Replace deprecated request/request-promise with axios
request has been deprecated since 2020 with an unfixed SSRF advisory and
pins vulnerable copies of form-data (critical), qs, tough-cookie and
uuid - 8 of the 13 remaining production audit findings, none fixable by
version bumps (issue #1634, item 1).
All 36 backend files that imported request-promise now use a small
compatibility wrapper (server/utils/request.ts) backed by axios, which
is already a production dependency. The wrapper accepts the existing
options shape (qs, form - object or pre-encoded string, body,
baseUrl/uri, rejectUnauthorized, json), resolves with the response body
directly, and rejects with a plain object mirroring request-promise's
StatusCodeError/RequestError shape, so CommonService.handleError works
unchanged (ECONNREFUSED -> 503, Eclair StatusCodeError -> 500, nested
error body extraction). Auth headers are excluded from rejected errors
so they cannot leak into logs. Callers without json: true (block
explorer, currency rates) still get raw text bodies, and LND's
line-delimited /v2/router/send stream still surfaces as a string for
the existing parser.
Only behavioral code change: CLN verifyMessage used request-promise's
callback style and was ported to the same promise style as signMessage;
four Eclair handlers gained explicit returns to satisfy
noImplicitReturns once the import became typed.
Production npm audit drops from 13 findings (2 critical) to 6 low, all
in the crypto-browserify/elliptic chain tracked in #1634.
Verified against the docker regtest fixture with 43 API checks across
LND, Core Lightning and Eclair: reads, invoice creation, a routed LND
payment over the streaming endpoint, cross-implementation payments from
CLN and Eclair, message sign/verify, channel backup to disk, and
bad-invoice/node-unreachable error mapping. Lint and both production
builds are clean.
2026-07-19 12:08:05 -07:00
|
|
|
import request from '../../utils/request.js';
|
2021-12-29 18:08:41 -05:00
|
|
|
import { Logger, LoggerService } from '../../utils/logger.js';
|
|
|
|
|
import { Common, CommonService } from '../../utils/common.js';
|
2024-06-10 12:40:37 -07:00
|
|
|
import { SelectedNode } from '../../models/config.model.js';
|
2023-12-05 20:32:05 -08:00
|
|
|
|
2021-12-29 18:08:41 -05:00
|
|
|
let options = null;
|
|
|
|
|
const logger: LoggerService = Logger;
|
|
|
|
|
const common: CommonService = Common;
|
2026-07-17 21:56:15 -07:00
|
|
|
// Alias cache: peerId -> { alias, ts }. Bounded by a TTL so an updated node alias is picked
|
|
|
|
|
// up without an RTL restart, and by a max size so it can't grow unbounded (evicts oldest).
|
|
|
|
|
const ALIAS_CACHE_TTL = 6 * 60 * 60 * 1000; // 6 hours
|
|
|
|
|
const ALIAS_CACHE_MAX = 5000;
|
|
|
|
|
const aliasCache = new Map<string, { alias: string; ts: number }>();
|
2021-12-29 18:08:41 -05:00
|
|
|
|
|
|
|
|
export const getRoute = (req, res, next) => {
|
|
|
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Network', msg: 'Getting Network Routes..' });
|
|
|
|
|
options = common.getOptions(req);
|
|
|
|
|
if (options.error) { return res.status(options.statusCode).json({ message: options.message, error: options.error }); }
|
2024-06-10 12:40:37 -07:00
|
|
|
options.url = req.session.selectedNode.settings.lnServerUrl + '/v1/getroute';
|
2023-12-05 20:32:05 -08:00
|
|
|
options.body = req.body;
|
|
|
|
|
request.post(options).then((body) => {
|
2022-01-16 15:55:50 -05:00
|
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Network', msg: 'Network Routes Received', data: body });
|
2026-07-17 21:56:15 -07:00
|
|
|
// Resolve hop aliases with a bounded number of concurrent listnodes calls, matching the
|
|
|
|
|
// peers/channels paths, so a long route can't storm clnrest (#1501).
|
|
|
|
|
const getRouteAliasesTasks = (body.route || []).map((rt) => () => getAlias(req.session.selectedNode, rt, 'id'));
|
|
|
|
|
common.runWithConcurrencyLimit(getRouteAliasesTasks, 20, () => {
|
2026-07-17 22:50:54 -07:00
|
|
|
// Guard the response-send: the limiter invokes this outside the surrounding .catch.
|
|
|
|
|
try {
|
|
|
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Peers', msg: 'Network Routes with Alias Received', data: body });
|
|
|
|
|
res.status(200).json(body || []);
|
|
|
|
|
} catch (e) {
|
|
|
|
|
const err = common.handleError(e, 'Network', 'Query Routes Error', req.session.selectedNode);
|
|
|
|
|
if (!res.headersSent) { res.status(err.statusCode).json({ message: err.message, error: err.error }); }
|
|
|
|
|
}
|
2023-12-05 20:32:05 -08:00
|
|
|
});
|
2021-12-29 18:08:41 -05:00
|
|
|
}).catch((errRes) => {
|
|
|
|
|
const err = common.handleError(errRes, 'Network', 'Query Routes Error', req.session.selectedNode);
|
|
|
|
|
return res.status(err.statusCode).json({ message: err.message, error: err.error });
|
|
|
|
|
});
|
|
|
|
|
};
|
|
|
|
|
|
2023-12-05 20:32:05 -08:00
|
|
|
export const listChannels = (req, res, next) => {
|
2021-12-29 18:08:41 -05:00
|
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Network', msg: 'Channel Lookup..' });
|
|
|
|
|
options = common.getOptions(req);
|
|
|
|
|
if (options.error) { return res.status(options.statusCode).json({ message: options.message, error: options.error }); }
|
2024-06-10 12:40:37 -07:00
|
|
|
options.url = req.session.selectedNode.settings.lnServerUrl + '/v1/listchannels';
|
2023-12-05 20:32:05 -08:00
|
|
|
options.body = req.body;
|
|
|
|
|
request.post(options).then((body) => {
|
2022-01-16 15:55:50 -05:00
|
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Network', msg: 'Channel Lookup Finished', data: body });
|
2021-12-29 18:08:41 -05:00
|
|
|
res.status(200).json(body);
|
|
|
|
|
}).catch((errRes) => {
|
|
|
|
|
const err = common.handleError(errRes, 'Network', 'Channel Lookup Error', req.session.selectedNode);
|
|
|
|
|
return res.status(err.statusCode).json({ message: err.message, error: err.error });
|
|
|
|
|
});
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
export const feeRates = (req, res, next) => {
|
2024-06-10 12:40:37 -07:00
|
|
|
const { style } = req.body;
|
2021-12-29 18:08:41 -05:00
|
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Network', msg: 'Getting Network Fee Rates..' });
|
|
|
|
|
options = common.getOptions(req);
|
|
|
|
|
if (options.error) { return res.status(options.statusCode).json({ message: options.message, error: options.error }); }
|
2024-06-10 12:40:37 -07:00
|
|
|
options.url = req.session.selectedNode.settings.lnServerUrl + '/v1/feerates';
|
2023-12-05 20:32:05 -08:00
|
|
|
options.body = req.body;
|
|
|
|
|
request.post(options).then((body) => {
|
2024-06-10 12:40:37 -07:00
|
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Network', msg: 'Network Fee Rates Received for ' + style, data: body });
|
2021-12-29 18:08:41 -05:00
|
|
|
res.status(200).json(body);
|
|
|
|
|
}).catch((errRes) => {
|
|
|
|
|
const err = common.handleError(errRes, 'Network', 'Fee Rates Error', req.session.selectedNode);
|
|
|
|
|
return res.status(err.statusCode).json({ message: err.message, error: err.error });
|
|
|
|
|
});
|
|
|
|
|
};
|
2022-05-16 22:53:13 -04:00
|
|
|
|
|
|
|
|
export const listNodes = (req, res, next) => {
|
2024-06-10 12:40:37 -07:00
|
|
|
const filter_liquidity_ads = !!req.body.liquidity_ads;
|
|
|
|
|
delete req.body.liquidity_ads;
|
2022-05-16 22:53:13 -04:00
|
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Network', msg: 'List Nodes..' });
|
|
|
|
|
options = common.getOptions(req);
|
|
|
|
|
if (options.error) { return res.status(options.statusCode).json({ message: options.message, error: options.error }); }
|
2024-06-10 12:40:37 -07:00
|
|
|
options.url = req.session.selectedNode.settings.lnServerUrl + '/v1/listnodes';
|
2023-12-05 20:32:05 -08:00
|
|
|
options.body = req.body;
|
2022-05-19 15:47:41 -04:00
|
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'DEBUG', fileName: 'Network', msg: 'List Nodes URL' + options.url });
|
2023-12-05 20:32:05 -08:00
|
|
|
request.post(options).then((body) => {
|
2022-05-16 22:53:13 -04:00
|
|
|
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Network', msg: 'List Nodes Finished', data: body });
|
2023-12-05 20:32:05 -08:00
|
|
|
let response = body.nodes;
|
|
|
|
|
if (filter_liquidity_ads) {
|
|
|
|
|
response = body.nodes.filter((node) => ((node.option_will_fund) ? node : null));
|
|
|
|
|
}
|
|
|
|
|
res.status(200).json(response);
|
2022-05-16 22:53:13 -04:00
|
|
|
}).catch((errRes) => {
|
|
|
|
|
const err = common.handleError(errRes, 'Network', 'Node Lookup Error', req.session.selectedNode);
|
|
|
|
|
return res.status(err.statusCode).json({ message: err.message, error: err.error });
|
|
|
|
|
});
|
|
|
|
|
};
|
2023-12-05 20:32:05 -08:00
|
|
|
|
2024-06-10 12:40:37 -07:00
|
|
|
export const getAlias = (selNode: SelectedNode, peer: any, id: string) => {
|
2025-09-09 14:48:23 +05:30
|
|
|
const peerId = peer[id];
|
|
|
|
|
if (!peerId) {
|
2023-12-05 20:32:05 -08:00
|
|
|
logger.log({ selectedNode: selNode, level: 'ERROR', fileName: 'Network', msg: 'Empty Peer ID' });
|
|
|
|
|
peer.alias = '';
|
2025-09-09 14:48:23 +05:30
|
|
|
return Promise.resolve(peer);
|
|
|
|
|
}
|
|
|
|
|
|
2026-07-17 21:56:15 -07:00
|
|
|
const cached = aliasCache.get(peerId);
|
|
|
|
|
if (cached && (Date.now() - cached.ts) < ALIAS_CACHE_TTL) {
|
|
|
|
|
peer.alias = cached.alias;
|
2025-09-09 14:48:23 +05:30
|
|
|
return Promise.resolve(peer);
|
2023-12-05 20:32:05 -08:00
|
|
|
}
|
2025-09-09 14:48:23 +05:30
|
|
|
|
2026-07-17 22:21:38 -07:00
|
|
|
// Build a self-contained request from the selected node's own auth options rather than the
|
|
|
|
|
// shared module-level 'options', which is only set by a prior network.ts endpoint call. That
|
|
|
|
|
// coupling meant a cold Peers/route lookup (no prior network call) dereferenced a null 'options'
|
|
|
|
|
// and threw; now that the limiter swallows per-task throws, that surfaced as a 200 with every
|
|
|
|
|
// alias unset (#1501 review F1). selNode.authentication.options is guaranteed present here
|
|
|
|
|
// because every caller runs getOptions() first.
|
|
|
|
|
const nodeOptions = selNode.authentication?.options;
|
|
|
|
|
if (!nodeOptions || !nodeOptions.headers) {
|
|
|
|
|
peer.alias = peerId.substring(0, 20);
|
|
|
|
|
return Promise.resolve(peer);
|
|
|
|
|
}
|
|
|
|
|
const aliasOptions = { ...nodeOptions, method: 'POST', url: selNode.settings.lnServerUrl + '/v1/listnodes', body: { id: peerId }, json: true, qs: {} };
|
|
|
|
|
delete aliasOptions.form;
|
2025-09-09 14:48:23 +05:30
|
|
|
|
2026-07-17 22:21:38 -07:00
|
|
|
return request.post(aliasOptions).then((body) => {
|
2023-12-05 20:32:05 -08:00
|
|
|
logger.log({ selectedNode: selNode, level: 'DEBUG', fileName: 'Network', msg: 'Peer Alias Finished', data: body });
|
2025-09-09 14:48:23 +05:30
|
|
|
const alias = body.nodes?.[0]?.alias || peerId.substring(0, 20);
|
2026-07-17 21:56:15 -07:00
|
|
|
// Re-insert so a refreshed entry moves to the most-recent position, then evict the
|
|
|
|
|
// oldest if we're over the cap (Map preserves insertion order).
|
|
|
|
|
aliasCache.delete(peerId);
|
|
|
|
|
aliasCache.set(peerId, { alias, ts: Date.now() });
|
|
|
|
|
if (aliasCache.size > ALIAS_CACHE_MAX) { aliasCache.delete(aliasCache.keys().next().value); }
|
2025-09-09 14:48:23 +05:30
|
|
|
peer.alias = alias;
|
2023-12-05 20:32:05 -08:00
|
|
|
return peer;
|
|
|
|
|
}).catch((errRes) => {
|
|
|
|
|
common.handleError(errRes, 'Network', 'Peer Alias Error', selNode);
|
2025-09-09 14:48:23 +05:30
|
|
|
const alias = peerId.substring(0, 20);
|
|
|
|
|
peer.alias = alias;
|
2023-12-05 20:32:05 -08:00
|
|
|
return peer;
|
|
|
|
|
});
|
|
|
|
|
};
|