@axinom/mosaic-message-bus 0.32.0-rc.7 → 0.32.0

package/src/middleware/validate-signed-event-middleware.spec.ts

@@ -0,0 +1,679 @@
+/* eslint-disable no-console */
+import { generateSignature, rejectionOf } from '@axinom/mosaic-service-common';
+import { stub } from 'jest-auto-stub';
+import 'jest-extended';
+import {
+  MOSAIC_SIGNING_SIGNATURE,
+  MOSAIC_SIGNING_SIGNATURE_KEY_VERSION,
+} from '../common';
+import * as keyService from '../generated/key-service';
+import { EventSigningErrors, registerPublicSigningKey } from '../signing';
+import {
+  exportedForTesting,
+  setCachedSigningPublicKeys,
+} from '../signing/signing-cache';
+import { createBuilder } from '../tests/utils';
+import {
+  GetEventSigningTokenFunc,
+  MessageEnvelope,
+  MessageInfo,
+} from '../types';
+import { validateSignedEventMiddleware } from './validate-signed-event-middleware';
+
+describe('validateSignedEventMiddleware', () => {
+  const keyServiceBaseUrl = 'http://localhost:12100/graphiql';
+  const managedServiceId = 'ax-test-service';
+  const customizableServiceId = 'test-service';
+  const validPrivateKey =
+    'MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCvqGMSzGnmch+BBNd89xhJMwACFgUuTKDIJAcjhoiJMvV911az2cgGiaIixONqmCBAapGfsZ2bO1FJFpi4dLmWXp+ivqPlRs/lLoUo/3BFmiYT3nZR636ogw6Jy8WCT9gHw4AfI5xnx1lJioylHQExEfEuOmP4VLcU92IilvkOPXSVdxQ/QjyNq1umn2KoIUNBpjuHFIUTanlcko9igDT/2ctmJFfkskXlCw7HV4BnBPSqBLhDlKQafNhPj9Xn93h4sGh85TcPBk90GeZ/XQ3LJ5Omf1p7pBda/uSi5gg6FyZlrFYKjiWgmkB3gi/7MvsnCKMmpw1wsevRKVpGZpQ1AgMBAAECggEAJmv/l7oMo/Jsf60OcXAe6Mv2AX7NjU4HkR+ITDX+IXx7BBaZCWfmf7+VLmPAlq1FyLFGvxZ7sdussP73Usl9Wq3B3zgx41G04Z1mVQxig2bvU0NCwDJxluxrvqpKvnE2gKQ7nxQL/ws0tYhPsUIB47jX91OgUE4/aZ+e4JADVCCyV+mSRwsswliHUU1MauZ0UB0dQGIhHNYXql6qvayyrtFmqBHNCy8hMCCe8TWO9j4WV5x4txZJH1q49u6UlV0dXqOFZOmRM5TkwwxIsJtdr71RFM5bzsLYlVbh7046vsTP31yi0GWfQnpRlKmnLzpuykJltikF0YahoDZSFTODdQKBgQDY0MVEYN/uW6BbNQTzBP9f/3pbaw6amXKa4CeTbQbfPYYGdzmPGpS//DiXzmdxj6Rm+L/eyX1WzZ4+0Ww3Dyp/VIyHxRK83Yh+5YWaTLUSSwjTaiq2sgWhEvy2Wnc8pI0XIMXJpkyLO58gIIhUfCPDM4dWE7MoPs91+i6iYilNEwKBgQDPZ2dkh16vCD/MEXFUwb5yy0fMpx2EDydPUy1MoxFJH74yYQGWZLZZOSJ8p4e+e2xmqM6xTa1cvIFNOckNKL1+p6a5wtv+ageITY5bASJFfGM9tN3sk4Omg3Nl6JDnY8INVltkh/caoj4l1yjKv02LRB1P/iuYkpRqnBDEpqcqlwKBgA887QBXRqW77tM6MLTbvw8CJ5lRNt+KtVFJO77SxM7fxhGiQ3tZROcRVPDmYsLKc6WBCgsgYhy9qseDdHWSLUxxpsbMBPsdHsC8ZN1pUriMaXxiU8ovTNH7QaOXTBYJApmDhiMb+vk2IYLihnJZnzHS50oXbFoBwBbslGZ5O6ndAoGAOSHN3GZh0atfD5K6elOIZ8zRcXGTct5NwM8zykmdKFyDIxOPwWLqzDct5dKsVO9g1AKqNTMlj0cqAyDo3iQb1vjNt5wSx8ljW8upbC4qx6NVHxlkjJeyCztonWjsCaF0QgJI2K+PhRmuLvRO+1KpRLS1smRclAHEun1VLSaPI+8CgYBkQKP0kNuhuC2UfBf4gS6vsT7ldBwCOrsgzIo+sPfnL/hn7INOYqVafg5UqLGO3Runm1WNNfKNmrBJm1+DZci7EQoKrHN9E9FKfn71kk4xyrJ3DabMNtRF5IQkRKoRzbQhAOJiV0oWkWFbtt/8DY5sOV28VsGQTHdB9rpwyigRwg==';
+  const validPublicKey =
+    'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr6hjEsxp5nIfgQTXfPcYSTMAAhYFLkygyCQHI4aIiTL1fddWs9nIBomiIsTjapggQGqRn7GdmztRSRaYuHS5ll6for6j5UbP5S6FKP9wRZomE952Uet+qIMOicvFgk/YB8OAHyOcZ8dZSYqMpR0BMRHxLjpj+FS3FPdiIpb5Dj10lXcUP0I8jatbpp9iqCFDQaY7hxSFE2p5XJKPYoA0/9nLZiRX5LJF5QsOx1eAZwT0qgS4Q5SkGnzYT4/V5/d4eLBofOU3DwZPdBnmf10NyyeTpn9ae6QXWv7kouYIOhcmZaxWCo4loJpAd4Iv+zL7JwijJqcNcLHr0SlaRmaUNQIDAQAB';
+
+  const messageType = 'TestMessage';
+  const ackOrNack = jest.fn();
+  const next = jest.fn();
+  const handler = jest.fn();
+  const getTokenCallback: GetEventSigningTokenFunc = async () => ({
+    accessToken: 'SGVsbG8gVGhlcmUh',
+    expiresInSeconds: 86400,
+    tokenType: 'ManagedServiceAccount',
+  });
+  const getEnvelope = (messageType: string, stringifiedPayload?: string) =>
+    stub<MessageEnvelope>({
+      message_type: messageType,
