@bedrock/kms-http 13.0.0 → 14.2.0

package/.github/workflows/main.yml

@@ -8,7 +8,7 @@ jobs:
     timeout-minutes: 10
     strategy:
       matrix:
-        node-version: [14.x]
+        node-version: [16.x]
     steps:
     - uses: actions/checkout@v2
     - name: Use Node.js ${{ matrix.node-version }}
@@ -24,12 +24,12 @@ jobs:
     timeout-minutes: 10
     services:
       mongodb:
-        image: mongo:4.2
+        image: mongo:4.4
         ports:
           - 27017:27017
     strategy:
       matrix:
-        node-version: [14.x]
+        node-version: [14.x, 16.x]
     steps:
     - uses: actions/checkout@v2
     - name: Use Node.js ${{ matrix.node-version }}
@@ -43,45 +43,19 @@ jobs:
     - name: Run test with Node.js ${{ matrix.node-version }}
       run: |
         cd test
-        npm run test-node
-  test-karma:
-    needs: [test-node]
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    services:
-      mongodb:
-        image: mongo:4.2
-        ports:
-          - 27017:27017
-    strategy:
-      matrix:
-        node-version: [14.x]
-    steps:
-    - uses: actions/checkout@v2
-    - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v1
-      with:
-        node-version: ${{ matrix.node-version }}
-    - run: |
-        npm install
-        cd test
-        npm install
-    - name: Run test with Node.js ${{ matrix.node-version }}
-      run: |
-        cd test
-        npm run test-karma
+        npm test
   coverage:
-    needs: [test-karma]
+    needs: [test-node]
     runs-on: ubuntu-latest
     timeout-minutes: 10
     services:
       mongodb:
-        image: mongo:4.2
+        image: mongo:4.4
         ports:
           - 27017:27017
     strategy:
       matrix:
-        node-version: [14.x]
+        node-version: [16.x]
     steps:
     - uses: actions/checkout@v2
     - name: Use Node.js ${{ matrix.node-version }}

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # bedrock-kms-http ChangeLog
 
+## 14.2.0 - 2022-05-13
+
+### Changed
+- Be more resilient to keystore config controller changes. When a keystore
+  is new and KMS operations are performed on it that could cause false-positive
+  fail authz errors, fetch a fresh version of the config to ensure that the
+  controller has not changed.
+
+## 14.1.0 - 2022-05-12
+
+### Added
+- Include full error as non-public `cause` in `onError` handler.
+
+## 14.0.0 - 2022-04-29
+
+### Changed
+- **BREAKING**: Update peer deps:
+  - `@bedrock/core@6`
+  - `@bedrock/app-identity@3`
+  - `@bedrock/express@8`
+  - `@bedrock/kms@10`
+  - `@bedrock/meter-usage-reporter@7`
+  - `@bedrock/validation@7`
+  - `@bedrock/zcap-storage@7`.
+
 ## 13.0.0 - 2022-04-05
 
 ### Changed

package/lib/BedrockKeystoreConfigStorage.js

@@ -3,7 +3,7 @@
  */
 import * as bedrock from '@bedrock/core';
 import * as helpers from './helpers.js';
-import {createRequire} from 'module';
+import {createRequire} from 'node:module';
 import {keystores} from '@bedrock/kms';
 const require = createRequire(import.meta.url);
 const {KeystoreConfigStorage} = require('@digitalbazaar/webkms-switch');
@@ -14,12 +14,13 @@ const {util: {BedrockError}} = bedrock;
 import './config.js';
 
 export class BedrockKeystoreConfigStorage extends KeystoreConfigStorage {
-  async get({id, req} = {}) {
-    const {config: keystoreConfig} = await keystores.get({id});
+  async get({id, req, returnRecord = false, fresh = false} = {}) {
+    const record = await keystores.get({id, fresh});
+    const {config: keystoreConfig} = record;
 
