Skip to content

fix(wallet-auth): preserve signed upload form field names - #2002

Closed
Osraka wants to merge 1 commit into
ProjectOpenSea:mainfrom
Osraka:osraka/fix-upload-field-casing
Closed

fix(wallet-auth): preserve signed upload form field names#2002
Osraka wants to merge 1 commit into
ProjectOpenSea:mainfrom
Osraka:osraka/fix-upload-field-casing

Conversation

@Osraka

@Osraka Osraka commented Aug 24, 2026

Copy link
Copy Markdown
Contributor

Motivation

Closes #2001

UploadContext.fields is an opaque signed multipart field map. Its generated schema explicitly tells callers to submit every entry unchanged, but wallet-auth responses are camelized by default. That rewrites valid field names such as success_action_status to successActionStatus, so the SDK can return a different upload context from the one supplied by the API.

All four wallet-auth helpers that return an UploadContext are affected: drop item media, drop allowlist, collection image, and profile image uploads.

Solution

Disable response camelization only for those four upload-context helpers. Other wallet-auth responses keep their existing camelCase behavior, and the profile image request keeps its existing snakeizeBody: false behavior.

The regression coverage verifies both response shapes used by the API:

  • a single upload context through the real fetch boundary
  • an array of upload contexts through the real fetch boundary
  • all four helper call sites opt out of response camelization

Validation:

  • npm run build
  • npm run check-types
  • npm run lint (passes with the existing unrelated Function warning)
  • npm test (48 files, 1009 tests)

@ryanio

ryanio commented Sep 4, 2026

Copy link
Copy Markdown
Collaborator

Thanks, this was a good catch. UploadContext.fields is an opaque signed map and the blanket response camelization was rewriting valid S3 policy fields like success_action_status, so the form we handed back no longer matched the signed policy.

Recreated internally and shipped in @opensea/sdk v12.0.2, with all four upload-context helpers opted out of response camelization. Testing through the real fetch boundary rather than a mocked fetcher was the right call, and that is how we kept it: the existing wallet-auth tests mock WalletAuthFetcher.request directly, which is exactly why this went unnoticed. You are credited as co-author.

This repo is a read-only mirror so we cannot merge here. Closing as shipped.

@ryanio ryanio closed this Sep 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Wallet-auth upload contexts rewrite signed multipart field names

2 participants