decentraland / worlds-content-server / 32175873889

92%

main: 92%

Pull #534

github

fix(auth): upgrade @dcl/crypto-middleware to 6

Version 6 changes the signed-fetch wire format. The payload is now
`[method.toLowerCase(), path.toLowerCase(), timestamp, metadata].join(':')`
instead of the whole string lowercased, so the metadata bytes are joined
verbatim and metadata casing is covered by the signature.

Update `getAuthHeaders` in the test helpers to build the payload the new
way, otherwise every signed-fetch test signs a payload the middleware no
longer reconstructs.

Version 6 also drops the canonical `signer`/`intent` guard 5.1.0 added:
a non-canonical value is now unambiguous by construction, so the library
stops policing it. The scene gate in `routes.ts` was relying on that
guard to backstop its exact `!== 'decentraland-kernel-scene'` match, and
without it a request signed with `Decentraland-Kernel-Scene` arrives with
a valid signature and walks straight past the gate. Normalize the signer
before comparing so the gate closes on its own.

Adjust the world-comms auth tests accordingly: non-canonical spellings of
the scene sentinel are still refused with 400, now by this service rather
than by the library, and non-canonical values of other metadata fields
are no longer refused at all.

1882 of 2171 branches covered (86.69%)

Branch coverage included in aggregate %.

1 of 1 new or added line in 1 file covered. (100.0%)

3870 of 4100 relevant lines covered (94.39%)

137.06 hits per line