Skip to content

fix: persistent storage required params to allow authToken#1341

Merged
ndrpp merged 1 commit intomainfrom
fix/persistent-storage-required-params
Apr 21, 2026
Merged

fix: persistent storage required params to allow authToken#1341
ndrpp merged 1 commit intomainfrom
fix/persistent-storage-required-params

Conversation

@ndrpp
Copy link
Copy Markdown
Member

@ndrpp ndrpp commented Apr 21, 2026

Fixes # .

Changes proposed in this PR:

  • update persistent storage handlers required input params to allow authToken usage

@ndrpp
Copy link
Copy Markdown
Member Author

ndrpp commented Apr 21, 2026

/run-security-scan

Copy link
Copy Markdown
Member

@alexcos20 alexcos20 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI automated code review (Gemini 3).

Overall risk: medium

Summary:
This pull request refactors the validation logic for several persistent storage command handlers (CreateBucketHandler, GetBucketsHandler, ListFilesHandler, GetFileObjectHandler, UploadFileHandler, DeleteFileHandler). It specifically removes consumerAddress, signature, and nonce from the list of parameters explicitly checked for presence within the validateCommandParameters function for these handlers. This change suggests that the validation of these authentication/authorization-related parameters is now either handled at a higher level in the request processing pipeline or is no longer considered a strict requirement for the structural validity of these specific commands.

Comments:
• [WARNING][security] The parameters consumerAddress, signature, and nonce have been removed from the required validation list for PersistentStorageCreateBucketCommand and similar commands throughout this file. While this might simplify individual handler logic, these parameters are typically crucial for authentication and authorization.

Please confirm that these parameters are indeed validated at a higher level in the request pipeline (e.g., by a middleware or a common authentication handler) before reaching these specific persistent storage operations, or that their absence from this validation step does not introduce security vulnerabilities like unauthorized access or command spoofing. If these checks are not performed elsewhere, this change could pose a significant risk.

@ndrpp ndrpp marked this pull request as ready for review April 21, 2026 06:37
@ndrpp ndrpp merged commit d46bae2 into main Apr 21, 2026
18 of 19 checks passed
@ndrpp ndrpp deleted the fix/persistent-storage-required-params branch April 21, 2026 06:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants