decentraland / builder / 33001220868

53%

push

github

fix(auth): upgrade decentraland-crypto-fetch to 3 (#3469)

* fix(auth): upgrade decentraland-crypto-fetch to 3

Version 2 built the signed payload as
`[method, path, timestamp, data].join(':').toLowerCase()`, folding the
metadata along with everything else while sending `x-identity-metadata`
verbatim. That left the metadata's casing outside the signature. Version
3 lowercases only the method and the path and joins the metadata as it
will be sent, which is what services on @dcl/crypto-middleware 6 verify.

`src/lib/api/auth.ts` built the same folded payload by hand and is
updated to match.

One override remains, narrowed to the single package that still needs it.
@dcl/hooks 1.6.0 declares `decentraland-crypto-fetch ^2.0.1` as a peer
and arrives transitively through decentraland-ui2, so without it npm can
satisfy neither range and the install fails with ERESOLVE. Verified by
removing it: the resolution fails outright.

The flat `decentraland-crypto-fetch` override this branch also carried is
gone. It existed because the published decentraland-dapps still depended
on `^2.0.1` and npm was installing a second, nested copy of the signer --
any signed request made from dapps code would have kept emitting the old
format from inside this app. Master now depends on decentraland-dapps
29.7.0, which depends on `^3.0.0` directly, so the nested copy no longer
appears and the override no longer does anything. Confirmed by removing
it: the tree still resolves exactly one instance, at 3.0.0.

The two overrides were redundant with each other rather than each doing
half the job -- either alone resolves the tree, and removing both is what
fails. Keeping the narrower one states which dependency is actually
holding this up, so it can be deleted the moment @dcl/hooks publishes a
release accepting 3.x. That fix is merged there but has only reached the
`next` tag so far; `latest` is still 1.6.0.

`npm ci` passes and installs one crypto-fetch, at 3.0.0.

* chore: drop the @dcl... (continued)

2605 of 6019 branches covered (43.28%)

Branch coverage included in aggregate %.

0 of 3 new or added lines in 1 file covered. (0.0%)

7775 of 13374 relevant lines covered (58.14%)

37.35 hits per line