decentraland / social-service-ea / 28548013452

90%

main: 90%

push

github

fix: enforce friendship state machine in upsertFriendship (#427)

* fix: enforce friendship state machine in upsertFriendship

upsertFriendship applied every friendship action without validating the
state-machine transition, so an authenticated user could send an ACCEPT
targeting an arbitrary address with no prior request and create an active
friendship (is_active = true) without the other user's consent. because the
private-voice authorization gate keys on friendship.is_active, the forged
friendship also defeated a victim's ONLY_FRIENDS privacy setting.

the validator that encodes the legal transitions (validateNewFriendshipAction)
already existed and was unit-tested, but its only call site was dropped during
the upsert-friendship refactor (#214), leaving it as dead code.

this wires the validator back into upsertFriendship, before any state is
written, so illegal transitions are rejected with an InvalidFriendshipActionError
and no friendship row is created or updated.

- call validateNewFriendshipAction in upsertFriendship before computing the new status
- move InvalidFriendshipActionError into the friends logic errors.ts, since a logic
  component must not import from controllers/; the controller still maps it to the
  existing invalidFriendshipAction response
- rewrite the component tests that asserted the vulnerable behavior into
  valid-transition tests, and add a regression block covering illegal transitions

* test: remove redundant action assignment in upsert-friendship no-prior-action block

2299 of 2688 branches covered (85.53%)

Branch coverage included in aggregate %.

7 of 7 new or added lines in 3 files covered. (100.0%)

5758 of 6221 relevant lines covered (92.56%)

80.56 hits per line