decentraland / world-storage-service / 29354048524

99%

push

github

feat: authorize scene-scoped storage delegations for env value reads (#113)

env values are keyed by place_id = f(world, parcel) — the same scope the
x-authoritative-scope claim pins — so GET /env/:key can accept a scene
worker's world-scoped storage delegation with the same confinement the
/values routes already grant. this lets a headless authoritative worker
read its own scene's env secrets without ever holding the authoritative
key.

- add authorizedAddressesOrScopedDelegationAuthorizationMiddleware
  (authorized addresses OR a valid scene-scoped delegation; still no
  owners/deployers) and wire it onto GET /env/:key
- the remaining env routes (list/upsert/delete) stay owner/deployer-only
  and never accept a delegation
- cover the route with unit + integration tests (valid delegation reads;
  parcel-mismatched claim is rejected)
- correct pre-existing schema-doc drift from the place_id migration: the
  world_storage, player_storage and env_variables primary keys all
  include place_id

424 of 438 branches covered (96.8%)

Branch coverage included in aggregate %.

1146 of 1153 relevant lines covered (99.39%)

70.43 hits per line