+      payload: stringifiedPayload
+        ? JSON.parse(stringifiedPayload)
+        : { test: 'test message' },
+    });
+  const getMessageInfo = (
+    messageType: string,
+    headers = {},
+    stringifiedPayload?: string,
+    routingKey?: string,
+  ) =>
+    stub<MessageInfo>({
+      unparsedEnvelope: stringifiedPayload
+        ? Buffer.from(stringifiedPayload)
+        : {},
+      envelope: getEnvelope(messageType, stringifiedPayload),
+      fields: { routingKey },
+      properties: { headers },
+    });
+
+  let keyServiceSpy: jest.SpyInstance;
+  let getRegisteredPublicKeys = () => ({});
+  let getRegistrationResponse = () => ({});
+
+  beforeAll(() => {
+    keyServiceSpy = jest.spyOn(keyService, 'getSdk').mockImplementation(() =>
+      stub<keyService.Sdk>({
+        GetPublicSigningKeys: () => ({ data: getRegisteredPublicKeys() }),
+        RegisterPublicSigningKey: () => ({ data: getRegistrationResponse() }),
+      }),
+    );
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+    getRegisteredPublicKeys = () => ({});
+    getRegistrationResponse = () => ({});
+    exportedForTesting.clearSigningCache();
+  });
+
+  it('event with empty builders -> unexpected message error thrown', async () => {
+    // Arrange
+    const builders = [];
+    const message = getMessageInfo(messageType);
+
+    // Act
+    const middleware = validateSignedEventMiddleware({
+      builders,
+      keyServiceBaseUrl,
+      getTokenCallback,
+    });
+    const error = await rejectionOf(
+      middleware(message.envelope, message, ackOrNack, next),
+    );
+
+    // Assert
+    expect(error).toMatchObject(EventSigningErrors.UnexpectedMessageType);
+    expect(next).not.toHaveBeenCalled();
+    expect(keyServiceSpy).not.toHaveBeenCalled();
+  });
+
+  it('event with not matching messageType -> unexpected message error thrown', async () => {
+    // Arrange
+    const builders = [createBuilder().subscribeForEvent(handler)];
+    const message = getMessageInfo(messageType);
+
+    // Act
+    const middleware = validateSignedEventMiddleware({
+      builders,
+      keyServiceBaseUrl,
+      getTokenCallback,
+    });
+    const error = await rejectionOf(
+      middleware(message.envelope, message, ackOrNack, next),
+    );
+
+    // Assert
+    expect(error).toMatchObject(EventSigningErrors.UnexpectedMessageType);
+    expect(next).not.toHaveBeenCalled();
+    expect(keyServiceSpy).not.toHaveBeenCalled();
+  });
+
+  it('event with matching messageType, but no serviceId -> service ID not found error thrown', async () => {
+    // Arrange
+    const builders = [
+      createBuilder({ messageType }).subscribeForEvent(handler),
+    ];
+    const message = getMessageInfo(messageType);
+
+    // Act
+    const middleware = validateSignedEventMiddleware({
+      builders,
+      keyServiceBaseUrl,
+      getTokenCallback,
+    });
+    const error = await rejectionOf(
+      middleware(message.envelope, message, ackOrNack, next),
+    );
+
+    // Assert
+    expect(error).toMatchObject(EventSigningErrors.ServiceIdNotFound);
+    expect(next).not.toHaveBeenCalled();
+    expect(keyServiceSpy).not.toHaveBeenCalled();
+  });
+
+  it('event with matching messageType, routing key serviceId, but no headers -> headers missing error thrown, fallback serviceId used', async () => {
+    // Arrange
+    const builders = [
+      createBuilder({ messageType }).subscribeForEvent(handler),
+    ];
+    const message = getMessageInfo(
+      messageType,
+      {},
+      undefined,
+      `${managedServiceId}.test.event`,
+    );
+
+    // Act
