You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently UserProfile is saved on GCUP/<eth-addr> key and contains the alias field. When you authorize with signature-based auth ctx.callingUser is set to alias. Also all balances and other user-related key parts use alias. But when you do some operations, like fetching balances or tranferring tokens, we don't search for aliases. If you provide eth|<ath-addr> for user that has an alias, it won't find the alias, which leads to potentially inconsistent state.
Implementation proposal:
For all DTO parameters which point to user, use a custom class UserId (like owner?: UserId in FetchBalances)
UserId should be serialized to string and deserialized from string to something like { "userId": string }
For all ChainObject parameters which point to user, use a custom class - UserAlias.
UserAlias should be serialized to string containing user alias to keep backward compatibility (we use alias-first approach), and deserialized to something like { "alias": string }.
Each time you want to use UserAlias type, you need to get it with some custom method like getUserAlias(id: UserId): UserAlias. This way we keep type-safety and enforce resolving user aliases.
Additionally we should support lower-cased eth addresses (not only checksumed ones)
To be considered:
Maybe we should implement it once we drop the legacy auth: Drop support for legacy auth #176 There is a risk that making it backward compatible with the legacy auth may be problematic. But there is also a benefit of making it backward compatible - no need to wait till the 2.0 release.
The text was updated successfully, but these errors were encountered:
Currently
UserProfile
is saved onGCUP/<eth-addr>
key and contains thealias
field. When you authorize with signature-based authctx.callingUser
is set toalias
. Also all balances and other user-related key parts use alias. But when you do some operations, like fetching balances or tranferring tokens, we don't search for aliases. If you provideeth|<ath-addr>
for user that has an alias, it won't find the alias, which leads to potentially inconsistent state.Implementation proposal:
UserId
(likeowner?: UserId
inFetchBalances
)UserId
should be serialized to string and deserialized from string to something like{ "userId": string }
UserAlias
.UserAlias
should be serialized to string containing user alias to keep backward compatibility (we use alias-first approach), and deserialized to something like{ "alias": string }
.UserAlias
type, you need to get it with some custom method likegetUserAlias(id: UserId): UserAlias
. This way we keep type-safety and enforce resolving user aliases.Additionally we should support lower-cased eth addresses (not only checksumed ones)
To be considered:
The text was updated successfully, but these errors were encountered: