decentraland / comms-gatekeeper / 32894959086

86%

push

github

fix: take crypto-middleware 6.3.0 so a re-spelled signer key is refused (#291)

* fix(auth): take crypto-middleware 6.3.0 so a re-spelled signer key is refused

`rejectIfSigner` and `requireSigner` read the exact metadata key, so metadata
delivering `{"Signer":"decentraland-kernel-scene"}` presented no `signer` field
and every predicate treated it as absent. The scene gate answered "allowed" for
metadata that names, in plain sight, the signer it exists to refuse.

This is reachable on the strict path. Re-spelling the key changes the signed
bytes, so the request has to be signed that way — which a scene-driven client
can simply do, and the signature then verifies cleanly. `authWatcher` and the
user-moderation `signedFetch` both declare no `canonicalMetadataKeys`, so the
legacy `assertLegacyMetadataKeys` check never ran for them and nothing else
stood between a scene and a watcher token.

6.3.0 adds a `hasFoldedVariant` guard to `canonicalField` and
`requireCanonicalField`: a key that case-folds to the declared field without
being spelled exactly that is a rejection rather than an absence. Nothing is
folded and no value is rewritten; the request is refused at the metadata gate,
before any crypto runs.

The lockfile refresh is the load-bearing part. The declared `^6.2.0` range
already admitted 6.3.0, so the range bump only makes the intent explicit — the
pin in yarn.lock is what actually held the old version in place.

* refactor(test): take the signed-fetch header helper from @dcl/test-helpers

test/utils.ts hand-rolled its own copy of the ADR-44 payload that
@dcl/crypto-middleware 6 verifies. @dcl/test-helpers 0.3.2 ships the same
implementation, so drop the local copy and re-export the shared one: the
payload format now has a single definition that moves with the middleware
instead of being duplicated per service.

The range bump from ^0.2.0 is required, since a caret on a 0.x version
excludes 0.3.x entirely. It also drops the stale nested
@dcl/crypto... (continued)

1152 of 1463 branches covered (78.74%)

Branch coverage included in aggregate %.

3145 of 3531 relevant lines covered (89.07%)

79.27 hits per line