Extension lists in errors can break the API specification

[bushjames]

Occasionally we have seen errors (returned from ALS) with extension lists that are not API spec compliant due to the "value" properties of an extension being longer than the maximum stated 128 characters (API spec document section 7.3.14). I suggest this library should check for, and possibly truncate invalid strings in both key and value properties.

When these invalid error bodies reach DFSPs they are failing validation.

At this point I have not determined if the ALS or MSISDN oracle are the actual source of the invalid strings but regardless, I think some validation/truncation in this module would be a good idea.

[elnyry-sam-k]

@bushjames just posting a quick response here..

This 'truncation' part is actually configurable and this is being done at the adapter level, so in ALS it can be set to 'true' and the length will be truncated to 128 to conform to the Spec. For example, in ml-api-adapter we see this set to 'true', whereas in central-ledger its set to 'false'.

The thinking at the time was that the information such as debug info, traces, etc can be used within internal services as needed but these will be truncated when its send outside of the Switch. For example here is the config in ml-api-adapter that sets this to false

Please let me know if this is good enough or if you still think additional work is needed

[bushjames]

Thanks for the fast feedback @elnyry. As we are seeing this on ALS errors, would you be comfortable with me changing the default config on ALS to be the same as the ml-api-adapter?

[elnyry-sam-k]

of course, it should be 'true' here as messages are sent out from it (same should apply for quoting-service)

[bushjames]

Many thanks @elnyry . I will get it sorted.

[elnyry-sam-k]

Thanks @bushjames . Just checked and it's set to 'true' here in ALS: https://github.com/mojaloop/account-lookup-service/blob/1244e71f572aad8faf5e91df2baf9efd0ad631f2/config/default.json#L28, so the extension values should be truncated, unless this config is overridden..

However, if you're still seeing this then it could be a bug.

[bushjames]

I will investigate further.