decentraland / world-storage-service / 28960364948

Builds Branch Commit Type Ran Committer Via Coverage
28960364948 main feat: authorize world-scoped authoritative storage delegations (#112) * feat: authorize world-scoped authoritative storage delegations Adds an additive authorization path for /values/* so an authoritative scene server can read/write a world's st... push web-flow github
98.68
28907443724 feat/scoped-storage-delegation refactor: encapsulate the signature check; document confinement model (review round 3) #4: extract isPersonalSignatureBy(address, message, signature) so the synthetic [SIGNER, ECDSA_PERSONAL_SIGNED_ENTITY] auth-chain trick is contained behind a c... Pull #112 LautaroPetaccio github
98.68
28898748893 feat/scoped-storage-delegation fix: harden storage delegation verification (review round 2) B1: guard a JSON 'null'/primitive payload before destructuring — previously threw a TypeError out of verifyStorageDelegation (attacker-triggerable 500, and broke owner/deployer fall-thr... Pull #112 LautaroPetaccio github
98.74
28895412237 feat/scoped-storage-delegation feat: enforce scene scope on storage delegations; guard header size Security review F2/F5: verifyStorageDelegation now takes a target { signer, world, sceneId, parcel, trustedSigners } and requires the claim's sceneId == the request's scene and p... Pull #112 LautaroPetaccio github
98.53
28891675888 feat/scoped-storage-delegation chore: fix eslint (prettier, import order, interface types, typed auth chain) Pull #112 LautaroPetaccio github
98.57
28891028092 feat/scoped-storage-delegation fix: restrict storage scope-claim signers to the authoritative address; cover the scoped path Least authority: a scope claim is trusted only when signed by AUTHORITATIVE_SERVER_ADDRESS, not by every AUTHORIZED_ADDRESSES entry. Add middleware-leve... Pull #112 LautaroPetaccio github
98.57
28889895322 feat/scoped-storage-delegation feat: enforce storage delegation expiry again (1h TTL) Re-add the Expiration claim line and the expiry check; delegations are short-lived and renewed by the worker over IPC, so an expired claim must be rejected. Pull #112 LautaroPetaccio github
97.92
28888929248 feat/scoped-storage-delegation refactor: storage delegations no longer expire (worker-lifetime) Drop the Expiration line from the claim and the expiry check: the ephemeral lives for the life of the scene worker. The ephemeral==signer binding and world scoping remain; revoke by... Pull #112 LautaroPetaccio github
97.9
28628817499 main fix: harden storage quotas, input validation, and upstream resilience (#111) * fix: harden storage quotas, input validation, and upstream resilience Fixes from a full-codebase audit: Quota correctness: - Credit the existing value against the ex... push web-flow github
98.82
28623054580 fix/audit-hardening refactor: address P2 review comments - Drain the body of the final non-OK upstream response before throwing/returning on the Places, worlds-content-server, and LAMBDAS error paths. The fetcher cancels bodies of retried responses itself but ha... Pull #111 LautaroPetaccio github
98.82
28621152435 fix/audit-hardening fix: close cache staleness under concurrent writes and a migration abort Two issues found in a deeper review of the hardening changes: - Cache coherence: the post-commit write-through set ran outside the quota advisory lock, and deleteValue ta... Pull #111 LautaroPetaccio github
98.82
28617557401 fix/audit-hardening refactor: address PR review comments - places: validate the upstream response shape in extractPlaceId instead of trusting a bare cast, consistent with the worlds-content-server adapter; drop the `as PlacesApiResponse` cast at the call site. -... Pull #111 LautaroPetaccio github
98.69
28615156822 fix/audit-hardening fix: harden storage quotas, input validation, and upstream resilience Fixes from a full-codebase audit: Quota correctness: - Credit the existing value against the exact (place_id, key) row on upserts; a same-named key in another scene could pr... Pull #111 LautaroPetaccio github
98.68
28469033931 main feat: cache storage reads and cut JSON CPU on the hot paths (#110) * feat: cache storage reads and cut JSON CPU on the hot paths Adds a dedicated in-memory cache (per-instance, TTL-bounded) and removes redundant JSON work on the most-used world/... push web-flow github
99.35
28466484362 feat/storage-caching-and-json-perf test: cover the list value::text passthrough with special-character values Adds integration tests (world + player GET .../values list) that store keys and values containing quotes, backslashes, newlines and unicode, and assert the list round-trip... Pull #110 LautaroPetaccio github
99.35