8171773380

Committed 06 Mar 2024 12:07PM UTC coverage: 93.172% (+0.01%) from 93.159%

Build # 8171773380

Build Type

push

github

Committed by

web-flow

Commit Message

Guard adding/removing recovery contracts (#1247)

This adds guards to the following routes for addding/removing recovery contracts from Tenderly:

### `POST` `/v1/chains/:chainId/safes/:safeAddress/recovery`

A signature is required in order to successfully add a recovery contract. The following message need be signed (where ${} represents placeholder values for the respective data):

`enable-recovery-alerts-${chainId}-${safeAddress}-${moduleAddress}-${signer}-${timestamp}`

 To use this guard, the route should have:

- the `chainId` as part of the path parameters
- the `safeAddress` as part of the path parameters
- the `moduleAddress` as part of the JSON body (top level - unchanged)
- the `signer` as part of the JSON body (top level - new)
- the `Safe-Wallet-Signature` header set to the signature
- the `Safe-Wallet-Signature-Timestamp` header set to the signature timestamp

On top of this, the 'Safe-Wallet-Signature-Timestamp' need be within the past 5 minutes and the 'signer' an owner of the Safe.

### `DELETE` `chains/:chainId/safes/:safeAddress/recovery/:moduleAddress`

A signature is required in order to successfully remove a recovery contract. The following message need be signed (where ${} represents placeholder values for the respective data):

`enable-recovery-alerts-${chainId}-${safeAddress}-${moduleAddress}-${signer}-${timestamp}`

 To use this guard, the route should have:

- the `chainId` as part of the path parameters
- the `safeAddress` as part of the path parameters
- the `moduleAddress` as part of the JSON body (top level - unchanged)
- the `signer` as part of the JSON body (top level - new)
- the `Safe-Wallet-Signature` header set to the signature
- the `Safe-Wallet-Signature-Timestamp` header set to the signature timestamp

On top of this, the 'Safe-Wallet-Signature-Timestamp' need be within the past 5 minutes and the 'signer' an owner of the Safe.

Run Details

1742 of 2110 branches covered (82.56%)

Branch coverage included in aggregate %.

41 of 45 new or added lines in 4 files covered. (91.11%)

1 existing line in 1 file now uncovered.

6445 of 6677 relevant lines covered (96.53%)

346.43 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

92.86

/src/routes/recovery/guards/enable-recovery-alerts.guard.ts

import {
  CanActivate,
  ExecutionContext,
  Inject,
  Injectable,
} from '@nestjs/common';
import { ILoggingService, LoggingService } from '@/logging/logging.interface';
import { verifyMessage } from 'viem';

/**
 * The EnableRecoveryAlertsGuard guard should be used on routes that require
 * authenticated actions for enabling recovery alerts.
 *
 * This guard therefore validates if the message came from the specified signer.
 *
 * The following message should be signed:
 * enable-recovery-alerts-${chainId}-${safeAddress}-${moduleAddress}-${signer}-${timestamp}
 *
 * (where ${} represents placeholder values for the respective data)
 *
 * To use this guard, the route should have:
 * - the 'chainId' as part of the path parameters
 * - the 'safeAddress' as part of the path parameters
 * - the 'moduleAddress' as part of the JSON body (top level)
 * - the 'signer' as part of the JSON body (top level)
 * - the 'Safe-Wallet-Signature' header set to the signature
 * - the 'Safe-Wallet-Signature-Timestamp' header set to the signature timestamp
 */
@Injectable()
export class EnableRecoveryAlertsGuard implements CanActivate {
  constructor(
    @Inject(LoggingService) private readonly loggingService: ILoggingService,
  ) {}

  private static readonly ACTION_PREFIX = 'enable-recovery-alerts';

  async canActivate(context: ExecutionContext): Promise<boolean> {
    const request = context.switchToHttp().getRequest();

    const chainId = request.params['chainId'];
    const safeAddress = request.params['safeAddress'];
    const moduleAddress = request.body['moduleAddress'];
    const signer = request.body['signer'];
    const signature = request.headers['safe-wallet-signature'];
    const timestamp = request.headers['safe-wallet-signature-timestamp'];

    // Required fields
    if (
      !chainId ||
      !safeAddress ||
      !moduleAddress ||
      !signer ||
      !signature ||
      !timestamp
    )
      return false;

    const message = `${EnableRecoveryAlertsGuard.ACTION_PREFIX}-${chainId}-${safeAddress}-${moduleAddress}-${signer}-${timestamp}`;

    try {
      return await verifyMessage({
        address: signer,
        message,
        signature,
      });
    } catch (e) {
      this.loggingService.debug(e);
      return false;
    }
  }
}

1	import {	84✔
2	CanActivate,
3	ExecutionContext,
4	Inject,
5	Injectable,
6	} from '@nestjs/common';
7	import { ILoggingService, LoggingService } from '@/logging/logging.interface';	84✔
8	import { verifyMessage } from 'viem';	84✔
9
10	/**
11	* The EnableRecoveryAlertsGuard guard should be used on routes that require
12	* authenticated actions for enabling recovery alerts.
13	*
14	* This guard therefore validates if the message came from the specified signer.
15	*
16	* The following message should be signed:
17	* enable-recovery-alerts-${chainId}-${safeAddress}-${moduleAddress}-${signer}-${timestamp}
18	*
19	* (where ${} represents placeholder values for the respective data)
20	*
21	* To use this guard, the route should have:
22	* - the 'chainId' as part of the path parameters
23	* - the 'safeAddress' as part of the path parameters
24	* - the 'moduleAddress' as part of the JSON body (top level)
25	* - the 'signer' as part of the JSON body (top level)
26	* - the 'Safe-Wallet-Signature' header set to the signature
27	* - the 'Safe-Wallet-Signature-Timestamp' header set to the signature timestamp
28	*/
29	@Injectable()
30	export class EnableRecoveryAlertsGuard implements CanActivate {	84✔
31	constructor(
32	@Inject(LoggingService) private readonly loggingService: ILoggingService,	1,056✔
33	) {}
34
35	private static readonly ACTION_PREFIX = 'enable-recovery-alerts';	84✔
36
37	async canActivate(context: ExecutionContext): Promise<boolean> {
38	const request = context.switchToHttp().getRequest();	28✔
39
40	const chainId = request.params['chainId'];	28✔
41	const safeAddress = request.params['safeAddress'];	28✔
42	const moduleAddress = request.body['moduleAddress'];	28✔
43	const signer = request.body['signer'];	28✔
44	const signature = request.headers['safe-wallet-signature'];	28✔
45	const timestamp = request.headers['safe-wallet-signature-timestamp'];	28✔
46
47	// Required fields
48	if (	28✔
49	!chainId \|\|	69✔
50	!safeAddress \|\|
51	!moduleAddress \|\|
52	!signer \|\|
53	!signature \|\|
54	!timestamp
55	)
56	return false;	12✔
57
58	const message = `${EnableRecoveryAlertsGuard.ACTION_PREFIX}-${chainId}-${safeAddress}-${moduleAddress}-${signer}-${timestamp}`;	16✔
59
60	try {	16✔
61	return await verifyMessage({	16✔
62	address: signer,
63	message,
64	signature,
65	});
66	} catch (e) {
NEW 67	this.loggingService.debug(e);	×
NEW 68	return false;	×
69	}
70	}
71	}

safe-global / safe-client-gateway / 8171773380

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous