Added explicit tests to verify HTTP timeout protection against DoS attacks.
The 10-second timeout was already configured in FederationModule via
HttpModule.register({ timeout: 10000 }), preventing slowloris and resource
exhaustion attacks.
Changes:
- Added http-timeout.spec.ts with 4 tests verifying timeout configuration
- Verified all federation HTTP requests use configured HttpService
- Documented timeout configuration in scratchpad
- All services (command, query, event, connection, agent) protected
Verification:
- command.service.ts:100 uses httpService.post with timeout
- query.service.ts:100 uses httpService.post with timeout
- event.service.ts:185 uses httpService.post with timeout
- connection.service.ts:76,341 uses httpService with timeout
- federation-agent.service.ts uses httpService with timeout
Impact:
- No security vulnerability - timeout already configured
- Added verification tests to ensure timeout remains in place
- All HTTP requests protected against slowloris DoS attacks
- 4/4 new tests pass
Fixes#282
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Replaced broad try-catch blocks with targeted error handling that only
catches expected business logic errors (CommandProcessingError subclasses).
System errors (OOM, DB failures, network issues) now propagate correctly
for proper debugging and monitoring.
Changes:
- Created CommandProcessingError hierarchy for business logic errors
- UnknownCommandTypeError for invalid command types
- AgentCommandError for orchestrator communication failures
- InvalidCommandPayloadError for payload validation
- Updated command.service.ts to only catch CommandProcessingError
- Updated federation-agent.service.ts to throw appropriate error types
- Added comprehensive tests for both business and system error scenarios
- System errors now include structured logging with context
- All 286 federation tests pass
Impact:
- Debugging is now possible for system failures
- System errors properly trigger monitoring/alerting
- Business logic errors handled gracefully with error responses
- No more masking of critical issues like OOM or DB failures
Fixes#281
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
