-
Notifications
You must be signed in to change notification settings - Fork 8
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add additional signed data checks #168
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
As I mentioned in the comment, I think fixing the confusing case mentioned in the issue is not worth it. It won't happen in practice and I only reproduced it because I saved some very old signed data response in my Postman.
WDYT?
continue; | ||
} | ||
|
||
if (Date.now() / 1000 - requestTimestamp > 60 * 60) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Mhh, what is wrong with >1h old signed data?
logger.debug('Not storing signed data because signed data with the same timestamp already exists.', { | ||
const goReadDb = await go(async () => get(signedData.airnode, signedData.templateId)); | ||
|
||
if (goReadDb.data && requestTimestamp <= Number.parseInt(goReadDb.data.timestamp, 10)) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We want to store even older data we have because it might be served by other (delayed) endpoint. To address the issue we would need to check whether the signed data will be pruned, but checking that is more complex than I initially thought (and probably not worth relative to the added benefit).
Sounds good to me, we can always come back to it. In practice we shouldn't be pushing very old signed data to the chain anyway (ultimately that's where the data will be going via Airseeker). |
Closes #162
This PR expands the existing signed data freshness check to confirm that the sample we've received is newer than what we already have (if we have something to compare against).
It also checks that the received sample is not older than an hour.
I'm not sure if this satisfies the issue? 🤷