decentraland / asset-bundle-registry / 32250059223

73%

push

github

fix(auth): upgrade @dcl/crypto-middleware to 6 (#132)

* fix(auth): upgrade @dcl/crypto-middleware to 6

6.0.0 changes the signed-fetch wire format: the payload is now
`[method.toLowerCase(), path.toLowerCase(), timestamp, metadata].join(':')`
instead of lowercasing the whole joined string, so the metadata JSON is
signed verbatim and its casing is bound by the signature.

- Update `getAuthHeaders` in the test helpers to build the new payload.
- Retarget the mixed-case scene-signer test: re-casing the metadata after
  signing now fails signature verification (401 `Invalid signature`)
  instead of the canonical signer/intent guard 5.1.0 added, which 6.0.0
  removes (400 `Invalid chain metadata`).

No source changes were needed: the middleware handed metadata to handlers
with its original casing both before and after, so the strict
`metadata?.signer !== 'decentraland-kernel-scene'` check in routes.ts is
unaffected.

* refactor(auth): use rejectIfSigner from crypto-middleware 6.1

Replaces the hand-rolled scene gate. The exact comparison let a signer
that was not already canonical through: a padded or re-cased value failed
`!== 'decentraland-kernel-scene'` and the request was served as a directly
user-signed one. rejectIfSigner refuses such a value instead of comparing
it, and refuses a non-string one too. Nothing is folded — the value is
rejected, not rewritten.

The canonical-signer spec now expects the 400 the gate produces rather
than the 401 from signature verification. metadataValidator runs first, so
a re-cased delivery is refused before any crypto rather than after; the
signature would have refused it either way.

666 of 953 branches covered (69.88%)

Branch coverage included in aggregate %.

1 of 1 new or added line in 1 file covered. (100.0%)

1749 of 2347 relevant lines covered (74.52%)

41.2 hits per line