decentraland / comms-gatekeeper / 28599876051

85%

main: 85%

Build Type

Pull #276

github

Committed by LautaroPetaccio

Commit Message

refactor: validate remove-scene-admin body via schema; tighten watcher auth

- remove-scene-admin: add RemoveSceneAdminRequestSchema and validate it on the
  route, dropping the manual request.json() try/catch + guard + EthAddress check
  from the handler (mirrors add-scene-admin, which relies on the schema validator).
- watcher-token: rely on the authWatcher middleware (optional: false) for
  identification and drop the redundant in-handler auth check, using the
  established verification!.auth pattern; the schema validator already guards the
  body, so the try/catch is removed too.
- watcher-token: reject the decentraland-kernel-scene signer via a
  metadataValidator on authWatcher — watcher tokens are for viewer clients, not
  scenes.

Pull Request Pull Request #276: fix: address security audit findings (access control, disclosure, hardening)

Coverage Stats

1122 of 1437 branches covered (78.08%)

Branch coverage included in aggregate %.

86 of 96 new or added lines in 21 files covered. (89.58%)

4 existing lines in 1 file now uncovered.

3094 of 3492 relevant lines covered (88.6%)

75.09 hits per line