKEN=eyJhbGciOiJ....
-
-curl "https://bchn.fullstack.cash/v4/electrumx/balance/bitcoincash:qr69kyzha07dcecrsvjwsj4s6slnlq4r8c30lxnur3" -X GET -H "Content-Type: application/json" -H "Authorization: Token ${BCHJSTOKEN}"
-```
-
 ## Support
 Have questions? Need help? Join our community support
 [Telegram channel](https://t.me/bch_js_toolkit)

apidoc.json

@@ -1,4 +0,0 @@
-{
-    "sampleUrl": null
-
-  }

config/index.js

@@ -10,21 +10,13 @@ const config = {
     : 'secret-jwt-token',
 
   // Rate Limits
-  anonRateLimit: process.env.ANON_RATE_LIMIT
-    ? Number(process.env.ANON_RATE_LIMIT)
-    : 500,
+  anonRateLimit: process.env.ANON_RATE_LIMIT ? Number(process.env.ANON_RATE_LIMIT) : 50,
   whitelistRateLimit: process.env.WHITELIST_RATE_LIMIT
     ? Number(process.env.WHITELIST_RATE_LIMIT)
     : 10,
-  internalRateLimit: process.env.INTERNAL_RATE_LIMIT
-    ? Number(process.env.INTERNAL_RATE_LIMIT)
-    : 10,
-  pointsPerMinute: process.env.POINTS_PER_MINUTE
-    ? Number(process.env.POINTS_PER_MINUTE)
-    : 10000,
   whitelistDomains: process.env.WHITELIST_DOMAINS
     ? process.env.WHITELIST_DOMAINS.split(',')
-    : ['fullstack.cash', 'psfoundation.cash', '10.0.']
+    : ['fullstack.cash', 'psfoundation.cash']
 }
 
 module.exports = config

docker/mainnet/Dockerfile

@@ -18,6 +18,7 @@ USER safeuser
 WORKDIR /home/safeuser
 RUN git clone https://github.com/Permissionless-Software-Foundation/bch-api
 WORKDIR /home/safeuser/bch-api
+RUN git checkout basic-auth-only
 RUN npm install --silent
 
 # Generate documentation

package.json

@@ -16,21 +16,20 @@
     "dev": "nodemon ./dist/app.js",
     "test": "npm run lint && npm run test-v4",
     "lint": "standard --env mocha --fix",
-    "test-v4": "export NETWORK=mainnet && nyc --reporter=text mocha --exit --timeout 60000 test/v4/",
+    "test-v4": "export NETWORK=mainnet && nyc --reporter=text mocha --timeout 60000 test/v4/",
     "test:integration": "mocha test/v4/integration",
     "test:integration:slpdb": "mocha --timeout 25000 -g '#validate2Single' test/v4/integration/slp*.js",
-    "test:integration:nft": "mocha --timeout 25000 -g '#nft' test/v4/integration/nft.js",
     "coverage": "nyc report --reporter=text-lcov | coveralls",
     "coverage:report": "export NETWORK=mainnet && nyc --reporter=html mocha --timeout 25000 test/v4/",
     "docs": "./node_modules/.bin/apidoc -i src/routes/v4 -o docs",
-    "test:temp1": "export NETWORK=mainnet && export TEST=integration && mocha --exit --timeout 25000 -g '#getNftChildren' test/v4/integration/",
-    "test:temp2": "mocha -g '#getNftGroup' --exit --timeout 30000 test/v4/"
+    "test:temp1": "export NETWORK=mainnet && export TEST=integration && mocha --exit --timeout 25000 -g '#hydrateUtxosWL' test/v4/integration/",
+    "test:temp2": "mocha test/v4/rate-limits.js"
   },
   "engines": {
     "node": ">=10.15.1"
   },
   "dependencies": {
-    "@psf/bch-js": "^4.18.0",
+    "@psf/bch-js": "^4.15.21",
     "apidoc": "^0.26.0",
     "axios": "^0.21.1",
     "bitcore-lib-cash": "^8.23.1",
@@ -67,11 +66,10 @@
     "eslint-plugin-prettier": "^3.1.0",
     "eslint-plugin-standard": "^4.0.0",
     "fs-extra": "^9.0.0",
-    "lodash.clonedeep": "^4.5.0",
     "nock": "^13.0.5",
     "nyc": "^15.0.0",
     "prettier": "^2.0.0",
-    "semantic-release": "^17.4.2",
+    "semantic-release": "^17.3.9",
     "sinon": "^9.0.0",
     "standard": "^14.3.1"
   },

src/app.js

@@ -3,6 +3,7 @@
 const express = require('express')
 
 // Middleware
+// const { routeRateLimit } = require("./middleware/route-ratelimit")
 const RateLimits = require('./middleware/route-ratelimit')
 const rateLimits = new RateLimits()
 
@@ -95,36 +96,17 @@ app.use('/', logReqInfo)
 
 const v4prefix = 'v4'
 
-// START Rate Limits
+// Inspect the header for a JWT token.
+app.use(`/${v4prefix}/`, jwtAuth.getTokenFromHeaders)
+
+// Instantiate the authorization middleware, used to implement pro-tier rate limiting.
+// Handles Anonymous and Basic Authorization schemes used by passport.js
 const auth = new AuthMW()
+app.use(`/${v4prefix}/`, auth.mw())
 
-// Ensure req.locals and res.locals objects exist.
-app.use(`/${v4prefix}/`, rateLimits.populateLocals)
-
-// Allow users to turn off rate limits with an environment variable.
-const DO_NOT_USE_RATE_LIMITS = process.env.DO_NOT_USE_RATE_LIMITS || false
-
-console.log(`DO_NOT_USE_RATE_LIMITS: ${DO_NOT_USE_RATE_LIMITS}`)
-
-if (!DO_NOT_USE_RATE_LIMITS) {
-  console.log('Rate limits are being used')
-  // Inspect the header for a JWT token.
-  app.use(`/${v4prefix}/`, jwtAuth.getTokenFromHeaders)
-
-  // Instantiate the authorization middleware, used to implement pro-tier rate limiting.
-  // Handles Anonymous and Basic Authorization schemes used by passport.js
-  app.use(`/${v4prefix}/`, auth.mw())
-
-  // Experimental rate limits
-  app.use(`/${v4prefix}/`, rateLimits.applyRateLimits)
-
-  // Rate limit on all v4 routes
-  // Establish and enforce rate limits.
-  // app.use(`/${v4prefix}/`, rateLimits.rateLimitByResource)
-} else {
-  console.log('Rate limits are NOT being used')
-}
-// END Rate Limits
+// Rate limit on all v4 routes
+// Establish and enforce rate limits.
+app.use(`/${v4prefix}/`, rateLimits.rateLimitByResource)
 
 // Connect v4 routes
 app.use(`/${v4prefix}/` + 'health-check', healthCheckV4)
@@ -189,11 +171,9 @@ server.listen(port)
 server.on('error', onError)
 server.on('listening', onListening)
 
-// Set the time before a timeout error is generated.
-// 10 seconds is way too agressive. 30 Seconds was used for a while, but with
-// being able to set a timeout between UTXOs for tokenUtxoDetails, the timeout
-// needed to be extended.
-server.setTimeout(1000 * 60 * 5) // 5 minutes
+// Set the time before a timeout error is generated. This impacts testing and
+// the handling of timeout errors. Is 10 seconds too agressive?
+server.setTimeout(30 * 1000)
 
 /**
  * Normalize a port into a number, string, or false.

src/middleware/auth.js

@@ -1,25 +1,22 @@
 /*
-  This library handles anonymous and Basic Authentication.
+  CT 2/4/20 Note: This library handles anonymous and Basic auth. This library
+  can be phased out with the chage to JWT tokens and the new rate-limit library.
+
+  Handle authorization for bypassing rate limits.
 
   1) Default is 'Anonymous Authentication', which unlocks the freemimum tier by
   default.
-
   2) Hard-coded 'Basic Authentication' is a token that does not expire and is
-  provided for clients who run their own isolated infrastructure without rate
-  limits, but still need a way from preventing the random public from using
-  their API.
-
+  provided to buisiness partners.
   3) JWT-based 'Local Authentication' is used for normal users that pay to
   access the premium pro-tier services.
 
   This file uses the passport npm library to check the header of each REST API
-  call for the prescence of a Basic Authentication header:
+  call for the prescence of a Basic authorization header:
   https://en.wikipedia.org/wiki/Basic_access_authentication
 
   If the header is found and validated, the req.locals.proLimit Boolean value
-  is set and passed to the route-ratelimit.js middleware. route-ratelimit.js
-  is for fine-grain JWT-based rate limits. If req.locals.proLimit is set to
-  true, then those rate limits will be skipped.
+  is set and passed to the route-ratelimits.ts middleware.
 */
 
 'use strict'
@@ -79,9 +76,8 @@ class AuthMW {
         req.locals.proLimit = false
 
         // Evaluate the username and password and set the rate limit accordingly.
+        // if (username === "BITBOX" && password === PRO_PASS) {
         if (username === 'fullstackcash') {
-          // Can set several different passwords in the environment variable.
-          // Loop through each one to see if one matches.
           for (let i = 0; i < PRO_PASS.length; i++) {
             const thisPass = PRO_PASS[i]
 

src/middleware/route-ratelimit.js

@@ -1,62 +1,55 @@
 /*
-This file will replace the original rate-limit.js file.
+  Sets the rate limits for the anonymous and paid tiers. Current rate limits:
+  - 1000 points in 60 seconds
+  - 10 points per call for paid tier (100 RPM)
+  - 50 points per call for anonymous tier (20 RPM)
 
-Sets the rate limits for the anonymous and paid tiers. Current rate limits:
-- 10000 points in 60 seconds
-- 500 points per call for anonymous tier (20 RPM)
-- 100 points per call for tier 40 (100 RPM)
-- 40 points per call for tier 50 (250 RPM)
-- 16 points per call for tier 60 (625 RPM)
+  Background:
+  The rate limits below were originially coded with the idea of charging on a
+  per-resource basis. However, that was confusing to end users trying to purchase
+  a subscription. So everything was simplied to two tiers: paid and anonymous
 
-The rate limit handling is designed for these four use cases:
-- Users who want to buy a JWT token for 24 hour access.
-- Users who want to buy different RPM tiers: 100, 250, 600
-- Basic Authentication which should not have any rate limits applied.
-- Local installations that do not want any authentication or rate limits at all.
-
-The Basic Auth use cases is considered when determining internal rate limits.
-The internal rate limits should not be applied to calls from those users.
-
-A lot of attention has been paid to passing rate-limit information for the user
-when they trigger an endpoint that makes a lot of internal API calls. Examples
-are hydrateUtxos() and getPublicKey(). These keeps things fair by charging the
-same for 'light' API calls and 'heavy' API calls.
-
-TODO:
-- Add code for applying rate limits to whitelist domains.
+  CT 3/4/21: I increased the total points from 1,000 to 100,000 to prevent systems
+  with Basic Authentication from hitting internal rate limits when calling
+  hydrateUtxos().
 */
 
+'use strict'
+
 // Public npm libraries.
 const jwt = require('jsonwebtoken')
-const Redis = require('ioredis')
-const { RateLimiterRedis } = require('rate-limiter-flexible')
 
 // local libraries.
 const wlogger = require('../util/winston-logging')
 const config = require('../../config')
 
-let _this // Global pointer to instance of class, when 'this' context is lost.
+// Hard coding limits since basic-authentiation is assumed to be the primary access.
+const ANON_LIMITS = 333
 
-// Setup Redis to track rate limits for each user.
+const WHITELIST_RATE_LIMIT = config.whitelistRateLimit
+const WHITELIST_DOMAINS = config.whitelistDomains
+const INTERNAL_RATE_LIMIT = 1
+
+// Redis
 const redisOptions = {
   enableOfflineQueue: false,
   port: process.env.REDIS_PORT ? process.env.REDIS_PORT : 6379,
   host: process.env.REDIS_HOST ? process.env.REDIS_HOST : '127.0.0.1'
 }
+console.log(`redisOptions: ${JSON.stringify(redisOptions, null, 2)}`)
+
+const Redis = require('ioredis')
 const redisClient = new Redis(redisOptions)
+
+// Rate limiter middleware lib.
+const { RateLimiterRedis } = require('rate-limiter-flexible')
 const rateLimitOptions = {
   storeClient: redisClient,
-  points: config.pointsPerMinute, // Number of points
+  points: 1000, // Number of points
   duration: 60 // Per minute (per 60 seconds)
 }
 
-// Constants
-const ANON_LIMITS = config.anonRateLimit
-// const WHITELIST_RATE_LIMIT = config.whitelistRateLimit
-const WHITELIST_DOMAINS = config.whitelistDomains
-const WHITELIST_POINTS_TO_CONSUME = config.whitelistRateLimit
-const POINTS_PER_MINUTE = config.pointsPerMinute
-const INTERNAL_POINTS_TO_CONSUME = config.internalRateLimit
+let _this
 
 class RateLimits {
   constructor () {
@@ -67,260 +60,248 @@ class RateLimits {
     this.config = config
   }
 
-  // This is the main middleware funciton of this library. All other functions
-  // support this function.
-  async applyRateLimits (req, res, next) {
+  // Used to disconnect from the Redis DB.
+  // Called by unit tests so that node.js thread doesn't live forever.
+  closeRedis () {
+    redisClient.disconnect()
+  }
+
+  async wipeRedis () {
+    await redisClient.flushdb()
+  }
+
+  // This is the new rate limit function that uses the rate-limiter-flexible npm
+  // library. It uses fine-grain rate limiting based on the resources being
+  // consumed.
+  async rateLimitByResource (req, res, next) {
     try {
-      // Exit if the user has already authenticated with Basic Authentication.
-      if (req.locals.proLimit) {
-        console.log('External call, basic auth, skipping rate limits.')
-        wlogger.debug(
-          'req.locals.proLimit = true; Using Basic Authentication instead of rate limits'
-        )
-        return next()
+      let userId
+      let decoded = {}
+
+      // Create a req.locals object if not passed in.
+      if (!req.locals) {
+        req.locals = {
+          // default values
+          jwtToken: '',
+          proLimit: false,
+          apiLevel: 0
+        }
       }
 
-      // Determine if the call is an external or internal API call.
-      const isInternal = _this.checkInternalIp(req)
-      // console.log(`isInternal: ${isInternal}`)
+      // Create a res.locals object if it does not exist. This is used for
+      // debugging.
+      if (!res.locals) {
+        res.locals = {
+          rateLimitTriggered: false
+        }
+      }
 
-      // Determine if the call originates from another computer on the intranet.
-      const isWhitelistOrigin = _this.isInWhitelist(req)
-      // console.log('isWhitelistOrigin: ', isWhitelistOrigin)
-
-      // Handle the use case of internally-generated requests.
-      if (isInternal) {
-        // Internal API calls should pass the authentication data in through the
-        // the usrObj in the body.
-        if (req.body && req.body.usrObj) {
-          if (req.body.usrObj.proLimit) {
-            // console.log('Internal call, basic auth, skipping rate limits.')
-
-            // If this is an internal call that originated from a user using
-            // Basic Authentication, then skip rate-limits.
-            return next()
-          } else {
-            // console.log(
-            //   'Internal call, applying rate limits. Using JWT if available.'
-            // )
-
-            // Determine if user has exceeded their rate limits. Pass in the
-            // JWT token if one exists.
-            const hasExceededRateLimit = await _this.trackRateLimits(
-              req,
-              res,
-              req.body.usrObj.jwtToken
-            )
-
-            if (!hasExceededRateLimit) {
-              // Rate limits have not been exceeded. Processing can continue.
-              return next()
-            } else {
-              // trackRateLimits() returns the 'res' object with an error message
-              // and status code.
-              return hasExceededRateLimit
-            }
-          }
-        } else {
-          // This should be a corner case. Calls should not be going into this
-          // code path, so the system should throw up big warning signs when they
-          // do.
-          // This code path happens when an internal call is made but does not
-          // pass the usrObj. Legacy code needs to be refactored to use the usrObj
-          // and avoid this code path. This code path is 'pooled': all users
-          // share the same rate limits. Even at 1000 RPM, this pool will get
-          // exhausted easily.
-          // const warnMsg =
-          //   'Internal call. req.body.usrObj does not exist. Applying high-speed internal rate limits.'
-          // console.log(warnMsg)
-          // wlogger.info(warnMsg)
-
-          const defaultPayload = {
-            id: '98.76.54.32',
-            email: 'internal@bchtest.net',
-            apiLevel: 40,
-            rateLimit: 100,
-            pointsToConsume: INTERNAL_POINTS_TO_CONSUME,
-            duration: 30
-          }
-
-          // Default values, in case there is an error.
-          const defaultJwt = _this.generateJwtToken(defaultPayload)
-
-          // Track the rate limit for this user. Pass in the JWT token, if one
-          // is available.
-          const hasExceededRateLimit = await _this.trackRateLimits(
-            req,
-            res,
-            defaultJwt
+      // Decode the JWT token if one exists.
+      if (req.locals.jwtToken) {
+        try {
+          decoded = _this.jwt.verify(
+            req.locals.jwtToken,
+            _this.config.apiTokenSecret
           )
-          // console.log(`hasExceededRateLimit: `, hasExceededRateLimit)
+          // console.log(`decoded: ${JSON.stringify(decoded, null, 2)}`)
 
-          if (!hasExceededRateLimit) {
-            // Rate limits have not been exceeded. Processing can continue.
-            return next()
-          } else {
-            // trackRateLimits() returns the 'res' object with an error message
-            // and status code.
-            return hasExceededRateLimit
-          }
+          userId = decoded.id
+        } catch (err) {
+          // This handler will be triggered if the JWT token does not match the
+          // token secret.
+          wlogger.error(
+            `Last three letters of token secret: ${_this.config.apiTokenSecret.slice(
+              -3
+            )}`
+          )
+          wlogger.error(
+            'Error trying to decode JWT token in route-ratelimit.js/newRateLimit(): ',
+            err
+          )
         }
         //
-        //
+      } else if (req.body && req.body.usrObj) {
+        // Same as above, but this code path is activated from internal calls to
+        // bch-js, like hydrateUtxo(), which passes the user object from the
+        // original API call.
+
+        try {
+          decoded = _this.jwt.verify(
+            req.body.usrObj.jwtToken,
+            _this.config.apiTokenSecret
+          )
+          // console.log(`decoded: ${JSON.stringify(decoded, null, 2)}`)
+
+          userId = decoded.id
+        } catch (err) {
+          // This handler will be triggered if the JWT token does not match the
+          // token secret.
+          wlogger.error(
+            'Error in route-ratelimit.js trying to decode JWT token in usrObj'
+          )
+        }
       } else {
-        // Handle the normal use-case of external requests
-        // console.log(
-        //   'External call, applying rate limits. Using JWT if available.'
-        // )
+        wlogger.debug('No JWT token found!')
+      }
 