     // skip request checks if specifically requested
     if(req === false) {
-      return keystoreConfig;
+      return returnRecord ? record : keystoreConfig;
     }
 
     // verify that request is from an IP that is allowed to access the config
@@ -32,6 +33,6 @@ export class BedrockKeystoreConfigStorage extends KeystoreConfigStorage {
         });
     }
 
-    return keystoreConfig;
+    return returnRecord ? record : keystoreConfig;
   }
 }

package/lib/http.js

@@ -7,7 +7,7 @@ import * as helpers from './helpers.js';
 import * as middleware from './middleware.js';
 import {asyncHandler} from '@bedrock/express';
 import cors from 'cors';
-import {createRequire} from 'module';
+import {createRequire} from 'node:module';
 import {createValidateMiddleware as validate} from '@bedrock/validation';
 import {
   defaultModuleManager as moduleManager,

package/lib/middleware.js

@@ -6,7 +6,7 @@ import * as brZCapStorage from '@bedrock/zcap-storage';
 import * as helpers from './helpers.js';
 import {asyncHandler} from '@bedrock/express';
 import {BedrockKeystoreConfigStorage} from './BedrockKeystoreConfigStorage.js';
-import {createRequire} from 'module';
+import {createRequire} from 'node:module';
 import {
   defaultDocumentLoader as documentLoader,
   defaultModuleManager as moduleManager
@@ -26,6 +26,8 @@ const {Ed25519VerificationKey2020} =
 
 const {config, util: {BedrockError}} = bedrock;
 
+const FIVE_MINUTES = 1000 * 60 * 5;
+
 const storage = new BedrockKeystoreConfigStorage();
 
 // create `getVerifier` hook for verifying zcap invocation HTTP signatures
@@ -39,8 +41,11 @@ export function createGetKeystoreConfig({routes}) {
     if(!req.webkms) {
       const keystoreId = helpers.getKeystoreId(
         {req, localId: req.params.keystoreId, routes});
-      const keystore = await storage.get({id: keystoreId, req});
-      req.webkms = {keystore};
+      const configRecord = await storage.get({
+        id: keystoreId, req, returnRecord: true
+      });
+      const {config: keystore} = configRecord;
+      req.webkms = {keystore, configRecord};
     }
     next();
   });
@@ -81,10 +86,7 @@ export function authorizeKeystoreZcapInvocation() {
         rootInvocationTarget: req.webkms.keystore.id
       };
     },
-    async getRootController({req}) {
-      // this will always be present based on where this middleware is used
-      return req.webkms.keystore.controller;
-    }
+    getRootController: getKeystoreController,
   });
 }
 
@@ -93,10 +95,7 @@ export function authorizeZcapRevocation() {
   return _authorizeZcapRevocation({
     documentLoader,
     expectedHost: config.server.host,
-    async getRootController({req}) {
-      // this will always be present based on where this middleware is used
-      return req.webkms.keystore.controller;
-    },
+    getRootController: getKeystoreController,
     getVerifier,
     inspectCapabilityChain,
     onError,
@@ -104,6 +103,77 @@ export function authorizeZcapRevocation() {
   });
 }
 
