@adobe/helix-config-storage 2.2.5 → 2.2.7

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [2.2.7](https://github.com/adobe/helix-config-storage/compare/v2.2.6...v2.2.7) (2025-05-16)
+
+
+### Bug Fixes
+
+* stricter apikey handling ([b533b1f](https://github.com/adobe/helix-config-storage/commit/b533b1fccd94cfd02d6cc1462220ac36682e9557))
+
+## [2.2.6](https://github.com/adobe/helix-config-storage/compare/v2.2.5...v2.2.6) (2025-05-13)
+
+
+### Bug Fixes
+
+* escape jti correctly ([#125](https://github.com/adobe/helix-config-storage/issues/125)) ([906c4ba](https://github.com/adobe/helix-config-storage/commit/906c4ba771cea525de5985b76a2556fc901a2206))
+
 ## [2.2.5](https://github.com/adobe/helix-config-storage/compare/v2.2.4...v2.2.5) (2025-05-12)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/helix-config-storage",
-  "version": "2.2.5",
+  "version": "2.2.7",
   "description": "Helix Config Storage",
   "main": "src/index.js",
   "types": "src/index.d.ts",
@@ -46,7 +46,7 @@
     "husky": "9.1.7",
     "json-schema-to-typescript": "15.0.4",
     "junit-report-builder": "5.1.1",
-    "lint-staged": "15.5.1",
+    "lint-staged": "16.0.0",
     "mocha": "11.2.2",
     "mocha-multi-reporters": "1.5.1",
     "mocha-suppress-logs": "0.5.1",

package/src/config-merge.js

@@ -39,6 +39,7 @@ const ROOT_PROPERTIES = {
   groups: {},
   features: {},
   limits: {},
+  apiKeys: {},
 };
 
 const FORCED_TYPES = {

package/src/config-store.js

@@ -13,14 +13,13 @@
 import crypto from 'crypto';
 import { decodeJwt } from 'jose';
 import { HelixStorage } from '@adobe/helix-shared-storage';
-import { sanitizeName } from '@adobe/helix-shared-string';
 import { StatusCodeError } from './status-code-error.js';
 import {
   createToken, createUser,
   migrateToken,
   updateCodeSource,
   updateContentSource,
-  deepGetOrCreate, deepPut, prune, createSecret, migrateSecret, isDeepEqual,
+  deepGetOrCreate, deepPut, prune, createSecret, migrateSecret, isDeepEqual, base64ToBase64Url,
 } from './utils.js';
 import { validate as validateSchema } from './config-validator.js';
 import { getMergedConfig } from './config-merge.js';
@@ -595,32 +594,32 @@ export class ConfigStore {
         delete ret.hash;
       }
       if (frag.type === 'apiKeys') {
-        if (data.jwt) {
-          try {
-            const payload = await decodeJwt(data.jwt);
-            data.id = payload.jti;
-            data.roles = payload.roles;
-            data.subject = payload.sub;
-            data.expiration = new Date(payload.exp * 1000).toISOString();
-            delete data.jwt;
-          } catch (e) {
-            throw new StatusCodeError(400, e.message);
-          }
+        if (!data.jwt) {
+          throw new StatusCodeError(400, 'jwt missing for new keys');
+        }
+        try {
+          const payload = await decodeJwt(data.jwt);
+          data.id = payload.jti;
+          data.roles = payload.roles;
+          data.subject = payload.sub;
+          data.expiration = new Date(payload.exp * 1000).toISOString();
+          delete data.jwt;
+        } catch (e) {
+          throw new StatusCodeError(400, e.message);
         }
-        frag.name = sanitizeName(data.id);
+        data.created = new Date().toISOString();
+        frag.name = base64ToBase64Url(data.id);
         frag.type = 'apiKey';
         frag.relPath.push(frag.name);
-      }
-      if (frag.type === 'apiKey') {
-        if (data.jwt) {
-          throw new StatusCodeError(400, 'jwt not allowed in existing apiKey');
+      } else if (frag.type === 'apiKey') {
+        if (Object.keys(data).some((key) => key !== 'description')) {
+          throw new StatusCodeError(400, 'not allowed to alter properties other than "description" in apiKey');
         }
-        const oldData = deepGetOrCreate(old, frag.relPath, true);
-        data.created = oldData.created || new Date().toISOString();
-        // ensure that the name is equal to the sanitized id
-        if (frag.name !== sanitizeName(data.id)) {
-          throw new StatusCodeError(400, 'apiKey id mismatch');
+        const oldData = deepGetOrCreate(old, frag.relPath, false);
+        if (!oldData) {
+          throw new StatusCodeError(404, 'object not found.');
         }
+        data = Object.assign(oldData, data);
       }
       if (frag.type === 'secrets') {
         // create new secret with random id

package/src/utils.js

@@ -194,6 +194,19 @@ export function createUser() {
   };
 }
 
+/**
+ * converts a base64 to a base64url string.
+ */
+export function base64ToBase64Url(str) {
+  if (!str) {
+    return str;
+  }
+  return str
+    .replaceAll('+', '-')
+    .replaceAll('/', '_')
+    .replaceAll('=', '');
+}
+
 /**
  * migrates an existing jwt token
  * @param key
@@ -211,9 +224,7 @@ export async function migrateToken(key, jwt) {
   if (!jti) {
     throw new StatusCodeError(400, 'unable to migrate jwt: missing jti claim.');
   }
-  const id = jti
-    .replaceAll('/', '_')
-    .replaceAll('+', '-');
+  const id = base64ToBase64Url(jti);
   const hash = crypto
     .createHmac('sha512', key)
     .update(jwt, 'utf-8')