-        // For calls originating from a whitelist domain, apply a high-RPM
-        // JWT token to the call.
-        if (isWhitelistOrigin) {
-          const defaultPayload = {
-            id: '77.77.77.77',
-            email: 'whitelist@bchtest.net',
-            apiLevel: 40,
-            rateLimit: 100,
-            pointsToConsume: WHITELIST_POINTS_TO_CONSUME,
-            duration: 30
+      // Default value is 50 points per request = 20 RPM
+      let rateLimit = ANON_LIMITS
+
+      // Only evaluate the JWT token if the user is not using Basic Authentication.
+      if (!req.locals.proLimit && !req.body.usrObj.proLimit) {
+        // Code here for the rate limiter is adapted from this example:
+        // https://github.com/animir/node-rate-limiter-flexible/wiki/Overall-example#authorized-and-not-authorized-users
+        try {
+          // The resource being consumed: full node, indexer, SLPDB, etc.
+          const resource = _this.getResource(req.url)
+          wlogger.debug(`resource: ${resource}`)
+
+          // Key will be the JWT ID if it exists, otherwise the IP address of the caller.
+          let key = userId || req.ip
+          res.locals.key = key // Feedback for tests.
+          // console.log(`key: ${key}`)
+
+          // const pointsToConsume = userId ? 1 : 30
+          decoded.resource = resource
+          let pointsToConsume = _this.calcPoints(decoded)
+          res.locals.pointsToConsume = pointsToConsume // Feedback for tests.
+
+          // Retrieve the origin.
+          let origin = req.get('origin')
+
+          // Handle calls coming from the intranet.
+          if (origin === undefined && key.indexOf('10.0.0.5') > -1) {
+            origin = 'slp-api'
           }
 
-          // Inject the high-RPM JWT token into the call.
-          req.locals.jwtToken = _this.generateJwtToken(defaultPayload)
-        }
+          wlogger.info(`origin: ${origin}`)
 
-        // Track the rate limit for this user. Pass in the JWT token, if one
-        // is available.
-        const hasExceededRateLimit = await _this.trackRateLimits(
-          req,
-          res,
-          req.locals.jwtToken
-        )
-        // console.log('hasExceededRateLimit: ', hasExceededRateLimit)
+          // If the request originates from one of the approved wallet apps, then
+          // apply paid-access rate limits.
+          // console.log(`origin: ${JSON.stringify(origin, null, 2)}`)
+          // console.log(`whitelist: ${JSON.stringify(WHITELIST_DOMAINS, null, 2)}`)
+          const isInWhitelist = _this.isInWhitelist(origin)
+          if (isInWhitelist) {
+            pointsToConsume = WHITELIST_RATE_LIMIT
+            res.locals.pointsToConsume = pointsToConsume // Feedback for tests.
+          }
 
-        if (!hasExceededRateLimit) {
-          // Rate limits have not been exceeded. Processing can continue.
-          return next()
-        } else {
-          // trackRateLimits() returns the 'res' object with an error message
-          // and status code.
-          return hasExceededRateLimit
+          // For internal calls, increase rate limits to as fast as possible.
+          if (
+            // Comment out the line below when running bch-js e2e rate limit tests.
+            key.toString().indexOf('::ffff:127.0.0.1') > -1 ||
+            // Do not comment out this line.
+            key.toString().indexOf('172.17.') > -1
+          ) {
+            pointsToConsume = INTERNAL_RATE_LIMIT
+            res.locals.pointsToConsume = pointsToConsume // Feedback for tests.
+          }
+
+          wlogger.info(
+            `User ${key} consuming ${pointsToConsume} point for resource ${resource}.`
+          )
+
+          rateLimit = Math.floor(100000 / pointsToConsume)
+
+          // Update the key so that rate limits track both the user and the resource.
+          key = `${key}-${resource}`
+
+          await _this.rateLimiter.consume(key, pointsToConsume)
+        } catch (err) {
+          // console.log('err: ', err)
+
+          // Used for returning data for tests.
+          res.locals.rateLimitTriggered = true
+          // console.log('res.locals: ', res.locals)
+
+          // Rate limited was triggered
+          res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+          return res.json({
+            error: `Too many requests. Your limits are currently ${rateLimit} requests per minute. Increase rate limits at https://fullstack.cash`
+          })
         }
       }
     } catch (err) {
-      wlogger.error('Error in route-ratelimit2.js/applyRateLimits(): ', err)
+      wlogger.error('Error in route-ratelimit.js/newRateLimit(): ', err)
+      // throw err
     }
 
-    // By default, move to the next middleware.
     next()
   }
 
-  // A wrapper for Redis-based rate limiter.
-  // Will return false if the user has not exceeded the rate limit. Otherwise
-  // it will return the 'res' object with an error status and message, which
-  // should be returned by the middleware.
-  async trackRateLimits (req, res, jwtToken) {
-    // Anonymous rate limits are used by default.
-    let pointsToConsume = ANON_LIMITS
-    // console.log('pointsToConsume: ', pointsToConsume)
-
-    let key = req.ip // Use the IP address as the key, by default.
-
-    // console.log('jwtToken: ', jwtToken)
+  // Calculates the points consumed, based on the jwt information and the route
+  // requested.
+  calcPoints (jwtInfo) {
+    let retVal = ANON_LIMITS // By default, use anonymous tier.
 
     try {
-      // Decode the JWT token if it exists
-      if (jwtToken) {
-        const decoded = _this.decodeJwtToken(jwtToken)
-        // console.log(`decoded: ${JSON.stringify(decoded, null, 2)}`)
+      // console.log(`jwtInfo: ${JSON.stringify(jwtInfo, null, 2)}`)
 
-        // Preferentially use the decoded ID in the JWT payload, as the key.
-        key = decoded.id
+      const apiLevel = jwtInfo.apiLevel
+      const resource = jwtInfo.resource
 
-        pointsToConsume = decoded.pointsToConsume
+      const level30Routes = ['insight', 'bitcore', 'blockbook', 'electrumx']
+      const level40Routes = ['slp']
+
+      wlogger.debug(`apiLevel: ${apiLevel}`)
+
+      // Only evaluate if user is using a JWT token.
+      if (jwtInfo.id) {
+        // SLP indexer routes
+        if (level40Routes.includes(resource)) {
+          if (apiLevel >= 40) retVal = 10
+          // else if (apiLevel >= 10) retVal = 10
+          else retVal = ANON_LIMITS
+
+          // Normal indexer routes
+        } else if (level30Routes.includes(resource)) {
+          if (apiLevel >= 30) retVal = 10
+          else retVal = ANON_LIMITS
+
+          // Full node tier
+        } else if (apiLevel >= 20) {
+          retVal = 10
+
+          // Free tier, full node only.
+        } else {
+          retVal = ANON_LIMITS
+        }
       }
-      // console.log(`rate limit key: ${key}`)
 
-      // This function will throw an error if the user exceeds the rate limit.
-      // The 429 error response is handled by the catch().
-      await _this.rateLimiter.consume(key, pointsToConsume)
-
-      // Debugging
-      // const rateLimitData = await _this.rateLimiter.consume(key, pointsToConsume)
-      // console.log(`rateLimitData: `, rateLimitData)
-
-      res.locals.pointsToConsume = pointsToConsume // Feedback for tests.
-
-      // Signal that the user has not exceeded their rate limits.
-      return false
+      return retVal
     } catch (err) {
-      // console.log('err: ', err)
-
-      const rateLimit = Math.floor(POINTS_PER_MINUTE / pointsToConsume)
-
-      res.locals.rateLimitTriggered = true
-      // console.log('res.locals: ', res.locals)
-
-      // Rate limited was triggered
-      res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
-      return res.json({
-        error: `Too many requests. Your limits are currently ${rateLimit} requests per minute. Increase rate limits at https://fullstack.cash`
-      })
+      wlogger.error('Error in route-ratelimit.js/calcPoints()')
+      // throw err
+      retVal = ANON_LIMITS
     }
+
+    return retVal
   }
 
-  // Attempts to decode a JWT token. Returns default values if it fails.
-  decodeJwtToken (jwtToken) {
-    const defaultPayload = {
-      id: '123.456.789.10',
-      email: 'test@bchtest.net',
-      apiLevel: 10,
-      rateLimit: 3,
-      pointsToConsume: ANON_LIMITS,
-      duration: 30
-    }
-
+  // This function parses the req.url property to identify what resource
+  // the user is requesting.
+  // This was created as a function so that it can be unit tested. Not sure
+  // what kind of variations will be seen in production.
+  getResource (url) {
     try {
-      // Default values, in case there is an error.
-      const defaultJwt = _this.generateJwtToken(defaultPayload)
+      wlogger.debug(`url: ${JSON.stringify(url, null, 2)}`)
 
-      // Generate a default payload to use, if the decoding of the user-provided
-      // jwt fails.
-      let decoded = _this.jwt.verify(defaultJwt, _this.config.apiTokenSecret)
+      const splitUrl = url.split('/')
+      const resource = splitUrl[1]
 
-      try {
-        decoded = _this.jwt.verify(jwtToken, _this.config.apiTokenSecret)
-      } catch (err) {
-        wlogger.error('Error in route-ratelimit2.js/decodeJwtTokens(): ', err)
-      }
-
-      return decoded
+      return resource
     } catch (err) {
-      wlogger.error(
-        'Unhandled error in route-ratelimit2.js/deocdeJwtToken: ',
-        err
-      )
-
-      // Making sure there is an exp property. Not sure if this will cause an
-      // issue, using a hard-coded value.
-      defaultPayload.exp = 1574269450
-
-      return defaultPayload
+      wlogger.error('Error in getResource().')
+      throw err
     }
   }
 
   // Returns a boolean if the origin of the request matches a domain in the
   // whitelist.
-  isInWhitelist (req) {
+  isInWhitelist (origin) {
     try {
       const retVal = false // Default value.
 
-      // Retrieve the origin.
-      const origin = req.get('origin')
-
-      if (!process.env.TEST) console.log('origin:', origin)
-
-      // If the origin is not determinable, return false.
       if (!origin) return false
 
       // console.log(`WHITELIST_DOMAINS: ${JSON.stringify(WHITELIST_DOMAINS, null, 2)}`)
@@ -328,7 +309,9 @@ class RateLimits {
       for (let i = 0; i < WHITELIST_DOMAINS.length; i++) {
         const thisDomain = WHITELIST_DOMAINS[i]
 
-        if (origin.includes(thisDomain)) return true
+        if (origin.toString().indexOf(thisDomain) > -1) {
+          return true
+        }
       }
 
       return retVal
@@ -339,93 +322,6 @@ class RateLimits {
       return false
     }
   }
-
-  // Checks the request object to see if it's IP address matches an internal
-  // IP address. That means the call is an internal API call and should be
-  // treated differently than an external API call.
-  checkInternalIp (req) {
-    try {
-      // Default value
-      let isInternal = false
-
-      const ip = req.ip
-
-      if (ip.includes('127.0.0.1')) isInternal = true
-
-      if (ip.includes('172.17.')) isInternal = true
-
-      // TODO: Add 192.168.
-
-      return isInternal
-    } catch (err) {
-      wlogger.error(
-        'Error in checkInternalIp(). Returning false be default. Err: ',
-        err
-      )
-      return false
-    }
-  }
-
-  // Used to disconnect from the Redis DB.
-  // Called by unit tests so that node.js thread doesn't live forever.
-  closeRedis () {
-    redisClient.disconnect()
-  }
-
-  // Clear the redis database. Used by unit tests.
-  async wipeRedis () {
-    await redisClient.flushdb()
-  }
-
-  // Generates a JWT token for testing purposes. This is not used in production.
-  // This function mirrors the kind of JWT token that would be generated by
-  // jwt-bch-api.
-  generateJwtToken (payload) {
-    try {
-      const jwtOptions = {
-        expiresIn: '30 days'
-      }
-
-      const token = _this.jwt.sign(
-        payload,
-        _this.config.apiTokenSecret,
-        jwtOptions
-      )
-
-      return token
-    } catch (err) {
-      console.error('Error in generateJwtToken()')
-      throw err
-    }
-  }
-
-  // Called when rate limits are not used.
-  populateLocals (req, res, next) {
-    try {
-      // Create a re*Q*.locals object if not passed in.
-      // req.locals.proLimit will be true if the user is using Basic Authentication.
-      if (!req.locals) {
-        req.locals = {
-          // default values
-          jwtToken: '',
-          proLimit: false,
-          apiLevel: 0
-        }
-      }
-
-      // Create a re*S*.locals object if it does not exist.
-      if (!res.locals) {
-        res.locals = {
-          rateLimitTriggered: false
-        }
-      }
-
-      next()
-    } catch (err) {
-      console.error('Error in populateLocals(): ', err)
-      throw err
-    }
-  }
 }
 
 module.exports = RateLimits

src/routes/v4/blockbook.js

@@ -0,0 +1,521 @@
+/*
+  Blockbook API route
+*/
+
+'use strict'
+
+const express = require('express')
+const axios = require('axios')
+const wlogger = require('../../util/winston-logging')
+
+const RouteUtils = require('../../util/route-utils')
+const routeUtils = new RouteUtils()
+
+// Library for easily switching the API paths to use different instances of
+// Blockbook.
+const BlockbookPath = require('../../util/blockbook-path')
+const BLOCKBOOKPATH = new BlockbookPath()
+// BLOCKBOOKPATH.toOpenBazaar()
+
+const router = express.Router()
+
+// Used for processing error messages before sending them to the user.
+const util = require('util')
+util.inspect.defaultOptions = { depth: 1 }
+
+const BCHJS = require('@psf/bch-js')
+const bchjs = new BCHJS()
+
+let _this
+
+class Blockbook {
+  constructor () {
+    _this = this
+
+    _this.axios = axios
+    _this.routeUtils = routeUtils
+    _this.bchjs = bchjs
+    _this.BLOCKBOOKPATH = BLOCKBOOKPATH
+
+    _this.router = router
+    _this.router.get('/', _this.root)
+    _this.router.get('/balance/:address', _this.balanceSingle)
+    _this.router.post('/balance', _this.balanceBulk)
+    _this.router.get('/utxos/:address', _this.utxosSingle)
+    _this.router.post('/utxos', _this.utxosBulk)
+    _this.router.get('/tx/:txid', _this.txSingle)
+    _this.router.post('/tx', _this.txBulk)
+  }
+
+  // DRY error handler.
+  errorHandler (err, res) {
+    // Attempt to decode the error message.
+    const { msg, status } = _this.routeUtils.decodeError(err)
+    if (msg) {
+      res.status(status)
+      return res.json({ error: msg })
+    }
+
+    res.status(500)
+    return res.json({ error: util.inspect(err) })
+  }
+
+  // Root API endpoint. Simply acknowledges that it exists.
+  root (req, res, next) {
+    return res.json({ status: 'address' })
+  }
+
+  // Query the Blockbook Node API for a balance on a single BCH address.
+  // Returns a Promise.
+  async balanceFromBlockbook (thisAddress) {
+    try {
+      // console.log(`BLOCKBOOK_URL: ${BLOCKBOOK_URL}`)
+
+      // Convert the address to a cashaddr without a prefix.
+      const addr = _this.bchjs.Address.toCashAddress(thisAddress)
+
+      const path = `${_this.BLOCKBOOKPATH.addrPath}${addr}`
+      // console.log(`path: ${path}`)
+
+      // Query the Blockbook Node API.
+      const options = {
+        method: 'get',
+        baseURL: path
+      }
+
+      const axiosResponse = await _this.axios.request(options)
+      const retData = axiosResponse.data
+      // console.log(`retData: ${util.inspect(retData)}`)
+
+      return retData
+    } catch (err) {
+      // Dev Note: Do not log error messages here. Throw them instead and let the
+      // parent function handle it.
+      wlogger.debug('Error in blockbook.js/balanceFromBlockbook()')
+      throw err
+    }
+  }
+
+  async balanceSingle (req, res, next) {
+    try {
+      const address = req.params.address
+
+      if (!address || address === '') {
+        res.status(400)
+        return res.json({ error: 'address can not be empty' })
+      }
+
+      // Reject if address is an array.
+      if (Array.isArray(address)) {
+        res.status(400)
+        return res.json({
+          error: 'address can not be an array. Use POST for bulk upload.'
+        })
+      }
+
+      wlogger.debug(
+        'Executing blockbook/balanceSingle with this address: ',
+        address
+      )
+
+      // Ensure the input is a valid BCH address.
+      try {
+        // const legacyAddr = bchjs.Address.toLegacyAddress(address)
+        _this.bchjs.Address.toLegacyAddress(address)
+      } catch (err) {
+        res.status(400)
+        return res.json({
+          error: `Invalid BCH address. Double check your address is valid: ${address}`
+        })
+      }
+
+      // Prevent a common user error. Ensure they are using the correct network address.
+      const networkIsValid = _this.routeUtils.validateNetwork(address)
+      if (!networkIsValid) {
+        res.status(400)
+        return res.json({
+          error:
+            'Invalid network. Trying to use a testnet address on mainnet, or vice versa.'
+        })
+      }
+
+      // Query the Blockbook Node API.
+      const retData = await _this.balanceFromBlockbook(address)
+
+      // Return the retrieved address information.
+      res.status(200)
+      return res.json(retData)
+    } catch (err) {
+      // Write out error to error log.
+      wlogger.error('Error in blockbook.js/balanceSingle().', err)
+
+      return _this.errorHandler(err, res)
+    }
+  }
+
+  // POST handler for bulk queries on address details
+  async balanceBulk (req, res, next) {
+    try {
+      let addresses = req.body.addresses
+      // const currentPage = req.body.page ? parseInt(req.body.page, 10) : 0
+
+      // Reject if addresses is not an array.
+      if (!Array.isArray(addresses)) {
+        res.status(400)
+        return res.json({
+          error: 'addresses needs to be an array. Use GET for single address.'
+        })
+      }
+
+      // Enforce array size rate limits
+      if (!_this.routeUtils.validateArraySize(req, addresses)) {
+        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        return res.json({
+          error: 'Array too large.'
+        })
+      }
+
+      wlogger.debug(
+        'Executing blockbook.js/balanceBulk with these addresses: ',
+        addresses
+      )
+
+      // Validate each element in the address array.
+      for (let i = 0; i < addresses.length; i++) {
+        const thisAddress = addresses[i]
+
+        // Ensure the input is a valid BCH address.
+        try {
+          _this.bchjs.Address.toLegacyAddress(thisAddress)
+        } catch (err) {
+          res.status(400)
+          return res.json({
+            error: `Invalid BCH address. Double check your address is valid: ${thisAddress}`
+          })
+        }
+
+        // Prevent a common user error. Ensure they are using the correct network address.
+        const networkIsValid = _this.routeUtils.validateNetwork(thisAddress)
+        if (!networkIsValid) {
+          res.status(400)
+          return res.json({
+            error: `Invalid network for address ${thisAddress}. Trying to use a testnet address on mainnet, or vice versa.`
+          })
+        }
+      }
+
+      // Loops through each address and creates an array of Promises, querying
+      // Insight API in parallel.
+      addresses = addresses.map(async (address, index) =>
+        // console.log(`address: ${address}`)
+        _this.balanceFromBlockbook(address)
+      )
+
+      // Wait for all parallel Insight requests to return.
+      const result = await _this.axios.all(addresses)
+
+      // Return the array of retrieved address information.
+      res.status(200)
+      return res.json(result)
+    } catch (err) {
+      wlogger.error('Error in blockbook.js/balanceBulk().', err)
+
+      return _this.errorHandler(err, res)
+    }
+  }
+
+  // Query the Blockbook API for utxos associated with a BCH address.
+  // Returns a Promise.
+  async utxosFromBlockbook (thisAddress) {
+    try {
+      // console.log(`BLOCKBOOK_URL: ${BLOCKBOOK_URL}`)
+
+      // Convert the address to a cashaddr without a prefix.
+      const addr = _this.bchjs.Address.toCashAddress(thisAddress)
+
+      const path = `${_this.BLOCKBOOKPATH.utxoPath}${addr}`
+      // console.log(`path: ${path}`)
+
+      // Query the Blockbook API.
+      // Query the Blockbook Node API.
+      const options = {
+        method: 'get',
+        baseURL: path
+      }
+      const axiosResponse = await _this.axios.request(options)
+      const retData = axiosResponse.data
+      // console.log(`retData: ${util.inspect(retData)}`)
+
+      // Add the satoshis property to each UTXO.
+      for (let i = 0; i < retData.length; i++) {
+        retData[i].satoshis = Number(retData[i].value)
+      }
+
+      return retData
+    } catch (err) {
+      // Dev Note: Do not log error messages here. Throw them instead and let the
+      // parent function handle it.
+      wlogger.debug('Error in blockbook.js/utxosFromBlockbook()')
+      throw err
+    }
+  }
+
+  // GET handler for single balance
+  async utxosSingle (req, res, next) {
+    try {
+      const address = req.params.address
+
+      if (!address || address === '') {
+        res.status(400)
+        return res.json({ error: 'address can not be empty' })
+      }
+
+      // Reject if address is an array.
+      if (Array.isArray(address)) {
+        res.status(400)
+        return res.json({
+          error: 'address can not be an array. Use POST for bulk upload.'
+        })
+      }
+
+      wlogger.debug(
+        'Executing blockbook/utxosSingle with this address: ',
+        address
+      )
+
+      // Ensure the input is a valid BCH address.
+      try {
+        // const legacyAddr = bchjs.Address.toLegacyAddress(address)
+        _this.bchjs.Address.toLegacyAddress(address)
+      } catch (err) {
+        res.status(400)
+        return res.json({
+          error: `Invalid BCH address. Double check your address is valid: ${address}`
+        })
+      }
+
+      // Prevent a common user error. Ensure they are using the correct network address.
+      const networkIsValid = _this.routeUtils.validateNetwork(address)
+      if (!networkIsValid) {
+        res.status(400)
+        return res.json({
+          error:
+            'Invalid network. Trying to use a testnet address on mainnet, or vice versa.'
+        })
+      }
+
+      // Query the Blockbook API.
+      const retData = await _this.utxosFromBlockbook(address)
+
+      // Return the retrieved address information.
+      res.status(200)
+      return res.json(retData)
+    } catch (err) {
+      // Write out error to error log.
+      wlogger.error('Error in blockbook.js/utxosSingle().', err)
+      return _this.errorHandler(err, res)
+    }
+  }
+
+  // POST handler for bulk queries on address utxos
+  async utxosBulk (req, res, next) {
+    try {
+      let addresses = req.body.addresses
+      // const currentPage = req.body.page ? parseInt(req.body.page, 10) : 0
+
+      // Reject if addresses is not an array.
+      if (!Array.isArray(addresses)) {
+        res.status(400)
+        return res.json({
+          error: 'addresses needs to be an array. Use GET for single address.'
+        })
+      }
+
+      // Enforce array size rate limits
+      if (!_this.routeUtils.validateArraySize(req, addresses)) {
+        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        return res.json({
+          error: 'Array too large.'
+        })
+      }
+
+      wlogger.debug(
+        'Executing blockbook.js/utxosBulk with these addresses: ',
+        addresses
+      )
+
+      // Validate each element in the address array.
+      for (let i = 0; i < addresses.length; i++) {
+        const thisAddress = addresses[i]
+
+        // Ensure the input is a valid BCH address.
+        try {
+          _this.bchjs.Address.toLegacyAddress(thisAddress)
+        } catch (err) {
+          res.status(400)
+          return res.json({
+            error: `Invalid BCH address. Double check your address is valid: ${thisAddress}`
+          })
+        }
+
+        // Prevent a common user error. Ensure they are using the correct network address.
+        const networkIsValid = _this.routeUtils.validateNetwork(thisAddress)
+        if (!networkIsValid) {
+          res.status(400)
+          return res.json({
+            error: `Invalid network for address ${thisAddress}. Trying to use a testnet address on mainnet, or vice versa.`
+          })
+        }
+      }
+
+      // Loops through each address and creates an array of Promises, querying
+      // Insight API in parallel.
+      addresses = addresses.map(async (address, index) =>
+        // console.log(`address: ${address}`)
+        _this.utxosFromBlockbook(address)
+      )
+
+      // Wait for all parallel Insight requests to return.
+      const result = await _this.axios.all(addresses)
+
+      // Return the array of retrieved address information.
+      res.status(200)
+      return res.json(result)
+    } catch (err) {
+      wlogger.error('Error in blockbook.js/utxosBulk().', err)
+      return _this.errorHandler(err, res)
+    }
+  }
+
+  // Query the Blockbook Node API for transactions on a single TXID.
+  // Returns a Promise.
+  async transactionsFromBlockbook (txid) {
+    try {
+      // console.log(`BLOCKBOOK_URL: ${BLOCKBOOK_URL}`)
+
+      const path = `${_this.BLOCKBOOKPATH.txPath}${txid}`
+      // console.log(`path: ${path}`)
+
+      // Query the Blockbook Node API.
+      const options = {
+        method: 'get',
+        baseURL: path
+      }
+      const axiosResponse = await _this.axios.request(options)
+      const retPromise = axiosResponse.data
+      // console.log(`retData: ${util.inspect(retData)}`)
+
+      return retPromise
+    } catch (err) {
+      // Dev Note: Do not log error messages here. Throw them instead and let the
+      // parent function handle it.
+      wlogger.debug('Error in blockbook.js/transactionsFromBlockbook()')
+      throw err
+    }
+  }
+
+  // GET handler for single transaction details.
+  async txSingle (req, res, next) {
+    try {
+      const txid = req.params.txid
+
+      if (!txid || txid === '') {
+        res.status(400)
+        return res.json({ error: 'txid can not be empty' })
+      }
+
+      // Reject if address is an array.
+      if (Array.isArray(txid)) {
+        res.status(400)
+        return res.json({
+          error: 'txid can not be an array. Use POST for bulk upload.'
+        })
+      }
+
+      // TODO: Add regex comparison of txid to ensure it's valid.
+      if (txid.length !== 64) {
+        res.status(400)
+        return res.json({
+          error: `txid must be of length 64 (not ${txid.length})`
+        })
+      }
+
+      wlogger.debug('Executing blockbook/txSingle with this txid: ', txid)
+
+      // Query the Blockbook Node API.
+      const retData = await _this.transactionsFromBlockbook(txid)
+
+      // Return the retrieved address information.
+      res.status(200)
+      return res.json(retData)
+    } catch (err) {
+      // Write out error to error log.
+      wlogger.error('Error in blockbook.js/txSingle().', err)
+
+      return _this.errorHandler(err, res)
+    }
+  }
+
+  // POST handler for bulk queries on tx details
+  async txBulk (req, res, next) {
+    try {
+      let txids = req.body.txids
+      // const currentPage = req.body.page ? parseInt(req.body.page, 10) : 0
+
+      // Reject if txids is not an array.
+      if (!Array.isArray(txids)) {
+        res.status(400)
+        return res.json({
+          error: 'txids need to be an array. Use GET for single address.'
+        })
+      }
+
+      // Enforce array size rate limits
+      if (!_this.routeUtils.validateArraySize(req, txids)) {
+        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        return res.json({
+          error: 'Array too large.'
+        })
+      }
+
+      wlogger.debug('Executing blockbook.js/txBulk with these txids: ', txids)
+
+      // Validate each element in the txids array.
+      for (let i = 0; i < txids.length; i++) {
+        const thisTxid = txids[i]
+
+        if (!thisTxid || thisTxid === '') {
+          res.status(400)
+          return res.json({ error: 'txid can not be empty' })
+        }
+
+        // TODO: Add regex comparison of txid to ensure it's valid.
+        if (thisTxid.length !== 64) {
+          res.status(400)
+          return res.json({
+            error: `txid must be of length 64 (not ${thisTxid.length})`
+          })
+        }
+      }
+
+      // Loops through each address and creates an array of Promises, querying
+      // Insight API in parallel.
+      txids = txids.map(async (txid, index) =>
+        // console.log(`address: ${address}`)
+        _this.transactionsFromBlockbook(txid)
+      )
+
+      // Wait for all parallel Insight requests to return.
+      const result = await _this.axios.all(txids)
+
+      // Return the array of retrieved address information.
+      res.status(200)
+      return res.json(result)
+    } catch (err) {
+      wlogger.error('Error in blockbook.js/txBulk().', err)
+      return _this.errorHandler(err, res)
+    }
+  }
+}
+
+module.exports = Blockbook

src/routes/v4/electrumx.js

@@ -284,7 +284,7 @@ class Electrum {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, addresses)) {
-        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -470,7 +470,7 @@ class Electrum {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, txids)) {
-        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           success: false,
           error: 'Array too large.'
@@ -726,7 +726,7 @@ class Electrum {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, heights)) {
-        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           success: false,
           error: 'Array too large.'
@@ -895,7 +895,7 @@ class Electrum {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, addresses)) {
-        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -1088,7 +1088,7 @@ class Electrum {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, addresses)) {
-        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -1281,7 +1281,7 @@ class Electrum {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, addresses)) {
-        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           error: 'Array too large.'
         })

src/routes/v4/encryption.js

@@ -114,17 +114,16 @@ class Encryption {
         })
       }
 
-      // console.log(
       wlogger.debug(
         'Executing encryption/getPublicKey with this address: ',
         cashAddr
       )
 
-      const rawTxData = await _this.bchjs.Electrumx.transactions([cashAddr], usrObj)
+      const rawTxData = await _this.bchjs.Electrumx.transactions(cashAddr, usrObj)
       // console.log(`rawTxData: ${JSON.stringify(rawTxData, null, 2)}`)
 
       // Extract just the TXIDs
-      const txids = rawTxData.transactions[0].transactions.map((elem) => elem.tx_hash)
+      const txids = rawTxData.transactions.map((elem) => elem.tx_hash)
       // console.log(`txids: ${JSON.stringify(txids, null, 2)}`)
 
       // throw error if there is no transaction history.
@@ -136,14 +135,16 @@ class Encryption {
       for (let i = 0; i < txids.length; i++) {
         const thisTx = txids[i]
 
+        // CT 2/24/21: I might want to convert this to the POST call, to take
+        // advantage of the usrObj. It does not get passed in a GET call.
         const txDetails = await _this.bchjs.RawTransactions.getRawTransaction(
-          [thisTx],
+          thisTx,
           true,
           usrObj
         )
         // console.log(`txDetails: ${JSON.stringify(txDetails, null, 2)}`)
 
-        const vin = txDetails[0].vin
+        const vin = txDetails.vin
 
         // Loop through each input.
         for (let j = 0; j < vin.length; j++) {
@@ -181,7 +182,6 @@ class Encryption {
         publicKey: 'not found'
       })
     } catch (err) {
-      // console.log('Error in encryption.js/getPublicKey().', err)
       wlogger.error('Error in encryption.js/getPublicKey().', err)
 
       return _this.errorHandler(err, res)

src/routes/v4/full-node/blockchain.js

@@ -53,7 +53,6 @@ class Blockchain {
     this.router.post('/getTxOutProof', this.getTxOutProofBulk)
     this.router.get('/verifyTxOutProof/:proof', this.verifyTxOutProofSingle)
     this.router.post('/verifyTxOutProof', this.verifyTxOutProofBulk)
-    this.router.post('/getBlock', this.getBlock)
   }
 
   root (req, res, next) {
@@ -285,7 +284,7 @@ class Blockchain {
 
       // Enforce array size rate limits
       if (!routeUtils.validateArraySize(req, hashes)) {
-        res.status(400) // https://github.com/Bitcoin-com/api.fullstack.cash/issues/330
+        res.status(429) // https://github.com/Bitcoin-com/api.fullstack.cash/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -458,7 +457,7 @@ class Blockchain {
 
       // Enforce array size rate limits
       if (!routeUtils.validateArraySize(req, txids)) {
-        res.status(400) // https://github.com/Bitcoin-com/api.fullstack.cash/issues/330
+        res.status(429) // https://github.com/Bitcoin-com/api.fullstack.cash/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -795,7 +794,7 @@ class Blockchain {
 
       // Enforce array size rate limits
       if (!routeUtils.validateArraySize(req, txids)) {
-        res.status(400) // https://github.com/Bitcoin-com/api.fullstack.cash/issues/330
+        res.status(429) // https://github.com/Bitcoin-com/api.fullstack.cash/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -889,7 +888,7 @@ class Blockchain {
 
       // Enforce array size rate limits
       if (!routeUtils.validateArraySize(req, proofs)) {
-        res.status(400) // https://github.com/Bitcoin-com/api.fullstack.cash/issues/330
+        res.status(429) // https://github.com/Bitcoin-com/api.fullstack.cash/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -938,52 +937,6 @@ class Blockchain {
       return _this.errorHandler(err, res)
     }
   }
-
-  /**
-   * @api {post} /blockchain/getBlock/ Get block details
-   * @apiName getBlock
-   * @apiGroup Blockchain
-   * @apiDescription Returns block details
-   *
-   * @apiExample Example usage:
-   * curl "https://api.fullstack.cash/v4/blockchain/getblock/" -X POST -H "Content-Type: application/json" --data-binary '{"blockhash":"000000000000000002a5fe0bdd6e3f04342a975c0f55e57f97e73bb90041676b","verbosity":0 }'
-   *
-   * @apiParam {String} blockhash Block hash (required)
-   * @apiParam {Number} verbosity Default 1 (optional)
-   *
-   */
-  async getBlock (req, res, next) {
-    try {
-      // Validate input parameter
-      const blockhash = req.body.blockhash
-      let verbosity = req.body.verbosity
-
-      // Default to a value of 1 if another verbosity level is not defined.
-      if (!verbosity && verbosity !== 0) verbosity = 1
-
-      if (!blockhash || blockhash === '') {
-        res.status(400)
-        return res.json({ error: 'blockhash can not be empty' })
-      }
-
-      // Axios options
-      const options = _this.routeUtils.getAxiosOptions()
-
-      options.data.id = 'getblock'
-      options.data.method = 'getblock'
-      options.data.params = [blockhash, verbosity]
-
-      const response = await _this.axios.request(options)
-
-      return res.json(response.data.result)
-    } catch (err) {
-      // Write out error to error log.
-      // logger.error(`Error in rawtransactions/decodeRawTransaction: `, err)
-      wlogger.error('Error in blockchain.js/getBlock()', err)
-
-      return _this.errorHandler(err, res)
-    }
-  }
 }
 
 module.exports = Blockchain

src/routes/v4/full-node/rawtransactions.js

@@ -118,7 +118,7 @@ class RawTransactions {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, hexes)) {
-        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -140,7 +140,7 @@ class RawTransactions {
       const options = _this.routeUtils.getAxiosOptions()
 
       // Loop through each height and creates an array of requests to call in parallel
-      const promises = hexes.map(async (hex) => {
+      const promises = hexes.map(async hex => {
         options.data.id = 'decoderawtransaction'
         options.data.method = 'decoderawtransaction'
         options.data.params = [hex]
@@ -152,7 +152,7 @@ class RawTransactions {
       const axiosResult = await _this.axios.all(promises)
 
       // Retrieve the data part of the result.
-      const result = axiosResult.map((x) => x.data.result)
+      const result = axiosResult.map(x => x.data.result)
 
       res.status(200)
       return res.json(result)
@@ -234,7 +234,7 @@ class RawTransactions {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, hexes)) {
-        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -254,7 +254,7 @@ class RawTransactions {
       const options = _this.routeUtils.getAxiosOptions()
 
       // Loop through each hex and create an array of promises
-      const promises = hexes.map(async (hex) => {
+      const promises = hexes.map(async hex => {
         options.data.id = 'decodescript'
         options.data.method = 'decodescript'
         options.data.params = [hex]
@@ -267,7 +267,7 @@ class RawTransactions {
       const resolved = await Promise.all(promises)
 
       // Retrieve the data from each resolved promise.
-      const result = resolved.map((x) => x.data.result)
+      const result = resolved.map(x => x.data.result)
 
       res.status(200)
       return res.json(result)
@@ -324,12 +324,20 @@ class RawTransactions {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, txids)) {
-        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           error: 'Array too large.'
         })
       }
 
+      // stub response object
+      // const returnResponse = {
+      //   status: 100,
+      //   json: {
+      //     error: ''
+      //   }
+      // }
+
       // Validate each txid in the array.
       for (let i = 0; i < txids.length; i++) {
         const txid = txids[i]
@@ -348,7 +356,7 @@ class RawTransactions {
       }
 
       // Loop through each txid and create an array of promises
-      const promises = txids.map(async (txid) =>
+      const promises = txids.map(async txid =>
         _this.getRawTransactionsFromNode(txid, verbose)
       )
 
@@ -436,12 +444,11 @@ class RawTransactions {
         return res.json({ error: 'hex must be an array' })
       }
 
-      let options = _this.routeUtils.getAxiosOptions()
-      options = _this.sendTxOptions(options)
+      const options = _this.routeUtils.getAxiosOptions()
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, hexes)) {
-        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -537,8 +544,7 @@ class RawTransactions {
         })
       }
 
-      let options = _this.routeUtils.getAxiosOptions()
-      options = _this.sendTxOptions(options)
+      const options = _this.routeUtils.getAxiosOptions()
 
