vocdoni / saas-backend / 28360900997

63%

push

github

fix(account): bind OAuth signature verification to expected address (#527.2) (#529)

* fix(account): bind OAuth signature verification to the expected address

VerifySignature had an inverted check and inconsistent address
formatting: calcAddress.String() keeps the 0x prefix while the expected
address was passed through util.TrimHex, and the function returned
success when the recovered address did NOT match. This let OAuth
registration and linking accept signatures produced by the wrong key.

- compare the recovered address against common.HexToAddress(address),
  which normalizes prefix and case reliably
- return an error when the recovered address differs from the expected one
- add tests for valid signature, wrong signer, tampered message,
  malformed/empty signature and 0x / non-0x / lowercase address inputs

Refs #527 (2)

3 of 3 new or added lines in 1 file covered. (100.0%)

10064 of 16109 relevant lines covered (62.47%)

45.02 hits per line