Token validation refuses login-typed messages

[feruzm]

What

ValidateCode refuses a signed message whose signed_message.type is login, before any key lookup. Every other shape goes through the signature checks exactly as before.

A message typed login proves who signed it and nothing more: HiveSigner answers /api/me for one and refuses it at its token and broadcast routes. Ecency's own clients never send one here: wallet logins send code, and HiveSigner issues posting for the scopes the web and mobile apps request. Third-party login-scope tokens and the sign-in proof the mobile app now hands to other apps (ecency/vision-mobile#3544) are the only messages of that type, and neither should be a session on this API.

Tests

TokenTypeTests pins the refusal (with and without an extra field in the message) and eleven shapes that stay with the signature checks: the other types, a differently-cased Login, a missing, null, numeric or array type, a non-object message. Disabling the check makes the first test fail. Full suite green locally on .NET 10.

Summary by CodeRabbit

• Bug Fixes
  • Login-only tokens are now rejected during validation, including messages with an audience.
  • Token validation now consistently excludes invalid, missing, or incorrectly formatted message types.
  • Other token types continue through the standard signature checks.

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Reject login-typed messages during token validation

🐞 Bug fix 🧪 Tests 🕐 10-20 Minutes

AI Description

• Rejects signed messages explicitly typed login before signature and Hive account lookup.
• Preserves existing signature validation for all other message types and malformed type shapes.
• Adds focused tests covering rejection and unchanged fallback behavior across eleven non-login
 shapes.

Diagram

graph TD
    A["Decoded token"] --> B{"Valid structure?"}
    B -- "No" --> C["Reject token"]
    B -- "Yes" --> D{"Login type?"}
    D -- "Yes" --> C
    D -- "No" --> E["Signature checks"] --> F["Hive key lookup"] --> G["Authenticated author"]

Loading

High-Level Assessment

The early, shape-based guard is the appropriate approach because login messages are categorically invalid as API sessions and can be rejected without cryptographic work or network lookup. A dedicated helper keeps the policy directly testable, while the exact case-sensitive comparison minimizes behavioral changes for every other payload shape.

Files changed (2) +63 / -0

Bug fix (1) +21 / -0

PrivateApi.Core.csReject login-only messages before token verification +21/-0

Reject login-only messages before token verification

• Adds an early 'ValidateCode' guard that returns no session for signed-message objects whose type is exactly 'login', before digest recovery or Hive account lookup. Introduces an internal helper that safely distinguishes this type while preserving prior handling for all other JSON shapes.

dotnet/EcencyApi/Handlers/PrivateApi.Core.cs

Tests (1) +42 / -0

TokenTypeTests.csCover login-only token type rejection +42/-0

Cover login-only token type rejection

• Adds tests proving that exact lowercase 'login' message types are refused, including messages with additional fields. Parameterized cases verify that other types, casing, missing or malformed type values, arrays, and null remain eligible for existing signature validation.

dotnet/EcencyApi.Tests/TokenTypeTests.cs

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can route each action level your way: inline, summary, both, or drop

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 93b5ef2b-8395-43f1-ab51-bea3ee1f90eb

📥 Commits

Reviewing files that changed from the base of the PR and between e93b7c6 and 32a6cc0.

📒 Files selected for processing (2)

• dotnet/EcencyApi.Tests/TokenTypeTests.cs
• dotnet/EcencyApi/Handlers/PrivateApi.Core.cs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

ValidateCode now rejects messages with a string type of "login" before account and signature checks. Tests cover login messages, supported non-login types, malformed JSON shapes, casing variations, and null input.

Changes

Login token validation

Layer / File(s)	Summary
Login message detection dotnet/EcencyApi/Handlers/PrivateApi.Core.cs	IsLoginOnlyMessage identifies JSON objects whose string type is exactly "login".
Validation integration and tests dotnet/EcencyApi/Handlers/PrivateApi.Core.cs, dotnet/EcencyApi.Tests/TokenTypeTests.cs	ValidateCode rejects login messages before account and signature checks. Tests cover valid, non-login, malformed, and null inputs.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 32a6c

Login-typed signed messages are now refused before they can establish API sessions, while other message shapes retain existing validation behavior. The change is covered by focused tests and is ready to merge.

Poem

A rabbit checks the token line
"login" signs are declined on time
Other shapes pass to checks anew
Null and arrays stay out of view
Tests hop brightly through the queue

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: ValidateCode rejects login-typed messages during token validation.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/reject-login-typed-codes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}