fix: use car block validator (#2241)

Use new lib to validate blocks
https://github.com/web3-storage/car-block-validator so that we can
support all the hashers. Alternatively, we can block on linkdex
`getDagStructure` which currently is done in `waitUntil`.

Thoughts?

packages/api/package.json

@@ -69,6 +69,7 @@
     "@magic-ext/oauth": "^0.8.0",
     "@magic-sdk/admin": "^1.3.0",
     "@nftstorage/ipfs-cluster": "^5.0.1",
+    "@web3-storage/car-block-validator": "^1.0.0",
     "@web3-storage/db": "^4.0.0",
     "@web3-storage/multipart-parser": "^1.0.0",
     "cardex": "^1.0.0",

packages/api/src/car.js

@@ -3,13 +3,14 @@
 import { PutObjectCommand } from '@aws-sdk/client-s3/dist-es/commands/PutObjectCommand.js'
 import { CarBlockIterator } from '@ipld/car'
 import { CarIndexer } from '@ipld/car/indexer'
-import { toString, equals } from 'uint8arrays'
+import { toString } from 'uint8arrays'
 import { LinkIndexer } from 'linkdex'
 import { maybeDecode } from 'linkdex/decode'
 import { CID } from 'multiformats/cid'
 import { sha256 } from 'multiformats/hashes/sha2'
 import * as raw from 'multiformats/codecs/raw'
 import * as pb from '@ipld/dag-pb'
+import { validateBlock } from '@web3-storage/car-block-validator'
 import pRetry from 'p-retry'
 import { MultihashIndexSortedWriter } from 'cardex'
 import { InvalidCarError, LinkdexError } from './errors.js'
@@ -438,12 +439,7 @@ async function carStat (carBytes) {
     if (blockSize > MAX_BLOCK_SIZE) {
       throw new InvalidCarError(`block too big: ${blockSize} > ${MAX_BLOCK_SIZE}`)
     }
-    if (block.cid.multihash.code === sha256.code) {
-      const ourHash = await sha256.digest(block.bytes)
-      if (!equals(ourHash.digest, block.cid.multihash.digest)) {
-        throw new InvalidCarError(`block data does not match CID for ${block.cid.toString()}`)
-      }
-    }
+    await validateBlock(block)
     if (!rawRootBlock && block.cid.equals(rootCid)) {
       rawRootBlock = block
     }

packages/api/test/car.spec.js

@@ -488,6 +488,6 @@ describe('POST /car', () => {
 
     assert.strictEqual(res.ok, false)
     const { message } = await res.json()
-    assert.strictEqual(message, `Invalid CAR file received: block data does not match CID for ${cid.toString()}`)
+    assert.strictEqual(message, 'CID hash does not match bytes')
   })
 })