decentraland / asset-bundle-registry
73%
main: 73%

LAST BUILD BRANCH: 2.5.2
DEFAULT BRANCH: main
Repo Added
Token fWUYLY2oPJ2Vqa6ysDYFCXWiESarAiCav regen
Build 374 Last
Files 87
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH 2.5.2
branch: SELECT
CHANGE BRANCH
x
Sync Branches

coverage: 73.247%. Remained the same
32895184916

push

github

web-flow 
fix(auth): upgrade @dcl/crypto-middleware to 6.3.0 to close the folded signer-key bypass (#134)

* fix(auth): upgrade @dcl/crypto-middleware to 6.3.0 to close the folded signer-key bypass

`rejectIfSigner('decentraland-kernel-scene')` read the exact `signer` key, so
metadata delivering `{"Signer":"decentraland-kernel-scene"}` presented no
`signer` at all and the predicate treated the field as absent — answering
"allowed" for a request that visibly names the signer the gate exists to refuse.
The scene request then reached the handler as an ordinary user-signed one.

This is reachable on the strict, current-format path. Re-spelling the key
changes the signed bytes, so the request has to be signed that way, which a
scene-driven client can simply do; the signature over the re-spelled metadata is
genuinely valid. It is not only a legacy-payload quirk.

6.3.0 adds a `hasFoldedVariant` guard to `canonicalField` and
`requireCanonicalField`: a key that case-folds to the declared field without
being spelled exactly that is now a rejection rather than an absence.

The caret range already admitted 6.3.0, so the lockfile refresh is the
load-bearing change here — the declared range is bumped alongside it only to
make the intent explicit.

The added regression test signs the re-spelled metadata with the current 6.x
payload so it exercises the strict path. Pinned back to 6.2.0 it fails with a
200: the scene request goes all the way through.

* test: reuse the shared signed-fetch helpers from @dcl/test-helpers

The local getIdentity/getAuthHeaders in test/utils.ts were a hand-rolled copy
of the ADR-44 signing that @dcl/test-helpers already provides. Bump the package
to ^0.3.2 — the first release whose getAuthHeaders signs the unfolded 6.x
payload rather than the pre-6.0.0 folded one — and re-export its helpers so the
payload format lives in one place that stays in step with @dcl/crypto-middleware.

createRequestMaker now calls getSignedAuthHeaders instead of repeating... (continued)

670 of 957 branches covered (70.01%)

Branch coverage included in aggregate %.

1753 of 2351 relevant lines covered (74.56%)

40.79 hits per line

Relevant lines Covered
2351 RELEVANT LINES 1753 COVERED LINES
40.79 HITS PER LINE
Source Files on main

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
32895184916 2.5.2 fix(auth): upgrade @dcl/crypto-middleware to 6.3.0 to close the folded signer-key bypass (#134) * fix(auth): upgrade @dcl/crypto-middleware to 6.3.0 to close the folded signer-key bypass `rejectIfSigner('decentraland-kernel-scene')` read the exa... push web-flow github
73.25
32894531957 main fix(auth): upgrade @dcl/crypto-middleware to 6.3.0 to close the folded signer-key bypass (#134) * fix(auth): upgrade @dcl/crypto-middleware to 6.3.0 to close the folded signer-key bypass `rejectIfSigner('decentraland-kernel-scene')` read the exa... push web-flow github
73.25
32893164255 fix/crypto-middleware-6.3.0-folded-signer-key test: reuse the shared signed-fetch helpers from @dcl/test-helpers The local getIdentity/getAuthHeaders in test/utils.ts were a hand-rolled copy of the ADR-44 signing that @dcl/test-helpers already provides. Bump the package to ^0.3.2 — the first... Pull #134 LautaroPetaccio github
73.25
32887038453 fix/crypto-middleware-6.3.0-folded-signer-key fix(auth): upgrade @dcl/crypto-middleware to 6.3.0 to close the folded signer-key bypass `rejectIfSigner('decentraland-kernel-scene')` read the exact `signer` key, so metadata delivering `{"Signer":"decentraland-kernel-scene"}` presented no `sign... Pull #134 LautaroPetaccio github
73.25
32883933355 fix/crypto-middleware-6.3.0-folded-signer-key fix(auth): upgrade @dcl/crypto-middleware to 6.3.0 to close the folded signer-key bypass `rejectIfSigner('decentraland-kernel-scene')` read the exact `signer` key, so metadata delivering `{"Signer":"decentraland-kernel-scene"}` presented no `sign... Pull #134 LautaroPetaccio github
73.25
32530337550 main feat: support a second registry instance fed by abgen (#133) * feat: support a second registry instance fed by abgen Adds what the asset-bundle-registry-abgen deployment needs to run the same image against the abgen lambda's output instead of th... push web-flow github
73.25
32529317338 feat/abgen-registry-instance refactor: drop the configurable conversion-finished event The knob never varies: abgen publishes the same asset-bundle/converted pair the Unity converter does, and which conversion events an instance sees is already decided by the topics its queu... Pull #133 LautaroPetaccio github
73.25
32527769410 feat/abgen-registry-instance fix: correct the documented env var defaults The table said DISABLE_PROFILE_SYNC and DISABLE_PROFILES were unset, but .env.default sets them to true and false and ships inside the image, so those are what an instance runs with when its deployment... Pull #133 LautaroPetaccio github
73.36
32523679122 feat/abgen-registry-instance feat: support a second registry instance fed by abgen Adds what the asset-bundle-registry-abgen deployment needs to run the same image against the abgen lambda's output instead of the Unity converter's. The conversion-finished event is now confi... Pull #133 LautaroPetaccio github
73.37
32250039004 fix/crypto-middleware-6 refactor(auth): use rejectIfSigner from crypto-middleware 6.1 Replaces the hand-rolled scene gate. The exact comparison let a signer that was not already canonical through: a padded or re-cased value failed `!== 'decentraland-kernel-scene'` and t... push LautaroPetaccio github
73.18
See All Builds (374)

Badge your Repo: asset-bundle-registry

We detected this repo isn’t badged! Grab the embed code to the right, add it to your repo to show off your code coverage, and when the badge is live hit the refresh button to remove this message.
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

Refresh