decentraland / social-service-ea / 32897286241

91%

push

github

fix: take crypto-middleware 6.3.0 so a re-spelled signer key is refused (#493)

* fix(auth): take crypto-middleware 6.3.0 so a re-spelled signer key is refused

`rejectIfSigner` reads the exact metadata key, so metadata delivering
`{"Signer":"decentraland-kernel-scene"}` presented no `signer` field and the
gate treated it as absent. `rejectSceneSigner` answered "allowed" for metadata
that names, in plain sight, the signer it exists to refuse.

This is reachable on the strict path. Re-spelling the key changes the signed
bytes, so the request has to be signed that way — which a scene-driven client
can simply do, and the chain then verifies cleanly. Neither surface declares
`canonicalMetadataKeys`, so the legacy `assertLegacyMetadataKeys` check, which
already refused folded keys, never ran for either of them.

Both surfaces were exposed: the HTTP routes and the WebSocket handshake, which
gates all 34 RPC services on the socket.

6.3.0 adds a `hasFoldedVariant` guard to `canonicalField` and
`requireCanonicalField`: a key that case-folds to the declared field without
being spelled exactly that is a rejection rather than an absence. Nothing is
folded and no value is rewritten.

One existing expectation moves with it. The spec that re-spells the key *after*
signing used to be caught by the signature (401); the gate now answers first,
before signature verification, so it is a 400 and costs no catalyst round-trip.
The request was refused before and is refused now, just earlier.

The lockfile refresh is the load-bearing part. The declared `^6.2.0` range
already admitted 6.3.0, so the range bump only makes the intent explicit — the
pin in yarn.lock is what actually held the old version in place.

* test(auth): expect the folded signer key to be refused by the gate

The unit spec still asserted that `{ Signer: 'decentraland-kernel-scene' }`
is allowed, "leaving the key spelling to the signature". That was correct
against 6.2.0 and is wrong against the 6.3.0 this ... (continued)

2591 of 2989 branches covered (86.68%)

Branch coverage included in aggregate %.

6241 of 6693 relevant lines covered (93.25%)

92.98 hits per line