decentraland / notifications-workers

80%

push

github

fix(auth): upgrade @dcl/crypto-middleware to 6.2 (#184)

6.0.0 changed the signed payload: the method, path and timestamp are
lowercased and the metadata is then joined verbatim, instead of folding
the whole joined string. The old fold left metadata casing outside the
signature, so a re-cased or renamed property kept a valid signature while
reading as absent to a case-sensitive comparison.

The `/notifications`, `/subscription`, `/subscription/opt-outs` and
`/set-email` routes gated on `metadata.signer !== 'decentraland-kernel-scene'`,
which that gap defeated: delivering `Signer` (or `Decentraland-Kernel-Scene`)
made `metadata.signer` read as `undefined`, which passes a `!==` check, and
the scene request was served as a directly user-signed one.

Adopt the 6.1.0 `rejectIfSigner` predicate, which refuses a non-canonical
`signer` rather than folding it, and runs before signature verification so
it guards the request either way.

`canonicalMetadataKeys` is deliberately not set: unity-explorer signs its
notifications calls with empty metadata, which is byte-identical under both
payload formats, so there is no legacy-signed traffic to accept here.

The test signing helper built the pre-6.0.0 payload; it now builds the
current one. Every suite's metadata is all-lowercase, so no signature it
produced actually changed.

239 of 377 branches covered (63.4%)

Branch coverage included in aggregate %.

1 of 1 new or added line in 1 file covered. (100.0%)

877 of 1012 relevant lines covered (86.66%)

20.19 hits per line