       // RPC call
       options.data.id = 'sendrawtransaction'
@@ -559,31 +565,6 @@ class RawTransactions {
       return _this.errorHandler(err, res)
     }
   }
-
-  // This method modifies the default axios options. It attempts to inject
-  // a specific full node to use when broadcasting transactions. This is useful
-  // because it leverages the built-in protections that a full node has against
-  // accidental double spends. It mitigates a corner-case when rapidly spending
-  // TXs on load balanced nodes. By piping all TX sends through a single node,
-  // accidental double spends can be reduced.
-  sendTxOptions (options) {
-    try {
-      const sendUrl = process.env.RPC_SENDURL
-
-      if (sendUrl !== 'undefined' && sendUrl !== undefined) {
-        // console.log(`original options: ${JSON.stringify(options, null, 2)}`)
-
-        options.baseURL = process.env.RPC_SENDURL
-
-        // console.log(`modified options: ${JSON.stringify(options, null, 2)}`)
-      }
-
-      return options
-    } catch (err) {
-      wlogger.error('Error in rawtransactions.js/sendTxOptions()')
-      throw err
-    }
-  }
 }
 
 module.exports = RawTransactions

src/routes/v4/route-utils.js

@@ -0,0 +1,192 @@
+/*
+  A private library of utility functions used by several different routes.
+*/
+
+'use strict'
+
+const axios = require('axios')
+const wlogger = require('../../util/winston-logging')
+
+const util = require('util')
+util.inspect.defaultOptions = { depth: 1 }
+
+const BCHJS = require('@psf/bch-js')
+const bchjs = new BCHJS()
+
+module.exports = {
+  validateNetwork, // Prevents a common user error
+  setEnvVars, // Allows RPC variables to be set dynamically based on changing env vars.
+  decodeError, // Extract and interpret error messages.
+  validateArraySize, // Ensure the passed array meets rate limiting requirements.
+  getAxiosOptions
+}
+
+// This function expects the Request Express.js object and an array as input.
+// The array is then validated against freemium and pro-tier rate limiting
+// requirements. A boolean is returned to indicate if the array size if valid
+// or not.
+function validateArraySize (req, array) {
+  const FREEMIUM_INPUT_SIZE = 20
+  const PRO_INPUT_SIZE = 20
+
+  if (req.locals && req.locals.proLimit) {
+    if (array.length <= PRO_INPUT_SIZE) return true
+  } else if (array.length <= FREEMIUM_INPUT_SIZE) {
+    return true
+  }
+
+  return false
+}
+
+// Returns true if user-provided cash address matches the correct network,
+// mainnet or testnet. If NETWORK env var is not defined, it returns false.
+// This prevent a common user-error issue that is easy to make: passing a
+// testnet address into rest.bitcoin.com or passing a mainnet address into
+// trest.bitcoin.com.
+function validateNetwork (addr) {
+  try {
+    const network = process.env.NETWORK
+
+    // Return false if NETWORK is not defined.
+    if (!network || network === '') {
+      console.log('Warning: NETWORK environment variable is not defined!')
+      return false
+    }
+
+    // Convert the user-provided address to a cashaddress, for easy detection
+    // of the intended network.
+    const cashAddr = bchjs.Address.toCashAddress(addr)
+
+    // Return true if the network and address both match testnet
+    const addrIsTest = bchjs.Address.isTestnetAddress(cashAddr)
+    if (network === 'testnet' && addrIsTest) return true
+
+    // Return true if the network and address both match mainnet
+    const addrIsMain = bchjs.Address.isMainnetAddress(cashAddr)
+    if (network === 'mainnet' && addrIsMain) return true
+
+    return false
+  } catch (err) {
+    wlogger.error('Error in validateNetwork()')
+    return false
+  }
+}
+
+// Dynamically set these based on env vars. Allows unit testing.
+function setEnvVars () {
+  const BitboxHTTP = axios.create({
+    baseURL: process.env.RPC_BASEURL,
+    timeout: 15000
+  })
+  const username = process.env.RPC_USERNAME
+  const password = process.env.RPC_PASSWORD
+
+  const requestConfig = {
+    method: 'post',
+    auth: {
+      username: username,
+      password: password
+    },
+    data: {
+      jsonrpc: '1.0'
+    }
+  }
+
+  return { BitboxHTTP, username, password, requestConfig }
+}
+
+// Axios options used when calling axios.post() to talk with a full node.
+function getAxiosOptions () {
+  return {
+    method: 'post',
+    baseURL: process.env.RPC_BASEURL,
+    timeout: 15000,
+    auth: {
+      username: process.env.RPC_USERNAME,
+      password: process.env.RPC_PASSWORD
+    },
+    data: {
+      jsonrpc: '1.0'
+    }
+  }
+}
+
+// Error messages returned by a full node can be burried pretty deep inside the
+// error object returned by Axios. This function attempts to extract and interpret
+// error messages.
+// Returns an object. If successful, obj.msg is a string.
+// If there is a failure, obj.msg is false.
+function decodeError (err) {
+  try {
+    // Attempt to extract the full node error message.
+    if (
+      err.response &&
+      err.response.data &&
+      err.response.data.error &&
+      err.response.data.error.message
+    ) {
+      return { msg: err.response.data.error.message, status: 400 }
+    }
+
+    // Attempt to extract the Insight error message
+    if (err.response && err.response.data) {
+      return { msg: err.response.data, status: err.response.status }
+    }
+
+    // console.log(`err.message: ${err.message}`)
+    // console.log(`err: `, err)
+
+    // Attempt to detect a network connection error.
+    if (err.message && err.message.indexOf('ENOTFOUND') > -1) {
+      return {
+        msg:
+          'Network error: Could not communicate with full node or other external service.',
+        status: 503
+      }
+    }
+
+    // Different kind of network error
+    if (err.message && err.message.indexOf('ENETUNREACH') > -1) {
+      return {
+        msg:
+          'Network error: Could not communicate with full node or other external service.',
+        status: 503
+      }
+    }
+
+    // Different kind of network error
+    if (err.message && err.message.indexOf('EAI_AGAIN') > -1) {
+      return {
+        msg:
+          'Network error: Could not communicate with full node or other external service.',
+        status: 503
+      }
+    }
+
+    // Axios timeout (aborted) error, or service is down (connection refused).
+    if (
+      err.code &&
+      (err.code === 'ECONNABORTED' || err.code === 'ECONNREFUSED')
+    ) {
+      return {
+        msg:
+          'Network error: Could not communicate with full node or other external service.',
+        status: 503
+      }
+    }
+
+    // Handle general Error objects.
+    if (err.message) {
+      return {
+        message: err.message,
+        status: 422
+      }
+    }
+
+    return { msg: false, status: 500 }
+  } catch (err) {
+    console.error('unhandled error in route-utils.js/decodeError(): ', err)
+    wlogger.error('unhandled error in route-utils.js/decodeError(): ', err)
+    return { msg: false, status: 500 }
+  }
+}

src/routes/v4/slp.js

@@ -50,9 +50,7 @@ const rawTransactions = new RawTransactions()
 
 // Setup REST and TREST URLs used by slpjs
 // Dev note: this allows for unit tests to mock the URL.
-if (!process.env.REST_URL) {
-  process.env.REST_URL = 'https://bchn.fullstack.cash/v4/'
-}
+if (!process.env.REST_URL) { process.env.REST_URL = 'https://bchn.fullstack.cash/v4/' }
 if (!process.env.TREST_URL) {
   process.env.TREST_URL = 'https://testnet.fullstack.cash/v4/'
 }
@@ -102,19 +100,12 @@ class Slp {
     _this.router.post('/hydrateUtxos', _this.hydrateUtxos)
     _this.router.post('/hydrateUtxosWL', _this.hydrateUtxosWL)
     _this.router.get('/status', _this.getStatus)
-    _this.router.get('/nftChildren/:tokenId', _this.getNftChildren)
-    _this.router.get('/nftGroup/:tokenId', _this.getNftGroup)
   }
 
   // DRY error handler.
   errorHandler (err, res) {
-    // console.error('Entering slp.js/errorHandler(). err: ', err)
-
     // Attempt to decode the error message.
     const { msg, status } = _this.routeUtils.decodeError(err)
-    console.log('slp.js/errorHandler msg from decodeError: ', msg)
-    console.log('slp.js/errorHandler status from decodeError: ', status)
-
     if (msg) {
       res.status(status)
       return res.json({ error: msg })
@@ -137,10 +128,6 @@ class Slp {
     delete token.tokenDetails.batonVout
     delete token.tokenDetails.sendOutputs
 
-    if (token.tokenDetails.versionType === 65 && token.nftParentId) {
-      token.tokenDetails.nftParentId = token.nftParentId
-    }
-
     token.tokenDetails.blockCreated = token.tokenStats.block_created
     token.tokenDetails.blockLastActiveSend =
       token.tokenStats.block_last_active_send
@@ -232,7 +219,7 @@ class Slp {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, tokenIds)) {
-        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -304,7 +291,7 @@ class Slp {
               'tokenDetails.tokenIdHex': tokenId
             }
           },
-          project: { tokenDetails: 1, tokenStats: 1, nftParentId: 1, _id: 0 },
+          project: { tokenDetails: 1, tokenStats: 1, _id: 0 },
           limit: 1000
         }
       }
@@ -562,7 +549,7 @@ class Slp {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, addresses)) {
-        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -931,7 +918,7 @@ class Slp {
 
     // Enforce array size rate limits
     if (!_this.routeUtils.validateArraySize(req, addresses)) {
-      res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+      res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
       return res.json({
         error: 'Array too large.'
       })
@@ -992,7 +979,7 @@ class Slp {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, txids)) {
-        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -1230,10 +1217,13 @@ class Slp {
         msg: ''
       }
 
+      const path = `${process.env.SLP_API_URL}slp/validate/${txid}`
+      // console.log(`validate2Single path: ${path}`)
+
       // Request options
       const opt = {
         method: 'get',
-        baseURL: `${process.env.SLP_API_URL}slp/validate/${txid}`,
+        baseURL: path,
         timeout: 10000 // Exit after 10 seconds.
       }
       const tokenRes = await _this.axios.request(opt)
@@ -1420,7 +1410,7 @@ class Slp {
 
       // Enforce array size rate limits
       if (!_this.routeUtils.validateArraySize(req, txids)) {
-        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           error: 'Array too large.'
         })
@@ -1788,6 +1778,8 @@ class Slp {
 
   // Format the response from SLPDB into an object.
   async formatToRestObject (slpDBFormat) {
+    _this.BigNumber.set({ DECIMAL_PLACES: 8 })
+
     // console.log(`slpDBFormat.data: ${JSON.stringify(slpDBFormat.data, null, 2)}`)
 
     const transaction = slpDBFormat.data.u.length
@@ -1997,9 +1989,7 @@ class Slp {
       // Extract a delay value if the user passed it in.
       const usrObjIn = req.body.usrObj
       let utxoDelay = 0
-      if (usrObjIn && usrObjIn.utxoDelay) {
-        utxoDelay = usrObjIn.utxoDelay
-      }
+      if (usrObjIn && usrObjIn.utxoDelay) { utxoDelay = usrObjIn.utxoDelay }
 
       // console.log('req: ', req)
       // console.log(`req._remoteAddress: ${req._remoteAddress}`)
@@ -2048,10 +2038,7 @@ class Slp {
         const theseUtxos = utxos[i].utxos
 
         // Get SLP token details.
-        const details = await _this.bchjs.SLP.Utils.tokenUtxoDetails(
-          theseUtxos,
-          usrObj
-        )
+        const details = await _this.bchjs.SLP.Utils.tokenUtxoDetails(theseUtxos, usrObj)
         // console.log('details: ', details)
 
         // Replace the original UTXO data with the hydrated data.
@@ -2062,13 +2049,12 @@ class Slp {
       return res.json({ slpUtxos: utxos })
     } catch (err) {
       wlogger.error('Error in slp.js/hydrateUtxos().', err)
-      // console.error('Error in slp.js/hydrateUtxos().', err)
+      console.error('Error in slp.js/hydrateUtxos().', err)
 
       // Decode the error message.
       const { msg, status } = routeUtils.decodeError(err)
-      // console.log('msg: ', msg)
-      // console.log('status: ', status)
-
+      console.log('msg: ', msg)
+      console.log('status: ', status)
       if (msg) {
         res.status(status)
         return res.json({ error: msg, message: msg, success: false })
@@ -2103,23 +2089,6 @@ class Slp {
     try {
       const utxos = req.body.utxos
 
-      // Extract a delay value if the user passed it in.
-      const usrObjIn = req.body.usrObj
-      let utxoDelay = 0
-      if (usrObjIn && usrObjIn.utxoDelay) {
-        utxoDelay = usrObjIn.utxoDelay
-      }
-
-      // Generate a user object that can be passed along with internal calls
-      // from bch-js.
-      const usrObj = {
-        ip: req._remoteAddress,
-        jwtToken: req.locals.jwtToken,
-        proLimit: req.locals.proLimit,
-        apiLevel: req.locals.apiLevel,
-        utxoDelay
-      }
-
       // Validate inputs
       if (!Array.isArray(utxos)) {
         res.status(422)
@@ -2156,8 +2125,7 @@ class Slp {
 
         // Get SLP token details.
         const details = await _this.bchjs.SLP.Utils.tokenUtxoDetailsWL(
-          theseUtxos,
-          usrObj
+          theseUtxos
         )
         // console.log('details : ', details)
 
@@ -2230,135 +2198,6 @@ class Slp {
       return _this.errorHandler(err, res)
     }
   }
-
-  /**
-   * @api {get} /slp/nftChildren/{tokenId} Get all NFT children for a given NFT group
-   * @apiName Get all NFT children for a given NFT group
-   * @apiGroup SLP
-   * @apiDescription Get all NFT children for a given NFT group
-   *
-   *
-   * @apiExample Example usage:
-   * curl -X GET "https://api.fullstack.cash/v4/slp/nftChildren/68cd33ecd909068fbea318ae5ff1d6207cf754e53b191327d6d73b6916424c0a" -H "accept:application/json"
-   *
-   */
-  async getNftChildren (req, res, next) {
-    try {
-      // Validate the input data.
-      const tokenId = req.params.tokenId
-
-      if (!tokenId || tokenId === '') {
-        res.status(400)
-        return res.json({ error: 'tokenId can not be empty' })
-      }
-
-      const token = await _this.lookupToken(tokenId)
-      // console.log(`token: ${JSON.stringify(token, null, 2)}`)
-
-      if (!token || token.id === 'not found' || token.versionType !== 129) {
-        res.status(400)
-        return res.json({ error: 'NFT group does not exists' })
-      }
-
-      const query = {
-        v: 3,
-        q: {
-          db: ['t'],
-          aggregate: [
-            { $match: { nftParentId: tokenId } },
-            { $skip: 0 }, // TODO: pass start point
-            { $limit: 100 } // TODO: pass count limit
-          ]
-        }
-      }
-
-      const s = JSON.stringify(query)
-      const b64 = Buffer.from(s).toString('base64')
-      const url = `${process.env.SLPDB_URL}q/${b64}`
-      // Request options
-      const opt = {
-        method: 'get',
-        baseURL: url
-      }
-      const childrenIds = []
-      const childrenRes = await _this.axios.request(opt)
-      // console.log(`childrenRes.data: ${JSON.stringify(childrenRes.data, null, 2)}`)
-      if (!childrenRes || !childrenRes.data || !childrenRes.data.t) {
-        return { error: 'No children data in the group' }
-      }
-
-      childrenRes.data.t.forEach(function (token) {
-        // console.log(`info: ${JSON.stringify(token, null, 2)}`)
-        if (
-          token.tokenDetails.versionType === 65 &&
-          token.tokenDetails.transactionType === 'GENESIS'
-        ) {
-          childrenIds.push(token.tokenDetails.tokenIdHex)
-        }
-      })
-
-      res.status(200)
-      return res.json({ nftChildren: childrenIds })
-    } catch (err) {
-      // console.log(err)
-      wlogger.error('Error in slp.js/getNftChildren().', err)
-      return _this.errorHandler(err, res)
-    }
-  }
-
-  /**
-   * @api {get} /slp/nftGroup/{tokenId} Get the NFT group for a given NFT child token
-   * @apiName Get the NFT group for a given NFT child token
-   * @apiGroup SLP
-   * @apiDescription Get the NFT group for a given NFT child token
-   *
-   *
-   * @apiExample Example usage:
-   * curl -X GET "https://api.fullstack.cash/v4/slp/nftGroup/45a30085691d6ea586e3ec2aa9122e9b0e0d6c3c1fd357decccc15d8efde48a9" -H "accept:application/json"
-   *
-   */
-  async getNftGroup (req, res, next) {
-    try {
-      // Validate the input data.
-      const tokenId = req.params.tokenId
-
-      if (!tokenId || tokenId === '') {
-        res.status(400)
-        return res.json({ error: 'tokenId can not be empty' })
-      }
-
-      const token = await _this.lookupToken(tokenId)
-      // console.log(`token: ${JSON.stringify(token, null, 2)}`)
-
-      if (
-        !token ||
-        token.id === 'not found' ||
-        token.versionType !== 65 ||
-        !token.nftParentId
-      ) {
-        res.status(400)
-        return res.json({ error: 'NFT child does not exists' })
-      }
-
-      const parentToken = await _this.lookupToken(token.nftParentId)
-      // console.log(`parentToken: ${JSON.stringify(token, null, 2)}`)
-      if (
-        !parentToken ||
-        parentToken.id === 'not found' ||
-        parentToken.versionType !== 129
-      ) {
-        res.status(400)
-        return res.json({ error: 'NFT group does not exists' })
-      }
-
-      res.status(200)
-      return res.json({ nftGroup: parentToken })
-    } catch (err) {
-      // console.log(err)
-      wlogger.error('Error in slp.js/getNftGroup().', err)
-      return _this.errorHandler(err, res)
-    }
-  }
 }
 
 module.exports = Slp

src/routes/v4/util.js

@@ -4,9 +4,7 @@ const express = require('express')
 const router = express.Router()
 const axios = require('axios')
 
-const RouteUtils = require('../../util/route-utils')
-const routeUtils = new RouteUtils()
-
+const routeUtils = require('./route-utils')
 const wlogger = require('../../util/winston-logging')
 
 const util = require('util')
@@ -143,7 +141,7 @@ class UtilRoute {
 
       // Enforce array size rate limits
       if (!routeUtils.validateArraySize(req, addresses)) {
-        res.status(400) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
+        res.status(429) // https://github.com/Bitcoin-com/rest.bitcoin.com/issues/330
         return res.json({
           error: 'Array too large.'
         })

src/routes/v4/xpub.js

@@ -5,10 +5,8 @@
 'use strict'
 
 const express = require('express')
-
-const RouteUtils = require('../../util/route-utils')
-const routeUtils = new RouteUtils()
-
+// const axios = require('axios')
+const routeUtils = require('./route-utils')
 const wlogger = require('../../util/winston-logging')
 
