fix(express): replace sinon stubs with proxyquire for ESM compatibility

Replace sinon.stub() with proxyquire for mocking clientRoutes module imports.
This fixes tests now that we use tsx which runs in ESM mode - ES modules are
immutable and cannot be modified at runtime, preventing sinon from stubbing
them. Proxyquire works by intercepting module resolution at the CommonJS level.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

TICKET: WP-5599

Author: zahin-mohammad

modules/express/src/clientRoutes.ts

@@ -32,8 +32,8 @@ import {
 } from '@bitgo/sdk-core';
 import { BitGo, BitGoOptions, Coin, CustomSigningFunction, SignedTransaction, SignedTransactionRequest } from 'bitgo';
 import * as bodyParser from 'body-parser';
-import * as debugLib from 'debug';
-import * as express from 'express';
+import debugLib from 'debug';
+import express from 'express';
 import type { ParamsDictionary } from 'express-serve-static-core';
 import * as _ from 'lodash';
 import * as url from 'url';

modules/express/src/expressApp.ts

@@ -1,16 +1,16 @@
 /**
  * @prettier
  */
-import * as express from 'express';
+import express from 'express';
 import * as path from 'path';
 import * as _ from 'lodash';
-import * as debugLib from 'debug';
+import debugLib from 'debug';
 import * as https from 'https';
 import * as http from 'http';
-import * as morgan from 'morgan';
+import morgan, { token as morganToken } from 'morgan';
 import * as fs from 'fs';
 import type { Request as StaticRequest } from 'express-serve-static-core';
-import * as timeout from 'connect-timeout';
+import timeout from 'connect-timeout';
 import * as bodyParser from 'body-parser';
 
 import { Config, config } from './config';
@@ -51,7 +51,7 @@ function setupLogging(app: express.Application, config: Config): void {
   }
 
   app.use(middleware);
-  morgan.token('remote-user', function (req: StaticRequest) {
+  morganToken('remote-user', function (req: StaticRequest) {
     return req.isProxy ? 'proxy' : 'local_express';
   });
 }

modules/express/test/unit/bitgoExpress.ts

@@ -1,25 +1,28 @@
-import * as should from 'should';
+import should from 'should';
 import 'should-http';
 import 'should-sinon';
 import '../lib/asserts';
 
-import * as nock from 'nock';
 import * as sinon from 'sinon';
+import * as nock from 'nock';
+import proxyquire from 'proxyquire';
 
-import * as fs from 'fs';
-import * as http from 'http';
-import * as https from 'https';
-import * as debugLib from 'debug';
-import * as path from 'path';
+import debugLib from 'debug';
 import { Environments } from 'bitgo';
 
 import { SSL_OP_NO_TLSv1 } from 'constants';
 import { TlsConfigurationError, NodeEnvironmentError } from '../../src/errors';
 
-nock.disableNetConnect();
-
 import { app as expressApp, startup, createServer, createBaseUri, prepareIpc } from '../../src/expressApp';
-import * as clientRoutes from '../../src/clientRoutes';
+
+// commonJS imports to allow stubbing
+const path = require('path');
+const http = require('http');
+const https = require('https');
+const fs = require('fs');
+
+nock.disableNetConnect();
+proxyquire.noPreserveCache();
 
 describe('Bitgo Express', function () {
   describe('server initialization', function () {
@@ -371,7 +374,7 @@ describe('Bitgo Express', function () {
     });
 
     it('should remove the socket before binding if IPC socket exists and is a socket', async () => {
-      const statStub = sinon.stub(fs, 'statSync').returns({ isSocket: () => true } as unknown as fs.Stats);
+      const statStub = sinon.stub(fs, 'statSync').returns({ isSocket: () => true });
       const unlinkStub = sinon.stub(fs, 'unlinkSync');
       await prepareIpc('testipc').should.be.resolved();
       unlinkStub.calledWithExactly('testipc').should.be.true();
@@ -381,7 +384,7 @@ describe('Bitgo Express', function () {
     });
 
     it('should fail if IPC socket is not actually a socket', async () => {
-      const statStub = sinon.stub(fs, 'statSync').returns({ isSocket: () => false } as unknown as fs.Stats);
+      const statStub = sinon.stub(fs, 'statSync').returns({ isSocket: () => false });
       const unlinkStub = sinon.stub(fs, 'unlinkSync');
       await prepareIpc('testipc').should.be.rejectedWith(/IPC socket is not actually a socket/);
       unlinkStub.notCalled.should.be.true();
@@ -404,58 +407,81 @@ describe('Bitgo Express', function () {
     });
 
     it('should only call setupAPIRoutes when running in regular mode', () => {
+      const setupAPIRoutesStub = sinon.stub();
+      const setupSigningRoutesStub = sinon.stub();
+
+      const { app } = proxyquire('../../src/expressApp', {
+        './clientRoutes': {
+          setupAPIRoutes: setupAPIRoutesStub,
+          setupSigningRoutes: setupSigningRoutesStub,
+          setupLightningSignerNodeRoutes: sinon.stub(),
+        },
+      });
+
       const args: any = {
         env: 'test',
         signerMode: undefined,
       };
 
