Merge pull request #18 from Permissionless-Software-Foundation/ct-unstable

fix(auth token): Passing auth token to internal bch-js

.env-example

@@ -25,6 +25,7 @@ PORT=5942
 X402_ENABLED=true
 SERVER_BCH_ADDRESS=bitcoincash:qqlrzp23w08434twmvr4fxw672whkjy0py26r63g3d
 FACILITATOR_URL=http://localhost:4345/facilitator
+X402_PRICE_SAT=200
 
 # Basic Authentication required to access this API?
 USE_BASIC_AUTH=true

README.md

@@ -8,7 +8,7 @@ This is a REST API for communicating with Bitcoin Cash infrastructure. It replac
 
 ## x402-bch Payments
 
-All REST endpoints exposed under the `/v6` prefix are protected by the [`x402-bch-express`](https://www.npmjs.com/package/x402-bch-express) middleware. Each API call requires a BCH payment authorization for **2000 satoshis**. The middleware advertises payment requirements via HTTP 402 responses and validates incoming `X-PAYMENT` headers with a configured Facilitator.
+All REST endpoints exposed under the `/v6` prefix are protected by the [`x402-bch-express`](https://www.npmjs.com/package/x402-bch-express) middleware. Each API call requires a BCH payment authorization for **200 satoshis**. The middleware advertises payment requirements via HTTP 402 responses and validates incoming `X-PAYMENT` headers with a configured Facilitator.
 
 ### Configuration
 
@@ -17,7 +17,7 @@ Environment variables control the payment flow:
 - `X402_ENABLED` — set to `false` (case-insensitive) to disable the middleware. Defaults to enabled.
 - `SERVER_BCH_ADDRESS` — BCH cash address that receives funding transactions. Defaults to `bitcoincash:qqlrzp23w08434twmvr4fxw672whkjy0py26r63g3d`.
 - `FACILITATOR_URL` — Root URL of the facilitator service (e.g., `http://localhost:4345/facilitator`).
-- `X402_PRICE_SAT` — Optional; override the satoshi price per call (defaults to `2000`).
+- `X402_PRICE_SAT` — Optional; override the satoshi price per call (defaults to `200`).
 
 When `X402_ENABLED=false`, the server continues to operate without payment headers for local development or trusted deployments.
 

bin/server.js

@@ -74,6 +74,19 @@ class Server {
         allowedHeaders: ['Content-Type', 'Authorization', 'X-Requested-With']
       }))
 
+      // URL normalization middleware - collapse multiple slashes
+      app.use((req, res, next) => {
+        if (req.url && req.url.includes('//')) {
+          // Split URL into path and query string
+          const [path, queryString] = req.url.split('?')
+          // Collapse multiple consecutive slashes into a single slash
+          const normalizedPath = path.replace(/\/+/g, '/')
+          // Reconstruct req.url with normalized path (req.path is read-only and will auto-update)
+          req.url = queryString ? `${normalizedPath}?${queryString}` : normalizedPath
+        }
+        next()
+      })
+
       // Apply basic auth middleware if enabled
       // This must run before x402 middleware to set req.locals.basicAuthValid
       if (basicAuthSettings.enabled) {
@@ -83,8 +96,10 @@ class Server {
 
       // Apply x402 middleware based on configuration
       // Logic:
-      // - If X402_ENABLED=false OR USE_BASIC_AUTH=false: Don't apply x402 (no rate limits)
       // - If X402_ENABLED=true AND USE_BASIC_AUTH=true: Apply x402 conditionally (bypass if basic auth valid)
+      // - If X402_ENABLED=true AND USE_BASIC_AUTH=false: Apply x402 unconditionally (no basic auth bypass)
+      // - If X402_ENABLED=false AND USE_BASIC_AUTH=true: Require basic auth only
+      // - If X402_ENABLED=false AND USE_BASIC_AUTH=false: No access control
 