+    const middleware = validateSignedEventMiddleware({
+      builders,
+      keyServiceBaseUrl,
+      getTokenCallback,
+    });
+    const error = await rejectionOf(
+      middleware(message.envelope, message, ackOrNack, next),
+    );
+
+    // Assert
+    expect(error).toMatchObject(EventSigningErrors.SigningHeadersMissing);
+    expect(next).not.toHaveBeenCalled();
+    expect(keyServiceSpy).not.toHaveBeenCalled();
+  });
+
+  it('event with matching messageType, builder serviceId, but no headers -> headers missing error thrown, builder info serviceId used', async () => {
+    // Arrange
+    const builders = [
+      createBuilder({
+        messageType,
+        serviceId: managedServiceId,
+      }).subscribeForEvent(handler),
+    ];
+    const message = getMessageInfo(messageType);
+
+    // Act
+    const middleware = validateSignedEventMiddleware({
+      builders,
+      keyServiceBaseUrl,
+      getTokenCallback,
+    });
+    const error = await rejectionOf(
+      middleware(message.envelope, message, ackOrNack, next),
+    );
+
+    // Assert
+    expect(error).toMatchObject(EventSigningErrors.SigningHeadersMissing);
+    expect(next).not.toHaveBeenCalled();
+    expect(keyServiceSpy).not.toHaveBeenCalled();
+  });
+
+  it('event with matching messageType, builder serviceId, existing headers, but no registered keys -> key not found error thrown', async () => {
+    // Arrange
+    const builders = [
+      createBuilder({
+        messageType,
+        serviceId: managedServiceId,
+      }).subscribeForEvent(handler),
+    ];
+    const message = getMessageInfo(messageType, {
+      [MOSAIC_SIGNING_SIGNATURE]: 'test',
+      [MOSAIC_SIGNING_SIGNATURE_KEY_VERSION]: 1,
+    });
+
+    // Act
+    const middleware = validateSignedEventMiddleware({
+      builders,
+      keyServiceBaseUrl,
+      getTokenCallback,
+    });
+    const error = await rejectionOf(
+      middleware(message.envelope, message, ackOrNack, next),
+    );
+
+    // Assert
+    expect(error).toMatchObject({
+      message:
+        "Unable to find the public signing key for service with ID 'ax-test-service' and version 1. Please contact Axinom Support.",
+      code: EventSigningErrors.SigningPublicKeyNotFound.code,
+    });
+    expect(next).not.toHaveBeenCalled();
+    expect(keyServiceSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('event with matching messageType, builder serviceId, existing headers, but other registered keys -> key not found error thrown', async () => {
+    // Arrange
+    const builders = [
+      createBuilder({
+        messageType,
+        serviceId: managedServiceId,
+      }).subscribeForEvent(handler),
+    ];
+    const message = getMessageInfo(messageType, {
+      [MOSAIC_SIGNING_SIGNATURE]: 'test',
+      [MOSAIC_SIGNING_SIGNATURE_KEY_VERSION]: 1,
+    });
+    getRegisteredPublicKeys = () => ({
+      publicKeys: {
+        nodes: [
+          {
+            version: 1,
+            key: 'R2VuZXJhbCBLZW5vYmkh',
+            serviceId: 'ax-other-service',
+          },
+        ],
+      },
+    });
+
+    // Act
+    const middleware = validateSignedEventMiddleware({
+      builders,
+      keyServiceBaseUrl,
+      getTokenCallback,
+    });
+    const error = await rejectionOf(
+      middleware(message.envelope, message, ackOrNack, next),
+    );
+
+    // Assert
+    expect(error).toMatchObject({
+      message:
+        "Unable to find the public signing key for service with ID 'ax-test-service' and version 1. Please contact Axinom Support.",
+      code: EventSigningErrors.SigningPublicKeyNotFound.code,
+    });
+    expect(next).not.toHaveBeenCalled();