-      const apiStub = sinon.stub(clientRoutes, 'setupAPIRoutes');
-      const signerStub = sinon.stub(clientRoutes, 'setupSigningRoutes');
-
-      expressApp(args);
-      apiStub.should.have.been.calledOnce();
-      signerStub.called.should.be.false();
-      apiStub.restore();
-      signerStub.restore();
+      app(args);
+      setupAPIRoutesStub.should.have.been.calledOnce();
+      setupSigningRoutesStub.called.should.be.false();
     });
 
     it('should only call setupLightningSignerNodeRoutes when running with lightningSignerFileSystemPath', () => {
+      const setupAPIRoutesStub = sinon.stub();
+      const setupSigningRoutesStub = sinon.stub();
+      const setupLightningSignerNodeRoutesStub = sinon.stub();
+      const { app } = proxyquire('../../src/expressApp', {
+        './clientRoutes': {
+          setupAPIRoutes: setupAPIRoutesStub,
+          setupSigningRoutes: setupSigningRoutesStub,
+          setupLightningSignerNodeRoutes: setupLightningSignerNodeRoutesStub,
+        },
+        fs: {
+          readFileSync: () => {
+            return validLightningSignerConfigJSON;
+          },
+        },
+      });
+
       const args: any = {
         env: 'test',
         lightningSignerFileSystemPath: 'lightningSignerFileSystemPath',
       };
 
-      const readValidStub = sinon.stub(fs, 'readFileSync').returns(validLightningSignerConfigJSON);
-      const lightningSignerStub = sinon.stub(clientRoutes, 'setupLightningSignerNodeRoutes');
-      const apiStub = sinon.stub(clientRoutes, 'setupAPIRoutes');
-      const signerStub = sinon.stub(clientRoutes, 'setupSigningRoutes');
-
-      expressApp(args);
-      lightningSignerStub.should.have.been.calledOnce();
-      apiStub.should.have.been.calledOnce();
-      signerStub.called.should.be.false();
-      apiStub.restore();
-      signerStub.restore();
-      readValidStub.restore();
+      app(args);
+      setupLightningSignerNodeRoutesStub.should.have.been.calledOnce();
+      setupAPIRoutesStub.should.have.been.calledOnce();
+      setupSigningRoutesStub.called.should.be.false();
     });
 
     it('should only call setupSigningRoutes when running in signer mode', () => {
+      const setupAPIRoutesStub = sinon.stub();
+      const setupSigningRoutesStub = sinon.stub();
+
+      const { app } = proxyquire('../../src/expressApp', {
+        './clientRoutes': {
+          setupAPIRoutes: setupAPIRoutesStub,
+          setupSigningRoutes: setupSigningRoutesStub,
+          setupLightningSignerNodeRoutes: sinon.stub(),
+        },
+        fs: {
+          readFileSync: () => {
+            return validPrvJSON;
+          },
+        },
+      });
+
       const args: any = {
         env: 'test',
         signerMode: 'signerMode',
         signerFileSystemPath: 'signerFileSystemPath',
       };
 
-      const apiStub = sinon.stub(clientRoutes, 'setupAPIRoutes');
-      const signerStub = sinon.stub(clientRoutes, 'setupSigningRoutes');
-      const readFileStub = sinon.stub(fs, 'readFileSync').returns(validPrvJSON);
-
-      expressApp(args);
-      signerStub.should.have.been.calledOnce();
-      apiStub.called.should.be.false();
-      apiStub.restore();
-      signerStub.restore();
-      readFileStub.restore();
+      app(args);
+      setupSigningRoutesStub.should.have.been.calledOnce();
+      setupAPIRoutesStub.called.should.be.false();
     });
 
     it('should require a signerFileSystemPath and signerMode are both set when running in signer mode', function () {
@@ -555,7 +581,7 @@ describe('Bitgo Express', function () {
 
     it('should set keepAliveTimeout and headersTimeout if specified in config for HTTP server', async function () {
       const createServerStub = sinon.stub(http, 'createServer').callsFake(() => {
-        return { listen: sinon.stub(), setTimeout: sinon.stub() } as unknown as http.Server;
+        return { listen: sinon.stub(), setTimeout: sinon.stub() };
       });
 
       const args: any = {
@@ -575,7 +601,7 @@ describe('Bitgo Express', function () {
 
     it('should set keepAliveTimeout and headersTimeout if specified in config for HTTPS server', async function () {
       const createServerStub = sinon.stub(https, 'createServer').callsFake(() => {
-        return { listen: sinon.stub(), setTimeout: sinon.stub() } as unknown as https.Server;
+        return { listen: sinon.stub(), setTimeout: sinon.stub() };
       });
 
       const args: any = {
@@ -597,7 +623,7 @@ describe('Bitgo Express', function () {
 
     it('should not set keepAliveTimeout and headersTimeout if not specified in config for HTTP server', async function () {
       const createServerStub = sinon.stub(http, 'createServer').callsFake(() => {
-        return { listen: sinon.stub(), setTimeout: sinon.stub() } as unknown as http.Server;
+        return { listen: sinon.stub(), setTimeout: sinon.stub() };
       });
 
       const args: any = {
@@ -616,7 +642,7 @@ describe('Bitgo Express', function () {
 
     it('should not set keepAliveTimeout and headersTimeout if not specified in config for HTTPS server', async function () {
       const createServerStub = sinon.stub(https, 'createServer').callsFake(() => {
-        return { listen: sinon.stub(), setTimeout: sinon.stub() } as unknown as https.Server;
+        return { listen: sinon.stub(), setTimeout: sinon.stub() };
       });
 
       const args: any = {

modules/express/test/unit/clientRoutes/externalSign.ts

@@ -35,7 +35,7 @@ import {
   MPCv2SignatureShareRound3Input,
 } from '@bitgo/public-types';
 import * as assert from 'assert';
-import * as nock from 'nock';
+import nock from 'nock';
 import * as fs from 'fs';
 import * as express from 'express';
 
@@ -504,7 +504,7 @@ describe('External signer', () => {
     const walletPassphrase = 'testPass';
 
     const [userShare, backupShare, bitgoShare] = await DklsUtils.generateDKGKeyShares();
-    assert(backupShare, 'backupShare is not defined');
+    assert.ok(backupShare, 'backupShare is not defined');
 
     const bgTest = new BitGo({ env: 'test' });
     const userKeyShare = userShare.getKeyShare().toString('base64');
@@ -555,7 +555,7 @@ describe('External signer', () => {
       round1Result.signatureShareRound1,
       round1Result.userGpgPubKey
     );
-    assert(
+    assert.ok(
       txRequestRound1.transactions &&
         txRequestRound1.transactions.length === 1 &&
         txRequestRound1.transactions[0].signatureShares.length === 2,
@@ -589,7 +589,7 @@ describe('External signer', () => {
       round2Result.signatureShareRound2,
       round1Result.userGpgPubKey
     );
-    assert(
+    assert.ok(
       txRequestRound2.transactions &&
         txRequestRound2.transactions.length === 1 &&
         txRequestRound2.transactions[0].signatureShares.length === 4,
@@ -623,7 +623,7 @@ describe('External signer', () => {
     );
 
     // signature generation and validation
-    assert(userMsg4.data.msg4.signatureR === bitgoMsg4.signatureR, 'User and BitGo signaturesR do not match');
+    assert.ok(userMsg4.data.msg4.signatureR === bitgoMsg4.signatureR, 'User and BitGo signaturesR do not match');
 
     const deserializedBitgoMsg4 = DklsTypes.deserializeMessages({
       p2pMessages: [],
@@ -652,8 +652,8 @@ describe('External signer', () => {
       derivationPath,
       createKeccakHash('keccak256') as Hash
     );
-    assert(convertedSignature, 'Signature is not valid');
-    assert(convertedSignature.split(':').length === 4, 'Signature is not valid');
+    assert.ok(convertedSignature, 'Signature is not valid');
+    assert.ok(convertedSignature.split(':').length === 4, 'Signature is not valid');
     readFileStub.restore();
     envStub.restore();
   });
@@ -710,7 +710,7 @@ async function signBitgoMPCv2Round1(
   userShare: SignatureShareRecord,
   userGPGPubKey: string
 ): Promise<TxRequest> {
-  assert(
+  assert.ok(
     txRequest.transactions && txRequest.transactions.length === 1,
     'txRequest.transactions is not an array of length 1'
   );
@@ -772,7 +772,7 @@ async function signBitgoMPCv2Round2(
   userShare: SignatureShareRecord,
   userGPGPubKey: string
 ): Promise<{ txRequest: TxRequest; bitgoMsg4: DklsTypes.SerializedBroadcastMessage }> {
-  assert(
+  assert.ok(
     txRequest.transactions && txRequest.transactions.length === 1,
     'txRequest.transactions is not an array of length 1'
   );

modules/express/test/unit/clientRoutes/lightning/lightningSignerRoutes.ts

@@ -1,7 +1,7 @@
 import { TestBitGo, TestBitGoAPI } from '@bitgo/sdk-test';
 import { BitGo } from 'bitgo';
 import { common } from '@bitgo/sdk-core';
-import * as nock from 'nock';
+import nock from 'nock';
 import * as express from 'express';
 import * as sinon from 'sinon';
 import * as fs from 'fs';