decentraland / worlds-content-server / 32314839963

92%

main: 92%

Pull #534

github

fix(auth): accept the legacy signed payload on the explorer comms routes

@dcl/crypto-middleware 6.0.0 bound the metadata bytes into the signed
payload. The unity, godot and bevy explorers all still sign the pre-6.0.0
folded payload and all send camelCase metadata, so every handshake they
make 401s under 6.x. They are three separate client releases and cannot be
deployed atomically with this service, so no deploy order avoids breaking
them.

6.2.0 adds `canonicalMetadataKeys`, an opt-in fallback for that window: the
current format is tried first and only a signature mismatch falls through
to the legacy payload.

The middleware was a single shared instance serving both explorer and
builder/CLI routes, so enabling the option on it would have widened the
fallback well past the clients that need it. It is now built by a small
factory and instantiated twice. Only the three comms handshakes
(/get-comms-adapter/:roomId, /worlds/:worldName/comms and
/worlds/:worldName/scenes/:sceneId/comms) take the legacy-accepting
instance; deployment, entity, world settings, contribution and every
permissions route keep the strict one.

The declared key list is derived from the reads in this repo rather than
from what clients send: signer, intent, secret, type, wallets, communities
and nft. It is what stops the fallback being a bypass — the legacy payload
folds the metadata, so a delivered `Signer` would share a valid signature
with `signer` while reading as absent to the scene gate. Fields the
explorers send but this service never reads (isGuest, origin, realmName,
realm.serverName, and metadata sceneId) are deliberately unlisted; an
unread field cannot change an authorization decision.

No handler logic changed, and nothing normalizes signer or intent.

1880 of 2169 branches covered (86.68%)

Branch coverage included in aggregate %.

9 of 9 new or added lines in 1 file covered. (100.0%)

3872 of 4102 relevant lines covered (94.39%)

137.07 hits per line