fix(mediorum): case-insensitive access authority check by rickyrombo · Pull Request #203 · OpenAudio/go-openaudio

rickyrombo · 2026-04-10T18:50:16Z

Summary

Ethereum addresses can have mixed casing (EIP-55 checksummed vs lowercase), causing access authority lookups in management_keys to fail when casing doesn't match exactly.
Updated all three streaming auth paths (requireRegisteredSignature, serveTrack, streamTrackGRPC) to use LOWER(address) = LOWER(?) for case-insensitive comparison.
This is consistent with the existing strings.EqualFold used for validator/peer wallet checks.

Test plan

Verify streaming works when signer wallet is checksummed but DB stores lowercase address (and vice versa)
Confirm gated content access still enforces management_keys correctly
Run make test-mediorum

🤖 Generated with Claude Code

Ethereum addresses can vary in casing (checksummed vs lowercase). Use LOWER() on both sides of the management_keys address comparison so streaming auth matches regardless of case, consistent with the existing EqualFold check for validator/peer wallets. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

This PR fixes gated streaming authorization failures caused by mixed-case Ethereum addresses by making management_keys address checks case-insensitive across Mediorum’s HTTP middleware, dev HTTP track streaming, and dev gRPC streaming paths.

Changes:

Update management_keys authorization queries to compare address case-insensitively via LOWER(address) = LOWER(?).
Apply the same logic consistently across requireRegisteredSignature, serveTrack, and streamTrackGRPC.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
pkg/mediorum/server/serve_blob.go	Makes access-authority (management_keys) checks case-insensitive in HTTP streaming auth + dev track streaming.
pkg/mediorum/server/serve_blob_grpc.go	Makes access-authority (management_keys) checks case-insensitive in the dev gRPC streaming path.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-10T18:53:35Z

 			if trackID != "" && managementKeyCount > 0 {
 				var count int
-				s.crud.DB.Raw("SELECT COUNT(*) FROM management_keys WHERE track_id = ? AND address = ?", trackID, sig.SignerWallet).Scan(&count)
+				s.crud.DB.Raw("SELECT COUNT(*) FROM management_keys WHERE track_id = ? AND LOWER(address) = LOWER(?)", trackID, sig.SignerWallet).Scan(&count)


Using LOWER(address) in the WHERE clause will generally prevent Postgres from using the existing btree index on (track_id, address) (see migration adding idx_management_keys_track_id_address). Since this check runs on the streaming auth path, consider normalizing addresses on write (store lowercase) and compare with address = LOWER(?) OR add a functional/composite index on (track_id, LOWER(address)) to avoid scanning all keys for a track.

Suggested change

s.crud.DB.Raw("SELECT COUNT(*) FROM management_keys WHERE track_id = ? AND LOWER(address) = LOWER(?)", trackID, sig.SignerWallet).Scan(&count)

normalizedSignerWallet := strings.ToLower(sig.SignerWallet)

s.crud.DB.Raw("SELECT COUNT(*) FROM management_keys WHERE track_id = ? AND address = ?", trackID, normalizedSignerWallet).Scan(&count)

Copilot · 2026-04-10T18:53:36Z


 	var count int
-	ss.crud.DB.Raw("SELECT COUNT(*) FROM management_keys WHERE track_id = ? AND address = ?", trackId, sig.SignerWallet).Scan(&count)
+	ss.crud.DB.Raw("SELECT COUNT(*) FROM management_keys WHERE track_id = ? AND LOWER(address) = LOWER(?)", trackId, sig.SignerWallet).Scan(&count)


Same index-usage concern here: LOWER(address) likely bypasses the existing (track_id, address) index, which can increase per-request DB work on this endpoint. Consider normalizing stored addresses to lowercase and comparing directly, or adding an index on (track_id, LOWER(address)).

Suggested change

ss.crud.DB.Raw("SELECT COUNT(*) FROM management_keys WHERE track_id = ? AND LOWER(address) = LOWER(?)", trackId, sig.SignerWallet).Scan(&count)

normalizedSignerWallet := strings.ToLower(sig.SignerWallet)

ss.crud.DB.Raw("SELECT COUNT(*) FROM management_keys WHERE track_id = ? AND address = ?", trackId, normalizedSignerWallet).Scan(&count)

Copilot · 2026-04-10T18:53:36Z


 	var count int
-	s.crud.DB.Raw("SELECT COUNT(*) FROM management_keys WHERE track_id = ? AND address = ?", trackId, ethAddress).Scan(&count)
+	s.crud.DB.Raw("SELECT COUNT(*) FROM management_keys WHERE track_id = ? AND LOWER(address) = LOWER(?)", trackId, ethAddress).Scan(&count)


This query change to LOWER(address) is likely to bypass the existing (track_id, address) index in Postgres. Because gRPC streaming can be high-volume, consider normalizing stored addresses (lowercase) and comparing directly, or adding a functional/composite index on (track_id, LOWER(address)) to keep auth checks efficient.

