decentraland / builder
53%
master: 53%

LAST BUILD BRANCH: fix/crypto-fetch-3
DEFAULT BRANCH: master
Repo Added
Files 343
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH fix/crypto-fetch-3
branch: SELECT
CHANGE BRANCH
x

coverage: 52.976% (+0.003%) from 52.973%
32493389482

Pull #3469

github

LautaroPetaccio 
fix(auth): upgrade decentraland-crypto-fetch to 3

Signs the payload format `@dcl/crypto-middleware` 6.x verifies. This repo
builds its own payload by concatenation rather than through the library, so
the bump alone is not enough: `createAuthHeaders` lowercased the whole
string, metadata included, after appending it. It now lowercases only the
method and path and appends the timestamp and metadata verbatim, so the
metadata header it sends is covered byte-for-byte by the signature.

No deploy ordering is needed here. Every call site sends either no metadata,
`{}`, or `{ type: worldPermissionType }`, and all four `WorldPermissionType`
values are lowercase under a lowercase key, so both formats produce identical
bytes for every request this repo makes. The change is inert on the wire and
can ship independently of the services.

Two overrides make the tree resolvable and consistent:

`decentraland-crypto-fetch` flat, because the published `decentraland-dapps`
still depends on `^2.0.1` and npm was installing a second, nested copy of the
signer at 2.0.1. Any signed request made from dapps code would have kept
emitting the old format from inside this app. The tree now holds exactly one
instance, at 3.0.0, deduped.

`@dcl/hooks` nested, because it declares `decentraland-crypto-fetch@^2.0.1`
as a peer and arrives transitively through `decentraland-ui2`, so npm could
satisfy neither range and every workflow failed at install with ERESOLVE --
`audit` and `test` both died there without running anything. No published
`@dcl/hooks` accepts 3.x. The pin is over-restrictive rather than meaningful:
hooks' only use is `signedFetchFactory()`, unchanged in 3.0.0, and it signs no
metadata, so it is unaffected by the format change.

Lockfile moves only where the bump forces it: `core-js-pure` drops out as a
2.0.1-only dependency, and `@dcl/crypto` goes 3.4.5 -> 3.7.0 with its subtree
because 3.0.0 pins that version exactly.
Pull Request #3469: fix(auth): upgrade decentraland-crypto-fetch to 3

2444 of 5783 branches covered (42.26%)

Branch coverage included in aggregate %.

0 of 3 new or added lines in 1 file covered. (0.0%)

7516 of 13018 relevant lines covered (57.74%)

35.52 hits per line

Relevant lines Covered
13018 RELEVANT LINES 7516 COVERED LINES
35.52 HITS PER LINE
Source Files on master

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
32493389482 fix/crypto-fetch-3 fix(auth): upgrade decentraland-crypto-fetch to 3 Signs the payload format `@dcl/crypto-middleware` 6.x verifies. This repo builds its own payload by concatenation rather than through the library, so the bump alone is not enough: `createAuthHeade... Pull #3469 LautaroPetaccio github
52.98
32483851159 fix/prevent-put-for-sale-sold-out-items Merge branch 'master' into fix/prevent-put-for-sale-sold-out-items Pull #3474 web-flow github
52.99
32483853401 fix/prevent-put-for-sale-sold-out-items Merge e0933f83d into a6b8fb010 Pull #3474 web-flow github
52.99
32483677631 feat/off-chain-marketplace-v3-listings fix: revoke every held marketplace version when disabling off-chain sale enableSaleOffchain only revoked the newest version, so a collection holding V2 minter rights kept them after the user turned off-chain sale off: listings on that version sta... Pull #3473 LautaroPetaccio github
53.01
32429968843 feat/blender-live feat: Blender live preview page with item-editor-style controls Replaces the bare connection test page with a proper live preview page at /live-preview. The left panel mirrors the item editor's panel style and reuses its Select/MultiSelect compon... push RocioCM github
52.4
32423686334 chore/bump-ui2-3.20.0-dapps-29.6.0 chore: bump decentraland-ui2 to ^3.20.0 and decentraland-dapps to ^29.6.0 Pull #3476 braianj github
52.97
32423592676 chore/bump-ui2-3.20.0-dapps-29.6.0 chore: bump decentraland-ui2 to ^3.20.0 and decentraland-dapps to ^29.6.0 push braianj github
52.97
32420867691 dependabot/npm_and_yarn/flatted-3.4.3 chore(deps-dev): bump flatted from 3.3.3 to 3.4.4 Bumps [flatted](https://github.com/WebReflection/flatted) from 3.3.3 to 3.4.4. - [Commits](https://github.com/WebReflection/flatted/compare/v3.3.3...v3.4.4) --- updated-dependencies: - dependency... Pull #3446 web-flow github
52.97
32420871539 dependabot/npm_and_yarn/flatted-3.4.3 Merge 51c9f4c52 into a6b8fb010 Pull #3446 web-flow github
52.97
32420836887 dependabot/npm_and_yarn/lodash.unset-4.18.0 chore(deps): bump lodash.unset from 4.5.2 to 4.18.0 Bumps [lodash.unset](https://github.com/lodash/lodash) from 4.5.2 to 4.18.0. - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](https://github.com/lodash/lodash/commits/4.1... Pull #3448 web-flow github
52.97
See All Builds (8472)