decentraland / asset-bundle-registry / 32176287535

73%

main: 73%

Pull #132

github

fix(auth): upgrade @dcl/crypto-middleware to 6

6.0.0 changes the signed-fetch wire format: the payload is now
`[method.toLowerCase(), path.toLowerCase(), timestamp, metadata].join(':')`
instead of lowercasing the whole joined string, so the metadata JSON is
signed verbatim and its casing is bound by the signature.

- Update `getAuthHeaders` in the test helpers to build the new payload.
- Retarget the mixed-case scene-signer test: re-casing the metadata after
  signing now fails signature verification (401 `Invalid signature`)
  instead of the canonical signer/intent guard 5.1.0 added, which 6.0.0
  removes (400 `Invalid chain metadata`).

No source changes were needed: the middleware handed metadata to handlers
with its original casing both before and after, so the strict
`metadata?.signer !== 'decentraland-kernel-scene'` check in routes.ts is
unaffected.

666 of 953 branches covered (69.88%)

Branch coverage included in aggregate %.

1750 of 2348 relevant lines covered (74.53%)

41.18 hits per line