@copilot apply changes based on this feedback

Applied in dceccd0. All three locations now normalize the address to lowercase in Go (strings.ToLower) before passing it to the SQL query, so the existing (track_id, address) index is preserved.

Copilot · 2026-04-10T18:53:36Z

 			// If track has access_authorities (management_keys), ONLY those signers may authorize - not validator keys
 			if trackID != "" && managementKeyCount > 0 {
 				var count int
-				s.crud.DB.Raw("SELECT COUNT(*) FROM management_keys WHERE track_id = ? AND address = ?", trackID, sig.SignerWallet).Scan(&count)
+				s.crud.DB.Raw("SELECT COUNT(*) FROM management_keys WHERE track_id = ? AND LOWER(address) = LOWER(?)", trackID, sig.SignerWallet).Scan(&count)
 				if count == 0 {


There are existing unit tests for requireRegisteredSignature, but none cover the access_authorities/management_keys path with mixed-case addresses. Add a test where the stored management_keys.address casing differs from the signer wallet (checksummed vs lowercase) to ensure this regression stays fixed.

…ndex usage Agent-Logs-Url: https://github.com/OpenAudio/go-openaudio/sessions/4323f5ff-0b33-47bb-911c-7cb6e682029c Co-authored-by: rickyrombo <3690498+rickyrombo@users.noreply.github.com>

…dex usage Agent-Logs-Url: https://github.com/OpenAudio/go-openaudio/sessions/4323f5ff-0b33-47bb-911c-7cb6e682029c Co-authored-by: rickyrombo <3690498+rickyrombo@users.noreply.github.com>

Ensures management_keys.address is always stored lowercase so streaming auth comparisons match regardless of the casing in the original tx. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

rickyrombo requested a review from Copilot April 10, 2026 18:51

Copilot started reviewing on behalf of rickyrombo April 10, 2026 18:51 View session

Copilot AI reviewed Apr 10, 2026

View reviewed changes

Copilot started work on behalf of rickyrombo April 10, 2026 18:58 View session

Copilot AI and others added 2 commits April 10, 2026 19:02

fix(mediorum): normalize address in Go before SQL query to preserve i…

dceccd0

…ndex usage Agent-Logs-Url: https://github.com/OpenAudio/go-openaudio/sessions/4323f5ff-0b33-47bb-911c-7cb6e682029c Co-authored-by: rickyrombo <3690498+rickyrombo@users.noreply.github.com>

fix(mediorum): normalize management_keys address in Go to preserve in…

4788740

…dex usage Agent-Logs-Url: https://github.com/OpenAudio/go-openaudio/sessions/4323f5ff-0b33-47bb-911c-7cb6e682029c Co-authored-by: rickyrombo <3690498+rickyrombo@users.noreply.github.com>

Copilot finished work on behalf of rickyrombo April 10, 2026 19:05

fix(core): normalize access authority addresses to lowercase on insert

b152e61

Ensures management_keys.address is always stored lowercase so streaming auth comparisons match regardless of the casing in the original tx. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(mediorum): case-insensitive access authority check#203

fix(mediorum): case-insensitive access authority check#203
rickyrombo wants to merge 4 commits intomainfrom
fix/case-insensitive-access-authority

rickyrombo commented Apr 10, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 10, 2026

Uh oh!

Copilot AI Apr 10, 2026

Uh oh!

Copilot AI Apr 10, 2026

Uh oh!

rickyrombo Apr 10, 2026

Uh oh!

Copilot AI Apr 10, 2026

Uh oh!

Copilot AI Apr 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	s.crud.DB.Raw("SELECT COUNT(*) FROM management_keys WHERE track_id = ? AND LOWER(address) = LOWER(?)", trackID, sig.SignerWallet).Scan(&count)
	normalizedSignerWallet := strings.ToLower(sig.SignerWallet)
	s.crud.DB.Raw("SELECT COUNT(*) FROM management_keys WHERE track_id = ? AND address = ?", trackID, normalizedSignerWallet).Scan(&count)

	ss.crud.DB.Raw("SELECT COUNT(*) FROM management_keys WHERE track_id = ? AND LOWER(address) = LOWER(?)", trackId, sig.SignerWallet).Scan(&count)
	normalizedSignerWallet := strings.ToLower(sig.SignerWallet)
	ss.crud.DB.Raw("SELECT COUNT(*) FROM management_keys WHERE track_id = ? AND address = ?", trackId, normalizedSignerWallet).Scan(&count)

Conversation

rickyrombo commented Apr 10, 2026

Summary

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

rickyrombo Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants