decentraland / world-storage-service / 29354643191

Builds Branch Commit Type Ran Committer Via Coverage
29354643191 1.6.0 feat: authorize scene-scoped storage delegations for env value reads (#113) env values are keyed by place_id = f(world, parcel) — the same scope the x-authoritative-scope claim pins — so GET /env/:key can accept a scene worker's world-scoped stor... push web-flow github
98.68
29354048524 main feat: authorize scene-scoped storage delegations for env value reads (#113) env values are keyed by place_id = f(world, parcel) — the same scope the x-authoritative-scope claim pins — so GET /env/:key can accept a scene worker's world-scoped stor... push web-flow github
98.68
29352955722 feat/env-scoped-storage-delegation feat: authorize scene-scoped storage delegations for env value reads env values are keyed by place_id = f(world, parcel) — the same scope the x-authoritative-scope claim pins — so GET /env/:key can accept a scene worker's world-scoped storage del... Pull #113 LautaroPetaccio github
98.68
29270565013 1.5.0 feat: authorize world-scoped authoritative storage delegations (#112) * feat: authorize world-scoped authoritative storage delegations Adds an additive authorization path for /values/* so an authoritative scene server can read/write a world's st... push web-flow github
98.68
28960364948 main feat: authorize world-scoped authoritative storage delegations (#112) * feat: authorize world-scoped authoritative storage delegations Adds an additive authorization path for /values/* so an authoritative scene server can read/write a world's st... push web-flow github
98.68
28907443724 feat/scoped-storage-delegation refactor: encapsulate the signature check; document confinement model (review round 3) #4: extract isPersonalSignatureBy(address, message, signature) so the synthetic [SIGNER, ECDSA_PERSONAL_SIGNED_ENTITY] auth-chain trick is contained behind a c... Pull #112 LautaroPetaccio github
98.68
28898748893 feat/scoped-storage-delegation fix: harden storage delegation verification (review round 2) B1: guard a JSON 'null'/primitive payload before destructuring — previously threw a TypeError out of verifyStorageDelegation (attacker-triggerable 500, and broke owner/deployer fall-thr... Pull #112 LautaroPetaccio github
98.74
28895412237 feat/scoped-storage-delegation feat: enforce scene scope on storage delegations; guard header size Security review F2/F5: verifyStorageDelegation now takes a target { signer, world, sceneId, parcel, trustedSigners } and requires the claim's sceneId == the request's scene and p... Pull #112 LautaroPetaccio github
98.53
28891675888 feat/scoped-storage-delegation chore: fix eslint (prettier, import order, interface types, typed auth chain) Pull #112 LautaroPetaccio github
98.57
28891028092 feat/scoped-storage-delegation fix: restrict storage scope-claim signers to the authoritative address; cover the scoped path Least authority: a scope claim is trusted only when signed by AUTHORITATIVE_SERVER_ADDRESS, not by every AUTHORIZED_ADDRESSES entry. Add middleware-leve... Pull #112 LautaroPetaccio github
98.57
28889895322 feat/scoped-storage-delegation feat: enforce storage delegation expiry again (1h TTL) Re-add the Expiration claim line and the expiry check; delegations are short-lived and renewed by the worker over IPC, so an expired claim must be rejected. Pull #112 LautaroPetaccio github
97.92
28888929248 feat/scoped-storage-delegation refactor: storage delegations no longer expire (worker-lifetime) Drop the Expiration line from the claim and the expiry check: the ephemeral lives for the life of the scene worker. The ephemeral==signer binding and world scoping remain; revoke by... Pull #112 LautaroPetaccio github
97.9
28628817499 main fix: harden storage quotas, input validation, and upstream resilience (#111) * fix: harden storage quotas, input validation, and upstream resilience Fixes from a full-codebase audit: Quota correctness: - Credit the existing value against the ex... push web-flow github
98.82
28623054580 fix/audit-hardening refactor: address P2 review comments - Drain the body of the final non-OK upstream response before throwing/returning on the Places, worlds-content-server, and LAMBDAS error paths. The fetcher cancels bodies of retried responses itself but ha... Pull #111 LautaroPetaccio github
98.82
28621152435 fix/audit-hardening fix: close cache staleness under concurrent writes and a migration abort Two issues found in a deeper review of the hardening changes: - Cache coherence: the post-commit write-through set ran outside the quota advisory lock, and deleteValue ta... Pull #111 LautaroPetaccio github
98.82