+async function getKeystoreController({req}) {
+  /* The following code is to prevent false-negative authz errors that are the
+  result of stale cached keystore configs.
+
+  It is a common pattern for keystore configs to have their root controllers
+  updated immediately after creation based on the value of a key that is in the
+  keystore itself. When this happens, decentralized caches may hold a stale
+  config with the old controller value. A client that uses a zcap that is
+  delegated / controlled by the root controller would see a false negative
+  authz error if the authz check used the cached value.
+
+  Therefore, this code will check whether keystore configs are reasonably new
+  and whether a failure is likely to occur on account of a mismatched root
+  controller. If this seems likely, a fresh copy of the keystore config record
+  is retrieved.
+
+  Algorithm: If the keystore config is less than five minutes old, then inspect
+  `req.ezcap.invocationParameters.capability` to ensure that either:
+
+  1. The `capability` is the root zcap and the verification method ID or
+    controller match the keystore controller.
+  2. The `capability` is delegated and the controller of the first delegated
+    zcap in the chain is the keystore controller.
+
+  If neither condition is true, fetch a fresh version of the keystore config
+  record and update `req.webkms`. */
+  const now = Date.now();
+  if((now - req.webkms.configRecord.meta.created) > FIVE_MINUTES ||
+    (req.ezcap.capabilityToRevoke && req.ezcap.invocationParameters)) {
+    // config is either older than five minutes or we've already been through
+    // this code path for the current request to run the checks against a
+    // zcap that is to be revoked (in which case we must not update again to
+    // ensure the keystore config used is consistent)
+    return req.webkms.keystore.controller;
+  }
+
+  // check for a zcap from the invocation params or for one to be revoked; the
+  // same rules above will be used to check if we need a fresh config record
+  const capability = req.ezcap?.invocationParameters?.capability ||
+    req.ezcap.capabilityToRevoke;
+
+  let getFreshConfigRecord = false;
+
+  // capability is root if it is a string; and it must be invoked because you
+  // can't revoke a root zcap
+  const isRoot = typeof capability === 'string';
+  if(isRoot && req.ezcap.invocationParameters) {
+    // fetch verification method early to compare against keystore controller
+    const {signature: {params: {keyId}}} = req.ezcap;
+    const {verificationMethod} = await getVerifier({keyId, documentLoader});
+    getFreshConfigRecord =
+      !(verificationMethod.controller === req.webkms.keystore.controller ||
+      verificationMethod.id === req.webkms.keystore.controller);
+  } else {
+    const second = capability?.proof?.capabilityChain[1];
+    if(second && second.controller !== req.webkms.keystore.controller) {
+      getFreshConfigRecord = true;
+    }
+  }
+
+  if(getFreshConfigRecord) {
+    const configRecord = await storage.get({
+      id: req.webkms.keystore.id, req, returnRecord: true, fresh: true
+    });
+    const {config: keystore} = configRecord;
+    req.webkms = {keystore, configRecord};
+  }
+
+  return req.webkms.keystore.controller;
+}
+
 // hook used to verify zcap invocation HTTP signatures
 async function getVerifier({keyId, documentLoader}) {
   const key = await cryptoLd.fromKeyId({id: keyId, documentLoader});
@@ -152,27 +222,25 @@ async function inspectCapabilityChain({
 }
 
 function onError({error}) {
-  // cause must be a public BedrockError to be surfaced to the HTTP client
-  let cause;
-  if(error instanceof BedrockError) {
-    cause = error;
-  } else {
+  if(!(error instanceof BedrockError)) {
+    // always expose cause message and name; expose cause details as
+    // BedrockError if error is marked public
     let details = {};
     if(error.details && error.details.public) {
       details = error.details;
     }
-    cause = new BedrockError(
+    error = new BedrockError(
       error.message,
       error.name || 'NotAllowedError', {
         ...details,
         public: true,
-      });
+      }, error);
   }
   throw new BedrockError(
     'Authorization error.', 'NotAllowedError', {
       httpStatusCode: 403,
       public: true,
-    }, cause);
+    }, error);
 }
 
 // hook used to create suites for verifying zcap delegation chains

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bedrock/kms-http",
-  "version": "13.0.0",
+  "version": "14.2.0",
   "type": "module",
   "description": "Bedrock KMS HTTP API",
   "main": "./lib/index.js",
@@ -26,7 +26,7 @@
   "dependencies": {
     "@digitalbazaar/ed25519-signature-2020": "^3.0.0",
     "@digitalbazaar/ed25519-verification-key-2020": "^3.2.0",
-    "@digitalbazaar/ezcap-express": "^6.0.0",
+    "@digitalbazaar/ezcap-express": "^6.2.0",
     "@digitalbazaar/webkms-switch": "^10.0.0",
     "cidr-regex": "^3.1.1",
     "cors": "^2.8.5",
@@ -35,13 +35,13 @@
     "netmask": "^2.0.2"
   },
   "peerDependencies": {
-    "@bedrock/core": "^5.0.0",
-    "@bedrock/app-identity": "^2.0.0",
-    "@bedrock/express": "^7.0.0",
-    "@bedrock/kms": "^9.0.0",
-    "@bedrock/meter-usage-reporter": "^6.0.0",
-    "@bedrock/validation": "^6.0.0",
-    "@bedrock/zcap-storage": "^6.0.0"
+    "@bedrock/app-identity": "^3.0.0",
+    "@bedrock/core": "^6.0.0",
+    "@bedrock/express": "^8.0.0",
+    "@bedrock/kms": "^10.1.0",
+    "@bedrock/meter-usage-reporter": "^7.0.0",
+    "@bedrock/validation": "^7.0.0",
+    "@bedrock/zcap-storage": "^7.0.0"
   },
   "directories": {
     "lib": "./lib"
@@ -49,7 +49,7 @@
   "devDependencies": {
     "eslint": "^7.32.0",
     "eslint-config-digitalbazaar": "^2.8.0",
-    "eslint-plugin-jsdoc": "^37.9.7",
+    "eslint-plugin-jsdoc": "^39.2.9",
     "jsdoc-to-markdown": "^7.1.1"
   },
   "engines": {

package/test/mocha/10-keystore.js

@@ -4,11 +4,11 @@
 import * as bedrock from '@bedrock/core';
 import * as helpers from './helpers.js';
 import {agent} from '@bedrock/https-agent';
-import {createRequire} from 'module';
+import {createRequire} from 'node:module';
+import {httpClient, DEFAULT_HEADERS} from '@digitalbazaar/http-client';
 import {mockData} from './mock.data.js';
 const require = createRequire(import.meta.url);
 const {CapabilityAgent} = require('@digitalbazaar/webkms-client');
-const {httpClient, DEFAULT_HEADERS} = require('@digitalbazaar/http-client');
 const {signCapabilityInvocation} = require(
   '@digitalbazaar/http-signature-zcap-invoke');
 const {ZcapClient} = require('@digitalbazaar/ezcap');
@@ -334,7 +334,7 @@ describe('bedrock-kms-http API', () => {
         should.exist(result);
         result.should.eql(expectedConfig);
       });
-      it('throw internal server error when attempting to update "meterId"',
+      it('throw operation error when attempting to update "meterId"',
         async () => {
           // TODO: Remove or update this test when the following is fixed
           // eslint-disable-next-line max-len
@@ -385,7 +385,7 @@ describe('bedrock-kms-http API', () => {
           should.not.exist(result);
           should.exist(err);
           err.status.should.equal(500);
-          err.data.type.should.equal('bedrock.InternalServerError');
+          err.data.type.should.equal('OperationError');
         });
       it('rejects config update for an invalid zcap', async () => {
         const secret = 'd852a72d-013f-4dd6-8ba2-588aaf601b66';

package/test/mocha/11-keystore-kms-client.js

@@ -3,7 +3,7 @@
  */
 import * as helpers from './helpers.js';
 import {httpsAgent} from '@bedrock/https-agent';
-import {createRequire} from 'module';
+import {createRequire} from 'node:module';
 const require = createRequire(import.meta.url);
 const {CapabilityAgent, KmsClient, KeystoreAgent} =
   require('@digitalbazaar/webkms-client');
@@ -55,7 +55,7 @@ describe('keystore API interactions using webkms-client', () => {
     should.not.exist(result);
     should.exist(err);
     err.status.should.equal(400);
-    err.data.should.have.keys('message', 'type', 'details', 'cause');
+    err.data.should.include.keys('message', 'name', 'type', 'details', 'cause');
     err.data.type.should.equal('URLMismatchError');
     err.data.details.should.have.keys(
       ['expected', 'httpStatusCode', 'actual', 'configId', 'requestUrl']);

package/test/mocha/20-revocation.js

@@ -3,7 +3,7 @@
  */
 import * as helpers from './helpers.js';
 import {httpsAgent} from '@bedrock/https-agent';
-import {createRequire} from 'module';
+import {createRequire} from 'node:module';
 const require = createRequire(import.meta.url);
 const {CapabilityAgent, KmsClient, KeystoreAgent} =
   require('@digitalbazaar/webkms-client');

package/test/mocha/21-revocation-ip-allow-list.js

@@ -3,7 +3,7 @@
  */
 import * as helpers from './helpers.js';
 import {httpsAgent} from '@bedrock/https-agent';
-import {createRequire} from 'module';
+import {createRequire} from 'node:module';
 const require = createRequire(import.meta.url);
 const {CapabilityAgent, KmsClient, KeystoreAgent} =
   require('@digitalbazaar/webkms-client');

package/test/mocha/30-operations-generate-key.js

@@ -2,12 +2,12 @@
  * Copyright (c) 2019-2022 Digital Bazaar, Inc. All rights reserved.
  */
 import * as helpers from './helpers.js';
+import {httpClient, DEFAULT_HEADERS} from '@digitalbazaar/http-client';
 import {httpsAgent} from '@bedrock/https-agent';
-import {createRequire} from 'module';
+import {createRequire} from 'node:module';
 const require = createRequire(import.meta.url);
 const {CapabilityAgent, KmsClient, KeystoreAgent} =
   require('@digitalbazaar/webkms-client');
-const {httpClient, DEFAULT_HEADERS} = require('@digitalbazaar/http-client');
 const {signCapabilityInvocation} = require(
   '@digitalbazaar/http-signature-zcap-invoke');
 

package/test/mocha/31-operations-hmac.js

@@ -1,17 +1,15 @@
 /*!
  * Copyright (c) 2019-2022 Digital Bazaar, Inc. All rights reserved.
  */
-import * as bedrock from '@bedrock/core';
 import * as helpers from './helpers.js';
 import {httpsAgent} from '@bedrock/https-agent';
-import {createRequire} from 'module';
+import {createRequire} from 'node:module';
 import pMap from 'p-map';
+import uuid from 'uuid-random';
 const require = createRequire(import.meta.url);
 const {CapabilityAgent, Hmac, KmsClient} = require(
   '@digitalbazaar/webkms-client');
 
-const {util: {uuid}} = bedrock;
-
 const ZCAP_ROOT_PREFIX = 'urn:zcap:root:';
 
 describe('bedrock-kms-http HMAC operations', () => {

package/test/mocha/helpers.js

@@ -2,11 +2,12 @@
  * Copyright (c) 2019-2022 Digital Bazaar, Inc. All rights reserved.
  */
 import * as bedrock from '@bedrock/core';
-import {createRequire} from 'module';
+import {createRequire} from 'node:module';
 import {documentLoader} from '@bedrock/jsonld-document-loader';
 import {getAppIdentity} from '@bedrock/app-identity';
 import {httpsAgent} from '@bedrock/https-agent';
 import jsigs from 'jsonld-signatures';
+import uuid from 'uuid-random';
 const require = createRequire(import.meta.url);
 const {AsymmetricKey, CapabilityAgent, KeystoreAgent, KmsClient} =
   require('@digitalbazaar/webkms-client');
@@ -18,7 +19,6 @@ const {Ed25519Signature2020} = require('@digitalbazaar/ed25519-signature-2020');
 const {ZcapClient} = require('@digitalbazaar/ezcap');
 
 const {purposes: {AssertionProofPurpose}} = jsigs;
-const {util: {uuid}} = bedrock;
 const {ZCAP_CONTEXT_URL} = zcapConstants;
 