+    expect(keyServiceSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('event with matching messageType, builder serviceId, existing headers, matching registered key, but invalid signing data -> signature validation error thrown', async () => {
+    // Arrange
+    const builders = [
+      createBuilder({
+        messageType,
+        serviceId: managedServiceId,
+      }).subscribeForEvent(handler),
+    ];
+    const message = getMessageInfo(messageType, {
+      [MOSAIC_SIGNING_SIGNATURE]: 'test',
+      [MOSAIC_SIGNING_SIGNATURE_KEY_VERSION]: 1,
+    });
+    getRegisteredPublicKeys = () => ({
+      publicKeys: {
+        nodes: [
+          {
+            version: 1,
+            key: 'R2VuZXJhbCBLZW5vYmkh',
+            serviceId: managedServiceId,
+          },
+        ],
+      },
+    });
+
+    // Act
+    const middleware = validateSignedEventMiddleware({
+      builders,
+      keyServiceBaseUrl,
+      getTokenCallback,
+    });
+    const error = await rejectionOf(
+      middleware(message.envelope, message, ackOrNack, next),
+    );
+
+    // Assert
+    expect(error).toMatchObject(EventSigningErrors.SignatureValidationFailed);
+    expect(next).not.toHaveBeenCalled();
+    expect(keyServiceSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('valid signed event -> no errors, validation passed', async () => {
+    // Arrange
+    const builders = [
+      createBuilder({
+        messageType,
+        serviceId: managedServiceId,
+      }).subscribeForEvent(handler),
+    ];
+    const data = { test: 'test message' };
+    const { signature, stringifiedValue } = generateSignature(
+      data,
+      validPrivateKey,
+    );
+    const message = getMessageInfo(
+      messageType,
+      {
+        [MOSAIC_SIGNING_SIGNATURE]: signature,
+        [MOSAIC_SIGNING_SIGNATURE_KEY_VERSION]: 1,
+      },
+      stringifiedValue,
+    );
+    getRegisteredPublicKeys = () => ({
+      publicKeys: {
+        nodes: [
+          {
+            version: 1,
+            key: validPublicKey,
+            serviceId: managedServiceId,
+          },
+        ],
+      },
+    });
+
+    // Act
+    const middleware = validateSignedEventMiddleware({
+      builders,
+      keyServiceBaseUrl,
+      getTokenCallback,
+    });
+    await middleware(message.envelope, message, ackOrNack, next);
+
+    // Assert
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(keyServiceSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('command -> no errors, validation skipped', async () => {
+    // Arrange
+    const builders = [
+      createBuilder({
+        messageType,
+        action: 'command',
+        serviceId: managedServiceId,
+      }).subscribeForEvent(handler),
+    ];
+    const message = getMessageInfo(messageType, {});
+    getRegisteredPublicKeys = () => ({
+      publicKeys: {
+        nodes: [
+          {
+            version: 1,
+            key: validPublicKey,
+            serviceId: managedServiceId,
+          },
+        ],
+      },
+    });
+
+    // Act
+    const middleware = validateSignedEventMiddleware({
+      builders,
+      keyServiceBaseUrl,
+      getTokenCallback,
+    });
+    await middleware(message.envelope, message, ackOrNack, next);
+
+    // Assert
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(keyServiceSpy).toHaveBeenCalledTimes(0);
+  });
+
+  it('valid signed event with own key cached during regitration -> no errors, validation passed', async () => {
+    // Arrange
+    const builders = [
+      createBuilder({
+        messageType,
+        serviceId: managedServiceId,
+      }).subscribeForEvent(handler),
