decentraland / worlds-content-server / 32896639610

92%

main: 92%

Pull #537

github

test: expect the scene gate on the re-cased signer key in world comms

The world comms suite kept the pre-6.3.0 expectation for the legacy re-cased
`Signer` key, so `build / test` failed on it -- the only failing test in the
run. The equivalent cases in explorer-legacy-payload.spec.ts and
post-permissions-legacy-payload.spec.ts moved with the upgrade; this one was
missed.

`metadataValidator` runs ahead of signature verification, so since 6.3.0 the
scene gate answers before `assertLegacyMetadataKeys` is reached and the message
is `Invalid metadata content` rather than `Invalid chain metadata`. Same
refusal, one layer earlier. The declared-key guard still refuses it a step
later, so the assertion is not weakened -- it names the layer that now replies.

Also adds the duplicate-key case: `{"signer":"dcl:explorer","Signer":
"decentraland-kernel-scene"}`, the exact key present and canonical with a
hostile folded duplicate beside it. It is signed in the current format, where
`canonicalMetadataKeys` is never consulted, so the gate is the only thing
inspecting the spelling -- up to 6.2.0 `rejectIfSigner` authorized on the
exactly-spelled key and never looked at the duplicate. Pinned against both:
6.2.0 answers that request 200, 6.3.0 answers it 400.

1900 of 2201 branches covered (86.32%)

Branch coverage included in aggregate %.

3901 of 4137 relevant lines covered (94.3%)

139.92 hits per line