fix(rpc): Validate accepts object params, not just arrays#14
Merged
Conversation
Validate decoded the signed params into []interface{}, which rejects JSON
objects. Real-world conveyor / koa-jsonrpc clients sign object params
(e.g. {"account":"foo"}), so every authenticated request would fail
with "failed to unmarshal params".
The []interface{} type was copied from RpcRequest.Params on day one and
never revisited — the JS reference (@steemit/rpc-auth validate) returns
JSON.parse(jsonString), which is shape-agnostic (any). This change aligns
the Go side: the decode target and return type are now interface{}.
Breaking change for callers of rpc.Validate: return type changes from
[]interface{} to interface{}. The only known caller (steemgosdk
API.VerifySignedRequest) will be updated in a follow-up once this is
tagged.
Tests:
- TestValidate / TestValidate_WithVerifySignedRpc updated to type-assert
the returned interface{} before indexing.
- New TestValidate_ObjectParams regression test signs and validates
object params — this would have failed before the fix.
kuny0707
approved these changes
Jul 14, 2026
ety001
added a commit
to steemit/steemgosdk
that referenced
this pull request
Jul 15, 2026
…pe (#12) steemutil v0.0.26 (PR steemit/steemutil#14) changed rpc.Validate's return type from []interface{} to interface{} to accept JSON object params (the shape conveyor/koa-jsonrpc clients actually sign). This is the follow-up: - go.mod: require steemutil v0.0.26 - api/verify.go: VerifySignedRequest return type []interface{} -> interface{} to match. Updated doc comment to note the shape-agnostic semantics. - api/verify_test.go: TestVerifySignedRequest_Success now type-asserts the returned interface{} before indexing (previously assumed []interface{}).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
rpc.Validatedecoded the signed params into[]interface{}, which rejects JSON objects. Real-world conveyor /@steemit/koa-jsonrpcclients sign object params (e.g.{"account":"foo"}), so every authenticated request fails with"failed to unmarshal params".Root cause
The
[]interface{}type was copied fromRpcRequest.Paramsin the first commit and never revisited. The JS reference (@steemit/rpc-auth validate) returnsJSON.parse(jsonString), which is shape-agnostic (accepts objects, arrays, scalars — any valid JSON).Evidence that this was not a deliberate design:
koa-jsonrpc/test/auth.ts) sign with object params exclusivelyFix
Changed the decode target and return type from
[]interface{}tointerface{}, matching JSJSON.parsesemantics.Breaking change for callers of
rpc.Validate: return type changes from[]interface{}tointerface{}. The only known production caller issteemgosdk'sAPI.VerifySignedRequest, which will be updated in a follow-up PR once this is tagged.Tests
TestValidateandTestValidate_WithVerifySignedRpcupdated to type-assert the returnedinterface{}before indexing (they previously assumed[]interface{})TestValidate_ObjectParamsregression test: signs and validates object params — this fails on the old code with"failed to unmarshal params", passes after the fixVerification
go build ./...✅go vet ./...✅go test ./rpc/ -v✅ (all pass including the new regression test)