+    ];
+    const data = { test: 'test message' };
+    const { signature, stringifiedValue } = generateSignature(
+      data,
+      validPrivateKey,
+    );
+    const message = getMessageInfo(
+      messageType,
+      {
+        [MOSAIC_SIGNING_SIGNATURE]: signature,
+        [MOSAIC_SIGNING_SIGNATURE_KEY_VERSION]: 1,
+      },
+      stringifiedValue,
+    );
+    getRegisteredPublicKeys = () => ({
+      publicKeys: {
+        nodes: [],
+      },
+    });
+    const config = {
+      rmqEventSigningKeyVersion: 1,
+      serviceId: managedServiceId,
+      rmqEventSigningPublicKey: validPublicKey,
+      rmqEventSigningKeyVersionsToRevoke: [],
+    };
+    getRegistrationResponse = () => ({
+      registerPublicKey: {
+        publicKey: {
+          version: config.rmqEventSigningKeyVersion,
+          serviceId: config.serviceId,
+          key: config.rmqEventSigningPublicKey,
+          isActive: true,
+        },
+      },
+    });
+
+    // Act
+    await registerPublicSigningKey(config, keyServiceBaseUrl, getTokenCallback);
+    const middleware = validateSignedEventMiddleware({
+      builders,
+      keyServiceBaseUrl,
+      getTokenCallback,
+    });
+    await middleware(message.envelope, message, ackOrNack, next);
+
+    // Assert
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(keyServiceSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('valid signed event with extraTrustedPublicKeys instead of key service keys -> no errors, validation passed', async () => {
+    // Arrange
+    const builders = [
+      createBuilder({
+        messageType,
+        serviceId: managedServiceId,
+      }).subscribeForEvent(handler),
+    ];
+    const data = { test: 'test message' };
+    const { signature, stringifiedValue } = generateSignature(
+      data,
+      validPrivateKey,
+    );
+    const message = getMessageInfo(
+      messageType,
+      {
+        [MOSAIC_SIGNING_SIGNATURE]: signature,
+        [MOSAIC_SIGNING_SIGNATURE_KEY_VERSION]: 1,
+      },
+      stringifiedValue,
+    );
+    getRegisteredPublicKeys = () => ({
+      publicKeys: {
+        nodes: [],
+      },
+    });
+
+    // Act
+    const middleware = validateSignedEventMiddleware({
+      builders,
+      keyServiceBaseUrl,
+      getTokenCallback,
+      extraTrustedPublicKeys: [
+        {
+          key: validPublicKey,
+          serviceId: managedServiceId,
+          version: 1,
+          isActive: true,
+        },
+      ],
+    });
+    await middleware(message.envelope, message, ackOrNack, next);
+
+    // Assert
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(keyServiceSpy).toHaveBeenCalledTimes(0);
+  });
+
+  it('valid signed customizable service event -> no errors, validation passed', async () => {
+    // Arrange
+    const builders = [
+      createBuilder({
+        messageType,
+        serviceId: customizableServiceId,
+      }).subscribeForEvent(handler),
+    ];
+    const data = { test: 'test message' };
+    const { signature, stringifiedValue } = generateSignature(
+      data,
+      validPrivateKey,
+    );
+    const message = getMessageInfo(
+      messageType,
+      {
+        [MOSAIC_SIGNING_SIGNATURE]: signature,
+        [MOSAIC_SIGNING_SIGNATURE_KEY_VERSION]: 1,
+      },
+      stringifiedValue,
+    );
+    getRegisteredPublicKeys = () => ({
+      publicKeys: {
+        nodes: [],
+      },
+    });
+
+    // Act
+    const middleware = validateSignedEventMiddleware({
+      builders,
+      keyServiceBaseUrl,
+      getTokenCallback,
+      extraTrustedPublicKeys: [
+        {
+          key: validPublicKey,
