decentraland / notifications-workers / 32886960948

80%

main: 80%

Pull #186

github

fix(auth): upgrade @dcl/crypto-middleware to 6.3.0

`rejectIfSigner` reads the exact `signer` key, so metadata delivering
`{"Signer":"decentraland-kernel-scene"}` presented no `signer` field at
all and the gate read it as absent -- answering "allowed" for a request
that visibly names the signer the gate exists to refuse.

This is reachable on the strict, current-format path. Since 6.0.0 the
metadata bytes are signed as delivered, so re-spelling the key changes
the signed bytes -- but a scene-driven client can simply sign it that
way, and the signature then verifies. The routes on the strict
middleware declare no `canonicalMetadataKeys`, so nothing else was
catching it there.

6.3.0 adds a `hasFoldedVariant` guard to `canonicalField` and
`requireCanonicalField`: a key that case-folds to the declared field
without being spelled exactly that is a rejection, not an absence.

The caret range already allowed 6.3.0, so the lockfile refresh is the
load-bearing part -- the range bump only makes the intent explicit.

239 of 377 branches covered (63.4%)

Branch coverage included in aggregate %.

881 of 1016 relevant lines covered (86.71%)

20.73 hits per line