8231497247

Committed 11 Mar 2024 10:45AM UTC coverage: 93.439% (-0.01%) from 93.452%

Build # 8231497247

Build Type

Pull #1267

github

Committed by

iamacook

Commit Message

Merge `try/catch` blocks

Pull Request Pull Request #1267: Only allow enabling/disabling recovery alerts for modules of given Safe

Run Details

1757 of 2114 branches covered (83.11%)

Branch coverage included in aggregate %.

15 of 17 new or added lines in 2 files covered. (88.24%)

1 existing line in 1 file now uncovered.

6475 of 6696 relevant lines covered (96.7%)

347.35 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

88.57

/src/routes/recovery/guards/enable-recovery-alerts.guard.ts

import {
  CanActivate,
  ExecutionContext,
  Inject,
  Injectable,
} from '@nestjs/common';
import { ILoggingService, LoggingService } from '@/logging/logging.interface';
import { getAddress, verifyMessage } from 'viem';
import { ISafeRepository } from '@/domain/safe/safe.repository.interface';

/**
 * The EnableRecoveryAlertsGuard guard should be used on routes that require
 * authenticated actions for enabling recovery alerts.
 *
 * This guard therefore validates if the message came from the specified signer.
 *
 * The following message should be signed:
 * enable-recovery-alerts-${chainId}-${safeAddress}-${moduleAddress}-${signer}-${timestamp}
 *
 * (where ${} represents placeholder values for the respective data)
 *
 * To use this guard, the route should have:
 * - the 'chainId' as part of the path parameters
 * - the 'safeAddress' as part of the path parameters
 * - the 'moduleAddress' as part of the JSON body (top level)
 * - the 'signer' as part of the JSON body (top level)
 * - the 'Safe-Wallet-Signature' header set to the signature
 * - the 'Safe-Wallet-Signature-Timestamp' header set to the signature timestamp
 */
@Injectable()
export class EnableRecoveryAlertsGuard implements CanActivate {
  constructor(
    @Inject(ISafeRepository) private readonly safeRepository: ISafeRepository,
    @Inject(LoggingService) private readonly loggingService: ILoggingService,
  ) {}

  private static readonly ACTION_PREFIX = 'enable-recovery-alerts';

  async canActivate(context: ExecutionContext): Promise<boolean> {
    const request = context.switchToHttp().getRequest();

    const chainId = request.params['chainId'];
    const safeAddress = request.params['safeAddress'];
    const moduleAddress = request.body['moduleAddress'];
    const signer = request.body['signer'];
    const signature = request.headers['safe-wallet-signature'];
    const timestamp = request.headers['safe-wallet-signature-timestamp'];

    // Required fields
    if (
      !chainId ||
      !safeAddress ||
      !moduleAddress ||
      !signer ||
      !signature ||
      !timestamp
    )
      return false;

    const message = `${EnableRecoveryAlertsGuard.ACTION_PREFIX}-${chainId}-${safeAddress}-${moduleAddress}-${signer}-${timestamp}`;

    try {
      await verifyMessage({
        address: signer,
        message,
        signature,
      });
    } catch (e) {
      this.loggingService.debug(e);
      return false;
    }

    try {
      const { safes } = await this.safeRepository.getSafesByModule({
        chainId,
        moduleAddress,
      });

      return safes.some((safe) => getAddress(safe) === getAddress(safeAddress));
    } catch (e) {
      this.loggingService.debug(e);
      return false;
    }
  }
}

1	import {	86✔
2	CanActivate,
3	ExecutionContext,
4	Inject,
5	Injectable,
6	} from '@nestjs/common';
7	import { ILoggingService, LoggingService } from '@/logging/logging.interface';	86✔
8	import { getAddress, verifyMessage } from 'viem';	86✔
9	import { ISafeRepository } from '@/domain/safe/safe.repository.interface';	86✔
10
11	/**
12	* The EnableRecoveryAlertsGuard guard should be used on routes that require
13	* authenticated actions for enabling recovery alerts.
14	*
15	* This guard therefore validates if the message came from the specified signer.
16	*
17	* The following message should be signed:
18	* enable-recovery-alerts-${chainId}-${safeAddress}-${moduleAddress}-${signer}-${timestamp}
19	*
20	* (where ${} represents placeholder values for the respective data)
21	*
22	* To use this guard, the route should have:
23	* - the 'chainId' as part of the path parameters
24	* - the 'safeAddress' as part of the path parameters
25	* - the 'moduleAddress' as part of the JSON body (top level)
26	* - the 'signer' as part of the JSON body (top level)
27	* - the 'Safe-Wallet-Signature' header set to the signature
28	* - the 'Safe-Wallet-Signature-Timestamp' header set to the signature timestamp
29	*/
30	@Injectable()
31	export class EnableRecoveryAlertsGuard implements CanActivate {	86✔
32	constructor(
33	@Inject(ISafeRepository) private readonly safeRepository: ISafeRepository,	1,070✔
34	@Inject(LoggingService) private readonly loggingService: ILoggingService,	1,070✔
35	) {}
36
37	private static readonly ACTION_PREFIX = 'enable-recovery-alerts';	86✔
38
39	async canActivate(context: ExecutionContext): Promise<boolean> {
40	const request = context.switchToHttp().getRequest();	32✔
41
42	const chainId = request.params['chainId'];	32✔
43	const safeAddress = request.params['safeAddress'];	32✔
44	const moduleAddress = request.body['moduleAddress'];	32✔
45	const signer = request.body['signer'];	32✔
46	const signature = request.headers['safe-wallet-signature'];	32✔
47	const timestamp = request.headers['safe-wallet-signature-timestamp'];	32✔
48
49	// Required fields
50	if (	32✔
51	!chainId \|\|	81✔
52	!safeAddress \|\|
53	!moduleAddress \|\|
54	!signer \|\|
55	!signature \|\|
56	!timestamp
57	)
58	return false;	12✔
59
60	const message = `${EnableRecoveryAlertsGuard.ACTION_PREFIX}-${chainId}-${safeAddress}-${moduleAddress}-${signer}-${timestamp}`;	20✔
61
62	try {	20✔
63	await verifyMessage({	20✔
64	address: signer,
65	message,
66	signature,
67	});
68	} catch (e) {
69	this.loggingService.debug(e);	×
70	return false;	×
71	}
72
73	try {	20✔
74	const { safes } = await this.safeRepository.getSafesByModule({	20✔
75	chainId,
76	moduleAddress,
77	});
78
79	return safes.some((safe) => getAddress(safe) === getAddress(safeAddress));	20✔
80	} catch (e) {
NEW 81	this.loggingService.debug(e);	×
NEW UNCOV 82	return false;	×
83	}
84	}
85	}

safe-global / safe-client-gateway / 8231497247

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous