FediMovies/fedimovies
1
1
Fork 0
Code Issues 3 Pull requests Projects Releases Packages Activity

Do not expose login wallet address via search

Browse source 
Login address is considered private unless verified.
This commit is contained in:
silverpill 2022-05-25 23:36:41 +00:00
parent dc8a7bed2e
commit 80880555bf
1 changed files with 8 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
src/models/profiles/queries.rs
View file

@ -378,14 +378,15 @@ pub async fn search_profile_by_wallet_address(
let field_name = get_currency_field_name(currency);
let did_str = DidPkh::from_address(currency, wallet_address).to_string();
// If currency is Ethereum,
// search over extra fields must be case insensitive
// search over extra fields must be case insensitive.
// This query does not scan user_account.wallet_address because
// login addresses are private by default.
let rows = db_client.query(
"
SELECT actor_profile, TRUE AS is_verified
FROM actor_profile LEFT JOIN user_account USING (id)
FROM actor_profile
WHERE
user_account.wallet_address = $2
OR EXISTS (
EXISTS (
SELECT 1
FROM jsonb_array_elements(actor_profile.identity_proofs) AS proof
WHERE proof ->> 'issuer' = $3
@ -557,12 +558,12 @@ mod tests {
wallet_address: Some(wallet_address.to_string()),
..Default::default()
};
let user = create_user(db_client, user_data).await.unwrap();
let _user = create_user(db_client, user_data).await.unwrap();
let profiles = search_profile_by_wallet_address(
db_client, &ETHEREUM, wallet_address, false).await.unwrap();
assert_eq!(profiles.len(), 1);
assert_eq!(profiles[0].id, user.profile.id);
// Login address must not be exposed
assert_eq!(profiles.len(), 0);
}
#[tokio::test]