decentraland / builder-server
72%

DEFAULT BRANCH: master
Repo Added
Token cczSCRT2GDczUah4EMMQqfm6DhsxMlbIz regen
Build 2273 Last
Files 192
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH master
branch: master
CHANGE BRANCH
x
Sync Branches

coverage: 72.428% (+0.1%) from 72.294%
33649736915

push

github

web-flow 
fix: harden third-party manager resolution and read scoping (#811)

* fix: harden third-party manager resolution and read scoping

Resolve third-party managers virtual-first: while a virtual (draft) record
exists, its managers are authoritative; the indexed on-chain record governs
only once it is the sole record.

- Scope GET /thirdParties to the authenticated wallet instead of a
  client-supplied manager filter.
- Require authentication and manager membership for reads of virtual
  (unpublished) records on GET /thirdParties/:id; keep indexed records public.
- Route the collection create/upsert manager check through the shared
  resolution.
- Match manager addresses case-insensitively across resolution, reads and
  reconciliation via a shared hasManager helper and a case-insensitive
  findByManager query.
- Add unit tests and a ManagerContinuity integration spec covering the
  end-to-end resolution.

* fix: prioritize approved on-chain managers and fail closed on lookup errors

Address review feedback on the third-party manager resolution hardening:

- Prioritize the approved on-chain (indexed) managers over the virtual ones.
  Virtual managers are authoritative only while the third party is still a
  draft, i.e. the indexed record is not yet approved (empty root); a rooted
  on-chain record governs regardless of any lingering virtual record.
- Fail closed in the collection create/upsert path: only create a virtual
  third party after a confirmed NonExistentThirdPartyError, and rethrow
  transient lookup errors so a graph/API failure can no longer create a
  caller-owned record.
- Return 404 instead of 401 when a virtual record is requested by a
  non-manager on GET /thirdParties/:id, so the response is indistinguishable
  from a genuine miss.
- Drop the standalone ManagerContinuity integration spec; its scenarios are
  covered by the collection router tests and the manager-resolution unit
  tests.

* fix: require authentication on GET /thirdParties/:... (continued)

1476 of 2252 branches covered (65.54%)

Branch coverage included in aggregate %.

33 of 38 new or added lines in 5 files covered. (86.84%)

1 existing line in 1 file now uncovered.

3360 of 4425 relevant lines covered (75.93%)

49.79 hits per line

Relevant lines Covered
4425 RELEVANT LINES 3360 COVERED LINES
49.79 HITS PER LINE
Source Files on master

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
33649736915 master fix: harden third-party manager resolution and read scoping (#811) * fix: harden third-party manager resolution and read scoping Resolve third-party managers virtual-first: while a virtual (draft) record exists, its managers are authoritative; t... push web-flow github
72.43
33617014485 master Harden collection and item write endpoints: ignore server-managed fields, validate input push cyaiox github
72.29
33517173190 master feat: support status filter on GET /:address/collections (#810) push web-flow github
72.29
32887477314 master fix(auth): upgrade to crypto-middleware 6 and refuse non-canonical signers (#809) * fix(auth): upgrade to crypto-middleware 6 and refuse non-canonical signers Builds on #808, which migrated off @dcl/platform-crypto-middleware and added declaresS... push web-flow github
72.24
31191720981 master fix(auth): harden signed fetch validation (#808) * chore: inline the Node base image digest in both FROM lines Revert the NODE_IMAGE build ARG introduced in 102c192 and write the pinned digest literally in both stages. The ARG made the pinned b... push web-flow github
72.19
30370626690 master fix: asset-pack routes push cyaiox github
72.32
30291580679 master chore: Fix Dockerimage Bump the Node base image from 24.17.0 to 24.18.0 (alpine3.24) and consolidate the builder and runtime pins behind a single NODE_IMAGE ARG so the two stages cannot drift apart. Verified on the built image: Node v24.18.0 / A... push cyaiox github
71.72
30284209279 master fix: TP Collections routes push cyaiox github
71.72
27776464336 master chore: update Node base image to 24 (#807) push web-flow github
71.33
27357486919 master fix: run migrations in ts-node transpile-only mode to prevent OOM (#806) * fix: run migrations in ts-node transpile-only mode to prevent OOM The migration step (`migrate:docker`) registers ts-node with the project tsconfig, which defaults to ful... push web-flow github
71.33
See All Builds (1181)

Badge your Repo: builder-server

We detected this repo isn’t badged! Grab the embed code to the right, add it to your repo to show off your code coverage, and when the badge is live hit the refresh button to remove this message.
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

Refresh