decentraland / comms-gatekeeper / 32380477054

86%

push

github

fix(auth): upgrade @dcl/crypto-middleware to 6 (#289)

* fix(auth): upgrade @dcl/crypto-middleware to 6

Version 6 binds the metadata bytes into the signed payload instead of
lowercasing them, so the signature now covers the metadata exactly as
delivered rather than only its case-folded form.

No source changes are needed. The middleware already handed handlers the
metadata as the client sent it, cased, both before and after this change;
only the payload the signature is checked against differs. Every
metadata.signer comparison and every value read out of authMetadata keeps
behaving as it did.

The test helper does need to catch up: getAuthHeaders signed the previous
payload format, so without this every integration auth test would fail
against a correctly working service.

Note that clients must ship the new signing format before this deploys.
Any explorer still signing the previous payload gets a 401, and that is
every scene-originated request rather than a subset, because the metadata
this service reads is camelCase throughout (sceneId, realmName,
realm.serverName, deviceIdentifier).

* test(auth): expect the signature rejection rather than the removed guard

The watcher-token spec covering a scene signer signed canonically and
delivered re-cased asserted a 400 from the canonical-value guard that
@dcl/crypto-middleware 5.1.0 applied. Version 6 joins the metadata bytes
into the signed payload, so the delivered bytes no longer reproduce what
was signed and the request fails verification first, with a 401.

The behaviour under test is unchanged: the request is still refused and
the handler is still not reached. Only the layer that refuses it moved,
from a guard covering two named fields to the signature covering all of
them.

* refactor(auth): use the shared signer predicates from crypto-middleware 6.1

The five hand-rolled metadataValidator closures are replaced by
requireSigner and rejectIfSigner. Same gates, expressed once in the
library rather tha... (continued)

1145 of 1456 branches covered (78.64%)

Branch coverage included in aggregate %.

3 of 3 new or added lines in 2 files covered. (100.0%)

3137 of 3525 relevant lines covered (88.99%)

78.61 hits per line