Merge pull request #7326 from BitGo/ANT-1033-fix

fix: Do not append text to HMAC subject if undefined

Author: bdesoky

modules/sdk-hmac/src/hmac.ts

@@ -57,13 +57,12 @@ export function calculateHMACSubject<T extends string | Buffer = string>({
         ? [method.toUpperCase(), timestamp, '3.0', queryPath].join('|')
         : [timestamp, queryPath].join('|');
   }
-  prefixedText += '|';
 
   const isBuffer = Buffer.isBuffer(text);
   if (isBuffer) {
-    return Buffer.concat([Buffer.from(prefixedText, 'utf-8'), text]) as T;
+    return Buffer.concat([Buffer.from(prefixedText + '|', 'utf-8'), text]) as T;
   }
-  return (prefixedText + text) as T;
+  return [prefixedText, text].join('|') as T;
 }
 
 /**

modules/sdk-hmac/test/hmac.ts

@@ -75,6 +75,20 @@ describe('HMAC Utility Functions', () => {
       ).to.equal(expectedSubject);
     });
 
+    it('should not include undefined for a response when text is undefined', () => {
+      const expectedSubject = 'GET|1672531200000|/api/test|200|';
+      expect(
+        calculateHMACSubject({
+          urlPath: '/api/test',
+          text: undefined as unknown as string,
+          timestamp: MOCK_TIMESTAMP,
+          statusCode: 200,
+          method: 'get',
+          authVersion: 3,
+        })
+      ).to.equal(expectedSubject);
+    });
+
     it('should handle Buffer text input and return a Buffer for requests', () => {
       const buffer = Buffer.from('binary-data-content');
       const result = calculateHMACSubject({
@@ -96,6 +110,22 @@ describe('HMAC Utility Functions', () => {
       expect(result).to.deep.equal(expectedBuffer);
     });
 
+    it('should handle Buffer undefined text input and return a Buffer for requests', () => {
+      const buffer = undefined as unknown as Buffer;
+      const result = calculateHMACSubject({
+        urlPath: '/api/test',
+        text: buffer,
+        timestamp: MOCK_TIMESTAMP,
+        method: 'get',
+        authVersion: 3,
+      });
+
+      expect(Buffer.isBuffer(result)).to.be.false;
+
+      const expectedSubject = 'GET|1672531200000|3.0|/api/test|';
+      expect(result).to.deep.equal(expectedSubject);
+    });
+
     it('should handle Buffer text input and return a Buffer for responses', () => {
       const buffer = Buffer.from('binary-response-data');
       const result = calculateHMACSubject({