safe-global / safe-client-gateway / 13453624767 / 1

89%

main: 89%

push

github

feat: only allow adding wallets with signature (#2345)

This modifies the current endpoint for adding a `Wallet` to a `User` to expect a SiWe `message` and `signature`, which must pass validation in order to succeed.

The `POST` `/v1/wallet/:walletAddress` endpoint now becomes `/v1/wallet/add`, which requires the original access token cookie, as well as the following request:

```ts
type Request = {
  message: string;
  signature: `0x${string}`
}
```

The `message` is parsed according to EIP-4362 (Sign-In with Ethereum) and the `signature` validated accordingly. The recovered address is that which a `Wallet` is created for.

As with other endpoints, the access token cookie is responsible for finding the `User` - the `address` of the token:

- Rename `POST` `/v1/wallet/:walletAddress` to `/v1/wallet/add`, and expect/validate payload
- Add `SiweMessageSchema`, responsible for parsing a string `message` to an object
- Add `ISiweRepository['getValidatedSiweMessage']`, responsible for returning a parsed/validated string `message` as an object
- Add/update tests accordingly

590 of 3647 branches covered (16.18%)

Branch coverage included in aggregate %.

11864 of 20966 relevant lines covered (56.59%)

6.65 hits per line