decentraland / comms-gatekeeper / 23764155057 / 1

84%

main: 84%

push

github

feat: add token-based moderator authentication (#250)

* feat: add token-based moderator authentication

Add MODERATOR_TOKEN env var as an alternative auth method for moderation
routes. Moderators can now authenticate via Bearer token instead of
wallet signatures, with identity provided via a moderator query parameter.

* fix: pass config to createModeratorComponent in test components

* fix: update integration tests to expect 401 for unsigned moderation requests

With signedFetch set to optional, unsigned requests now pass through to
the moderator middleware which returns 401 instead of signedFetch's 400.

* refactor: parameterize moderator middleware with moderatorRequired option

Replace two separate middlewares with a single configurable
moderatorAuthMiddleware({ moderatorRequired }) factory. Write endpoints
require the moderator query param, read endpoints do not.

* fix: address security review feedback for moderator token auth

- Use timing-safe comparison for token validation to prevent timing attacks
- Sanitize moderator query parameter (alphanumeric, max 100 chars)
- Add audit logging for token-based auth success and failure

998 of 1327 branches covered (75.21%)

Branch coverage included in aggregate %.

5302 of 6162 relevant lines covered (86.04%)

20.67 hits per line