decentraland / asset-bundle-registry / 32895184916

73%

main: 73%

push

github

fix(auth): upgrade @dcl/crypto-middleware to 6.3.0 to close the folded signer-key bypass (#134)

* fix(auth): upgrade @dcl/crypto-middleware to 6.3.0 to close the folded signer-key bypass

`rejectIfSigner('decentraland-kernel-scene')` read the exact `signer` key, so
metadata delivering `{"Signer":"decentraland-kernel-scene"}` presented no
`signer` at all and the predicate treated the field as absent — answering
"allowed" for a request that visibly names the signer the gate exists to refuse.
The scene request then reached the handler as an ordinary user-signed one.

This is reachable on the strict, current-format path. Re-spelling the key
changes the signed bytes, so the request has to be signed that way, which a
scene-driven client can simply do; the signature over the re-spelled metadata is
genuinely valid. It is not only a legacy-payload quirk.

6.3.0 adds a `hasFoldedVariant` guard to `canonicalField` and
`requireCanonicalField`: a key that case-folds to the declared field without
being spelled exactly that is now a rejection rather than an absence.

The caret range already admitted 6.3.0, so the lockfile refresh is the
load-bearing change here — the declared range is bumped alongside it only to
make the intent explicit.

The added regression test signs the re-spelled metadata with the current 6.x
payload so it exercises the strict path. Pinned back to 6.2.0 it fails with a
200: the scene request goes all the way through.

* test: reuse the shared signed-fetch helpers from @dcl/test-helpers

The local getIdentity/getAuthHeaders in test/utils.ts were a hand-rolled copy
of the ADR-44 signing that @dcl/test-helpers already provides. Bump the package
to ^0.3.2 — the first release whose getAuthHeaders signs the unfolded 6.x
payload rather than the pre-6.0.0 folded one — and re-export its helpers so the
payload format lives in one place that stays in step with @dcl/crypto-middleware.

createRequestMaker now calls getSignedAuthHeaders instead of repeating... (continued)

670 of 957 branches covered (70.01%)

Branch coverage included in aggregate %.

1753 of 2351 relevant lines covered (74.56%)

40.79 hits per line