decentraland / lamb2 / 25123804554

83%

main: 83%

Pull #462

github

refactor: validate /crypto/validate-signature body via @dcl/schema-validator-component

drops the in-handler body parsing and shape checks in favor of the
@dcl/schema-validator-component middleware, which is what the wkc
ecosystem standardizes on for http body validation.

wiring:
- new dependency @dcl/schema-validator-component @ ^0.3.1.
- src/types.ts adds schemaValidator: ISchemaValidatorComponent
  <GlobalContext> to BaseComponents.
- src/components.ts instantiates it with createSchemaValidatorComponent
  (no init args; defaults to ensureJsonContentType: true which is what
  we want).
- src/controllers/routes.ts pulls schemaValidator out of GlobalContext
  and chains withSchemaValidatorMiddleware(schema) before
  validateSignatureHandler. setupRouter no longer marks GlobalContext
  unused.

handler:
- export const validateSignatureBodySchema lives next to the handler
  and is the single source of truth for the body contract: object
  with optional string timestamp / signedMessage and required
  authChain (delegating to AuthChain.schema from @dcl/schemas).
- the handler now assumes the body is well-formed and only enforces
  the policy-level length cap (1..10) and the "must have at least
  one of signedMessage / timestamp" semantic that is not expressible
  in json schema.
- the in-handler json.parse try/catch and the parseBody validator
  are gone.

tests:
- unit tests are scoped to handler-only concerns: missing authority,
  empty / overlong authchain, signature happy-path. body-shape cases
  moved to integration since the middleware does not run when the
  handler is called directly.
- integration tests now cover the middleware: malformed json returns
  400 with the middleware shape ({ ok: false, message, ... }), missing
  authchain returns 400 with .data containing ajv errors, non-array
  authchain and non-string signature likewise. content-type other
  than application/json is rejected with 4xx by the framework before
  the middleware runs (as... (continued)

713 of 957 branches covered (74.5%)

Branch coverage included in aggregate %.

199 of 202 new or added lines in 11 files covered. (98.51%)

2021 of 2343 relevant lines covered (86.26%)

40.97 hits per line