decentraland / world-storage-service
99%

DEFAULT BRANCH: main
Repo Added
Files 58
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH main
branch: SELECT
CHANGE BRANCH
x

coverage: 98.68% (-0.1%) from 98.824%
28960364948

push

github

web-flow 
feat: authorize world-scoped authoritative storage delegations (#112)

* feat: authorize world-scoped authoritative storage delegations

Adds an additive authorization path for /values/* so an authoritative scene server can read/write a world's storage without holding the authoritative key.

A request signed by a throwaway ephemeral is authorized when it carries an x-authoritative-scope claim, signed by a trusted AUTHORITATIVE_SERVER_ADDRESS, that binds that ephemeral to the target world and has not expired. The claim's ephemeral must equal the request signer (blocks replaying a captured claim with another key). The existing owner/ACL and broad authorized-address paths are unchanged.

Pin @dcl/crypto (was transitive) since verifyStorageDelegation uses it directly.

* refactor: storage delegations no longer expire (worker-lifetime)

Drop the Expiration line from the claim and the expiry check: the ephemeral lives for the life of the scene worker. The ephemeral==signer binding and world scoping remain; revoke by rotating the authoritative key.

* feat: enforce storage delegation expiry again (1h TTL)

Re-add the Expiration claim line and the expiry check; delegations are short-lived and renewed by the worker over IPC, so an expired claim must be rejected.

* fix: restrict storage scope-claim signers to the authoritative address; cover the scoped path

Least authority: a scope claim is trusted only when signed by AUTHORITATIVE_SERVER_ADDRESS, not by every AUTHORIZED_ADDRESSES entry. Add middleware-level tests for the world-scoped delegation branch (valid, untrusted signer, wrong ephemeral, wrong world, expired, missing header).

* chore: fix eslint (prettier, import order, interface types, typed auth chain)

* feat: enforce scene scope on storage delegations; guard header size

Security review F2/F5: verifyStorageDelegation now takes a target { signer, world, sceneId, parcel, trustedSigners } and requires the claim's sceneId == the request's scene and pa... (continued)

424 of 438 branches covered (96.8%)

Branch coverage included in aggregate %.

69 of 70 new or added lines in 2 files covered. (98.57%)

1146 of 1153 relevant lines covered (99.39%)

69.42 hits per line

Relevant lines Covered
1153 RELEVANT LINES 1146 COVERED LINES
69.42 HITS PER LINE
Source Files on main

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
28960364948 main feat: authorize world-scoped authoritative storage delegations (#112) * feat: authorize world-scoped authoritative storage delegations Adds an additive authorization path for /values/* so an authoritative scene server can read/write a world's st... push web-flow github
98.68
28907443724 feat/scoped-storage-delegation refactor: encapsulate the signature check; document confinement model (review round 3) #4: extract isPersonalSignatureBy(address, message, signature) so the synthetic [SIGNER, ECDSA_PERSONAL_SIGNED_ENTITY] auth-chain trick is contained behind a c... Pull #112 LautaroPetaccio github
98.68
28898748893 feat/scoped-storage-delegation fix: harden storage delegation verification (review round 2) B1: guard a JSON 'null'/primitive payload before destructuring — previously threw a TypeError out of verifyStorageDelegation (attacker-triggerable 500, and broke owner/deployer fall-thr... Pull #112 LautaroPetaccio github
98.74
28895412237 feat/scoped-storage-delegation feat: enforce scene scope on storage delegations; guard header size Security review F2/F5: verifyStorageDelegation now takes a target { signer, world, sceneId, parcel, trustedSigners } and requires the claim's sceneId == the request's scene and p... Pull #112 LautaroPetaccio github
98.53
28891675888 feat/scoped-storage-delegation chore: fix eslint (prettier, import order, interface types, typed auth chain) Pull #112 LautaroPetaccio github
98.57
28891028092 feat/scoped-storage-delegation fix: restrict storage scope-claim signers to the authoritative address; cover the scoped path Least authority: a scope claim is trusted only when signed by AUTHORITATIVE_SERVER_ADDRESS, not by every AUTHORIZED_ADDRESSES entry. Add middleware-leve... Pull #112 LautaroPetaccio github
98.57
28889895322 feat/scoped-storage-delegation feat: enforce storage delegation expiry again (1h TTL) Re-add the Expiration claim line and the expiry check; delegations are short-lived and renewed by the worker over IPC, so an expired claim must be rejected. Pull #112 LautaroPetaccio github
97.92
28888929248 feat/scoped-storage-delegation refactor: storage delegations no longer expire (worker-lifetime) Drop the Expiration line from the claim and the expiry check: the ephemeral lives for the life of the scene worker. The ephemeral==signer binding and world scoping remain; revoke by... Pull #112 LautaroPetaccio github
97.9
28628817499 main fix: harden storage quotas, input validation, and upstream resilience (#111) * fix: harden storage quotas, input validation, and upstream resilience Fixes from a full-codebase audit: Quota correctness: - Credit the existing value against the ex... push web-flow github
98.82
28623054580 fix/audit-hardening refactor: address P2 review comments - Drain the body of the final non-OK upstream response before throwing/returning on the Places, worlds-content-server, and LAMBDAS error paths. The fetcher cancels bodies of retried responses itself but ha... Pull #111 LautaroPetaccio github
98.82
See All Builds (164)