decentraland / comms-gatekeeper / 23764155057

82%

Build Type

push

github

Committed by web-flow

Commit Message

feat: add token-based moderator authentication (#250)

* feat: add token-based moderator authentication

Add MODERATOR_TOKEN env var as an alternative auth method for moderation
routes. Moderators can now authenticate via Bearer token instead of
wallet signatures, with identity provided via a moderator query parameter.

* fix: pass config to createModeratorComponent in test components

* fix: update integration tests to expect 401 for unsigned moderation requests

With signedFetch set to optional, unsigned requests now pass through to
the moderator middleware which returns 401 instead of signedFetch's 400.

* refactor: parameterize moderator middleware with moderatorRequired option

Replace two separate middlewares with a single configurable
moderatorAuthMiddleware({ moderatorRequired }) factory. Write endpoints
require the moderator query param, read endpoints do not.

* fix: address security review feedback for moderator token auth

- Use timing-safe comparison for token validation to prevent timing attacks
- Sanitize moderator query parameter (alphanumeric, max 100 chars)
- Add audit logging for token-based auth success and failure

Run Details

927 of 1238 branches covered (74.88%)

Branch coverage included in aggregate %.

44 of 44 new or added lines in 4 files covered. (100.0%)

2 existing lines in 1 file now uncovered.

2651 of 3081 relevant lines covered (86.04%)

41.33 hits per line