feat: code rabbit fixes part1

Author: coodos

infrastructure/eid-wallet/src/routes/(app)/ePassport/+page.svelte

@@ -180,8 +180,8 @@
         }
 
         if (!result.session?.sessionId) {
-            kycError = "Verification did not return a session ID.";
             resetKyc();
+            kycError = "Verification did not return a session ID.";
             return;
         }
 
@@ -219,9 +219,9 @@
             kycStep = "result";
         } catch (err) {
             console.error("[KYC] Failed to fetch decision:", err);
+            resetKyc();
             kycError =
                 "Failed to retrieve verification result. Please try again.";
-            resetKyc();
             setTimeout(() => {
                 kycError = null;
             }, 6000);

infrastructure/evault-core/src/controllers/RecoveryController.ts

@@ -1,6 +1,7 @@
 import { Request, Response } from "express";
 import { default as Axios } from "axios";
 import FormData from "form-data";
+import { validate as uuidValidate } from "uuid";
 import type { VerificationService } from "../services/VerificationService";
 
 const diditClient = Axios.create({ baseURL: "https://verification.didit.me" });
@@ -74,6 +75,11 @@ export class RecoveryController {
             if (!diditSessionId) {
                 return res.status(400).json({ error: "diditSessionId is required" });
             }
+            if (!uuidValidate(diditSessionId)) {
+                return res.status(400).json({
+                    error: "diditSessionId must be a valid UUID",
+                });
+            }
 
             const apiKey = process.env.DIDIT_API_KEY;
             if (!apiKey) {
@@ -87,7 +93,7 @@ export class RecoveryController {
 
             try {
                 const { data: decision } = await diditClient.get(
-                    `/v3/session/${diditSessionId}/decision/`,
+                    `/v3/session/${encodeURIComponent(diditSessionId)}/decision/`,
                     { headers: { "x-api-key": apiKey } },
                 );
 

infrastructure/evault-core/src/controllers/SessionIdValidation.spec.ts

@@ -0,0 +1,101 @@
+import "reflect-metadata";
+import express from "express";
+import { AddressInfo } from "node:net";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { RecoveryController } from "./RecoveryController";
+import { VerificationController } from "./VerificationController";
+
+describe("Session ID validation in controllers", () => {
+    const previousEnv = {
+        PROVISIONER_SHARED_SECRET: process.env.PROVISIONER_SHARED_SECRET,
+        DIDIT_API_KEY: process.env.DIDIT_API_KEY,
+        PUBLIC_EVAULT_SERVER_URI: process.env.PUBLIC_EVAULT_SERVER_URI,
+    };
+
+    beforeAll(() => {
+        process.env.PROVISIONER_SHARED_SECRET = "test-shared-secret";
+        process.env.DIDIT_API_KEY = "test-api-key";
+        process.env.PUBLIC_EVAULT_SERVER_URI = "https://evault.example.com";
+    });
+
+    afterAll(() => {
+        process.env.PROVISIONER_SHARED_SECRET = previousEnv.PROVISIONER_SHARED_SECRET;
+        process.env.DIDIT_API_KEY = previousEnv.DIDIT_API_KEY;
+        process.env.PUBLIC_EVAULT_SERVER_URI = previousEnv.PUBLIC_EVAULT_SERVER_URI;
+    });
+
+    it("rejects invalid diditSessionId in /recovery/face-search", async () => {
+        const app = express();
+        app.use(express.json());
+
+        const verificationServiceStub = {
+            create: async () => ({}),
+            findByIdAndUpdate: async () => null,
+            findOne: async () => null,
+        } as any;
+
+        new RecoveryController(verificationServiceStub).registerRoutes(app);
+
+        const server = app.listen(0);
+        const baseUrl = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
+
+        try {
+            const response = await fetch(`${baseUrl}/recovery/face-search`, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ diditSessionId: "../etc/passwd" }),
+            });
+            const body = await response.json();
+
+            expect(response.status).toBe(400);
+            expect(body.error).toContain("valid UUID");
+        } finally {
+            await new Promise<void>((resolve, reject) => {
+                server.close((error) => {
+                    if (error) reject(error);
+                    else resolve();
+                });
+            });
+        }
+    });
+
+    it("rejects invalid sessionId in /verification/decision/:sessionId", async () => {
+        const app = express();
+        app.use(express.json());
+
+        const verificationServiceStub = {
+            findById: async () => null,
+            findOne: async () => null,
+            create: async () => ({}),
+            findByIdAndUpdate: async () => null,
+        } as any;
+
+        new VerificationController(verificationServiceStub).registerRoutes(app);
+
+        const server = app.listen(0);
+        const baseUrl = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
+
+        try {
+            const response = await fetch(
+                `${baseUrl}/verification/decision/not-a-uuid`,
+                {
+                    method: "GET",
+                    headers: {
+                        "x-shared-secret": "test-shared-secret",
+                    },
+                },
+            );
+            const body = await response.json();
+
+            expect(response.status).toBe(400);
+            expect(body.error).toContain("valid UUID");
+        } finally {
+            await new Promise<void>((resolve, reject) => {
+                server.close((error) => {
+                    if (error) reject(error);
+                    else resolve();
+                });
+            });
+        }
+    });
+});

infrastructure/evault-core/src/controllers/VerificationController.ts

@@ -1,5 +1,6 @@
 import { Request, Response } from "express";
 import { default as Axios } from "axios";
+import { validate as uuidValidate } from "uuid";
 import { VerificationService } from "../services/VerificationService";
 import type { ProvisioningService } from "../services/ProvisioningService";
 
@@ -123,13 +124,18 @@ export class VerificationController {
         app.get("/verification/decision/:sessionId", async (req: Request, res: Response) => {
             if (!requireSharedSecret(req, res)) return;
             const { sessionId } = req.params;
+            if (!uuidValidate(sessionId)) {
+                return res.status(400).json({
+                    error: "sessionId must be a valid UUID",
+                });
+            }
             const apiKey = process.env.DIDIT_API_KEY;
             if (!apiKey) {
                 return res.status(500).json({ error: "DIDIT_API_KEY not configured" });
             }
             try {
                 const { data } = await diditClient.get(
-                    `/v3/session/${sessionId}/decision/`,
+                    `/v3/session/${encodeURIComponent(sessionId)}/decision/`,
                     { headers: { "x-api-key": apiKey } },
                 );
                 return res.json(data);