       // Apply access control middleware based on configuration
       if (x402Settings.enabled && basicAuthSettings.enabled) {
@@ -112,6 +127,21 @@ class Server {
         }
 
         app.use(conditionalX402Middleware)
+      } else if (x402Settings.enabled && !basicAuthSettings.enabled) {
+        // X402_ENABLED=true AND USE_BASIC_AUTH=false: Apply x402 unconditionally (no basic auth bypass)
+        const routes = buildX402Routes(this.config.apiPrefix)
+        const facilitatorOptions = x402Settings.facilitatorUrl
+          ? { url: x402Settings.facilitatorUrl }
+          : undefined
+
+        wlogger.info(`x402 middleware enabled (basic auth disabled); enforcing ${x402Settings.priceSat} satoshis per request`)
+
+        // Apply x402 middleware unconditionally - no basic auth bypass
+        app.use(x402PaymentMiddleware(
+          x402Settings.serverAddress,
+          routes,
+          facilitatorOptions
+        ))
       } else if (basicAuthSettings.enabled && !x402Settings.enabled) {
         // USE_BASIC_AUTH=true AND X402_ENABLED=false: Require basic auth, reject unauthenticated requests
         wlogger.info('Basic auth enforcement enabled (x402 disabled)')
@@ -144,7 +174,7 @@ class Server {
 
       // Endpoint logging middleware
       app.use((req, res, next) => {
-        console.log(`Endpoint called: ${req.method} ${req.path}`)
+        console.log(`Endpoint called: ${req.method} ${req.path} by ${req.ip}`)
         res.on('finish', () => {
           console.log(`Endpoint responded: ${req.method} ${req.path} - ${res.statusCode}`)
         })

package.json

@@ -15,17 +15,17 @@
   "license": "MIT",
   "description": "REST API proxy to Bitcoin Cash infrastructure",
   "dependencies": {
-    "@psf/bch-js": "7.1.0",
+    "@psf/bch-js": "7.1.11",
     "axios": "1.7.7",
     "cors": "2.8.5",
     "dotenv": "16.3.1",
     "express": "5.1.0",
-    "minimal-slp-wallet": "7.0.1",
+    "minimal-slp-wallet": "7.1.4",
     "psffpp": "1.2.1",
     "slp-token-media": "1.2.10",
     "winston": "3.11.0",
     "winston-daily-rotate-file": "4.7.1",
-    "x402-bch-express": "1.1.1"
+    "x402-bch-express": "2.0.0"
   },
   "devDependencies": {
     "apidoc": "1.2.0",

production/docker/.env-example

@@ -9,10 +9,10 @@ RPC_PASSWORD=password
 FULCRUM_API=http://172.17.0.1:3001/v1
 
 # SLP Indexer
-SLP_INDEXER_API=http://localhost:5010
+SLP_INDEXER_API=http://172.17.0.1:5010
 
 # REST API URL for wallet operations
-LOCAL_RESTURL=http://localhost:5942/v6
+LOCAL_RESTURL=http://172.17.0.1:5942/v6
 
 # END INFRASTRUCTURE SETUP
 
@@ -22,13 +22,16 @@ LOCAL_RESTURL=http://localhost:5942/v6
 PORT=5942
 
 # x402 payments required to access this API?
-X402_ENABLED=true
-SERVER_BCH_ADDRESS=bitcoincash:qqlrzp23w08434twmvr4fxw672whkjy0py26r63g3d
-FACILITATOR_URL=http://localhost:4345/facilitator
+X402_ENABLED=false
+#X402_ENABLED=true
+#SERVER_BCH_ADDRESS=bitcoincash:qqlrzp23w08434twmvr4fxw672whkjy0py26r63g3d
+#FACILITATOR_URL=http://localhost:4345/facilitator
+#X402_PRICE_SAT=200
 
 # Basic Authentication required to access this API?
-USE_BASIC_AUTH=true
-BASIC_AUTH_TOKEN=some-random-token
+USE_BASIC_AUTH=false
+#USE_BASIC_AUTH=true
+#BASIC_AUTH_TOKEN=some-random-token
 
 # END ACCESS CONTROL
 

production/docker/Dockerfile

@@ -51,6 +51,8 @@ RUN git clone https://github.com/Permissionless-Software-Foundation/psf-bch-api
 # and `stage` has the most up-to-date changes.
 WORKDIR /home/safeuser/psf-bch-api
 
