decentraland / notifications-workers / 32855999150

80%

main: 80%

Pull #185

github

fix(auth): accept the pre-6.0.0 signed payload

Upgrading to crypto-middleware 6 made this service verify the metadata
bytes as delivered. Every current caller still signs the folded payload --
the whole joined string lowercased -- while sending the metadata header
verbatim, so the two disagree for any metadata carrying uppercase.

`PUT /notifications/read` carries `notificationIds`, which means
decentraland-dapps (builder, marketplace, profile, account) and
godot-explorer get a 401 on every attempt to mark a notification read
once this deploys. The suite did not catch it because the shared
`getAuthHeaders` helper already signs the 6.x payload.

Declaring `canonicalMetadataKeys` opts the routes into verifying that
older format as a fallback, tried only after the current one fails.

Only `signer` is declared. No handler in this service reads
`authMetadata` at all -- `readNotificationsHandler` takes the ids from
the request body and the address from the recovered signature -- so no
other key can change an authorization outcome, and declaring one would
describe a boundary this service does not enforce. `signer` is there
because `rejectIfSigner` gates on it, and the fold leaves key casing
outside the signature: without it a legacy request could deliver
`Signer` and have the gate read the field as absent.

The fallback widens which signatures verify, not who may call. A
scene-signed request is still refused, and so is a re-spelled `signer`.
Removable once every caller signs the 6.x payload.

239 of 377 branches covered (63.4%)

Branch coverage included in aggregate %.

14 of 15 new or added lines in 1 file covered. (93.33%)

878 of 1013 relevant lines covered (86.67%)

20.67 hits per line