 export async function createMeter({capabilityAgent} = {}) {

package/test/mocha/mock.data.js

@@ -1,7 +1,7 @@
 /*!
  * Copyright (c) 2019-2022 Digital Bazaar, Inc. All rights reserved.
  */
-import {createRequire} from 'module';
+import {createRequire} from 'node:module';
 const require = createRequire(import.meta.url);
 const {constants: zcapConstants} = require('@digitalbazaar/zcap');
 

package/test/package.json

@@ -14,33 +14,33 @@
     "coverage-report": "c8 report"
   },
   "dependencies": {
-    "@bedrock/app-identity": "^2.0.0",
-    "@bedrock/core": "^5.0.0",
-    "@bedrock/did-context": "^3.0.0",
-    "@bedrock/did-io": "^7.0.0",
-    "@bedrock/express": "^7.0.0",
-    "@bedrock/https-agent": "^3.0.0",
-    "@bedrock/jsonld-document-loader": "^2.0.0",
-    "@bedrock/karma": "^3.0.0",
-    "@bedrock/kms": "^9.0.0",
+    "@bedrock/app-identity": "^3.0.0",
+    "@bedrock/core": "^6.0.0",
+    "@bedrock/did-context": "^4.0.0",
+    "@bedrock/did-io": "^8.0.0",
+    "@bedrock/express": "^8.0.0",
+    "@bedrock/https-agent": "^4.0.0",
+    "@bedrock/jsonld-document-loader": "^3.0.0",
+    "@bedrock/karma": "^4.0.0",
+    "@bedrock/kms": "^10.0.0",
     "@bedrock/kms-http": "file:..",
-    "@bedrock/ledger-context": "^22.0.0",
-    "@bedrock/meter": "^2.0.0",
-    "@bedrock/meter-http": "^7.0.0",
-    "@bedrock/meter-usage-reporter": "^6.0.0",
-    "@bedrock/mongodb": "^9.0.0",
-    "@bedrock/package-manager": "^2.0.0",
-    "@bedrock/security-context": "^6.0.0",
-    "@bedrock/server": "^4.0.0",
-    "@bedrock/ssm-mongodb": "^8.0.0",
-    "@bedrock/test": "^7.0.0",
-    "@bedrock/validation": "^6.0.0",
-    "@bedrock/veres-one-context": "^13.0.0",
-    "@bedrock/zcap-storage": "^6.0.0",
+    "@bedrock/ledger-context": "^23.0.0",
+    "@bedrock/meter": "^3.0.0",
+    "@bedrock/meter-http": "^8.0.0",
+    "@bedrock/meter-usage-reporter": "^7.0.0",
+    "@bedrock/mongodb": "^10.0.0",
+    "@bedrock/package-manager": "^3.0.0",
+    "@bedrock/security-context": "^7.0.0",
+    "@bedrock/server": "^5.0.0",
+    "@bedrock/ssm-mongodb": "^9.0.0",
+    "@bedrock/test": "^8.0.0",
+    "@bedrock/validation": "^7.0.0",
+    "@bedrock/veres-one-context": "^14.0.0",
+    "@bedrock/zcap-storage": "^7.0.0",
     "@digitalbazaar/did-method-key": "^2.0.0",
     "@digitalbazaar/ed25519-signature-2020": "^3.0.0",
     "@digitalbazaar/ezcap": "^2.0.0",
-    "@digitalbazaar/http-client": "^2.0.1",
+    "@digitalbazaar/http-client": "^3.0.1",
     "@digitalbazaar/http-signature-zcap-invoke": "^5.0.1",
     "@digitalbazaar/webkms-client": "^10.0.0",
     "@digitalbazaar/zcap": "^7.0.0",

package/test/test.config.js

@@ -2,8 +2,8 @@
  * Copyright (c) 2019-2022 Digital Bazaar, Inc. All rights reserved.
  */
 import {config} from '@bedrock/core';
-import {fileURLToPath} from 'url';
-import path from 'path';
+import {fileURLToPath} from 'node:url';
+import path from 'node:path';
 import '@bedrock/https-agent';
 import '@bedrock/kms-http';
 import '@bedrock/mongodb';