+RUN git checkout ct-unstable
+
 # Install dependencies
 RUN npm install
 RUN npm install minimal-slp-wallet
@@ -58,7 +60,7 @@ RUN npm install minimal-slp-wallet
 # Generate the API docs
 RUN npm run docs
 
-COPY .env-local .env
+COPY .env .env
 
 
 CMD ["npm", "start"]

production/docker/start-rest2nostr.sh

@@ -1,3 +0,0 @@
-#!/bin/bash
-
-npm start

production/docker/temp.js

@@ -1,7 +0,0 @@
-// Simple Node.js app that prints 'hello world' every 10 seconds
-
-setInterval(() => {
-  console.log('hello world')
-}, 10000)
-
-console.log('Timer started. Printing "hello world" every 10 seconds...')

src/config/env/common.js

@@ -26,10 +26,10 @@ const normalizeBoolean = (value, defaultValue) => {
   return defaultValue
 }
 
-// By default, the price per API call is 2000 satoshis.
+// By default, the price per API call is 200 satoshis.
 // But the user can override this value by setting the X402_PRICE_SAT environment variable.
 const parsedPriceSat = Number(process.env.X402_PRICE_SAT)
-const priceSat = Number.isFinite(parsedPriceSat) && parsedPriceSat > 0 ? parsedPriceSat : 2000
+const priceSat = Number.isFinite(parsedPriceSat) && parsedPriceSat > 0 ? parsedPriceSat : 200
 
 const x402Defaults = {
   enabled: normalizeBoolean(process.env.X402_ENABLED, true),

src/config/x402.js

@@ -26,7 +26,7 @@ export function buildX402Routes (apiPrefix = '/v6') {
       price: config.x402.priceSat,
       network: NETWORK,
       config: {
-        description: `${DEFAULT_DESCRIPTION} (2000 satoshis)`,
+        description: `${DEFAULT_DESCRIPTION} (${config.x402.priceSat} satoshis)`,
         maxTimeoutSeconds: DEFAULT_TIMEOUT_SECONDS
       }
     }

src/controllers/rest-api/fulcrum/controller.js

@@ -424,7 +424,20 @@ class FulcrumRESTController {
 
       const cashAddr = this._validateAndConvertAddress(address)
 
-      const result = await this.fulcrumUseCases.getTransactions({ address: cashAddr, allTxs })
+      // Extract bearer token from request header if present
+      let bearerToken = null
+      if (req.headers && req.headers.authorization) {
+        const parts = req.headers.authorization.split(' ')
+        if (parts.length === 2 && parts[0] === 'Bearer') {
+          bearerToken = parts[1]
+        }
+      }
+
+      const result = await this.fulcrumUseCases.getTransactions({
+        address: cashAddr,
+        allTxs,
+        bearerToken
+      })
       return res.status(200).json(result)
     } catch (err) {
       return this.handleError(err, res)
@@ -470,9 +483,19 @@ class FulcrumRESTController {
         }
       }
 
+      // Extract bearer token from request header if present
+      let bearerToken = null
+      if (req.headers && req.headers.authorization) {
+        const parts = req.headers.authorization.split(' ')
+        if (parts.length === 2 && parts[0] === 'Bearer') {
+          bearerToken = parts[1]
+        }
+      }
+
       const result = await this.fulcrumUseCases.getTransactionsBulk({
         addresses: validatedAddresses,
-        allTxs
+        allTxs,
+        bearerToken
       })
       return res.status(200).json(result)
     } catch (err) {

src/use-cases/fulcrum-use-cases.js

@@ -6,7 +6,15 @@ import wlogger from '../adapters/wlogger.js'
 import BCHJS from '@psf/bch-js'
 import config from '../config/index.js'
 
