decentraland / notifications-workers

80%

main: 80%

LAST BUILD ON BRANCH 3.12.2

branch: SELECT

CHANGE BRANCH

x

Sync Branches

• No branch selected
• 1.1.0
• 1.2.0
• 1.4.0
• 1.5.0
• 1.6.0
• 1.7.0
• 2.0.0
• 2.1.0
• 2.1.1
• 2.2.0
• 2.2.1
• 2.2.2
• 2.3.0
• 3.0.0
• 3.1.0
• 3.12.0
• 3.12.1
• 3.12.2
• chore/coveralls-configuration
• dependabot/npm_and_yarn/well-known-components/pg-component-1.1.0
• feat/add-email-validation-failed-event
• feat/allow-one-single-email-per-wallet
• feat/communities-notifications
• feat/credits-email-confirmation
• feat/credits-emails
• feat/credits-notification
• feat/credits-reminder-usage-enhance
• feat/email-domains-blacklist
• feat/endpoint-to-send-email
• feat/event-created-notification
• feat/long-polling-sqs
• feat/poc-real-time
• feat/referral-notification
• feat/retrieve-user-email
• feat/social-service-notifications
• feat/social-service-notifications-with-new-props
• feat/streaming
• feat/streaming-image
• feat/turnstile
• feat/update-mail-templates
• feat/update-referral-metadata
• feat/update-schemas
• fix/accept-legacy-signed-payload
• fix/community-deleted-event-parsing
• fix/credits-usage-emails
• fix/credits-usage-reminder-email
• fix/crypto-middleware-6
• fix/crypto-middleware-6.3
• fix/domain-allowlist
• fix/email-encoding-typo
• fix/ff-blacklist-domain-name
• fix/notifications-canonical-signer-validation
• fix/typo
• main

Build # 33279967354

Build Type

push

github

Committed by web-flow

Commit Message

fix(auth): upgrade @dcl/crypto-middleware to 6.3.0 (#186)

* fix(auth): upgrade @dcl/crypto-middleware to 6.3.0

`rejectIfSigner` reads the exact `signer` key, so metadata delivering
`{"Signer":"decentraland-kernel-scene"}` presented no `signer` field at
all and the gate read it as absent -- answering "allowed" for a request
that visibly names the signer the gate exists to refuse.

This is reachable on the strict, current-format path. Since 6.0.0 the
metadata bytes are signed as delivered, so re-spelling the key changes
the signed bytes -- but a scene-driven client can simply sign it that
way, and the signature then verifies. The routes on the strict
middleware declare no `canonicalMetadataKeys`, so nothing else was
catching it there.

6.3.0 adds a `hasFoldedVariant` guard to `canonicalField` and
`requireCanonicalField`: a key that case-folds to the declared field
without being spelled exactly that is a rejection, not an absence.

The caret range already allowed 6.3.0, so the lockfile refresh is the
load-bearing part -- the range bump only makes the intent explicit.

* test: reuse the shared signed-fetch helpers from @dcl/test-helpers

The local getIdentity/getAuthHeaders in inbox/test/utils.ts were a hand-rolled
copy of the ADR-44 signing that @dcl/test-helpers already provides. Bump the
package to ^0.3.2 — the first release whose getAuthHeaders signs the unfolded
6.x payload rather than the pre-6.0.0 folded one — and re-export its helpers so
the payload format lives in one place that stays in step with
@dcl/crypto-middleware.

makeRequest now calls getSignedAuthHeaders instead of repeating the signPayload
boilerplate. getIdentityFromPrivateKey is kept: it has no shared equivalent.

All three workspaces are bumped together so the monorepo resolves a single
test-helpers. common and processor only use createRunner and
createLocalFetchComponent, whose public surface is unchanged in 0.3.x. Doing
them together also drops the stale nested @dcl/crypto-middl... (continued)

Coverage Stats

239 of 377 branches covered (63.4%)

Branch coverage included in aggregate %.

881 of 1016 relevant lines covered (86.71%)

20.73 hits per line