search

AlphaWallet / TokenScript-Repo

A repo full of signed TokenScript files which are served to AlphaWallet
7 stars 10 forks source link

Repo server should either be more forgiving in terms of the contract address in the URL or use EIP55 (or all lowercase) #12

Closed hboon closed 5 years ago

hboon commented 5 years ago

The current implementation seems to just read the addresses from the TokenScript file and expects the address to be provided in the URL to match exactly. This makes it impossible for the TokenScript client to construct a URL that will predictably fetch the file correctly.

Given the TokenScript for FIFA:

<ts:address network="3">0xd8e5f58de3933e1e35f9c65eb72cb188674624f3</ts:address>
$ curl -I https://repo.tokenscript.org/2019/05/0xd8e5f58de3933e1e35f9c65eb72cb188674624f3
> 200
$ curl -I https://repo.tokenscript.org/2019/05/0xD8e5F58DE3933E1E35f9c65eb72cb188674624F3
>404

On the other hand, with EntryToken:

<ts:address network="3">0xFB82A5a2922A249f32222316b9D1F5cbD3838678</ts:address>

We have:

$ curl -I https://repo.tokenscript.org/2019/05/0xfb82a5a2922a249f32222316b9d1f5cbd3838678
> 404
$ curl -I https://repo.tokenscript.org/2019/05/0xFB82A5a2922A249f32222316b9D1F5cbD3838678
> 200

We should either:

A) Expect to be liberal about casing in the URL, or B) Enforce all lowercase, or C) Enforce EIP55

SmartLayer commented 5 years ago

Will handle it. To save you a bit of time in the future, I can understand the issue if you just say the title.

Since it's not TokenScript's task to make sure the address actually exists, I'll just implement case-ignore, close this one, file a new one about EIP55 to work on perfecting it in the future.

SmartLayer commented 5 years ago

Solved by adding a case-ignore flag, both works.

https://repo.tokenscript.org/2019/05/0x4A60C0BF93b2b3a3D20720a773E5Da8C80C427ac https://repo.tokenscript.org/2019/05/0x4A60C0BF93b2b3a3D20720a773E5Da8C80C427AC

On second thought, maybe we don't need to enforce EIP55, because it's not an EIP55 scenario (where user copy&paste might get the address wrong or accidentally replaced). This is a machine-to-machine conversation. On the long run, the Makefile in the repo should verify the existence of the smart-contracts being described (not just the syntax).

I skipped Pull-Request because you will need to test by setting up apache2 otherwise.