decentraland / builder-server / 33655803817

72%

master: 72%

Build Type

push

github

Committed by web-flow

Commit Message

fix: harden third-party manager resolution and read scoping (#811)

* fix: harden third-party manager resolution and read scoping

Resolve third-party managers virtual-first: while a virtual (draft) record
exists, its managers are authoritative; the indexed on-chain record governs
only once it is the sole record.

- Scope GET /thirdParties to the authenticated wallet instead of a
  client-supplied manager filter.
- Require authentication and manager membership for reads of virtual
  (unpublished) records on GET /thirdParties/:id; keep indexed records public.
- Route the collection create/upsert manager check through the shared
  resolution.
- Match manager addresses case-insensitively across resolution, reads and
  reconciliation via a shared hasManager helper and a case-insensitive
  findByManager query.
- Add unit tests and a ManagerContinuity integration spec covering the
  end-to-end resolution.

* fix: prioritize approved on-chain managers and fail closed on lookup errors

Address review feedback on the third-party manager resolution hardening:

- Prioritize the approved on-chain (indexed) managers over the virtual ones.
  Virtual managers are authoritative only while the third party is still a
  draft, i.e. the indexed record is not yet approved (empty root); a rooted
  on-chain record governs regardless of any lingering virtual record.
- Fail closed in the collection create/upsert path: only create a virtual
  third party after a confirmed NonExistentThirdPartyError, and rethrow
  transient lookup errors so a graph/API failure can no longer create a
  caller-owned record.
- Return 404 instead of 401 when a virtual record is requested by a
  non-manager on GET /thirdParties/:id, so the response is indistinguishable
  from a genuine miss.
- Drop the standalone ManagerContinuity integration spec; its scenarios are
  covered by the collection router tests and the manager-resolution unit
  tests.

* fix: require authentication on GET /thirdParties/:... (continued)

Coverage Stats

1476 of 2252 branches covered (65.54%)

Branch coverage included in aggregate %.

33 of 38 new or added lines in 5 files covered. (86.84%)

1 existing line in 1 file now uncovered.

3360 of 4425 relevant lines covered (75.93%)

49.79 hits per line