decentraland / world-storage-service / 32175632922

99%

main: 99%

Pull #116

github

fix(auth): upgrade @dcl/crypto-middleware to 6

@dcl/crypto-middleware 6 changes the signed payload wire format: method,
path and timestamp are lowercased individually and the metadata is joined
verbatim, instead of lowercasing the whole joined string. Metadata casing
is now covered by the signature.

No source changes were needed. The middleware hands handlers the metadata
with its original casing both before and after, so the scene gate in
routes.ts and every authMetadata read behave identically.

Bump decentraland-crypto-fetch to 3, the client half of the same format
change. It signs every integration request, so without it the suite would
sign the old payload and get a 401 from a correctly-working server.

Update test/integration/auth/canonical-signer.spec.ts:

- Metadata re-cased after signing is now refused by signature
  verification (401 Invalid signature) instead of the canonical-value
  guard (400 Invalid chain metadata). Same request, same refusal, one
  layer earlier.
- A whitespace-padded scene signer is no longer refused at all. Version 6
  drops the canonical-value guard, and binding the metadata bytes to the
  signature does not cover a value that was already padded when signed,
  so it passes the strict `!==` in routes.ts and is served as an ordinary
  user-signed request. The tests now pin that behaviour and flag the gap.

424 of 438 branches covered (96.8%)

Branch coverage included in aggregate %.

1146 of 1153 relevant lines covered (99.39%)

72.16 hits per line