You are now the owner of this repo.

decentraland / signatures-server
92%

DEFAULT BRANCH: main
Repo Added
Token 5fzEDohoZWPHYubwbkDqoo9zs3BYDOw3s regen
Build 536 Last
Files 22
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH main
branch: SELECT
CHANGE BRANCH
x
Sync Branches

coverage: 91.755% (+0.3%) from 91.458%
30359218283

push

github

web-flow 
fix: stop cancelling listings whose asset the rentals contract holds (#487)

* fix: stop cancelling listings whose asset the rentals contract holds

the unauthenticated PATCH /v1/rentals-listings/:id cancelled any open listing whose asset was
not owned by the lessor, without excluding the case its own comment described: the rentals
contract holding the asset on the lessor's behalf. that is the supported flow of re-listing
after a rent ended without claiming the asset back, so anyone could enumerate listing ids
through the public GET and cancel them one by one. updateMetadata had the same defect written
differently, comparing the nft owner against the on chain lessor, a comparison that never
matched, so its guard never returned early either. both paths now share one check.

other fixes in the same area:

- the contract index cancellation wrapped a bound parameter in double quotes, which postgres
  reads as an identifier, so the statement failed, the whole batch rolled back and the job
  never advanced its cursor again. listings invalidated on chain stayed open.
- the rental contract address was stored as the caller sent it. it drives the index based
  cancellations, so repairing the statement above without validating it would have turned an
  inert bug into a bypass. it is now checked against the rentals contract of the chain.
- the cancellation issued during a refresh was neither awaited nor ordered against the
  executed update it raced. the service runs with unhandled-rejections=strict, so a rejection
  there took the process down.
- the lookup by signature in updateRentalsListings relied on and binding tighter than or, so
  neither branch joined every table and period_chosen could point at another listing's period.
- updateMetadata stored the indexer timestamp with the conversion inverted, writing dates near
  1970. that made the refresh treat the metadata as stale on every call.
- cancelRentalsListings computed a cursor it never passed to the quer... (continued)

350 of 377 branches covered (92.84%)

Branch coverage included in aggregate %.

63 of 65 new or added lines in 8 files covered. (96.92%)

2 existing lines in 1 file now uncovered.

685 of 751 relevant lines covered (91.21%)

48.31 hits per line

Relevant lines Covered
751 RELEVANT LINES 685 COVERED LINES
48.31 HITS PER LINE
Source Files on main

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
30359218283 main fix: stop cancelling listings whose asset the rentals contract holds (#487) * fix: stop cancelling listings whose asset the rentals contract holds the unauthenticated PATCH /v1/rentals-listings/:id cancelled any open listing whose asset was not ... push web-flow github
91.76
30313693906 fix/rental-listing-cancellation-and-integration-tests fix: do not race an executed listing against an index cancellation on refresh when the indexer reported a rental newer than the stored listing, the refresh queued the executed update, and the index branch, which still looked at the status the lis... Pull #487 LautaroPetaccio github
91.76
30313067898 fix/rental-listing-cancellation-and-integration-tests fix: keep index cancellations to open listings and make them visible to updatedAfter review findings on the three index bump statements. they matched rows in any status, so a nonce bump could rewrite an executed or a claimed listing to cancelled... Pull #487 LautaroPetaccio github
91.75
30311499338 fix/rental-listing-cancellation-and-integration-tests fix: compare addresses ignoring casing and alias the misspelled signer field review findings on the ownership checks and the index update query. addresses reach the server from the authorization middleware, the request body, the indexers and the... Pull #487 LautaroPetaccio github
91.74
30310656455 fix/rental-listing-cancellation-and-integration-tests chore: bump the pinned node 24 base image to 24.18.0 both stages pinned the digest of node 24.16.0. the digest is moved to the current one of the node:24-alpine tag, which is node 24.18.0, keeping the pin so the build stays reproducible. the ima... Pull #487 LautaroPetaccio github
91.61
30306353503 fix/rental-listing-cancellation-and-integration-tests fix: stop cancelling listings whose asset the rentals contract holds the unauthenticated PATCH /v1/rentals-listings/:id cancelled any open listing whose asset was not owned by the lessor, without excluding the case its own comment described: the ... Pull #487 LautaroPetaccio github
91.61
28386928073 main chore: migrate @well-known-components/tracer-component to @dcl/tracer-component (#486) Replace the last migratable @well-known-components dependency, @well-known-components/tracer-component (^1.2.0), with the @dcl equivalent @dcl/tracer-component... push web-flow github
91.46
28379576636 chore/migrate-tracer-to-dcl chore: migrate @well-known-components/tracer-component to @dcl/tracer-component Replace the last migratable @well-known-components dependency, @well-known-components/tracer-component (^1.2.0), with the @dcl equivalent @dcl/tracer-component (^1.0.... Pull #486 LautaroPetaccio github
91.46
28052205064 main fix: cancel undrained response bodies and bump @dcl core-components/core-libs deps (#485) Cancel two undrained undici response bodies in the integration ping spec, where the Response from the native-fetch-backed localFetch was discarded after ass... push web-flow github
91.46
28051307897 fix/response-body-leaks-and-dcl-bump fix: cancel undrained response bodies and bump @dcl core-components/core-libs deps Cancel two undrained undici response bodies in the integration ping spec, where the Response from the native-fetch-backed localFetch was discarded after asserting ... Pull #485 LautaroPetaccio github
91.46
See All Builds (314)

Badge your Repo: signatures-server

We detected this repo isn’t badged! Grab the embed code to the right, add it to your repo to show off your code coverage, and when the badge is live hit the refresh button to remove this message.
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

Refresh