-const bchjs = new BCHJS({ restURL: config.restURL })
+// Use RESTURL (from test) or REST_URL (from psf-bch-api config) or fallback to config
+const restURL = process.env.RESTURL || process.env.REST_URL || process.env.LOCAL_RESTURL || config.restURL
+// Use BCHJSBEARERTOKEN (from test) or BASIC_AUTH_TOKEN (from psf-bch-api config) or fallback to config
+const bearerToken = process.env.BCHJSBEARERTOKEN || process.env.BASIC_AUTH_TOKEN || config.basicAuth.token
+
+const bchjs = new BCHJS({
+  restURL,
+  bearerToken
+})
 
 class FulcrumUseCases {
   constructor (localConfig = {}) {
@@ -56,7 +64,7 @@ class FulcrumUseCases {
   async getTransactionDetails ({ txid }) {
     try {
       const response = await this.fulcrum.get(`electrumx/tx/data/${txid}`)
-      console.log(`getTransactionDetails() TXID ${txid}: ${JSON.stringify(response, null, 2)}`)
+      // console.log(`getTransactionDetails() TXID ${txid}: ${JSON.stringify(response, null, 2)}`)
       return response
     } catch (err) {
       wlogger.error('Error in FulcrumUseCases.getTransactionDetails()', err)
@@ -98,13 +106,24 @@ class FulcrumUseCases {
     }
   }
 
-  async getTransactions ({ address, allTxs }) {
+  async getTransactions ({ address, allTxs, bearerToken = null }) {
     try {
       const response = await this.fulcrum.get(`electrumx/transactions/${address}`)
 
       // Sort transactions in descending order, so that newest transactions are first.
       if (response.transactions && Array.isArray(response.transactions)) {
-        response.transactions = await this.bchjs.Electrumx.sortAllTxs(response.transactions, 'DESCENDING')
+        // Use bearer token from request if provided, otherwise use the default bchjs instance
+        let bchjsInstance = this.bchjs
+        if (bearerToken) {
+          // Create a temporary bchjs instance with the bearer token from the request
+          const restURL = process.env.RESTURL || process.env.REST_URL || process.env.LOCAL_RESTURL || config.restURL
+          bchjsInstance = new BCHJS({
+            restURL,
+            bearerToken
+          })
+        }
+
+        response.transactions = await bchjsInstance.Electrumx.sortAllTxs(response.transactions, 'DESCENDING')
 
         if (!allTxs) {
           // Return only the first 100 transactions of the history.
@@ -119,16 +138,27 @@ class FulcrumUseCases {
     }
   }
 
-  async getTransactionsBulk ({ addresses, allTxs }) {
+  async getTransactionsBulk ({ addresses, allTxs, bearerToken = null }) {
     try {
       const response = await this.fulcrum.post('electrumx/transactions/', { addresses })
 
       // Sort transactions in descending order for each address entry.
       if (response.transactions && Array.isArray(response.transactions)) {
+        // Use bearer token from request if provided, otherwise use the default bchjs instance
+        let bchjsInstance = this.bchjs
+        if (bearerToken) {
+          // Create a temporary bchjs instance with the bearer token from the request
+          const restURL = process.env.RESTURL || process.env.REST_URL || process.env.LOCAL_RESTURL || config.restURL
+          bchjsInstance = new BCHJS({
+            restURL,
+            bearerToken
+          })
+        }
+
         for (let i = 0; i < response.transactions.length; i++) {
           const thisEntry = response.transactions[i]
           if (thisEntry.transactions && Array.isArray(thisEntry.transactions)) {
-            thisEntry.transactions = await this.bchjs.Electrumx.sortAllTxs(thisEntry.transactions, 'DESCENDING')
+            thisEntry.transactions = await bchjsInstance.Electrumx.sortAllTxs(thisEntry.transactions, 'DESCENDING')
 
             if (!allTxs && thisEntry.transactions.length > 100) {
               // Extract only the first 100 transactions.

src/use-cases/slp-use-cases.js

@@ -274,7 +274,7 @@ class SlpUseCases {
       // Get transaction data
       console.log('Decoding OP_RETURN for TXID: ', txid)
       const txData = await this.bchjs.Electrumx.txData(txid)
-      console.log(`TXID ${txid}: ${JSON.stringify(txData, null, 2)}`)
+      // console.log(`TXID ${txid}: ${JSON.stringify(txData, null, 2)}`)
       let data = false
 
       // Map the vout of the transaction in search of an OP_RETURN