Skip to content

Fix: Do not mask recovery failures as MISSING_SIGNER #838

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dzikowski merged 2 commits into from
Sep 17, 2026
Merged

Fix: Do not mask recovery failures as MISSING_SIGNER #838

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9451788
Fix: Do not mask recovery failures as MISSING_SIGNER
dzikowski Sep 17, 2026
06a0691
Merge branch 'main' into fix/surface-recover-public-key-error
dzikowski Sep 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 16 additions & 1 deletion chaincode/src/contracts/authenticate.spec.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
import { SubmitCallDTO, asValidUserRef } from "@gala-chain/api";
import { ChainCallDTO, SubmitCallDTO, asValidUserRef, signatures } from "@gala-chain/api";

import { GalaChainContext, GalaChainStub } from "../types";
import { authenticate } from "./authenticate";
Expand Down Expand Up @@ -66,6 +66,21 @@ describe("authenticate", () => {
// Then
await expect(result).rejects.toThrow(expectedErrorMessage);
});

it("does not emit MISSING_SIGNER when public-key recovery throws", async () => {
const { ctx } = mockedContext();
const { privateKey } = signatures.genKeyPair();
const dto = new ChainCallDTO();
dto.uniqueKey = "k";
Object.assign(dto, {
domain: { name: "GalaChain" },
types: { Message: [{ name: "uniqueKey", type: "string" }] }
});
dto.signature = signatures.getSignature(dto, signatures.normalizePrivateKey(privateKey));
Object.assign(dto, { extra: "not-in-types" });

await expect(authenticate(ctx, dto, undefined)).rejects.toThrow(/not declared in the signed type/);
});
});

function mockedContext() {
Expand Down
8 changes: 7 additions & 1 deletion chaincode/src/contracts/authenticate.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
*/
import {
ChainCallDTO,
ChainError,
ForbiddenError,
PublicKey,
UnauthorizedError,
Expand Down Expand Up @@ -328,7 +329,12 @@ function tryRecoverEthPublicKey(
const address = signatures.getEthAddress(publicKeyHex);
return { publicKeyHex, address };
} catch (err) {
return undefined;
// DER / no-recovery signatures cannot recover a key. Everything else
// (payload hash, undeclared EIP-712 fields) must surface as-is.
if (ChainError.from(err).key === "INVALID_SIGNATURE_FORMAT") {
return undefined;
}
throw err;
}
}

Expand Down
Loading