decentraland / comms-gatekeeper / 31058619892

86%

main: 86%

Build Type

Pull #284

github

Committed by LautaroPetaccio

Commit Message

fix: gate stream key retrieval and document the 403s

GET /scene-stream-access returns an existing streaming_key after a signed-fetch
and admin check, and was left ungated when POST and PUT were fixed. that is the
same key-bearer bypass on the third route: a banned admin could read the existing
key and redeem it through validateStreamerToken, which does not re-check the
wallet. 'blocking the mint' only ever held if every route that hands over a key is
gated, and retrieval hands over a key.

gate it identically — before the admin lookup, with the request device id when the
metadata carries one, falling back to the recorded device. DELETE stays ungated on
purpose: revoking a key removes access rather than granting it.

also documents the 403 on the three operations that return or mint a key
(getSceneStreamAccess, addSceneStreamAccess, resetSceneStreamAccess), which
listed only 400/401/404/500 and so did not show consumers the new rejection.

Pull Request Pull Request #284: feat: enforce platform bans on voice and cast, and make ban status match the gate

Coverage Stats

1145 of 1459 branches covered (78.48%)

Branch coverage included in aggregate %.

49 of 50 new or added lines in 9 files covered. (98.0%)

2 existing lines in 1 file now uncovered.

3127 of 3527 relevant lines covered (88.66%)

77.49 hits per line