8647098294

Committed 11 Apr 2024 12:58PM UTC coverage: 93.025% (-0.02%) from 93.044%

Build # 8647098294

Build Type

Pull #1388

github

Committed by

iamacook

Commit Message

Only sign signer address

Pull Request Pull Request #1388: Split auth domain

Run Details

1908 of 2303 branches covered (82.85%)

Branch coverage included in aggregate %.

64 of 66 new or added lines in 8 files covered. (96.97%)

3 existing lines in 1 file now uncovered.

6721 of 6973 relevant lines covered (96.39%)

358.09 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

96.88

/src/domain/siwe/siwe.repository.ts

import { IConfigurationService } from '@/config/configuration.service.interface';
import { CacheRouter } from '@/datasources/cache/cache.router';
import {
  CacheService,
  ICacheService,
} from '@/datasources/cache/cache.service.interface';
import { IAuthApi } from '@/domain/interfaces/auth-api.interface';
import { ISiweRepository } from '@/domain/siwe/siwe.repository.interface';
import { VerifyAuthMessageDto } from '@/routes/auth/entities/verify-auth-message.dto.entity';
import { Inject, Injectable } from '@nestjs/common';

@Injectable()
export class SiweRepository implements ISiweRepository {
  private readonly nonceTtlInSeconds: number;

  constructor(
    @Inject(IAuthApi)
    private readonly authApi: IAuthApi,
    @Inject(IConfigurationService)
    private readonly configurationService: IConfigurationService,
    @Inject(CacheService) private readonly cacheService: ICacheService,
  ) {
    this.nonceTtlInSeconds = this.configurationService.getOrThrow(
      'auth.nonceTtlSeconds',
    );
  }

  /**
   * Generates a unique nonce and stores it in cache for later verification.
   *
   * @returns nonce - unique string to be signed
   */
  async generateNonce(): Promise<{ nonce: string }> {
    const nonce = this.authApi.generateNonce();

    // Store nonce for reference to verify/prevent replay attacks
    const cacheDir = CacheRouter.getAuthNonceCacheDir(nonce);
    await this.cacheService.set(cacheDir, nonce, this.nonceTtlInSeconds);

    return {
      nonce,
    };
  }

  /**
   * Verifies the validity of a signed message:
   *
   * 1. Ensure the message itself has not expired.
   * 2. Ensure the nonce was generated by us/is not a replay attack.
   * 3. Verify the signature of the message.
   *
   * @param args - DTO containing the message and signature to verify.
   *
   * @returns boolean - whether the signed message is valid.
   */
  async isValidMessage(args: VerifyAuthMessageDto): Promise<boolean> {
    const cacheDir = CacheRouter.getAuthNonceCacheDir(args.message.nonce);

    const isExpired =
      !!args.message.expirationTime &&
      new Date(args.message.expirationTime) < new Date();

    try {
      // Verification is not necessary, message has expired
      if (isExpired) {
        return false;
      }

      const [isValidSignature, cachedNonce] = await Promise.all([
        this.authApi.verifyMessage(args),
        this.cacheService.get(cacheDir),
      ]);
      const isValidNonce = cachedNonce === args.message.nonce;

      return isValidSignature && isValidNonce;
    } catch {
      return false;
    } finally {
      await this.cacheService.deleteByKey(cacheDir.key);
    }
  }
}

1	import { IConfigurationService } from '@/config/configuration.service.interface';	94✔
2	import { CacheRouter } from '@/datasources/cache/cache.router';	94✔
3	import {	94✔
4	CacheService,
5	ICacheService,
6	} from '@/datasources/cache/cache.service.interface';
7	import { IAuthApi } from '@/domain/interfaces/auth-api.interface';	94✔
8	import { ISiweRepository } from '@/domain/siwe/siwe.repository.interface';
9	import { VerifyAuthMessageDto } from '@/routes/auth/entities/verify-auth-message.dto.entity';
10	import { Inject, Injectable } from '@nestjs/common';	94✔
11
12	@Injectable()
13	export class SiweRepository implements ISiweRepository {	94✔
14	private readonly nonceTtlInSeconds: number;
15
16	constructor(
17	@Inject(IAuthApi)
18	private readonly authApi: IAuthApi,	1,192✔
19	@Inject(IConfigurationService)
20	private readonly configurationService: IConfigurationService,	1,192✔
21	@Inject(CacheService) private readonly cacheService: ICacheService,	1,192✔
22	) {
23	this.nonceTtlInSeconds = this.configurationService.getOrThrow(	1,192✔
24	'auth.nonceTtlSeconds',
25	);
26	}
27
28	/**
29	* Generates a unique nonce and stores it in cache for later verification.
30	*
31	* @returns nonce - unique string to be signed
32	*/
33	async generateNonce(): Promise<{ nonce: string }> {
34	const nonce = this.authApi.generateNonce();	10✔
35
36	// Store nonce for reference to verify/prevent replay attacks
37	const cacheDir = CacheRouter.getAuthNonceCacheDir(nonce);	10✔
38	await this.cacheService.set(cacheDir, nonce, this.nonceTtlInSeconds);	10✔
39
40	return {	10✔
41	nonce,
42	};
43	}
44
45	/**
46	* Verifies the validity of a signed message:
47	*
48	* 1. Ensure the message itself has not expired.
49	* 2. Ensure the nonce was generated by us/is not a replay attack.
50	* 3. Verify the signature of the message.
51	*
52	* @param args - DTO containing the message and signature to verify.
53	*
54	* @returns boolean - whether the signed message is valid.
55	*/
56	async isValidMessage(args: VerifyAuthMessageDto): Promise<boolean> {
57	const cacheDir = CacheRouter.getAuthNonceCacheDir(args.message.nonce);	10✔
58
59	const isExpired =
60	!!args.message.expirationTime &&	10✔
61	new Date(args.message.expirationTime) < new Date();
62
63	try {	10✔
64	// Verification is not necessary, message has expired
65	if (isExpired) {	10✔
66	return false;	2✔
67	}
68
69	const [isValidSignature, cachedNonce] = await Promise.all([	8✔
70	this.authApi.verifyMessage(args),
71	this.cacheService.get(cacheDir),
72	]);
73	const isValidNonce = cachedNonce === args.message.nonce;	8✔
74
75	return isValidSignature && isValidNonce;	8✔
76	} catch {
NEW 77	return false;	×
78	} finally {
79	await this.cacheService.deleteByKey(cacheDir.key);	10✔
80	}
81	}
82	}

safe-global / safe-client-gateway / 8647098294

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous