@bedrock/kms-http 13.0.0

package/test/mocha/21-revocation-ip-allow-list.js

@@ -0,0 +1,143 @@
+/*!
+ * Copyright (c) 2019-2022 Digital Bazaar, Inc. All rights reserved.
+ */
+import * as helpers from './helpers.js';
+import {httpsAgent} from '@bedrock/https-agent';
+import {createRequire} from 'module';
+const require = createRequire(import.meta.url);
+const {CapabilityAgent, KmsClient, KeystoreAgent} =
+  require('@digitalbazaar/webkms-client');
+
+const ZCAP_ROOT_PREFIX = 'urn:zcap:root:';
+
+describe('revocations API with ipAllowList', () => {
+  let aliceCapabilityAgent;
+  let aliceKeystoreConfig;
+  let aliceKeystoreAgent;
+  let bobCapabilityAgent;
+  let carolCapabilityAgent;
+
+  before(async () => {
+    const secret = '40762a17-1696-428f-a2b2-ddf9fe9b4987';
+    const handle = 'alice';
+    aliceCapabilityAgent = await CapabilityAgent.fromSecret({secret, handle});
+
+    aliceKeystoreConfig = await helpers.createKeystore(
+      {capabilityAgent: aliceCapabilityAgent});
+    const kmsClient = new KmsClient({httpsAgent});
+    aliceKeystoreAgent = new KeystoreAgent({
+      capabilityAgent: aliceCapabilityAgent,
+      keystoreId: aliceKeystoreConfig.id,
+      kmsClient,
+    });
+  });
+
+  // generate a capability agent for Bob
+  before(async () => {
+    const secret = '34f2afd1-34ef-4d46-a998-cdc5462dc0d2';
+    const handle = 'bob';
+    bobCapabilityAgent = await CapabilityAgent.fromSecret({secret, handle});
+  });
+
+  // generate a capability agent for Carol
+  before(async () => {
+    const secret = 'ae806cd9-2765-4232-b955-01e1024ac032';
+    const handle = 'carol';
+    carolCapabilityAgent = await CapabilityAgent.fromSecret({secret, handle});
+  });
+
+  it('returns NotAllowedError for invalid source IP', async () => {
+    // first generate a new key for alice; use a did:key ID for its public ID
+    const aliceKey = await aliceKeystoreAgent.generateKey({
+      type: 'asymmetric',
+      publicAliasTemplate: 'did:key:{publicKeyMultibase}#${publicKeyMultibase}'
+    });
+
+    // next, delegate authority to bob to use alice's key
+    const rootCapability = ZCAP_ROOT_PREFIX +
+      encodeURIComponent(aliceKeystoreAgent.keystoreId);
+    const bobZcap = await helpers.delegate({
+      parentCapability: rootCapability,
+      controller: bobCapabilityAgent.id,
+      invocationTarget: aliceKey.kmsId,
+      allowedAction: 'sign',
+      delegator: aliceCapabilityAgent
+    });
+
+    // Bob now uses his delegated authority to sign a document with Alice's key
+    const bobSignedDocument = await helpers.signWithDelegatedKey({
+      capability: bobZcap,
+      // bob signs the invocation to use alice's key (and alice's key will
+      // sign the document)
+      invocationSigner: bobCapabilityAgent.getSigner()
+    });
+
+    bobSignedDocument.should.have.property('@context');
+    bobSignedDocument.should.have.property('example:foo');
+    bobSignedDocument.should.have.property('proof');
+    bobSignedDocument.proof.should.have.property('verificationMethod');
+    // the document was ultimately signed with alice's key
+    bobSignedDocument.proof.verificationMethod.should.equal(aliceKey.id);
+
+    // Bob has successfully used alice's key to sign a document!
+
+    // Bob now delegates the use of Alice's key to Carol
+    const carolZcap = await helpers.delegate({
+      parentCapability: bobZcap,
+      controller: carolCapabilityAgent.id,
+      delegator: bobCapabilityAgent
+    });
+
+    // Bob would then store record of the delegation to Carol in an EDV
+
+    // demonstrate that Carol can also sign with Alice's key
+    const carolSignedDocument = await helpers.signWithDelegatedKey({
+      capability: carolZcap,
+      // carol signs the invocation to use alice's key (and alice's key
+      // will sign the document)
+      invocationSigner: carolCapabilityAgent.getSigner()
+    });
+    carolSignedDocument.should.have.property('@context');
+    carolSignedDocument.should.have.property('example:foo');
+    carolSignedDocument.should.have.property('proof');
+    carolSignedDocument.proof.should.have.property('verificationMethod');
+    // the document was ultimately signed with alice's key
+    carolSignedDocument.proof.verificationMethod.should.equal(aliceKey.id);
+
+    // update Alice's keystore config to include ipAllowList
+    aliceKeystoreConfig.sequence++;
+    aliceKeystoreConfig.ipAllowList = ['8.8.8.8/32'];
+
+    const {config} = await aliceKeystoreAgent.updateConfig(
+      {config: aliceKeystoreConfig});
+    config.should.eql(aliceKeystoreConfig);
+
+    // Bob now submits a revocation to revoke the capability he gave to Carol.
+
+    // in practice bob is going to locate the capability he gave to carol
+    // by way of bedrock-web-zcap-storage
+
+    // this adds a revocation for Carol's `sign` capability on Alice's
+    // kms system
+
+    // this request should fails because the request does not originate from
+    // an IP in the `ipAllowList` on Alice's keystore.
+    let err;
+    let result;
+    try {
+      result = await helpers.revokeDelegatedCapability({
+        // the `sign` capability that Bob gave to Carol
+        capabilityToRevoke: carolZcap,
+        // bob is revoking the capability he gave to carol
+        invocationSigner: bobCapabilityAgent.getSigner()
+      });
+    } catch(e) {
+      err = e;
+    }
+    should.not.exist(result);
+    should.exist(err);
+    err.status.should.equal(403);
+    err.data.type.should.equal('NotAllowedError');
+    err.data.message.should.contain('Source IP');
+  });
+});

package/test/mocha/30-operations-generate-key.js

@@ -0,0 +1,180 @@
+/*!
+ * Copyright (c) 2019-2022 Digital Bazaar, Inc. All rights reserved.
+ */
+import * as helpers from './helpers.js';
+import {httpsAgent} from '@bedrock/https-agent';
+import {createRequire} from 'module';
+const require = createRequire(import.meta.url);
+const {CapabilityAgent, KmsClient, KeystoreAgent} =
+  require('@digitalbazaar/webkms-client');
+const {httpClient, DEFAULT_HEADERS} = require('@digitalbazaar/http-client');
+const {signCapabilityInvocation} = require(
+  '@digitalbazaar/http-signature-zcap-invoke');
+
+describe('generateKey', () => {
+  it('generates a key', async () => {
+    const secret = '0628a44e-7599-11ec-989d-10bf48838a41';
+    const handle = 'testKey';
+    const keystoreAgent = await helpers.createKeystoreAgent(
+      {handle, secret});
+    let err;
+    let result;
+    try {
+      result = await keystoreAgent.generateKey({type: 'hmac'});
+    } catch(e) {
+      err = e;
+    }
+    assertNoError(err);
+    should.exist(result);
+    result.should.include.keys([
+      'algorithm', 'capability', 'id', 'type', 'invocationSigner', 'kmsClient'
+    ]);
+  });
+  it('generates a key with ipAllowList', async () => {
+    // source of requests in the test suite are from 127.0.0.1
+    const secret = '22612679-05ce-4ffd-bf58-22b3c4bc1314';
+    const handle = 'testKeyAllowList';
+    const ipAllowList = ['127.0.0.1/32'];
+    const keystoreAgent = await helpers.createKeystoreAgent(
+      {handle, ipAllowList, secret});
+    let err;
+    let result;
+    try {
+      result = await keystoreAgent.generateKey({type: 'hmac'});
+    } catch(e) {
+      err = e;
+    }
+    assertNoError(err);
+    should.exist(result);
+    result.should.include.keys([
+      'algorithm', 'capability', 'id', 'type', 'invocationSigner', 'kmsClient'
+    ]);
+  });
+  it('generates a key with x-forwarded-for header', async () => {
+    // source of requests in the test suite are from 127.0.0.1
+    const secret = '22612679-05ce-4ffd-bf58-22b3c4bc1314';
+    const handle = 'testKeyAllowList';
+    const ipAllowList = ['8.8.8.8/32'];
+    const keystoreAgent = await helpers.createKeystoreAgent({
+      handle, ipAllowList, secret, kmsClientHeaders: {
+        'x-forwarded-for': '8.8.8.8',
+      }
+    });
+    let err;
+    let result;
+    try {
+      result = await keystoreAgent.generateKey({type: 'hmac'});
+    } catch(e) {
+      err = e;
+    }
+    assertNoError(err);
+    should.exist(result);
+    result.should.include.keys([
+      'algorithm', 'capability', 'id', 'type', 'invocationSigner', 'kmsClient'
+    ]);
+  });
+  it('generates a key with multiple ipAllowList entries', async () => {
+    // source of requests in the test suite are from 127.0.0.1
+    const secret = 'efef2772-f7aa-4d25-9eac-6228f2a64b3b';
+    const handle = 'testKeyAllowList';
+    const ipAllowList = ['8.8.8.8/32', '127.0.0.1/32'];
+    const keystoreAgent = await helpers.createKeystoreAgent(
+      {handle, ipAllowList, secret});
+    let err;
+    let result;
+    try {
+      result = await keystoreAgent.generateKey({type: 'hmac'});
+    } catch(e) {
+      err = e;
+    }
+    assertNoError(err);
+    should.exist(result);
+    result.should.include.keys([
+      'algorithm', 'capability', 'id', 'type', 'invocationSigner', 'kmsClient'
+    ]);
+  });
+  it('returns NotAllowedError for invalid source IP', async () => {
+    // source of requests in the test suite are from 127.0.0.1
+    const secret = '860a6bc8-74e1-4dfd-b701-7efc2a596e91';
+    const handle = 'testKeyAllowList';
+    const ipAllowList = ['8.8.8.8/32'];
+    const keystoreAgent = await helpers.createKeystoreAgent(
+      {handle, ipAllowList, secret});
+
+    let err;
+    let result;
+    try {
+      result = await keystoreAgent.generateKey({type: 'hmac'});
+    } catch(e) {
+      err = e;
+    }
+    should.exist(err);
+    should.not.exist(result);
+    err.status.should.equal(403);
+    err.data.type.should.equal('NotAllowedError');
+  });
+  it('generates a key with "maxCapabilityChainLength=1"', async () => {
+    const secret = '0ad59134-7583-11ec-b16e-10bf48838a41';
+    const handle = 'testKeyMaxCapabilityChainLength';
+    const keystoreAgent = await helpers.createKeystoreAgent(
+      {handle, secret});
+    let err;
+    let result;
+    try {
+      result = await keystoreAgent.generateKey({
+        type: 'asymmetric', maxCapabilityChainLength: 1
+      });
+    } catch(e) {
+      err = e;
+    }
+    assertNoError(err);
+    should.exist(result);
+    result.should.include.keys([
+      'capability', 'id', 'type', 'invocationSigner', 'kmsClient', 'kmsId'
+    ]);
+  });
+}); // generateKey with ipAllowList
+
+describe('get public key description', () => {
+  it('gets public key description', async () => {
+    const secret = '34f2afd1-34ef-4d46-a998-cdc5462dc0d2';
+    const handle = 'bobKey';
+    const capabilityAgent = await CapabilityAgent.fromSecret(
+      {secret, handle});
+    const {id: keystoreId} = await helpers.createKeystore(
+      {capabilityAgent});
+    const kmsClient = new KmsClient({keystoreId, httpsAgent});
+    let keystoreAgent;
+    try {
+      keystoreAgent = new KeystoreAgent(
+        {capabilityAgent, keystoreId, kmsClient});
+    } catch(e) {
+      assertNoError(e);
+    }
+    const key = await keystoreAgent.generateKey({type: 'asymmetric'});
+
+    const url = key.id;
+    const headers = await signCapabilityInvocation({
+      url, method: 'get',
+      headers: DEFAULT_HEADERS,
+      capability: 'urn:zcap:root:' + encodeURIComponent(url),
+      invocationSigner: capabilityAgent.getSigner(),
+      capabilityAction: 'read'
+    });
+
+    let err;
+    let result;
+    try {
+      result = await httpClient.get(url, {agent: httpsAgent, headers});
+    } catch(e) {
+      err = e;
+    }
+    assertNoError(err);
+    should.exist(result);
+    result.data.should.include.keys([
+      '@context', 'id', 'type', 'publicKeyMultibase', 'controller'
+    ]);
+    result.data.id.should.equal(key.id);
+    result.data.type.should.equal(key.type);
+  });
+});

package/test/mocha/31-operations-hmac.js

@@ -0,0 +1,178 @@
+/*!
+ * Copyright (c) 2019-2022 Digital Bazaar, Inc. All rights reserved.
+ */
+import * as bedrock from '@bedrock/core';
+import * as helpers from './helpers.js';
+import {httpsAgent} from '@bedrock/https-agent';
+import {createRequire} from 'module';
+import pMap from 'p-map';
+const require = createRequire(import.meta.url);
+const {CapabilityAgent, Hmac, KmsClient} = require(
+  '@digitalbazaar/webkms-client');
+
+const {util: {uuid}} = bedrock;
+
+const ZCAP_ROOT_PREFIX = 'urn:zcap:root:';
+
+describe('bedrock-kms-http HMAC operations', () => {
+  describe('Sha256HmacKey2019', () => {
+    let hmac;
+    before(async () => {
+      const secret = 'b07e6b31-d910-438e-9a5f-08d945a5f676';
+      const handle = 'testKey1';
+      const keystoreAgent = await helpers.createKeystoreAgent({handle, secret});
+      hmac = await keystoreAgent.generateKey({type: 'hmac'});
+    });
+    it('successfully signs', async () => {
+      const data = new TextEncoder('utf-8').encode('hello');
+      let err;
+      let result;
+      try {
+        result = await hmac.sign({data});
+      } catch(e) {
+        err = e;
+      }
+      assertNoError(err);
+      should.exist(result);
+      result.should.be.a('Uint8Array');
+    });
+  }); // end Sha256HmacKey2019
+
+  describe('Sha256HmacKey2019 with ipAllowList', () => {
+    it('successfully signs', async () => {
+      const secret = '22612679-05ce-4ffd-bf58-22b3c4bc1314';
+      const handle = 'testKeyAllowList';
+      const ipAllowList = ['127.0.0.1/32'];
+      const keystoreAgent = await helpers.createKeystoreAgent(
+        {handle, ipAllowList, secret});
+      const hmac = await keystoreAgent.generateKey({type: 'hmac'});
+      const data = new TextEncoder('utf-8').encode('hello');
+      let err;
+      let result;
+      try {
+        result = await hmac.sign({data});
+      } catch(e) {
+        err = e;
+      }
+      assertNoError(err);
+      should.exist(result);
+      result.should.be.a('Uint8Array');
+    });
+    it('fails when "maxCapabilityChainLength" is exceeded', async () => {
+      const secret = '22612679-05ce-4ffd-bf58-22b3c4bc1314';
+      const handle = 'testKeyMaxCapabilityChainLength';
+      const keystoreAgent = await helpers.createKeystoreAgent(
+        {handle, secret});
+      const hmac = await keystoreAgent.generateKey({
+        type: 'hmac', maxCapabilityChainLength: 1
+      });
+      const data = new TextEncoder('utf-8').encode('hello');
+
+      let err;
+      let result;
+      try {
+        result = await hmac.sign({data});
+      } catch(e) {
+        err = e;
+      }
+      assertNoError(err);
+      should.exist(result);
+      result.should.be.a('Uint8Array');
+
+      // now delegate and try to invoke
+      const delegatee = await CapabilityAgent.fromSecret({
+        secret: uuid(),
+        handle: uuid()
+      });
+      const rootCapability = ZCAP_ROOT_PREFIX +
+        encodeURIComponent(keystoreAgent.keystoreId);
+      const delegatedZcap = await helpers.delegate({
+        parentCapability: rootCapability,
+        controller: delegatee.id,
+        invocationTarget: hmac.id,
+        allowedAction: 'sign',
+        delegator: keystoreAgent.capabilityAgent
+      });
+      const hmac2 = await Hmac.fromCapability({
+        capability: delegatedZcap,
+        invocationSigner: delegatee.getSigner(),
+        kmsClient: new KmsClient({httpsAgent})
+      });
+
+      let err2;
+      let result2;
+      try {
+        result2 = await hmac2.sign({data});
+      } catch(e) {
+        err2 = e;
+      }
+      should.exist(err2);
+      should.not.exist(result2);
+      should.exist(err2.data);
+      err2.data.type.should.equal('NotAllowedError');
+      should.exist(err2.data.cause);
+      err2.data.cause.message.should.equal(
+        'Maximum zcap invocation capability chain length (1) exceeded.');
+    });
+    it('successfully signs with x-forwarded-for header', async () => {
+      const secret = '2726f62d-31bb-4688-b54a-1a0b4e50329f';
+      const handle = 'testKeyAllowList';
+      const ipAllowList = ['8.8.8.8/32'];
+      const keystoreAgent = await helpers.createKeystoreAgent({
+        handle, ipAllowList, secret, kmsClientHeaders: {
+          'x-forwarded-for': '8.8.8.8',
+        }
+      });
+      const hmac = await keystoreAgent.generateKey({type: 'hmac'});
+      const data = new TextEncoder('utf-8').encode('hello');
+      let err;
+      let result;
+      try {
+        result = await hmac.sign({data});
+      } catch(e) {
+        err = e;
+      }
+      assertNoError(err);
+      should.exist(result);
+      result.should.be.a('Uint8Array');
+    });
+  }); // end Sha256HmacKey2019 with ipAllowList
+
+  describe('bulk operations', () => {
+    const operationCount = 1000;
+    const vData = [];
+    let hmac;
+
+    before(async () => {
+      const secret = '9b5a0a63-aac2-447c-a60a-8cc79b46418d';
+      const handle = 'testKeyBulk';
+      const keystoreAgent = await helpers.createKeystoreAgent({handle, secret});
+      hmac = await keystoreAgent.generateKey({type: 'hmac'});
+    });
+    before(async () => {
+      for(let i = 0; i < operationCount; ++i) {
+        // uuids are 37 chars long, * 30 is ~1KiB
+        let v = '';
+        for(let n = 0; n < 30; ++n) {
+          v += uuid();
+        }
+        vData.push(new TextEncoder('utf-8').encode(v));
+      }
+    });
+    it(`performs ${operationCount} signatures`, async function() {
+      this.timeout(0);
+      let result;
+      let err;
+      try {
+        result = await pMap(
+          vData, data => hmac.sign({data}), {concurrency: 30});
+      } catch(e) {
+        err = e;
+      }
+      assertNoError(err);
+      should.exist(result);
+      result.should.be.an('array');
+      result.should.have.length(operationCount);
+    });
+  }); // end bulk operations
+});

package/test/mocha/helpers.js

@@ -0,0 +1,163 @@
+/*
+ * Copyright (c) 2019-2022 Digital Bazaar, Inc. All rights reserved.
+ */
+import * as bedrock from '@bedrock/core';
+import {createRequire} from 'module';
+import {documentLoader} from '@bedrock/jsonld-document-loader';
+import {getAppIdentity} from '@bedrock/app-identity';
+import {httpsAgent} from '@bedrock/https-agent';
+import jsigs from 'jsonld-signatures';
+const require = createRequire(import.meta.url);
+const {AsymmetricKey, CapabilityAgent, KeystoreAgent, KmsClient} =
+  require('@digitalbazaar/webkms-client');
+const {
+  CapabilityDelegation,
+  constants: zcapConstants
+} = require('@digitalbazaar/zcap');
+const {Ed25519Signature2020} = require('@digitalbazaar/ed25519-signature-2020');
+const {ZcapClient} = require('@digitalbazaar/ezcap');
+
+const {purposes: {AssertionProofPurpose}} = jsigs;
+const {util: {uuid}} = bedrock;
+const {ZCAP_CONTEXT_URL} = zcapConstants;
+
+export async function createMeter({capabilityAgent} = {}) {
+  // create signer using the application's capability invocation key
+  const {keys: {capabilityInvocationKey}} = getAppIdentity();
+
+  const zcapClient = new ZcapClient({
+    agent: httpsAgent,
+    invocationSigner: capabilityInvocationKey.signer(),
+    SuiteClass: Ed25519Signature2020
+  });
+  // create a meter
+  const meterService = `${bedrock.config.server.baseUri}/meters`;
+  let meter = {
+    controller: capabilityAgent.id,
+    product: {
+      // mock ID for webkms service product
+      id: 'urn:uuid:80a82316-e8c2-11eb-9570-10bf48838a41'
+    }
+  };
+  ({data: {meter}} = await zcapClient.write({url: meterService, json: meter}));
+
+  // return full meter ID
+  const {id} = meter;
+  return {id: `${meterService}/${id}`};
+}
+
+export async function createKeystore({
+  capabilityAgent, ipAllowList, referenceId, meterId,
+  kmsBaseUrl = `${bedrock.config.server.baseUri}/kms`,
+  kmsModule = 'ssm-v1',
+}) {
+  if(!meterId) {
+    // create a meter for the keystore
+    ({id: meterId} = await createMeter({capabilityAgent}));
+  }
+
+  // create keystore
+  const config = {
+    sequence: 0,
+    controller: capabilityAgent.id,
+    meterId,
+    kmsModule
+  };
+  if(referenceId) {
+    config.referenceId = referenceId;
+  }
+  if(ipAllowList) {
+    config.ipAllowList = ipAllowList;
+  }
+
+  return KmsClient.createKeystore({
+    url: `${kmsBaseUrl}/keystores`,
+    config,
+    invocationSigner: capabilityAgent.getSigner(),
+    httpsAgent
+  });
+}
+
+export async function createKeystoreAgent({
+  handle, ipAllowList, secret, kmsClientHeaders = {}
+}) {
+  const capabilityAgent = await CapabilityAgent.fromSecret({secret, handle});
+
+  let err;
+  let keystore;
+  try {
+    keystore = await createKeystore({capabilityAgent, ipAllowList});
+  } catch(e) {
+    err = e;
+  }
+  assertNoError(err);
+
+  // create kmsClient only required because we need to use httpsAgent
+  // that accepts self-signed certs used in test suite
+  const kmsClient = new KmsClient(
+    {httpsAgent, defaultHeaders: kmsClientHeaders});
+  const keystoreAgent = new KeystoreAgent({
+    capabilityAgent,
+    keystoreId: keystore.id,
+    kmsClient
+  });
+
+  return keystoreAgent;
+}
+
+export async function getKeystore({id, capabilityAgent}) {
+  const kmsClient = new KmsClient({keystoreId: id, httpsAgent});
