MarketTakers/arbiter
6
0
Fork 0
Code Issues 14 Pull Requests 7 Packages Projects Releases Wiki Activity

security(evm): remove client-controlled wallet_access_id from grant revocation

Browse Source
This commit is contained in:
CleverWild
2026-06-09 19:36:44 +02:00
committed by Skipper
parent bb28d311a1
commit 7e23b3b2ec
5 changed files with 4 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
server/crates/arbiter-server/src/actors/evm/mod.rs
View File

@@ -161,10 +161,9 @@ impl EvmActor {
pub async fn useragent_delete_grant(
&mut self,
grant_id: i32,
wallet_access_id: i32,
) -> Result<(), Error> {
self.engine
.revoke_grant(grant_id, wallet_access_id)
.revoke_grant(grant_id)
.await
.map_err(Error::from)
}

5
server/crates/arbiter-server/src/actors/user_agent/session/connection.rs
View File

@@ -360,13 +360,12 @@ impl UserAgentSession {
pub(crate) async fn handle_grant_delete(
&mut self,
grant_id: i32,
wallet_access_id: i32,
) -> Result<(), GrantMutationError> {
// match self
// .props
// .actors
// .evm
// .ask(UseragentDeleteGrant { grant_id, wallet_access_id })
// .ask(UseragentDeleteGrant { grant_id })
// .await
// {
// Ok(()) => Ok(()),
@@ -375,7 +374,7 @@ impl UserAgentSession {
// Err(GrantMutationError::Internal)
// }
// }
let _ = (grant_id, wallet_access_id);
let _ = grant_id;
todo!()
}