fix: untrusted composer data parsing

.changeset/strong-needles-bake.md

@@ -0,0 +1,5 @@
+---
+"frog": patch
+---
+
+Fixed an issue with parsing Composer Action data when verified is `false`.

src/utils/requestBodyToComposerActionBaseContext.ts

@@ -4,7 +4,10 @@ import type { ComposerActionBaseContext } from '../types/context.js'
 import type { Env } from '../types/env.js'
 import type { Hub } from '../types/hub.js'
 import { getRequestUrl } from './getRequestUrl.js'
-import { verifyComposerAction } from './verifyComposerAction.js'
+import {
+  parseComposerActionDataState,
+  verifyComposerAction,
+} from './verifyComposerAction.js'
 
 type RequestBodyToComposerActionBaseContextOptions = {
   hub?: Hub | undefined
@@ -35,6 +38,11 @@ export async function requestBodyToComposerActionBaseContext<
 
   const url = getRequestUrl(c.req)
 
+  const untrustedComposerActionData = (() => {
+    const state = parseComposerActionDataState(untrustedData.state)
+    return { ...untrustedData, state }
+  })()
+
   const trustedComposerActionData = await (async () => {
     if (verify === false) return null
     if (!trustedData) return null
@@ -56,7 +64,7 @@ export async function requestBodyToComposerActionBaseContext<
 
   return {
     env: c.env,
-    actionData: trustedComposerActionData || untrustedData,
+    actionData: trustedComposerActionData || untrustedComposerActionData,
     req: c.req,
     var: c.var,
     verified: Boolean(trustedComposerActionData),

src/utils/verifyComposerAction.ts

@@ -21,7 +21,13 @@ export async function verifyComposerAction(
 }
 
 ////////////////////////////////////////////////////////////////////
-// Utilties
+// Utilities
+
+export function parseComposerActionDataState(
+  state: string,
+): ComposerActionData['state'] {
+  return JSON.parse(decodeURIComponent(state))
+}
 
 export function messageToComposerActionData(
   message: Message,
@@ -32,7 +38,7 @@ export function messageToComposerActionData(
     messageHash: bytesToHex(message.hash),
     network: message.data?.network!,
     timestamp: message.data?.timestamp!,
-    state: JSON.parse(decodeURIComponent(bytesToString(frameActionBody.state))),
+    state: parseComposerActionDataState(bytesToString(frameActionBody.state)),
     url: bytesToString(frameActionBody.url),
     buttonIndex: frameActionBody.buttonIndex as any,
   }