decentraland / notifications-workers / 33279967354

80%

main: 80%

push

github

fix(auth): upgrade @dcl/crypto-middleware to 6.3.0 (#186)

* fix(auth): upgrade @dcl/crypto-middleware to 6.3.0

`rejectIfSigner` reads the exact `signer` key, so metadata delivering
`{"Signer":"decentraland-kernel-scene"}` presented no `signer` field at
all and the gate read it as absent -- answering "allowed" for a request
that visibly names the signer the gate exists to refuse.

This is reachable on the strict, current-format path. Since 6.0.0 the
metadata bytes are signed as delivered, so re-spelling the key changes
the signed bytes -- but a scene-driven client can simply sign it that
way, and the signature then verifies. The routes on the strict
middleware declare no `canonicalMetadataKeys`, so nothing else was
catching it there.

6.3.0 adds a `hasFoldedVariant` guard to `canonicalField` and
`requireCanonicalField`: a key that case-folds to the declared field
without being spelled exactly that is a rejection, not an absence.

The caret range already allowed 6.3.0, so the lockfile refresh is the
load-bearing part -- the range bump only makes the intent explicit.

* test: reuse the shared signed-fetch helpers from @dcl/test-helpers

The local getIdentity/getAuthHeaders in inbox/test/utils.ts were a hand-rolled
copy of the ADR-44 signing that @dcl/test-helpers already provides. Bump the
package to ^0.3.2 — the first release whose getAuthHeaders signs the unfolded
6.x payload rather than the pre-6.0.0 folded one — and re-export its helpers so
the payload format lives in one place that stays in step with
@dcl/crypto-middleware.

makeRequest now calls getSignedAuthHeaders instead of repeating the signPayload
boilerplate. getIdentityFromPrivateKey is kept: it has no shared equivalent.

All three workspaces are bumped together so the monorepo resolves a single
test-helpers. common and processor only use createRunner and
createLocalFetchComponent, whose public surface is unchanged in 0.3.x. Doing
them together also drops the stale nested @dcl/crypto-middl... (continued)

239 of 377 branches covered (63.4%)

Branch coverage included in aggregate %.

881 of 1016 relevant lines covered (86.71%)

20.73 hits per line