decentraland / builder-server
72%
master: 72%

LAST BUILD BRANCH: 5.21.0
DEFAULT BRANCH: master
Repo Added
Token cczSCRT2GDczUah4EMMQqfm6DhsxMlbIz regen
Build 2273 Last
Files 192
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH 5.21.0
branch: SELECT
CHANGE BRANCH
x
Sync Branches

coverage: 72.428% (+0.1%) from 72.294%
33655803817

push

github

web-flow 
fix: harden third-party manager resolution and read scoping (#811)

* fix: harden third-party manager resolution and read scoping

Resolve third-party managers virtual-first: while a virtual (draft) record
exists, its managers are authoritative; the indexed on-chain record governs
only once it is the sole record.

- Scope GET /thirdParties to the authenticated wallet instead of a
  client-supplied manager filter.
- Require authentication and manager membership for reads of virtual
  (unpublished) records on GET /thirdParties/:id; keep indexed records public.
- Route the collection create/upsert manager check through the shared
  resolution.
- Match manager addresses case-insensitively across resolution, reads and
  reconciliation via a shared hasManager helper and a case-insensitive
  findByManager query.
- Add unit tests and a ManagerContinuity integration spec covering the
  end-to-end resolution.

* fix: prioritize approved on-chain managers and fail closed on lookup errors

Address review feedback on the third-party manager resolution hardening:

- Prioritize the approved on-chain (indexed) managers over the virtual ones.
  Virtual managers are authoritative only while the third party is still a
  draft, i.e. the indexed record is not yet approved (empty root); a rooted
  on-chain record governs regardless of any lingering virtual record.
- Fail closed in the collection create/upsert path: only create a virtual
  third party after a confirmed NonExistentThirdPartyError, and rethrow
  transient lookup errors so a graph/API failure can no longer create a
  caller-owned record.
- Return 404 instead of 401 when a virtual record is requested by a
  non-manager on GET /thirdParties/:id, so the response is indistinguishable
  from a genuine miss.
- Drop the standalone ManagerContinuity integration spec; its scenarios are
  covered by the collection router tests and the manager-resolution unit
  tests.

* fix: require authentication on GET /thirdParties/:... (continued)

1476 of 2252 branches covered (65.54%)

Branch coverage included in aggregate %.

33 of 38 new or added lines in 5 files covered. (86.84%)

1 existing line in 1 file now uncovered.

3360 of 4425 relevant lines covered (75.93%)

49.79 hits per line

Relevant lines Covered
4425 RELEVANT LINES 3360 COVERED LINES
49.79 HITS PER LINE
Source Files on master

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
33655803817 5.21.0 fix: harden third-party manager resolution and read scoping (#811) * fix: harden third-party manager resolution and read scoping Resolve third-party managers virtual-first: while a virtual (draft) record exists, its managers are authoritative; t... push web-flow github
72.43
33649736915 master fix: harden third-party manager resolution and read scoping (#811) * fix: harden third-party manager resolution and read scoping Resolve third-party managers virtual-first: while a virtual (draft) record exists, its managers are authoritative; t... push web-flow github
72.43
33645238428 hardening/third-party-manager-resolution fix: gate on-chain manager precedence on isApproved instead of root Use the third party's isApproved flag as the signal for when the indexed on-chain managers take precedence over the virtual ones, rather than the presence of a root. isApproved i... Pull #811 cyaiox github
72.43
33644299866 hardening/third-party-manager-resolution fix: require authentication on GET /thirdParties/:id and simplify resolution - Require authentication on GET /thirdParties/:id (strict), removing the unauthenticated surface. Unpublished records return 404 to non-managers; indexed records are... Pull #811 cyaiox github
72.43
33642596023 hardening/third-party-manager-resolution fix: prioritize approved on-chain managers and fail closed on lookup errors Address review feedback on the third-party manager resolution hardening: - Prioritize the approved on-chain (indexed) managers over the virtual ones. Virtual managers ... Pull #811 cyaiox github
72.39
33639961407 hardening/third-party-manager-resolution fix: harden third-party manager resolution and read scoping Resolve third-party managers virtual-first: while a virtual (draft) record exists, its managers are authoritative; the indexed on-chain record governs only once it is the sole record. -... Pull #811 cyaiox github
72.41
33617014485 master Harden collection and item write endpoints: ignore server-managed fields, validate input push cyaiox github
72.29
33517173190 master feat: support status filter on GET /:address/collections (#810) push web-flow github
72.29
33516412194 feat/address-collections-status-filter fix: address decentraland-bot review findings - Add test asserting status=pending maps to non-approved remote ids, covering the remaining non-approved status path suggested by review Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Pull #810 RocioCM github
72.24
33512995330 feat/address-collections-status-filter fix: address decentraland-bot review findings - Add test asserting all authorized remote ids are passed when no status filter is sent - Add test asserting under_review maps to non-approved remote ids like rejected Co-Authored-By: Claude Fable 5 ... Pull #810 RocioCM github
72.24
See All Builds (1181)

Badge your Repo: builder-server

We detected this repo isn’t badged! Grab the embed code to the right, add it to your repo to show off your code coverage, and when the badge is live hit the refresh button to remove this message.
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

Refresh