Merge pull request #704 from charles-openclaw/fix-auth-challenge-sweep

fix(auth): sweep expired challenges

Author: ogazboiz

backend/src/middleware/auth.ts

@@ -14,6 +14,44 @@ const STELLAR_NETWORK =
 
 // In-memory challenge store: publicKey -> { nonce, expiresAt }
 const challenges = new Map<string, { nonce: string; expiresAt: number }>();
+const DEFAULT_CHALLENGE_SWEEP_INTERVAL_MS = 5 * 60 * 1000;
+let challengeSweepTimer: NodeJS.Timeout | undefined;
+
+function resolveChallengeSweepIntervalMs(): number {
+  const raw = process.env.AUTH_CHALLENGE_SWEEP_INTERVAL_MS;
+  if (!raw) return DEFAULT_CHALLENGE_SWEEP_INTERVAL_MS;
+  const parsed = Number(raw);
+  return Number.isFinite(parsed) && parsed > 0
+    ? parsed
+    : DEFAULT_CHALLENGE_SWEEP_INTERVAL_MS;
+}
+
+export function sweepExpiredChallenges(now = Date.now()): number {
+  let deleted = 0;
+  for (const [publicKey, challenge] of challenges.entries()) {
+    if (challenge.expiresAt < now) {
+      challenges.delete(publicKey);
+      deleted += 1;
+    }
+  }
+  return deleted;
+}
+
+export function startChallengeSweep(intervalMs = resolveChallengeSweepIntervalMs()): void {
+  if (challengeSweepTimer) return;
+  challengeSweepTimer = setInterval(() => {
+    sweepExpiredChallenges();
+  }, intervalMs);
+  challengeSweepTimer.unref?.();
+}
+
+export function stopChallengeSweep(): void {
+  if (!challengeSweepTimer) return;
+  clearInterval(challengeSweepTimer);
+  challengeSweepTimer = undefined;
+}
+
+startChallengeSweep();
 
 // ─── Minimal JWT (no external dep) ──────────────────────────────────────────
 
@@ -62,6 +100,13 @@ export function issueChallenge(req: Request, res: Response): void {
   res.json({ nonce, expiresAt: Date.now() + 60_000 });
 }
 
+export const __authChallengeTestUtils = {
+  challenges,
+  startChallengeSweep,
+  stopChallengeSweep,
+  sweepExpiredChallenges,
+};
+
 export function verifyChallenge(req: Request, res: Response): void {
   const { publicKey, signedTransaction } = req.body as {
     publicKey?: string;

backend/tests/auth.test.ts

@@ -3,6 +3,7 @@ import request from 'supertest';
 import * as crypto from 'crypto';
 import * as StellarSdk from '@stellar/stellar-sdk';
 import app from '../src/app.js';
+import { __authChallengeTestUtils } from '../src/middleware/auth.js';
 
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 
@@ -39,6 +40,7 @@ function buildSignedTransaction(keypair: StellarSdk.Keypair, nonce: string): str
 describe('Authentication & Middleware Tests', () => {
   beforeEach(() => {
     vi.restoreAllMocks();
+    __authChallengeTestUtils.challenges.clear();
   });
 
   describe('POST /v1/auth/challenge', () => {
@@ -56,6 +58,25 @@ describe('Authentication & Middleware Tests', () => {
       expect(res.body).toHaveProperty('expiresAt');
       expect(res.body.expiresAt).toBeGreaterThan(Date.now());
     });
+
+    it('test_challenge_sweep_removes_expired_entries', () => {
+      const expiredKey = makeKeypair().publicKey();
+      const activeKey = makeKeypair().publicKey();
+      const now = Date.now();
+
+      __authChallengeTestUtils.challenges.set(expiredKey, {
+        nonce: crypto.randomBytes(32).toString('hex'),
+        expiresAt: now - 1,
+      });
+      __authChallengeTestUtils.challenges.set(activeKey, {
+        nonce: crypto.randomBytes(32).toString('hex'),
+        expiresAt: now + 60_000,
+      });
+
+      expect(__authChallengeTestUtils.sweepExpiredChallenges(now)).toBe(1);
+      expect(__authChallengeTestUtils.challenges.has(expiredKey)).toBe(false);
+      expect(__authChallengeTestUtils.challenges.has(activeKey)).toBe(true);
+    });
   });
 
   describe('POST /v1/auth/verify', () => {