fix: keep proxied RPC requests bounded and surface upstream failures

Author: Romsters

packages/api/src/rpc/rpc.controller.spec.ts

@@ -30,6 +30,7 @@ describe("RpcController", () => {
   it("forwards the request with the session token and returns the response", async () => {
     fetchSpy.mockResolvedValueOnce({
       status: 200,
+      ok: true,
       json: () => Promise.resolve({ jsonrpc: "2.0", id: 1, result: "0x1" }),
     });
 
@@ -50,8 +51,24 @@ describe("RpcController", () => {
   });
 
   it("throws when the permissions API rejects the token", async () => {
-    fetchSpy.mockResolvedValueOnce({ status: 401, json: () => Promise.resolve({}) });
+    fetchSpy.mockResolvedValueOnce({ status: 401, ok: false, json: () => Promise.resolve({}) });
 
     await expect(controller.proxy(body, user)).rejects.toThrowError(PrividiumApiError);
   });
+
+  it("throws a bad gateway when the permissions API fails", async () => {
+    fetchSpy.mockResolvedValueOnce({ status: 500, ok: false, json: () => Promise.resolve({}) });
+
+    await expect(controller.proxy(body, user)).rejects.toThrowError(expect.objectContaining({ status: 502 }) as Error);
+  });
+
+  it("throws a bad gateway when the response is not JSON", async () => {
+    fetchSpy.mockResolvedValueOnce({
+      status: 200,
+      ok: true,
+      json: () => Promise.reject(new SyntaxError("Unexpected token < in JSON")),
+    });
+
+    await expect(controller.proxy(body, user)).rejects.toThrowError(expect.objectContaining({ status: 502 }) as Error);
+  });
 });

packages/api/src/rpc/rpc.controller.ts

@@ -36,6 +36,16 @@ export class RpcController {
       throw new PrividiumApiError("Invalid or expired token", 401);
     }
 
-    return response.json();
+    // A JSON-RPC error is carried in a 2xx body, so any other status is a transport failure.
+    // Without this an upstream 5xx is returned to the app as a 200 with a body ethers cannot parse.
+    if (!response.ok) {
+      throw new PrividiumApiError("Invalid response from permissions API", 502);
+    }
+
+    try {
+      return await response.json();
+    } catch {
+      throw new PrividiumApiError("Invalid response from permissions API", 502);
+    }
   }
 }

packages/app/src/composables/useContext.ts

@@ -1,7 +1,7 @@
 import { computed, type ComputedRef, type Ref, ref, watch } from "vue";
 
 import { useStorage } from "@vueuse/core";
-import { FetchRequest, JsonRpcProvider } from "ethers";
+import { FetchRequest, JsonRpcProvider, makeError } from "ethers";
 
 import useEnvironmentConfig from "./useEnvironmentConfig";
 import { DEFAULT_NETWORK } from "./useRuntimeConfig";
@@ -41,13 +41,35 @@ function getRpcRequest(network: NetworkConfig) {
   }
 
   const request = new FetchRequest(`${network.apiUrl}/rpc`);
-  request.getUrlFunc = async (req) => {
-    const response = await fetch(req.url, {
-      method: req.method,
-      headers: req.headers,
-      body: req.body,
-      credentials: "include",
+  // Overriding getUrlFunc replaces ethers' own fetch, which arms `req.timeout` and forwards
+  // cancellation, so both are reproduced here to keep requests bounded and abortable.
+  request.getUrlFunc = async (req, signal) => {
+    const controller = new AbortController();
+    let abortError: Error | null = null;
+    const timer = setTimeout(() => {
+      abortError = makeError("request timeout", "TIMEOUT");
+      controller.abort();
+    }, req.timeout);
+    signal?.addListener(() => {
+      abortError = makeError("request cancelled", "CANCELLED");
+      controller.abort();
     });
+
+    let response: Response;
+    try {
+      response = await fetch(req.url, {
+        method: req.method,
+        headers: req.headers,
+        body: req.body,
+        credentials: "include",
+        signal: controller.signal,
+      });
+    } catch (error) {
+      throw abortError ?? error;
+    } finally {
+      clearTimeout(timer);
+    }
+
     const headers: Record<string, string> = {};
     response.headers.forEach((value, key) => {
       headers[key.toLowerCase()] = value;

packages/app/tests/composables/useContext.spec.ts

@@ -124,5 +124,42 @@ describe("useContext:", () => {
       expect(context.getL2Provider()._getConnection().url).toBe("https://api.example.com/rpc");
       restore();
     });
+
+    it("sends session credentials and an abort signal on a Prividium network", async () => {
+      const { context, restore } = buildContext(PRIVIDIUM_NETWORK);
+      const fetchMock = vi.spyOn(global, "fetch").mockResolvedValue({
+        status: 200,
+        statusText: "OK",
+        headers: new Headers(),
+        arrayBuffer: () => Promise.resolve(new ArrayBuffer(0)),
+      } as unknown as Response);
+
+      const request = context.getL2Provider()._getConnection();
+      await request.getUrlFunc(request);
+
+      expect(fetchMock).toBeCalledWith(
+        "https://api.example.com/rpc",
+        expect.objectContaining({ credentials: "include", signal: expect.any(AbortSignal) })
+      );
+      fetchMock.mockRestore();
+      restore();
+    });
+
+    it("aborts a Prividium request that exceeds the request timeout", async () => {
+      const { context, restore } = buildContext(PRIVIDIUM_NETWORK);
+      const fetchMock = vi.spyOn(global, "fetch").mockImplementation(
+        (_url, init) =>
+          new Promise((_resolve, reject) => {
+            (init as RequestInit).signal?.addEventListener("abort", () => reject(new Error("aborted")));
+          })
+      );
+
+      const request = context.getL2Provider()._getConnection();
+      request.timeout = 1;
+
+      await expect(request.getUrlFunc(request)).rejects.toThrowError(/timeout/);
+      fetchMock.mockRestore();
+      restore();
+    });
   });
 });