decentraland / world-storage-service / 29352955722 / 1

99%

main: 99%

Pull #113

github

feat: authorize scene-scoped storage delegations for env value reads

env values are keyed by place_id = f(world, parcel) — the same scope the
x-authoritative-scope claim pins — so GET /env/:key can accept a scene
worker's world-scoped storage delegation with the same confinement the
/values routes already grant. this lets a headless authoritative worker
read its own scene's env secrets without ever holding the authoritative
key.

- add authorizedAddressesOrScopedDelegationAuthorizationMiddleware
  (authorized addresses OR a valid scene-scoped delegation; still no
  owners/deployers) and wire it onto GET /env/:key
- the remaining env routes (list/upsert/delete) stay owner/deployer-only
  and never accept a delegation
- cover the route with unit + integration tests (valid delegation reads;
  parcel-mismatched claim is rejected)
- correct pre-existing schema-doc drift from the place_id migration: the
  world_storage, player_storage and env_variables primary keys all
  include place_id

455 of 472 branches covered (96.4%)

Branch coverage included in aggregate %.

2292 of 2306 relevant lines covered (99.39%)

35.22 hits per line