 // const router = express.Router()

src/util/route-utils.js

@@ -154,30 +154,6 @@ class RouteUtils {
         }
       }
 
-      // Handle 429 errors
-      if (err.error) {
-        console.log('decodeError: err: ', err)
-
-        // Error thrown by nginx (usually the SLPDB load balancer.)
-        if (err.error.includes('429 Too Many Requests')) {
-          const internalMsg =
-            '429 error thrown by nginx caught by route-utils.js/decodeError()'
-          console.error(internalMsg)
-          wlogger.error(internalMsg)
-
-          return {
-            msg: '429 Too Many Requests',
-            status: 429
-          }
-        } else if (err.error.includes('Too many requests')) {
-          // Error is being thrown by bch-api rate limit middleware.
-          return {
-            msg: '429 Too Many Requests',
-            status: 429
-          }
-        }
-      }
-
       // Handle general Error objects.
       if (err.message) {
         return {
@@ -193,29 +169,6 @@ class RouteUtils {
       return { msg: false, status: 500 }
     }
   }
-
-  // Dynamically set these based on env vars. Allows unit testing.
-  setEnvVars () {
-    const BitboxHTTP = axios.create({
-      baseURL: process.env.RPC_BASEURL,
-      timeout: 15000
-    })
-    const username = process.env.RPC_USERNAME
-    const password = process.env.RPC_PASSWORD
-
-    const requestConfig = {
-      method: 'post',
-      auth: {
-        username: username,
-        password: password
-      },
-      data: {
-        jsonrpc: '1.0'
-      }
-    }
-
-    return { BitboxHTTP, username, password, requestConfig }
-  }
 }
 
 module.exports = RouteUtils

src/util/winston-logging.js

@@ -15,11 +15,7 @@ var NETWORK = process.env.NETWORK
 var LOG_MAX_SIZE = process.env.LOG_MAX_SIZE ? process.env.LOG_MAX_SIZE : '1m'
 
 // Default 5 days.
-// This was causing a problem with popularity. Creating over a gigabyte of files.
-// var LOG_MAX_FILES = process.env.LOG_MAX_FILES ? process.env.LOG_MAX_FILES : '5d'
-
-// 250 files @ 1Meg each = 250 megs
-var LOG_MAX_FILES = process.env.LOG_MAX_FILES ? process.env.LOG_MAX_FILES : '250'
+var LOG_MAX_FILES = process.env.LOG_MAX_FILES ? process.env.LOG_MAX_FILES : '5d'
 
 // Configure daily-rotation transport.
 var transport = new winston.transports.DailyRotateFile({

start-dev-example.sh

@@ -15,11 +15,6 @@ export RPC_BASEURL=http://$RPC_IP/
 export RPC_USERNAME=bitcoin
 export RPC_PASSWORD=password
 
-# (optional) If load-balancing multiple full nodes, it's best to pick a single
-# one for broadcasting transactions to the network. Prevents accidental
-# double spends.
-#export RPC_SENDURL=http://$RPC_IP/
-
 # SLPDB
 export SLPDB_PASS_GP=somelongpassword
 export SLPDB_URL=http://<SLPDB IP>:12300/
@@ -53,12 +48,12 @@ export PRO_PASS=somerandomepassword:someotherrandompassword:aThirdPassword
 # that originate froma domain on the whitelist.
 export WHITELIST_DOMAINS=fullstack.cash,psfoundation.cash,torlist.cash
 
-# Rate Limits. Numbers are divided into 1000. e.g. 10000 / 500 = 20 RPM for ANON.
+# Rate Limits. Numbers are divided into 1000. e.g. 1000 / 50 = 20 RPM for ANON.
 # Requests use the ANON rate limit if they fail to pass in a JWT token.
 # ANON = 20 requests per minute (RPM)
-export ANON_RATE_LIMIT=500
-# 10 = 1000 RPM
-export WHITELIST_RATE_LIMIT=100
+export ANON_RATE_LIMIT=50
+# 10 = 100 RPM
+export WHITELIST_RATE_LIMIT=10
 
 # Set logging parameters
 #1m means no more than 1 megabyte

test/v4/a01-electrumx.js

@@ -594,7 +594,7 @@ describe('#Electrumx', () => {
       assert.isArray(result.transactions)
     })
 
-    it('should throw 400 error if txid array is too large', async () => {
+    it('should throw 429 error if txid array is too large', async () => {
       const testArray = []
       for (var i = 0; i < 25; i++) testArray.push('')
 
@@ -603,7 +603,7 @@ describe('#Electrumx', () => {
       const result = await electrumxRoute.transactionDetailsBulk(req, res)
       // console.log(`result: ${util.inspect(result)}`)
 
-      expectRouteError(res, result, 'Array too large', 400)
+      expectRouteError(res, result, 'Array too large', 429)
     })
 
     it('should get details for a single txid', async () => {
@@ -841,7 +841,7 @@ describe('#Electrumx', () => {
       assert.isArray(result.headers)
     })
 
-    it('should throw 400 error if heights array is too large', async () => {
+    it('should throw 429 error if heights array is too large', async () => {
       const testArray = []
       for (var i = 0; i < 25; i++) testArray.push('')
 
@@ -849,7 +849,7 @@ describe('#Electrumx', () => {
 
       const result = await electrumxRoute.blockHeadersBulk(req, res)
 
-      expectRouteError(res, result, 'Array too large', 400)
+      expectRouteError(res, result, 'Array too large', 429)
     })
 
     it('should get details for a single height', async () => {

test/v4/blockchain.js

@@ -1823,204 +1823,4 @@ describe('#BlockchainRouter', () => {
       assert.equal(result.length, 2)
     })
   })
-
-  describe('#getBlock()', () => {
-    it('returns proper error when downstream service stalls', async () => {
-      // Mock the timeout error.
-      sandbox.stub(uut.axios, 'request').throws({ code: 'ECONNABORTED' })
-
-      req.body.blockhash =
-        '000000202ed2723e7590e2b937f6821a99d6764cb8799bf30f8e300000000000000000001d311c02df9a1e3f57b8dbdcf97ec8dbc3109a26779724c63e560b29ad9ea501e2af955d286403183049e39c1e000000067139f230701a2819a76795564bd2f67ded7eeae68596f368eddb3dd5bc54e59320e896f71d61cfc3ae3d4a90fca08b1aa35ba91256d8939d2cad11e638c0081f66724abdef55cf7b8b9fed064bce0369171434f8b289c1330ccef765f8e97a2c0d794d81aafb535855f7daa6bb51e40f77c6b59d7af7f62d0eb726a4fc4df82353d56fcbda7c7ea6bd935d61af8fb3b295637e6f323b10231135b3f10a034cfb238f635830c0595e52c6c31247cf677b555f7a287076e20cd0e1d3cc9af7260f02b700'
-
-      const result = await uut.getBlock(req, res)
-      // console.log(`result: ${JSON.stringify(result, null, 2)}`)
-
-      assert.isAbove(res.statusCode, 499, 'HTTP status code 503 expected.')
-      assert.include(
-        result.error,
-        'Could not communicate with full node',
-        'Error message expected'
-      )
-    })
-
-    it('returns proper error when downstream service is down', async () => {
-      // Mock the timeout error.
-      sandbox.stub(uut.axios, 'request').throws({ code: 'ECONNREFUSED' })
-
-      req.body.blockhash =
-        '000000202ed2723e7590e2b937f6821a99d6764cb8799bf30f8e300000000000000000001d311c02df9a1e3f57b8dbdcf97ec8dbc3109a26779724c63e560b29ad9ea501e2af955d286403183049e39c1e000000067139f230701a2819a76795564bd2f67ded7eeae68596f368eddb3dd5bc54e59320e896f71d61cfc3ae3d4a90fca08b1aa35ba91256d8939d2cad11e638c0081f66724abdef55cf7b8b9fed064bce0369171434f8b289c1330ccef765f8e97a2c0d794d81aafb535855f7daa6bb51e40f77c6b59d7af7f62d0eb726a4fc4df82353d56fcbda7c7ea6bd935d61af8fb3b295637e6f323b10231135b3f10a034cfb238f635830c0595e52c6c31247cf677b555f7a287076e20cd0e1d3cc9af7260f02b700'
-      const result = await uut.getBlock(req, res)
-      // console.log(`result: ${JSON.stringify(result, null, 2)}`)
-
-      assert.isAbove(res.statusCode, 499, 'HTTP status code 503 expected.')
-      assert.include(
-        result.error,
-        'Could not communicate with full node',
-        'Error message expected'
-      )
-    })
-
-    it('should throw 400 if blockhash is empty', async () => {
-      const result = await uut.getBlock(req, res)
-      // console.log(`result: ${util.inspect(result)}`)
-
-      assert.hasAllKeys(result, ['error'])
-      assert.include(result.error, 'blockhash can not be empty')
-    })
-
-    it('should return block info with verbosity 0', async () => {
-      // Mock the RPC call for unit tests.
-      if (process.env.TEST === 'unit') {
-        sandbox
-          .stub(uut.axios, 'request')
-          .resolves({ data: { result: mockData.mockBlockInfo.verbosity0 } })
-      }
-
-      req.body.blockhash =
-        '0000000000000000008e8d83cba6d45a9314bc2ef4538d4e0577c6bed8593536'
-      req.body.verbosity = 0
-
-      const result = await uut.getBlock(req, res)
-      // console.log(`result: ${JSON.stringify(result, null, 2)}`)
-
-      assert.isString(result)
-    })
-
-    it('should return block info with verbosity 1', async () => {
-      // Mock the RPC call for unit tests.
-      if (process.env.TEST === 'unit') {
-        sandbox
-          .stub(uut.axios, 'request')
-          .resolves({ data: { result: mockData.mockBlockInfo.verbosity1 } })
-      }
-
-      req.body.blockhash =
-        '0000000000000000008e8d83cba6d45a9314bc2ef4538d4e0577c6bed8593536'
-      req.body.verbosity = 1
-
-      const result = await uut.getBlock(req, res)
-      // console.log(`result: ${JSON.stringify(result, null, 2)}`)
-
-      assert.property(result, 'hash', 'hash property expected')
-      assert.property(
-        result,
-        'confirmations',
-        'confirmations property expected'
-      )
-      assert.property(result, 'size', 'size property expected')
-      assert.property(result, 'height', 'height property expected')
-      assert.property(result, 'version', 'version property expected')
-      assert.property(result, 'versionHex', 'versionHex property expected')
-      assert.property(result, 'merkleroot', 'merkleroot property expected')
-      assert.property(result, 'tx', 'tx property expected')
-      assert.property(result, 'time', 'time property expected')
-      assert.property(result, 'mediantime', 'mediantime property expected')
-      assert.property(result, 'nonce', 'nonce property expected')
-      assert.property(result, 'bits', 'bits property expected')
-      assert.property(result, 'difficulty', 'difficulty property expected')
-      assert.property(result, 'chainwork', 'chainwork property expected')
-      assert.property(result, 'nTx', 'nTx property expected')
-      assert.property(
-        result,
-        'previousblockhash',
-        'previousblockhash property expected'
-      )
-      assert.property(
-        result,
-        'nextblockhash',
-        'nextblockhash property expected'
-      )
-    })
-
-    it('should return block info with verbosity 2', async () => {
-      // Mock the RPC call for unit tests.
-      if (process.env.TEST === 'unit') {
-        sandbox
-          .stub(uut.axios, 'request')
-          .resolves({ data: { result: mockData.mockBlockInfo.verbosity1 } })
-      }
-
-      req.body.blockhash =
-        '0000000000000000008e8d83cba6d45a9314bc2ef4538d4e0577c6bed8593536'
-      req.body.verbosity = 2
-
-      const result = await uut.getBlock(req, res)
-      // console.log(`result: ${JSON.stringify(result, null, 2)}`)
-
-      assert.property(result, 'hash', 'hash property expected')
-      assert.property(
-        result,
-        'confirmations',
-        'confirmations property expected'
-      )
-      assert.property(result, 'size', 'size property expected')
-      assert.property(result, 'height', 'height property expected')
-      assert.property(result, 'version', 'version property expected')
-      assert.property(result, 'versionHex', 'versionHex property expected')
-      assert.property(result, 'merkleroot', 'merkleroot property expected')
-      assert.property(result, 'tx', 'tx property expected')
-      assert.property(result, 'time', 'time property expected')
-      assert.property(result, 'mediantime', 'mediantime property expected')
-      assert.property(result, 'nonce', 'nonce property expected')
-      assert.property(result, 'bits', 'bits property expected')
-      assert.property(result, 'difficulty', 'difficulty property expected')
-      assert.property(result, 'chainwork', 'chainwork property expected')
-      assert.property(result, 'nTx', 'nTx property expected')
-      assert.property(
-        result,
-        'previousblockhash',
-        'previousblockhash property expected'
-      )
-      assert.property(
-        result,
-        'nextblockhash',
-        'nextblockhash property expected'
-      )
-    })
-
-    it('should return block info without verbosity especified', async () => {
-      // Mock the RPC call for unit tests.
-      if (process.env.TEST === 'unit') {
-        sandbox
-          .stub(uut.axios, 'request')
-          .resolves({ data: { result: mockData.mockBlockInfo.verbosity1 } })
-      }
-
-      req.body.blockhash =
-        '0000000000000000008e8d83cba6d45a9314bc2ef4538d4e0577c6bed8593536'
-
-      const result = await uut.getBlock(req, res)
-      // console.log(`result: ${JSON.stringify(result, null, 2)}`)
-
-      assert.property(result, 'hash', 'hash property expected')
-      assert.property(
-        result,
-        'confirmations',
-        'confirmations property expected'
-      )
-      assert.property(result, 'size', 'size property expected')
-      assert.property(result, 'height', 'height property expected')
-      assert.property(result, 'version', 'version property expected')
-      assert.property(result, 'versionHex', 'versionHex property expected')
-      assert.property(result, 'merkleroot', 'merkleroot property expected')
-      assert.property(result, 'tx', 'tx property expected')
-      assert.property(result, 'time', 'time property expected')
-      assert.property(result, 'mediantime', 'mediantime property expected')
-      assert.property(result, 'nonce', 'nonce property expected')
-      assert.property(result, 'bits', 'bits property expected')
-      assert.property(result, 'difficulty', 'difficulty property expected')
-      assert.property(result, 'chainwork', 'chainwork property expected')
-      assert.property(result, 'nTx', 'nTx property expected')
-      assert.property(
-        result,
-        'previousblockhash',
-        'previousblockhash property expected'
-      )
-      assert.property(
-        result,
-        'nextblockhash',
-        'nextblockhash property expected'
-      )
-    })
-  })
 })

test/v4/encryption.js

@@ -82,7 +82,7 @@ describe('#Encryption Router', () => {
           .resolves(mockData.mockFulcrumTxHistory)
         sandbox
           .stub(encryptionRoute.bchjs.RawTransactions, 'getRawTransaction')
-          .resolves([mockData.mockTxDetails2])
+          .resolves(mockData.mockTxDetails2)
       }
 
       const result = await encryptionRoute.getPublicKey(req, res)
@@ -110,7 +110,7 @@ describe('#Encryption Router', () => {
       }
 
       const result = await encryptionRoute.getPublicKey(req, res)
-      console.log(`result: ${JSON.stringify(result, null, 2)}`)
+      // console.log(`result: ${JSON.stringify(result, null, 2)}`)
 
       assert.property(result, 'success')
       assert.equal(result.success, false)
@@ -130,7 +130,7 @@ describe('#Encryption Router', () => {
           .resolves(mockData.mockFulcrumNoSendBalance)
         sandbox
           .stub(encryptionRoute.bchjs.RawTransactions, 'getRawTransaction')
-          .resolves([mockData.mockNoSendTx])
+          .resolves(mockData.mockNoSendTx)
       }
 
       const result = await encryptionRoute.getPublicKey(req, res)

test/v4/integration/nft.js

@@ -1,77 +0,0 @@
-/*
-  These integration tests need to be run against a live SLPDB. They query
-  against a live SLPDB and test the results against known token stats.
- */
-
-'use strict'
-
-const chai = require('chai')
-const assert = chai.assert
-// const axios = require('axios')
-
-// Used for debugging.
-const util = require('util')
-util.inspect.defaultOptions = { depth: 1 }
-
-// Exit if SLPDB URL is not defined.
-if (!process.env.SLPDB_URL) {
-  throw new Error(
-    'SLPDB_URL and SLPDB_PASS must be defined in order to run these tests.'
-  )
-}
-
-const SLP = require('../../../src/routes/v4/slp')
-const slp = new SLP()
-
-const { mockReq, mockRes } = require('../mocks/express-mocks')
-
-describe('#nft', () => {
-  let req, res
-
-  beforeEach(() => {
-    // Mock the req and res objects used by Express routes.
-    req = mockReq
-    res = mockRes
-  })
-
-  describe('#getNftChildren', () => {
-    it('should get NFT children list', async () => {
-      req.params.tokenId =
-        '68cd33ecd909068fbea318ae5ff1d6207cf754e53b191327d6d73b6916424c0a'
-
-      const result = await slp.getNftChildren(req, res)
-      // console.log(`result: ${util.inspect(result)}`)
-
-      assert.isArray(result.nftChildren)
-      assert.equal(result.nftChildren.length, 2)
-      assert.equal(
-        result.nftChildren[0],
-        '45a30085691d6ea586e3ec2aa9122e9b0e0d6c3c1fd357decccc15d8efde48a9'
-      )
-      assert.equal(
-        result.nftChildren[1],
-        '928ce61fe1006b1325a0ba0dce700bf83986a6f0691ba26e121c9ac035d12a55'
-      )
-    })
-  })
-
-  describe('#getNftGroup', () => {
-    it('should get NFT group token info', async () => {
-      req.params.tokenId =
-        '45a30085691d6ea586e3ec2aa9122e9b0e0d6c3c1fd357decccc15d8efde48a9'
-      // req.params.tokenId = '928ce61fe1006b1325a0ba0dce700bf83986a6f0691ba26e121c9ac035d12a55'
-      const result = await slp.getNftGroup(req, res)
-      // console.log(`result: ${util.inspect(result)}`)
-      assert.property(result, 'nftGroup')
-      assert.property(result.nftGroup, 'id')
-      assert.property(result.nftGroup, 'versionType')
-      assert.property(result.nftGroup, 'symbol')
-      assert.equal(
-        result.nftGroup.id,
-        '68cd33ecd909068fbea318ae5ff1d6207cf754e53b191327d6d73b6916424c0a'
-      )
-      assert.equal(result.nftGroup.versionType, 129)
-      assert.equal(result.nftGroup.symbol, 'PSF.TEST.GROUP')
-    })
-  })
-})