+          serviceId: customizableServiceId,
+          version: 1,
+          isActive: true,
+        },
+      ],
+    });
+    await middleware(message.envelope, message, ackOrNack, next);
+
+    // Assert
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(keyServiceSpy).toHaveBeenCalledTimes(0);
+  });
+
+  it('valid unsigned customizable service event -> no errors, validation skipped', async () => {
+    // Arrange
+    const builders = [
+      createBuilder({
+        messageType,
+        serviceId: customizableServiceId,
+      }).subscribeForEvent(handler),
+    ];
+    const data = { test: 'test message' };
+    const { signature, stringifiedValue } = generateSignature(
+      data,
+      validPrivateKey,
+    );
+    const message = getMessageInfo(
+      messageType,
+      {
+        [MOSAIC_SIGNING_SIGNATURE]: signature,
+        [MOSAIC_SIGNING_SIGNATURE_KEY_VERSION]: 1,
+      },
+      stringifiedValue,
+    );
+    getRegisteredPublicKeys = () => ({
+      publicKeys: {
+        nodes: [],
+      },
+    });
+
+    // Act
+    const middleware = validateSignedEventMiddleware({
+      builders,
+      keyServiceBaseUrl,
+      getTokenCallback,
+    });
+    await middleware(message.envelope, message, ackOrNack, next);
+
+    // Assert
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(keyServiceSpy).toHaveBeenCalledTimes(0);
+  });
+
+  it('valid signed event with already cached key -> no errors, validation passed', async () => {
+    // Arrange
+    const builders = [
+      createBuilder({
+        messageType,
+        serviceId: managedServiceId,
+      }).subscribeForEvent(handler),
+    ];
+    const data = { test: 'test message' };
+    const { signature, stringifiedValue } = generateSignature(
+      data,
+      validPrivateKey,
+    );
+    const message = getMessageInfo(
+      messageType,
+      {
+        [MOSAIC_SIGNING_SIGNATURE]: signature,
+        [MOSAIC_SIGNING_SIGNATURE_KEY_VERSION]: 1,
+      },
+      stringifiedValue,
+    );
+    getRegisteredPublicKeys = () => ({
+      publicKeys: {
+        nodes: [],
+      },
+    });
+    setCachedSigningPublicKeys(
+      [
+        {
+          version: 1,
+          key: validPublicKey,
+          serviceId: managedServiceId,
+          isActive: true,
+        },
+      ],
+      100000,
+    );
+
+    // Act
+    const middleware = validateSignedEventMiddleware({
+      builders,
+      keyServiceBaseUrl,
+      getTokenCallback,
+    });
+    await middleware(message.envelope, message, ackOrNack, next);
+
+    // Assert
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(keyServiceSpy).toHaveBeenCalledTimes(0);
+  });
+
+  it('valid unsigned customizable event with managed extraTrustedPublicKeys event -> no errors, validation skipped', async () => {
+    // Arrange
+    const builders = [
+      createBuilder({
+        messageType,
+        serviceId: customizableServiceId,
+      }).subscribeForEvent(handler),
+    ];
+    const message = getMessageInfo(messageType, {});
+    getRegisteredPublicKeys = () => ({
+      publicKeys: {
+        nodes: [{}],
+      },
+    });
+
+    // Act
+    const middleware = validateSignedEventMiddleware({
+      builders,
+      keyServiceBaseUrl,
+      getTokenCallback,
+      extraTrustedPublicKeys: [
+        {
+          key: validPublicKey,
+          serviceId: managedServiceId,
+          version: 1,
+          isActive: true,
+        },
+      ],
+    });
+    await middleware(message.envelope, message, ackOrNack, next);
+
+    // Assert
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(keyServiceSpy).toHaveBeenCalledTimes(0);
+  });
+});