+  const invocationSigner = capabilityAgent.getSigner();
+  return kmsClient.getKeystore({invocationSigner});
+}
+
+export async function delegate({
+  parentCapability, controller, invocationTarget, expires, allowedAction,
+  delegator, purposeOptions = {}
+}) {
+  const newCapability = {
+    '@context': ZCAP_CONTEXT_URL,
+    id: `urn:zcap:${uuid()}`,
+    controller,
+    parentCapability: parentCapability.id || parentCapability,
+    invocationTarget: invocationTarget || parentCapability.invocationTarget,
+    expires: expires || parentCapability.expires ||
+      new Date(Date.now() + 5000).toISOString().slice(0, -5) + 'Z',
+    allowedAction: allowedAction || parentCapability.allowedAction
+  };
+  // attach capability delegation proof
+  return jsigs.sign(newCapability, {
+    documentLoader,
+    purpose: new CapabilityDelegation({parentCapability, ...purposeOptions}),
+    suite: new Ed25519Signature2020({signer: delegator.getSigner()}),
+  });
+}
+
+export async function revokeDelegatedCapability({
+  capabilityToRevoke, invocationSigner
+}) {
+  const kmsClient = new KmsClient({httpsAgent});
+  await kmsClient.revokeCapability({
+    capabilityToRevoke,
+    invocationSigner
+  });
+}
+
+export async function signWithDelegatedKey({
+  capability, doc, invocationSigner
+}) {
+  const delegatedSigningKey = await AsymmetricKey.fromCapability({
+    capability,
+    invocationSigner,
+    kmsClient: new KmsClient({httpsAgent})
+  });
+  const suite = new Ed25519Signature2020({signer: delegatedSigningKey});
+
+  doc = doc || {'example:foo': 'test'};
+
+  return jsigs.sign(doc, {
+    documentLoader,
+    purpose: new AssertionProofPurpose(),
+    suite
+  });
+}

package/test/mocha/mock.data.js

@@ -0,0 +1,40 @@
+/*!
+ * Copyright (c) 2019-2022 Digital Bazaar, Inc. All rights reserved.
+ */
+import {createRequire} from 'module';
+const require = createRequire(import.meta.url);
+const {constants: zcapConstants} = require('@digitalbazaar/zcap');
+
+const {ZCAP_CONTEXT_URL} = zcapConstants;
+
+export const mockData = {};
+
+const zcaps = mockData.zcaps = {};
+
+// Note: This zcap is only used to check JSON schema validators, it does not
+// have valid proofs.
+const zcap0 = {
+  '@context': ZCAP_CONTEXT_URL,
+  id: 'urn:zcap:z19vWhR8EsNbWqvazp5bg6BTu',
+  controller: 'did:key:z6Mkkt1BWYLPAAXwYBwyVHAZkL94tgT8QbQv2SUxeW1U3DaG',
+  expires: '2022-01-08T17:27:15Z',
+  invocationTarget: 'https://bedrock.localhost:18443/kms' +
+    '/keystores/z1AAWWM7Zd4YyyV3NfaCqFuzQ/keys/z19wxodgv1UhrToQMvSxGhQG6',
+  parentCapability: 'urn:zcap:root:' + encodeURIComponent(
+    'https://bedrock.localhost:18443/kms/keystores/z1AAWWM7Zd4YyyV3NfaCqFuzQ'),
+  allowedAction: 'sign',
+  proof: {
+    type: 'Ed25519Signature2020',
+    created: '2020-02-27T21:22:48Z',
+    verificationMethod: 'did:key:z6MkkrtV7wnBpXKBtiZjxaSghCo8ttb5kZUJTk8bEwT' +
+      'TTYvg#z6MkkrtV7wnBpXKBtiZjxaSghCo8ttb5kZUJTk8bEwTTTYvg',
+    proofPurpose: 'capabilityDelegation',
+    capabilityChain: [
+      'urn:zcap:root:' + encodeURIComponent(
+        'https://bedrock.localhost:18443/kms/keystores/z1AAWWM7Zd4YyyV3NfaCqFu')
+    ],
+    proofValue: 'eyJhbGciOiJFZERTQSIsImI2NCI6ZmFsc2UsImNyaXQiOlsiYjY0Il19'
+  }
+};
+
+zcaps.zero = zcap0;