test/v4/mocks/blockchain-mock.js

@@ -285,86 +285,7 @@ const mockAncestors = [
   'e68dad4a7292105cfa84fcaef7f99e5d4f2ece9613ca625d4d2ebf61efa84118',
   'fe94caf5da672be3772d2304a6272eb8bc3d3f5cb4a886f39b7981e1485cf74b'
 ]
-const mockBlockInfo = {
-  verbosity0: '20000000',
-  verbosity1: {
-    hash: '00000000c937983704a73af28acdec37b049d214adbda81d7e2a3dd146f6ed09',
-    confirmations: 1,
-    size: 3725,
-    strippedsize: 3725,
-    weight: 3725,
-    height: 6725,
-    version: 1,
-    versionHex: '00000000',
-    merkleroot: 'xxxx',
-    tx: [
-      '2afb8264508e2bf3e5288ccad01ed2ab766745b6b9747666b519d59212012c01',
-      '18f40b1ae56bba3fa1934b737fbe46ed8d5ca40fa9aed95073eeb5a119530cd3',
-      '349720d878547752607a69eb19e330592fee271fb5376cdfd811bee423558ed8',
-      '35571c80e7d0e9247b467454ef147d1d5833c775bc2d4164b1bebd4c1f69164f',
-      '480937e8efacdafeeb97d401ff0dd9ea8e8ddb27244cefa67a03621315bdb0e6',
-      '523327469d0b90c0de9a905c2fe6e227278fc5b55b9d9911ca151e1c26647065',
-      '61de4af971d94dbc741762f21dcef08b74b62863a56a1cb3496becdd8d47a858',
-      '69f70a288403b5bba23030ccd05d2e5cb00394620fdae3b050cff9432cc590ce',
-      '94472a90fbdba2eb2cba68308415181faedf3585c66b89efcbdb927a0c10ba23',
-      'bc6f781f9e2f2df460f89995c5e1c7224e48ccbe1aa2a575961f3f5330259864',
-      'f2d945a79bec5454a9ab4d570a150d81124daa308f1c81106a977d6413476944'
-    ],
-    time: 111,
-    mediantime: 111,
-    nonce: 111,
-    bits: '1d00ffff',
-    difficulty: 99.999,
-    chainwork: 'xxxx',
-    nTx: 1,
-    previousblockhash:
-      '00000000c937983704a73af28acdec37b049d214adbda81d7e2a3dd146f6ed09',
-    nextblockhash:
-      '00000000c937983704a73af28acdec37b049d214adbda81d7e2a3dd146f6ed09'
-  },
-  verbosity2: {
-    hash: '00000000c937983704a73af28acdec37b049d214adbda81d7e2a3dd146f6ed09',
-    confirmations: 1,
-    size: 3725,
-    strippedsize: 3725,
-    weight: 3725,
-    height: 6725,
-    version: 1,
-    versionHex: '00000000',
-    merkleroot: 'xxxx',
-    tx: [
-      {
-        hex:
-          '01000000010000000000000000000000000000000000000000000000000000000000000000ffffffff0704ffff001d0104ffffffff0100f2052a0100000043410496b538e853519c726a2c91e61ec11600ae1390813a627c66fb8be7947be63c52da7589379515d4e0a604f8141781e62294721166bf621e73a82cbf2342c858eeac00000000',
-        txid:
-          '0e3e2357e806b6cdb1f70b54c3a3a17b6714ee1f0e68bebb44a74b1efd512098',
-        hash:
-          '0e3e2357e806b6cdb1f70b54c3a3a17b6714ee1f0e68bebb44a74b1efd512098',
-        size: 134,
-        version: 1,
-        locktime: 0,
-        vin: [],
-        vout: [],
-        blockhash:
-          '00000000839a8e6886ab5951d76f411475428afc90947ee320161bbf18eb6048',
-        confirmations: 581882,
-        time: 1231469665,
-        blocktime: 1231469665
-      }
-    ],
-    time: 111,
-    mediantime: 111,
-    nonce: 111,
-    bits: '1d00ffff',
-    difficulty: 99.999,
-    chainwork: 'xxxx',
-    nTx: 1,
-    previousblockhash:
-      '00000000c937983704a73af28acdec37b049d214adbda81d7e2a3dd146f6ed09',
-    nextblockhash:
-      '00000000c937983704a73af28acdec37b049d214adbda81d7e2a3dd146f6ed09'
-  }
-}
+
 module.exports = {
   mockBlockHash,
   mockBlockchainInfo,
@@ -375,6 +296,5 @@ module.exports = {
   mockBlockHeader,
   mockTxOut,
   mockTxOutProof,
-  mockAncestors,
-  mockBlockInfo
+  mockAncestors
 }

test/v4/mocks/encryption-mocks.js

@@ -55,68 +55,64 @@ const mockFulcrumTxHistory = {
   success: true,
   transactions: [
     {
-      transactions: [
-        {
-          height: 511463,
-          tx_hash:
-            'eff00a9538487ff44243c75fb13de19b5783454c42c81b9aff9afbfd09cbaec3'
-        },
-        {
-          height: 511464,
-          tx_hash:
-            '7e9aa7a74de2b30200a2d6fc748ff35a0c753221444194f720bb7f61ef1d9153'
-        },
-        {
-          height: 513373,
-          tx_hash:
-            '6960255abe64893073921e96bf3c053c82686e0fc22a565494fbe2a31e766975'
-        },
-        {
-          height: 513373,
-          tx_hash:
-            '9ea667bcfc9cd337bd6c5583d8094c1b1942bd2015d95b54189deac5070eeff0'
-        },
-        {
-          height: 560481,
-          tx_hash:
-            'ecc1b51bac767880382bf3190ff17abf78d0936843a022a943d871116ed50368'
-        },
-        {
-          height: 560615,
-          tx_hash:
-            'b3792d28377b975560e1b6f09e48aeff8438d4c6969ca578bd406393bd50bd7d'
-        },
-        {
-          height: 561568,
-          tx_hash:
-            '8bc2134c7e48e56e1769b3d7c4c1e3a0acc68e1e58160eee6fa67f3208c07262'
-        },
-        {
-          height: 561569,
-          tx_hash:
-            'ceb0cab0e37b59caf3ca29e1a698d19ff47f2827dd09cb2f3b91b9100b1dad1c'
-        },
-        {
-          height: 561572,
-          tx_hash:
-            '0f9b49cafeb9ae1d741cdb12137c92816aa8470944c270a78ba2e610bd59190d'
-        },
-        {
-          height: 561582,
-          tx_hash:
-            'e4a0ac48ff3f42fc342717a2a3d34248e5e85bae79d59bd20e1b60e61b1c500f'
-        },
-        {
-          height: 562106,
-          tx_hash:
-            '1afcc63b244182647909539ebe3f4a44b8ea4120a95edb8d9eebe5347b9491bb'
-        },
-        {
-          height: 562106,
-          tx_hash:
-            'c42f8f16d3baa2ee343ea89ef110dfe094992379d08edd30887b8ca7ee671c9a'
-        }
-      ]
+      height: 511463,
+      tx_hash:
+        'eff00a9538487ff44243c75fb13de19b5783454c42c81b9aff9afbfd09cbaec3'
+    },
+    {
+      height: 511464,
+      tx_hash:
+        '7e9aa7a74de2b30200a2d6fc748ff35a0c753221444194f720bb7f61ef1d9153'
+    },
+    {
+      height: 513373,
+      tx_hash:
+        '6960255abe64893073921e96bf3c053c82686e0fc22a565494fbe2a31e766975'
+    },
+    {
+      height: 513373,
+      tx_hash:
+        '9ea667bcfc9cd337bd6c5583d8094c1b1942bd2015d95b54189deac5070eeff0'
+    },
+    {
+      height: 560481,
+      tx_hash:
+        'ecc1b51bac767880382bf3190ff17abf78d0936843a022a943d871116ed50368'
+    },
+    {
+      height: 560615,
+      tx_hash:
+        'b3792d28377b975560e1b6f09e48aeff8438d4c6969ca578bd406393bd50bd7d'
+    },
+    {
+      height: 561568,
+      tx_hash:
+        '8bc2134c7e48e56e1769b3d7c4c1e3a0acc68e1e58160eee6fa67f3208c07262'
+    },
+    {
+      height: 561569,
+      tx_hash:
+        'ceb0cab0e37b59caf3ca29e1a698d19ff47f2827dd09cb2f3b91b9100b1dad1c'
+    },
+    {
+      height: 561572,
+      tx_hash:
+        '0f9b49cafeb9ae1d741cdb12137c92816aa8470944c270a78ba2e610bd59190d'
+    },
+    {
+      height: 561582,
+      tx_hash:
+        'e4a0ac48ff3f42fc342717a2a3d34248e5e85bae79d59bd20e1b60e61b1c500f'
+    },
+    {
+      height: 562106,
+      tx_hash:
+        '1afcc63b244182647909539ebe3f4a44b8ea4120a95edb8d9eebe5347b9491bb'
+    },
+    {
+      height: 562106,
+      tx_hash:
+        'c42f8f16d3baa2ee343ea89ef110dfe094992379d08edd30887b8ca7ee671c9a'
     }
   ]
 }
@@ -163,25 +159,16 @@ const mockTxDetails2 = {
 
 const mockFulcrumNoTxHistory = {
   success: true,
-  transactions: [
-    {
-      transactions: [],
-      address: 'bitcoincash:qrgqqkky28jdkv3w0ctrah0mz3jcsnsklc34gtukrh'
-    }
-  ]
+  transactions: []
 }
 
 const mockFulcrumNoSendBalance = {
   success: true,
   transactions: [
     {
-      transactions: [
-        {
-          height: 633578,
-          tx_hash:
-            'a3b62cd4f4c56ba52139179db14bffd4ab22a2e077f3c62bd5cf0541bfcaf023'
-        }
-      ]
+      height: 633578,
+      tx_hash:
+        'a3b62cd4f4c56ba52139179db14bffd4ab22a2e077f3c62bd5cf0541bfcaf023'
     }
   ]
 }

test/v4/mocks/slp-mocks.js

@@ -66,69 +66,6 @@ const mockSingleToken = {
   ]
 }
 
-const mockNftGroup = {
-  decimals: 0,
-  timestamp: '2021-05-03 10:36:01',
-  timestamp_unix: 1620038161,
-  versionType: 129,
-  documentUri: 'psfoundation.cash',
-  symbol: 'PSF.TEST.GROUP',
-  name: 'PSF Test NFT Group',
-  containsBaton: true,
-  id: '68cd33ecd909068fbea318ae5ff1d6207cf754e53b191327d6d73b6916424c0a',
-  documentHash: null,
-  initialTokenQty: 1000000,
-  blockCreated: 686117,
-  totalMinted: null,
-  totalBurned: null,
-  circulatingSupply: null
-}
-
-const mockNftChildren = [
-  {
-    decimals: 0,
-    timestamp: '2021-05-03 11:59:30',
-    timestamp_unix: 1620043170,
-    versionType: 65,
-    documentUri: 'psfoundation.cash',
-    symbol: 'PSF.TEST.CHILD.1',
-    name: 'PSF Test NFT Child #1',
-    containsBaton: false,
-    id: '45a30085691d6ea586e3ec2aa9122e9b0e0d6c3c1fd357decccc15d8efde48a9',
-    documentHash: null,
-    initialTokenQty: 1,
-    nftParentId: '68cd33ecd909068fbea318ae5ff1d6207cf754e53b191327d6d73b6916424c0a',
-    blockCreated: 686130,
-    totalMinted: null,
-    totalBurned: null,
-    circulatingSupply: null,
-    // only in axios.data.t
-    transactionType: 'GENESIS',
-    tokenIdHex: '45a30085691d6ea586e3ec2aa9122e9b0e0d6c3c1fd357decccc15d8efde48a9'
-  },
-  {
-    decimals: 0,
-    timestamp: '2021-05-03 11:59:30',
-    timestamp_unix: 1620043170,
-    versionType: 65,
-    documentUri: 'psfoundation.cash',
-    symbol: 'PSF.TEST.CHILD.2',
-    name: 'PSF Test NFT Child #2',
-    containsBaton: false,
-    id: '928ce61fe1006b1325a0ba0dce700bf83986a6f0691ba26e121c9ac035d12a55',
-    documentHash: null,
-    initialTokenQty: 1,
-    nftParentId: '68cd33ecd909068fbea318ae5ff1d6207cf754e53b191327d6d73b6916424c0a',
-    blockCreated: 686130,
-    totalMinted: null,
-    totalBurned: null,
-    circulatingSupply: null,
-    // only in axios.data.t
-    transactionType: 'GENESIS',
-    tokenIdHex: '928ce61fe1006b1325a0ba0dce700bf83986a6f0691ba26e121c9ac035d12a55'
-  }
-]
-
 const mockSingleTokenError = {
   t: []
 }
@@ -1101,7 +1038,5 @@ module.exports = {
   mockPsfToken,
   mockValidateBulk,
   mockValidate3Bulk,
-  mockStatus,
-  mockNftGroup,
-  mockNftChildren
+  mockStatus
 }

test/v4/rate-limit-unit.js

@@ -1,506 +0,0 @@
-/*
-  Unit tests for the route-ratelimit2.js middleware.
-*/
-
-'use strict'
-
-// Public npm libraries.
-const assert = require('chai').assert
-const sinon = require('sinon')
-const cloneDeep = require('lodash.clonedeep')
-
-const config = require('../../config')
-
-// Mocking data.
-const { mockReq, mockRes, mockNext } = require('./mocks/express-mocks')
-
-// Libraries under test
-const RateLimits = require('../../src/middleware/route-ratelimit')
-let uut = new RateLimits()
-
-let req, res, next
-
-describe('#rate-routelimit', () => {
-  let sandbox
-
-  before(async () => {
-    if (!process.env.JWT_AUTH_SERVER) {
-      process.env.JWT_AUTH_SERVER = 'http://fakeurl.com/'
-    }
-
-    // Wipe the Redis DB, which prevents false negatives when running integration
-    // tests back-to-back.
-    await uut.wipeRedis()
-  })
-
-  // Setup the mocks before each test.
-  beforeEach(() => {
-    // Mock the req and res objects used by Express routes.
-    req = cloneDeep(mockReq)
-    res = cloneDeep(mockRes)
-    next = mockNext
-
-    // Explicitly reset the parmas and body.
-    req.params = {}
-    req.body = {}
-    req.query = {}
-    req.locals = {}
-
-    sandbox = sinon.createSandbox()
-
-    uut = new RateLimits()
-  })
-
-  afterEach(() => {
-    sandbox.restore()
-  })
-
-  after(() => {
-    uut.closeRedis()
-  })
-
-  describe('#checkInternalIp', () => {
-    it('should return true for a request from localhost', () => {
-      req.ip = '::ffff:127.0.0.1'
-
-      const result = uut.checkInternalIp(req)
-
-      assert.equal(result, true)
-    })
-
-    it('should return true for a request from a Docker container', () => {
-      req.ip = '172.17.0.3'
-
-      const result = uut.checkInternalIp(req)
-
-      assert.equal(result, true)
-    })
-
-    it('should return false for a random ip address', () => {
-      req.ip = '123.456.7.8'
-
-      const result = uut.checkInternalIp(req)
-
-      assert.equal(result, false)
-    })
-
-    it('should return false when an error is encountered', () => {
-      req.ip = 4
-
-      const result = uut.checkInternalIp(req)
-
-      assert.equal(result, false)
-    })
-  })
-
-  describe('#isInWhitelist', () => {
-    it('should return false when no argument is passed in', () => {
-      const result = uut.isInWhitelist()
-
-      assert.equal(result, false)
-    })
-
-    it('should return false when origin is not in the whitelist', () => {
-      req.origin = 'blah.com'
-      req.get = sandbox.stub().returns(req.origin)
-
-      const result = uut.isInWhitelist(req)
-
-      assert.equal(result, false)
-
-      // Used to appease linter. Remove these.
-      res.blah = 4
-      next()
-    })
-
-    it('should return true when origin is in the whitelist', () => {
-      req.origin = 'message.fullstack.cash'
-      req.get = sandbox.stub().returns(req.origin)
-
-      const result = uut.isInWhitelist(req)
-
-      assert.equal(result, true)
-    })
-  })
-
-  describe('#decodeJwtToken', () => {
-    it('should return the default JWT payload if decoding fails', () => {
-      const jwt =
-        'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjVlODhhY2JmMDIyMWMxMDAxMmFkOTNmZiIsImVtYWlsIjoiY2hyaXMudHJvdXRuZXJAZ21haWwuY29tIiwiYXBpTGV2ZWwiOjQwLCJyYXRlTGltaXQiOjMsImlhdCI6MTYxNTE1NzA4NywiZXhwIjoxNjE3NzQ5MDg3fQ.RLNGuYAa-CcLdhTGD27tDeaxT6-GIdeR8T4JWZZLDZA'
-
-      const result = uut.decodeJwtToken(jwt)
-      // console.log('result: ', result)
-
-      assert.property(result, 'id')
-      // assert.equal(result.id, '123.456.789.10')
-      assert.property(result, 'email')
-      // assert.equal(result.email, 'test@bchtest.net')
-      // assert.property(result, 'pointsToConsume')
-      // assert.equal(result.pointsToConsume, config.anonRateLimit)
-      // assert.property(result, 'duration')
-      // assert.equal(result.duration, 30)
-      assert.property(result, 'exp')
-    })
-
-    it('should return the default JWT payload if no input is given', () => {
-      const result = uut.decodeJwtToken()
-      // console.log('result: ', result)
-
-      assert.property(result, 'id')
-      assert.equal(result.id, '123.456.789.10')
-      assert.property(result, 'email')
-      assert.equal(result.email, 'test@bchtest.net')
-      assert.property(result, 'pointsToConsume')
-      assert.equal(result.pointsToConsume, config.anonRateLimit)
-      assert.property(result, 'duration')
-      assert.equal(result.duration, 30)
-      assert.property(result, 'exp')
-    })
-
-    it('should correctly decode a JWT token', () => {
-      // Generate a new JWT token for the test.
-      const jwtPayload = {
-        id: '5dade3f5739e6c0ff034b9a1',
-        pointsToConsume: 10,
-        email: 'gooduser@test.com',
-        apiLevel: 40,
-        rateLimit: 100,
-        duration: 30
-      }
-      const jwtToken = uut.generateJwtToken(jwtPayload)
-
-      const result = uut.decodeJwtToken(jwtToken)
-      // console.log('result: ', result)
-
-      assert.property(result, 'id')
-      assert.equal(result.id, jwtPayload.id)
-      assert.property(result, 'email')
-      assert.equal(result.email, jwtPayload.email)
-      assert.property(result, 'pointsToConsume')
-      assert.equal(result.pointsToConsume, jwtPayload.pointsToConsume)
-      assert.property(result, 'duration')
-      assert.equal(result.duration, jwtPayload.duration)
-      assert.property(result, 'exp')
-    })
-
-    it('should return the default payload if there is an unhandled error', () => {
-      // Force an error.
-      sandbox.stub(uut, 'generateJwtToken').throws(new Error('test error'))
-
-      const result = uut.decodeJwtToken()
-      // console.log('result: ', result)
-
-      assert.property(result, 'id')
-      assert.equal(result.id, '123.456.789.10')
-      assert.property(result, 'email')
-      assert.equal(result.email, 'test@bchtest.net')
-      assert.property(result, 'pointsToConsume')
-      assert.equal(result.pointsToConsume, config.anonRateLimit)
-      assert.property(result, 'duration')
-      assert.equal(result.duration, 30)
-      assert.property(result, 'exp')
-    })
-  })
-
-  describe('#trackRateLimits', () => {
-    it('should apply anonymous rate limits if no JWT token is provided', async () => {
-      req.ip = '127.0.0.1'
-
-      const result = await uut.trackRateLimits(req, res)
-      // console.log(`result: `, result)
-
-      // console.log('res.locals.pointsToConsume: ', res.locals.pointsToConsume)
-
-      assert.equal(result, false, 'Rate limits not exceeded')
-      assert.equal(
-        res.locals.pointsToConsume,
-        config.anonRateLimit,
-        'Anonymous rate limits applied'
-      )
-    })
-
-    it('should apply 100 RPM rate limits when JWT token is provided', async () => {
-      // Generate a new JWT token for the test.
-      const jwtPayload = {
-        id: '5dade3f5739e6c0ff034b9a1',
-        pointsToConsume: 10
-      }
-      const jwtToken = uut.generateJwtToken(jwtPayload)
-
-      const result = await uut.trackRateLimits(req, res, jwtToken)
-      // console.log(`result: `, result)
-
-      // console.log('res.locals.pointsToConsume: ', res.locals.pointsToConsume)
-
-      assert.equal(result, false, 'Rate limits not exceeded')
-      assert.equal(res.locals.pointsToConsume, 10, '100 RPM limits applied')
-    })
-  })
-
-  describe('#applyRateLimits', () => {
-    it('should skip rate limits if basic auth token is used', async () => {
-      req.locals.proLimit = true
-
-      // console.log('next.callCount: ', next.callCount)
-      const startCallCount = next.callCount
-
-      await uut.applyRateLimits(req, res, next)
-
-      // console.log('next.callCount: ', next.callCount)
-      const endCallCount = next.callCount
-
-      assert.isAbove(
-        endCallCount,
-        startCallCount,
-        'Expecting next() to be called'
-      )
-    })
-
-    it('should skip rate limits if internal call passes basic auth token', async () => {
-      req.ip = '127.0.0.1'
-      req.body.usrObj = {
-        proLimit: true
-      }
-
-      // console.log('next.callCount: ', next.callCount)
-      const startCallCount = next.callCount
-
-      await uut.applyRateLimits(req, res, next)
-
-      // console.log('next.callCount: ', next.callCount)
-      const endCallCount = next.callCount
-
-      assert.isAbove(
-        endCallCount,
-        startCallCount,
-        'Expecting next() to be called'
-      )
-    })
-
-    it('should apply rate limits to anonymous users', async () => {
-      req.ip = '123.456.7.8'
-
-      // console.log('next.callCount: ', next.callCount)
-      const startCallCount = next.callCount
-
-      await uut.applyRateLimits(req, res, next)
-
-      // console.log('next.callCount: ', next.callCount)
-      const endCallCount = next.callCount
-
-      assert.isAbove(
-        endCallCount,
-        startCallCount,
-        'Expecting next() to be called'
-      )
-
-      assert.equal(
-        res.locals.pointsToConsume,
-        config.anonRateLimit,
-        'Anonymous rate limits applied'
-      )
-    })
-
-    it('should return 429 error when anonymous users exceed rate limit', async () => {
-      req.ip = '123.456.7.8'
-
-      // force req.locals.jwtToken to be empty.
-      req.locals.jwtToken = undefined
-
-      let val
-      for (let i = 0; i < 25; i++) {
-        // console.log('req.locals: ', req.locals)
-        val = await uut.applyRateLimits(req, res, next)
-      }
-      // console.log('val: ', val)
-
-      assert.property(val, 'error')
-      assert.include(
-        val.error,
-        'Too many requests. Your limits are currently 20 requests per minute.'
-      )
-
-      assert.equal(res.locals.rateLimitTriggered, true, 'Rate limits triggered')
-
-      assert.equal(
-        res.locals.pointsToConsume,
-        config.anonRateLimit,
-        'Anonymous rate limits applied'
-      )
-    })
-
-    it('should apply rate limits when JWT token is provided', async () => {
-      // Generate a new JWT token for the test.
-      const jwtPayload = {
-        id: '5dade3f5739e6c0ff034b9a1',
-        pointsToConsume: 10
-      }
-      const jwtToken = uut.generateJwtToken(jwtPayload)
-
-      req.ip = '123.456.7.8'
-      req.locals.jwtToken = jwtToken
-
-      // console.log('next.callCount: ', next.callCount)
-      const startCallCount = next.callCount
-
-      await uut.applyRateLimits(req, res, next)
-
-      // console.log('next.callCount: ', next.callCount)
-      const endCallCount = next.callCount
-
-      assert.isAbove(
-        endCallCount,
-        startCallCount,
-        'Expecting next() to be called'
-      )
-
-      assert.equal(
-        res.locals.pointsToConsume,
-        10,
-        'Anonymous rate limits applied'
-      )
-    })
-
-    it('should apply internal rate limits to internal calls', async () => {
-      req.ip = '127.0.0.1'
-
-      // console.log('next.callCount: ', next.callCount)
-      const startCallCount = next.callCount
-
-      await uut.applyRateLimits(req, res, next)
-
-      // console.log('next.callCount: ', next.callCount)
-      const endCallCount = next.callCount
-
-      assert.isAbove(
-        endCallCount,
-        startCallCount,
-        'Expecting next() to be called'
-      )
-
-      assert.equal(
-        res.locals.pointsToConsume,
-        10,
-        'Internal rate limits applied'
-      )
-    })
-
-    it('should return 429 error when internal calls exceed interal rate limit', async () => {
-      req.ip = '127.0.0.1'
-
-      let val
-      for (let i = 0; i < 1025; i++) {
-        val = await uut.applyRateLimits(req, res, next)
-      }
-
-      assert.property(val, 'error')
-      assert.include(
-        val.error,
-        'Too many requests. Your limits are currently 1000 requests per minute.'
-      )
-
-      assert.equal(res.locals.rateLimitTriggered, true, 'Rate limits triggered')
-
-      assert.equal(
-        res.locals.pointsToConsume,
-        10,
-        'Internal rate limits applied'
-      )
-    })
-
-    it('should apply JWT rate limits to internal calls when JWT passes through', async () => {
-      // Generate a new JWT token for the test.
-      const jwtPayload = {
-        id: '5dade3f5739e6c0ff034b9a1',
-        pointsToConsume: 10
-      }
-      const jwtToken = uut.generateJwtToken(jwtPayload)
-
-      req.ip = '127.0.0.1'
-      req.body.usrObj = {
-        jwtToken
-      }
-
-      // console.log('next.callCount: ', next.callCount)
-      const startCallCount = next.callCount
-
-      await uut.applyRateLimits(req, res, next)
-
-      // console.log('next.callCount: ', next.callCount)
-      const endCallCount = next.callCount
-
-      assert.isAbove(
-        endCallCount,
-        startCallCount,
-        'Expecting next() to be called'
-      )
-
-      assert.equal(
-        res.locals.pointsToConsume,
-        10,
-        'User JWT rate limits applied'
-      )
-    })
-
-    it('should return 429 error when internal calls using JWT pass-through exceeds rate limit', async () => {
-      // Generate a new JWT token for the test.
-      const jwtPayload = {
-        id: '5dade3f5739e6c0ff034b9a1',
-        pointsToConsume: 100
-      }
-      const jwtToken = uut.generateJwtToken(jwtPayload)
-
-      req.ip = '127.0.0.1'
-      req.body.usrObj = {
-        jwtToken
-      }
-
-      try {
-        let val
-        for (let i = 0; i < 120; i++) {
-          val = await uut.applyRateLimits(req, res, next)
-        }
-        // console.log('val: ', val)
-
-        assert.property(val, 'error')
-        assert.include(
-          val.error,
-          'Too many requests. Your limits are currently 100 requests per minute.'
-        )
-
-        assert.equal(
-          res.locals.pointsToConsume,
-          100,
-          'User JWT rate limits applied'
-        )
-      } catch (err) {
-        console.log('err: ', err)
-        assert.fail('Unexpected result')
-      }
-    })
-
-    it('should move to the next middleware when encountering an unexpected internal error', async () => {
-      // Force the creation of the res and req locals property. Covers an
-      // otherwise untested code path.
-      req.locals = undefined
-      res.locals = undefined
-
-      // Force an error
-      sandbox.stub(uut, 'checkInternalIp').throws(new Error('test error'))
-
-      // console.log('next.callCount: ', next.callCount)
-      const startCallCount = next.callCount
-
-      await uut.applyRateLimits(req, res, next)
-
-      // console.log('next.callCount: ', next.callCount)
-      const endCallCount = next.callCount
-
-      assert.isAbove(
-        endCallCount,
-        startCallCount,
-        'Expecting next() to be called'
-      )
-    })
-  })
-})

test/v4/rate-limits.js

@@ -0,0 +1,487 @@
+'use strict'
+
+const chai = require('chai')
+const assert = chai.assert
+const sinon = require('sinon')
+
+// Used for debugging.
+const util = require('util')
+util.inspect.defaultOptions = { depth: 1 }
+
+// Mocking data.
+const { mockReq, mockRes, mockNext } = require('./mocks/express-mocks')
+
+// Libraries under test
+const RateLimits = require('../../src/middleware/route-ratelimit')
+let rateLimits = new RateLimits()
+
+// const controlRoute = require('../../src/routes/v4/full-node/control')
+const jwtAuth = require('../../src/middleware/jwt-auth')
+
+let req, res, next
+// let originalEnvVars // Used during transition from integration to unit tests.
+
+// JWT token used in tests.
+const jwt = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjVkYWRlM2Y1NzM5ZTZjMGZmMDM0YjlhMSIsImlhdCI6MTU3MTY3NzQ1MCwiZXhwIjoxNTc0MjY5NDUwfQ.SSz7F7ETyBB3eoNG2VKCzPOhddtB-vrtmEoj7PxicrQ'
+
+describe('#route-ratelimits & jwt-auth', () => {
+  let sandbox
+
+  before(async () => {
+    // Save existing environment variables.
+    // originalEnvVars = {
+    //   BITCOINCOM_BASEURL: process.env.BITCOINCOM_BASEURL,
+    //   RPC_BASEURL: process.env.RPC_BASEURL,
+    //   RPC_USERNAME: process.env.RPC_USERNAME,
+    //   RPC_PASSWORD: process.env.RPC_PASSWORD
+    // }
+
+    if (!process.env.JWT_AUTH_SERVER) { process.env.JWT_AUTH_SERVER = 'http://fakeurl.com/' }
+
+    // Wipe the Redis DB, which prevents false negatives when running integration
+    // tests back-to-back.
+    await rateLimits.wipeRedis()
+  })
+
+  // Setup the mocks before each test.
+  beforeEach(() => {
+    // Mock the req and res objects used by Express routes.
+    req = Object.assign({}, mockReq)
+    res = Object.assign({}, mockRes)
+    next = mockNext
+
+    // Explicitly reset the parmas and body.
+    req.params = {}
+    req.body = {}
+    req.query = {}
+    req.locals = {}
+
+    sandbox = sinon.createSandbox()
+  })
+
+  afterEach(() => {
+    sandbox.restore()
+  })
+
+  after(() => {
+    rateLimits.closeRedis()
+  })
+
+  describe('#jwt-auth.js', () => {
+    describe('#getTokenFromHeaders', () => {
+      it('should populate the req.locals object correctly', () => {
+        // Initialize req.locals
+        req.locals = {
+          proLimit: false,
+          apiLevel: 0
+        }
+
+        const header = `Token ${jwt}`
+        req.headers.authorization = header
+
+        jwtAuth.getTokenFromHeaders(req, res, next)
+
+        // console.log(`req.locals: ${JSON.stringify(req.locals, null, 2)}`)
+
+        assert.property(req.locals, 'proLimit')
+        assert.property(req.locals, 'apiLevel')
+        assert.property(req.locals, 'jwtToken')
+        assert.equal(req.locals.jwtToken, jwt)
+      })
+    })
+  })
+
+  describe('#getResource', () => {
+    it('should decode a blockchain request', () => {
+      const url =
+        '/blockchain/getTxOut/62a3ea958a463a372bc0caf2c374a7f60be9c624be63a0db8db78f05809df6d8/0?include_mempool=true'
+
+      const result = rateLimits.getResource(url)
+      // console.log(`result: ${JSON.stringify(result, null, 2)}`)
+
+      assert.equal(result, 'blockchain')
+    })
+  })
+
+  describe('#calcPoints', () => {
+    it('should return 50 points for anonymous user', () => {
+      const result = rateLimits.calcPoints()
+      // console.log(`result: ${result}`)
+
+      assert.equal(result, 50)
+    })
+
+    it('should return 50 points for free tier requesting full node access', () => {
+      const jwtInfo = {
+        apiLevel: 10,
+        resource: 'blockchain',
+        id: '5e3a0415eb29a962da2708b4'
+      }
+
+      const result = rateLimits.calcPoints(jwtInfo)
+      assert.equal(result, 50)
+    })
+
+    it('should return 50 points for free tier requesting indexer access', () => {
+      const jwtInfo = {
+        apiLevel: 10,
+        resource: 'blockbook',
+        id: '5e3a0415eb29a962da2708b4'
+      }
+
+      const result = rateLimits.calcPoints(jwtInfo)
+      assert.equal(result, 50)
+    })
+
+    it('should return 50 points for free tier requesting SLPDB access', () => {
+      const jwtInfo = {
+        apiLevel: 10,
+        resource: 'slp',
+        id: '5e3a0415eb29a962da2708b4'
+      }
+
+      const result = rateLimits.calcPoints(jwtInfo)
+      assert.equal(result, 50)
+    })
+
+    it('should return 10 points for full node tier requesting full node access', () => {
+      const jwtInfo = {
+        apiLevel: 20,
+        resource: 'blockchain',
+        id: '5e3a0415eb29a962da2708b4'
+      }
+
+      const result = rateLimits.calcPoints(jwtInfo)
+      assert.equal(result, 10)
+    })
+
+    it('should return 50 points for full-node tier requesting indexer access', () => {
+      const jwtInfo = {
+        apiLevel: 20,
+        resource: 'blockbook',
+        id: '5e3a0415eb29a962da2708b4'
+      }
+
+      const result = rateLimits.calcPoints(jwtInfo)
+      assert.equal(result, 50)
+    })
+
+    it('should return 50 points for full node tier requesting SLPDB access', () => {
+      const jwtInfo = {
+        apiLevel: 20,
+        resource: 'slp',
+        id: '5e3a0415eb29a962da2708b4'
+      }
+
+      const result = rateLimits.calcPoints(jwtInfo)
+      assert.equal(result, 50)
+    })
+
+    it('should return 10 point for indexer tier requesting full node access', () => {
+      const jwtInfo = {
+        apiLevel: 30,
+        resource: 'blockchain',
+        id: '5e3a0415eb29a962da2708b4'
+      }
+
+      const result = rateLimits.calcPoints(jwtInfo)
+      assert.equal(result, 10)
+    })
+
+    it('should return 10 points for indexer tier requesting indexer access', () => {
+      const jwtInfo = {
+        apiLevel: 30,
+        resource: 'blockbook',
+        id: '5e3a0415eb29a962da2708b4'
+      }
+
+      const result = rateLimits.calcPoints(jwtInfo)
+      assert.equal(result, 10)
+    })
+
+    it('should return 50 points for indexer tier requesting SLPDB access', () => {
+      const jwtInfo = {
+        apiLevel: 30,
+        resource: 'slp',
+        id: '5e3a0415eb29a962da2708b4'
+      }
+
+      const result = rateLimits.calcPoints(jwtInfo)
+      assert.equal(result, 50)
+    })
+
+    it('should return 10 point for SLP tier requesting full node access', () => {
+      const jwtInfo = {
+        apiLevel: 40,
+        resource: 'blockchain',
+        id: '5e3a0415eb29a962da2708b4'
+      }
+
+      const result = rateLimits.calcPoints(jwtInfo)
+      assert.equal(result, 10)
+    })
+
+    it('should return 10 points for SLP tier requesting indexer access', () => {
+      const jwtInfo = {
+        apiLevel: 40,
+        resource: 'blockbook',
+        id: '5e3a0415eb29a962da2708b4'
+      }
+
+      const result = rateLimits.calcPoints(jwtInfo)
+      assert.equal(result, 10)
+    })
+
+    it('should return 10 points for SLP tier requesting SLPDB access', () => {
+      const jwtInfo = {
+        apiLevel: 40,
+        resource: 'slp',
+        id: '5e3a0415eb29a962da2708b4'
+      }
+
+      const result = rateLimits.calcPoints(jwtInfo)
+      assert.equal(result, 10)
+    })
+  })
+
+  describe('#rateLimitByResource', () => {
+    // NOTE: this test will fail if you run multiple integration tests in a
+    // short period. Because it talks to the Redis DB.
+    it('should pass through rate-limit middleware', async () => {
+      req.baseUrl = '/v4'
+      req.path = '/control/getNetworkInfo'
+      req.url = req.path
+      req.method = 'GET'
+
+      // Call the route twice to trigger the rate handling.
+      await rateLimits.rateLimitByResource(req, res, next)
+      await rateLimits.rateLimitByResource(req, res, next)
+
+      // next() will be called if rate-limit is not triggered
+      assert.equal(next.called, true)
+    })
+
+    it('should trigger rate-limit handler if rate limits exceeds 5 request per minute', async () => {
+      req.baseUrl = '/v4'
+      req.path = '/control/getNetworkInfo'
+      req.url = req.path
+      req.method = 'GET'
+
+      for (let i = 0; i < 5; i++) {
+        next.reset() // reset the stubbed next() function.
+
+        await rateLimits.rateLimitByResource(req, res, next)
+        // console.log(`next() called: ${next.called}`)
+      }
+
+      // Note: next() will be called unless the rate-limit kicks in.
+      assert.equal(
+        next.called,
+        false,
+        'next should not be called if rate limit was triggered.'
+      )
+    })
+
+    it('should NOT trigger rate-limit for free-tier at 5 RPM', async () => {
+      // Create a new instance of the rate limit so we start with zeroed tracking.
+      rateLimits = new RateLimits()
+
+      req.baseUrl = '/v4'
+      req.path = '/control/getNetworkInfo'
+      req.url = req.path
+      req.method = 'GET'
+
+      req.locals.jwtToken = 'some-token'
+
+      const jwtInfo = {
+        apiLevel: 10,
+        id: '5e3a0415eb29a962da2708b1'
+      }
+
+      // Mock the call to the jwt library.
+      sandbox.stub(rateLimits.jwt, 'verify').returns(jwtInfo)
+
+      for (let i = 0; i < 5; i++) {
+        next.reset() // reset the stubbed next() function.
+
+        await rateLimits.rateLimitByResource(req, res, next)
+        // console.log(`next() called: ${next.called}`)
+      }
+
+      // console.log(`req.locals after test: ${util.inspect(req.locals)}`)
+
+      // Note: next() will be called unless the rate-limit kicks in.
+      assert.equal(
+        next.called,
+        true,
+        'next should be called if rate limit was not triggered.'
+      )
+    })
+
+    it('should trigger rate-limit for free tier after 20 RPM', async () => {
+      // Create a new instance of the rate limit so we start with zeroed tracking.
+      rateLimits = new RateLimits()
+
+      req.baseUrl = '/v4'
+      req.path = '/control/getNetworkInfo'
+      req.url = req.path
+      req.method = 'GET'
+
+      req.locals.jwtToken = 'some-token'
+
+      const jwtInfo = {
+        apiLevel: 10,
+        id: '5e3a0415eb29a962da2708b2'
+      }
+
+      // Mock the call to the jwt library.
+      sandbox.stub(rateLimits.jwt, 'verify').returns(jwtInfo)
+
+      for (let i = 0; i < 22; i++) {
+        next.reset() // reset the stubbed next() function.
+
+        await rateLimits.rateLimitByResource(req, res, next)
+        // console.log(`next() called: ${next.called}`)
+      }
+
+      // Note: next() will be called unless the rate-limit kicks in.
+      assert.equal(
+        next.called,
+        false,
+        'next should not be called if rate limit was triggered.'
+      )
+    })
+
+    it('should NOT trigger rate-limit handler for indexer-tier at 25 RPM', async () => {
+      // Create a new instance of the rate limit so we start with zeroed tracking.
+      rateLimits = new RateLimits()
+
+      req.baseUrl = '/v4'
+      req.path = '/control/getNetworkInfo'
+      req.url = req.path
+      req.method = 'GET'
+
+      req.locals.jwtToken = 'some-token'
+
+      const jwtInfo = {
+        apiLevel: 20,
+        id: '5e3a0415eb29a962da2708b3'
+      }
+
+      // Mock the call to the jwt library.
+      sandbox.stub(rateLimits.jwt, 'verify').returns(jwtInfo)
+
+      for (let i = 0; i < 25; i++) {
+        next.reset() // reset the stubbed next() function.
+
+        await rateLimits.rateLimitByResource(req, res, next)
+        // console.log(`next() called: ${next.called}`)
+      }
+
+      // console.log(`req.locals after test: ${util.inspect(req.locals)}`)
+
+      // Note: next() will be called unless the rate-limit kicks in.
+      assert.equal(
+        next.called,
+        true,
+        'next should be called if rate limit was not triggered.'
+      )
+    })
+
+    it('should still rate-limit at a higher RPM for pro-tier', async () => {
+      // Create a new instance of the rate limit so we start with zeroed tracking.
+      rateLimits = new RateLimits()
+
+      req.baseUrl = '/v4'
+      req.path = '/control/getNetworkInfo'
+      req.url = req.path
+      req.method = 'GET'
+
+      req.locals.jwtToken = 'some-token'
+
+      const jwtInfo = {
+        apiLevel: 20,
+        id: '5e3a0415eb29a962da2708b5'
+      }
+
+      // Mock the call to the jwt library.
+      sandbox.stub(rateLimits.jwt, 'verify').returns(jwtInfo)
+
+      for (let i = 0; i < 150; i++) {
+        next.reset() // reset the stubbed next() function.
+
+        await rateLimits.rateLimitByResource(req, res, next)
+        // console.log(`next() called: ${next.called}`)
+      }
+
+      // console.log(`req.locals after test: ${util.inspect(req.locals)}`)
+
+      // Note: next() will be called unless the rate-limit kicks in.
+      assert.equal(
+        next.called,
+        false,
+        'next should NOT be called if rate limit was triggered.'
+      )
+    })
+
+    // CT 2/24/21 This test may have been invalidated by the interal IP address
+    // passing that I implemented to get hydrateUtxos() working properly.
+    // I'm commenting this out until I can study the side effects of this change,
+    // and why exactly this test is breaking.
+    // it('should handle misconfigured token secret', async () => {
+    //   // Create a new instance of the rate limit so we start with zeroed tracking.
+    //   rateLimits = new RateLimits()
+    //
+    //   req.baseUrl = '/v4'
+    //   req.path = '/control/getNetworkInfo'
+    //   req.url = req.path
+    //   req.method = 'GET'
+    //
+    //   req.locals.jwtToken = 'some-token'
+    //
+    //   next.reset() // reset the stubbed next() function.
+    //
+    //   await rateLimits.rateLimitByResource(req, res, next)
+    //
+    //   // Issues with token secret should treat incoming requests as anonymous
+    //   // calls with 50 points, or 20 RPM.
+    //   assert.equal(res.locals.pointsToConsume, 50)
+    // })
+  })
+
+  describe('#isInWhitelist', () => {
+    it('should return false when no argument is passed in', () => {
+      const result = rateLimits.isInWhitelist()
+
+      assert.equal(result, false)
+    })
+
+    it('should return false when origin is not in the whitelist', () => {
+      const origin = 'blah.com'
+
+      const result = rateLimits.isInWhitelist(origin)
+
+      assert.equal(result, false)
+    })
+
+    it('should return true when origin is in the whitelist', () => {
+      const origin = 'message.fullstack.cash'
+
+      const result = rateLimits.isInWhitelist(origin)
+
+      assert.equal(result, true)
+    })
+  })
+})
+
+// Generates a Basic authorization header.
+// function generateAuthHeader (pass) {
+//   // https://en.wikipedia.org/wiki/Basic_access_authentication
+//   const username = 'BITBOX'
+//   const combined = `${username}:${pass}`
+//
+//   var base64Credential = Buffer.from(combined).toString('base64')
+//   var readyCredential = `Basic ${base64Credential}`
+//
+//   return readyCredential
+// }

test/v4/raw-transactions.js

@@ -250,7 +250,6 @@ describe('#Raw-Transactions', () => {
         'Proper error message'
       )
     })
-
     it('returns proper error when downstream service stalls', async () => {
       req.body.hexes = [
         '0200000001b9b598d7d6d72fc486b2b3a3c03c79b5bade6ec9a77ced850515ab5e64edcc21010000006b483045022100a7b1b08956abb8d6f322aa709d8583c8ea492ba0585f1a6f4f9983520af74a5a0220411aee4a9a54effab617b0508c504c31681b15f9b187179b4874257badd4139041210360cfc66fdacb650bc4c83b4e351805181ee696b7d5ab4667c57b2786f51c413dffffffff0210270000000000001976a914eb4b180def88e3f5625b2d8ae2c098ff7d85f66488ac786e9800000000001976a914eb4b180def88e3f5625b2d8ae2c098ff7d85f66488ac00000000'
@@ -1047,12 +1046,10 @@ describe('#Raw-Transactions', () => {
       // Save the existing RPC URL.
       const savedUrl = process.env.BITCOINCOM_BASEURL
       const savedUrl2 = process.env.RPC_BASEURL
-      const savedUrl3 = process.env.RPC_SENDURL
 
       // Manipulate the URL to cause a 500 network error.
       process.env.BITCOINCOM_BASEURL = 'http://fakeurl/api/'
       process.env.RPC_BASEURL = 'http://fakeurl/api/'
-      process.env.RPC_SENDURL = 'http://fakeurl/api/'
 
       req.params.hex =
         '020000000136697692fed77bc4f5b6885295d0c56d1d0280fb578f445ce42be4eb6db381f2010000006a4730440220473adba0e7da14f0abf4817bbd591741ecb8da6544b998f10341f6704f5f05280220405221c626cb7edcf333367ebd469aff3f5a2169e37ee58eebb811ffc2fbc9e0412102202ff86325c5d903171fa5a2895c4efb3765105115460dc96f113048ddb69b47feffffff027a621b00000000001976a914e0a8ffc3b91e35f46618d6db90f66397989abf0588ac38041300000000001976a914a741f282af390bc7ea8c4375a3a56401d668564288ac2c330900'
@@ -1062,7 +1059,6 @@ describe('#Raw-Transactions', () => {
       // Restore the saved URL.
       process.env.BITCOINCOM_BASEURL = savedUrl
       process.env.RPC_BASEURL = savedUrl2
-      process.env.RPC_SENDURL = savedUrl3
 
       assert.isAbove(
         res.statusCode,

test/v4/route-utils.js

@@ -1,34 +0,0 @@
-/*
-  Unit tests for the route-utils.js library.
-*/
-
-const assert = require('chai').assert
-
-const RouteUtils = require('../../src/util/route-utils.js')
-
-describe('#route-utils', () => {
-  let uut
-
-  beforeEach(() => {
-    uut = new RouteUtils()
-  })
-
-  describe('#decodeError', () => {
-    it('should decode a 429 error from nginx', () => {
-      const err = {
-        error: '<html>\r\n<head><title>429 Too Many Requests</title></head>\r\n<body>\r\n<center><h1>429 Too Many Requests</h1></center>\r\n<hr><center>nginx/1.18.0 (Ubuntu)</center>\r\n</body>\r\n</html>\r\n',
-        level: 'error',
-        message: 'Error in slp.js/hydrateUtxos().',
-        timestamp: '2021-03-31T04:13:36.662Z'
-      }
-
-      const result = uut.decodeError(err)
-      // console.log('result: ', result)
-
-      assert.property(result, 'msg')
-      assert.equal(result.msg, '429 Too Many Requests')
-      assert.property(result, 'status')
-      assert.equal(result.status, 429)
-    })
-  })
-})

test/v4/slp.js

@@ -1760,277 +1760,6 @@ describe('#SLP', () => {
       assert.isAbove(res.statusCode, 499, 'HTTP status code 503 expected.')
     })
   })
-
-  describe('#getNftChildren', () => {
-    it('should throw 400 if tokenID is empty', async () => {
-      req.params.tokenId = ''
-      const result = await slpRoute.getNftChildren(req, res)
-      // console.log(`result: ${util.inspect(result)}`)
-
-      assert.hasAllKeys(result, ['error'])
-      assert.include(result.error, 'tokenId can not be empty')
-    })
-
-    it('returns proper error when downstream service stalls', async () => {
-      // Mock the timeout error.
-      sandbox.stub(slpRoute.axios, 'request').throws({ code: 'ECONNABORTED' })
-
-      req.params.tokenId =
-        '68cd33ecd909068fbea318ae5ff1d6207cf754e53b191327d6d73b6916424c0a'
-
-      const result = await slpRoute.getNftChildren(req, res)
-      // console.log(`result: ${JSON.stringify(result, null, 2)}`)
-      assert.isAbove(res.statusCode, 499, 'HTTP status code 503 expected.')
-      assert.include(
-        result.error,
-        'Could not communicate with full node',
-        'Error message expected'
-      )
-    })
-
-    it('returns proper error when downstream service is down', async () => {
-      // Mock the timeout error.
-      sandbox.stub(slpRoute.axios, 'request').throws({ code: 'ECONNREFUSED' })
-
-      req.params.tokenId =
-        '68cd33ecd909068fbea318ae5ff1d6207cf754e53b191327d6d73b6916424c0a'
-
-      const result = await slpRoute.getNftChildren(req, res)
-      // console.log(`result: ${JSON.stringify(result, null, 2)}`)
-
-      assert.isAbove(res.statusCode, 499, 'HTTP status code 503 expected.')
-      assert.include(
-        result.error,
-        'Could not communicate with full node',
-        'Error message expected'
-      )
-    })
-
-    it('should return error on non-existing NFT group token', async () => {
-      if (process.env.TEST === 'unit') {
-        sandbox.stub(slpRoute, 'lookupToken').resolves({ id: 'not found' })
-      }
-
-      req.params.tokenId =
-        '68cd33ecd909068fbea318ae5ff1d6207cf754e53b191327d6d73b6916424c0b'
-
-      const result = await slpRoute.getNftChildren(req, res)
-      // console.log(`result: ${JSON.stringify(result, null, 2)}`)
-
-      assert.include(
-        result.error,
-        'NFT group does not exists',
-        'Error message expected'
-      )
-    })
-
-    it('should return error on non-group NFT token', async () => {
-      if (process.env.TEST === 'unit') {
-        sandbox
-          .stub(slpRoute, 'lookupToken')
-          .resolves(mockData.mockNftChildren[0])
-      }
-
-      req.params.tokenId =
-        '68cd33ecd909068fbea318ae5ff1d6207cf754e53b191327d6d73b6916424c0b'
-
-      const result = await slpRoute.getNftChildren(req, res)
-      // console.log(`result: ${JSON.stringify(result, null, 2)}`)
-      assert.include(
-        result.error,
-        'NFT group does not exists',
-        'Error message expected'
-      )
-    })
-
-    if (process.env.TEST === 'unit') {
-      it('should return error on invalid NFT group data', async () => {
-        sandbox.stub(slpRoute, 'lookupToken').resolves(mockData.mockNftGroup)
-        sandbox.stub(slpRoute.axios, 'request').resolves({
-          data: { u: 'invalid' }
-        })
-
-        req.params.tokenId =
-          '68cd33ecd909068fbea318ae5ff1d6207cf754e53b191327d6d73b6916424c0a'
-
-        const result = await slpRoute.getNftChildren(req, res)
-        // console.log(`result: ${JSON.stringify(result, null, 2)}`)
-        assert.include(
-          result.error,
-          'No children data in the group',
-          'Error message expected'
-        )
-      })
-    }
-
-    if (process.env.ISBCHN) {
-      it('should get NFT children IDs in given NFT group', async () => {
-        if (process.env.TEST === 'unit') {
-          sandbox.stub(slpRoute, 'lookupToken').resolves(mockData.mockNftGroup)
-          sandbox.stub(slpRoute.axios, 'request').resolves({
-            data: {
-              t: [
-                {
-                  tokenDetails: mockData.mockNftChildren[0],
-                  nftParentId: mockData.mockNftGroup.id
-                },
-                {
-                  tokenDetails: mockData.mockNftChildren[1],
-                  nftParentId: mockData.mockNftGroup.id
-                }
-              ]
-            }
-          })
-        }
-
-        req.params.tokenId =
-          '68cd33ecd909068fbea318ae5ff1d6207cf754e53b191327d6d73b6916424c0a'
-
-        const result = await slpRoute.getNftChildren(req, res)
-        // console.log(`result: ${JSON.stringify(result, null, 2)}`)
-        assert.isArray(result.nftChildren)
-        assert.equal(result.nftChildren.length, 2)
-        assert.equal(
-          result.nftChildren[0],
-          '45a30085691d6ea586e3ec2aa9122e9b0e0d6c3c1fd357decccc15d8efde48a9'
-        )
-        assert.equal(
-          result.nftChildren[1],
-          '928ce61fe1006b1325a0ba0dce700bf83986a6f0691ba26e121c9ac035d12a55'
-        )
-      })
-    }
-  })
-
-  describe('#getNftGroup', () => {
-    it('should throw 400 if tokenID is empty', async () => {
-      req.params.tokenId = ''
-      const result = await slpRoute.getNftGroup(req, res)
-      // console.log(`result: ${util.inspect(result)}`)
-
-      assert.hasAllKeys(result, ['error'])
-      assert.include(result.error, 'tokenId can not be empty')
-    })
-
-    it('returns proper error when downstream service stalls', async () => {
-      // Mock the timeout error.
-      sandbox.stub(slpRoute.axios, 'request').throws({ code: 'ECONNABORTED' })
-
-      req.params.tokenId =
-        '45a30085691d6ea586e3ec2aa9122e9b0e0d6c3c1fd357decccc15d8efde48a9'
-
-      const result = await slpRoute.getNftGroup(req, res)
-      // console.log(`result: ${JSON.stringify(result, null, 2)}`)
-      assert.isAbove(res.statusCode, 499, 'HTTP status code 503 expected.')
-      assert.include(
-        result.error,
-        'Could not communicate with full node',
-        'Error message expected'
-      )
-    })
-
-    it('returns proper error when downstream service is down', async () => {
-      // Mock the timeout error.
-      sandbox.stub(slpRoute.axios, 'request').throws({ code: 'ECONNREFUSED' })
-
-      req.params.tokenId =
-        '45a30085691d6ea586e3ec2aa9122e9b0e0d6c3c1fd357decccc15d8efde48a9'
-
-      const result = await slpRoute.getNftGroup(req, res)
-      // console.log(`result: ${JSON.stringify(result, null, 2)}`)
-
-      assert.isAbove(res.statusCode, 499, 'HTTP status code 503 expected.')
-      assert.include(
-        result.error,
-        'Could not communicate with full node',
-        'Error message expected'
-      )
-    })
-
-    it('should return error on non-existing NFT child token', async () => {
-      if (process.env.TEST === 'unit') {
-        sandbox.stub(slpRoute, 'lookupToken').resolves({ id: 'not found' })
-      }
-
-      req.params.tokenId =
-        '45a30085691d6ea586e3ec2aa9122e9b0e0d6c3c1fd357decccc15d8efde48a8'
-
-      const result = await slpRoute.getNftGroup(req, res)
-      // console.log(`result: ${JSON.stringify(result, null, 2)}`)
-      assert.include(
-        result.error,
-        'NFT child does not exists',
-        'Error message expected'
-      )
-    })
-
-    it('should return error on invalid NFT child token', async () => {
-      if (process.env.TEST === 'unit') {
-        sandbox.stub(slpRoute, 'lookupToken').resolves(mockData.mockNftGroup)
-      }
-
-      req.params.tokenId =
-        '45a30085691d6ea586e3ec2aa9122e9b0e0d6c3c1fd357decccc15d8efde48a8'
-
-      const result = await slpRoute.getNftGroup(req, res)
-      // console.log(`result: ${JSON.stringify(result, null, 2)}`)
-      assert.include(
-        result.error,
-        'NFT child does not exists',
-        'Error message expected'
-      )
-    })
-
-    if (process.env.TEST === 'unit') {
-      it('should return error on invalid parent', async () => {
-        req.params.tokenId =
-          '45a30085691d6ea586e3ec2aa9122e9b0e0d6c3c1fd357decccc15d8efde48a9'
-
-        const callback = sandbox.stub(slpRoute, 'lookupToken')
-        callback
-          .withArgs(req.params.tokenId)
-          .resolves(mockData.mockNftChildren[0])
-        // parent is non-valid NFT group (type != 129)
-        callback
-          .withArgs(mockData.mockNftGroup.id)
-          .resolves(mockData.mockNftChildren[0])
-
-        const result = await slpRoute.getNftGroup(req, res)
-        // console.log(`result: ${JSON.stringify(result, null, 2)}`)
-        assert.include(
-          result.error,
-          'NFT group does not exists',
-          'Error message expected'
-        )
-      })
-    }
-
-    if (process.env.ISBCHN) {
-      it('should get NFT group information for tokenId', async () => {
-        req.params.tokenId =
-          '45a30085691d6ea586e3ec2aa9122e9b0e0d6c3c1fd357decccc15d8efde48a9'
-
-        if (process.env.TEST === 'unit') {
-          const callback = sandbox.stub(slpRoute, 'lookupToken')
-          callback
-            .withArgs(req.params.tokenId)
-            .resolves(mockData.mockNftChildren[0])
-          callback
-            .withArgs(mockData.mockNftGroup.id)
-            .resolves(mockData.mockNftGroup)
-        }
-        const result = await slpRoute.getNftGroup(req, res)
-        // console.log(`result: ${JSON.stringify(result, null, 2)}`)
-        assert.property(result, 'nftGroup')
-        assert.property(result.nftGroup, 'id')
-        assert.equal(result.nftGroup.id, mockData.mockNftGroup.id)
-        assert.property(result.nftGroup, 'versionType')
-        assert.equal(result.nftGroup.versionType, 129)
-        assert.property(result.nftGroup, 'symbol')
-        assert.property(result.nftGroup, 'initialTokenQty')
-      })
-    }
-  })
 })
 
 /*