@bedrock/kms-http 14.1.0 → 14.2.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # bedrock-kms-http ChangeLog
 
+## 14.2.0 - 2022-05-13
+
+### Changed
+- Be more resilient to keystore config controller changes. When a keystore
+  is new and KMS operations are performed on it that could cause false-positive
+  fail authz errors, fetch a fresh version of the config to ensure that the
+  controller has not changed.
+
 ## 14.1.0 - 2022-05-12
 
 ### Added

package/lib/BedrockKeystoreConfigStorage.js

@@ -14,12 +14,13 @@ const {util: {BedrockError}} = bedrock;
 import './config.js';
 
 export class BedrockKeystoreConfigStorage extends KeystoreConfigStorage {
-  async get({id, req} = {}) {
-    const {config: keystoreConfig} = await keystores.get({id});
+  async get({id, req, returnRecord = false, fresh = false} = {}) {
+    const record = await keystores.get({id, fresh});
+    const {config: keystoreConfig} = record;
 
     // skip request checks if specifically requested
     if(req === false) {
-      return keystoreConfig;
+      return returnRecord ? record : keystoreConfig;
     }
 
     // verify that request is from an IP that is allowed to access the config
@@ -32,6 +33,6 @@ export class BedrockKeystoreConfigStorage extends KeystoreConfigStorage {
         });
     }
 
-    return keystoreConfig;
+    return returnRecord ? record : keystoreConfig;
   }
 }

package/lib/middleware.js

@@ -26,6 +26,8 @@ const {Ed25519VerificationKey2020} =
 
 const {config, util: {BedrockError}} = bedrock;
 
+const FIVE_MINUTES = 1000 * 60 * 5;
+
 const storage = new BedrockKeystoreConfigStorage();
 
 // create `getVerifier` hook for verifying zcap invocation HTTP signatures
@@ -39,8 +41,11 @@ export function createGetKeystoreConfig({routes}) {
     if(!req.webkms) {
       const keystoreId = helpers.getKeystoreId(
         {req, localId: req.params.keystoreId, routes});
-      const keystore = await storage.get({id: keystoreId, req});
-      req.webkms = {keystore};
+      const configRecord = await storage.get({
+        id: keystoreId, req, returnRecord: true
+      });
+      const {config: keystore} = configRecord;
+      req.webkms = {keystore, configRecord};
     }
     next();
   });
@@ -81,10 +86,7 @@ export function authorizeKeystoreZcapInvocation() {
         rootInvocationTarget: req.webkms.keystore.id
       };
     },
-    async getRootController({req}) {
-      // this will always be present based on where this middleware is used
-      return req.webkms.keystore.controller;
-    }
+    getRootController: getKeystoreController,
   });
 }
 
@@ -93,10 +95,7 @@ export function authorizeZcapRevocation() {
   return _authorizeZcapRevocation({
     documentLoader,
     expectedHost: config.server.host,
-    async getRootController({req}) {
-      // this will always be present based on where this middleware is used
-      return req.webkms.keystore.controller;
-    },
+    getRootController: getKeystoreController,
     getVerifier,
     inspectCapabilityChain,
     onError,
@@ -104,6 +103,77 @@ export function authorizeZcapRevocation() {
   });
 }
 
+async function getKeystoreController({req}) {
+  /* The following code is to prevent false-negative authz errors that are the
+  result of stale cached keystore configs.
+
+  It is a common pattern for keystore configs to have their root controllers
+  updated immediately after creation based on the value of a key that is in the
+  keystore itself. When this happens, decentralized caches may hold a stale
+  config with the old controller value. A client that uses a zcap that is
+  delegated / controlled by the root controller would see a false negative
+  authz error if the authz check used the cached value.
+
+  Therefore, this code will check whether keystore configs are reasonably new
+  and whether a failure is likely to occur on account of a mismatched root
+  controller. If this seems likely, a fresh copy of the keystore config record
+  is retrieved.
+
+  Algorithm: If the keystore config is less than five minutes old, then inspect
+  `req.ezcap.invocationParameters.capability` to ensure that either:
+
+  1. The `capability` is the root zcap and the verification method ID or
+    controller match the keystore controller.
+  2. The `capability` is delegated and the controller of the first delegated
+    zcap in the chain is the keystore controller.
+
+  If neither condition is true, fetch a fresh version of the keystore config
+  record and update `req.webkms`. */
+  const now = Date.now();
+  if((now - req.webkms.configRecord.meta.created) > FIVE_MINUTES ||
+    (req.ezcap.capabilityToRevoke && req.ezcap.invocationParameters)) {
+    // config is either older than five minutes or we've already been through
+    // this code path for the current request to run the checks against a
+    // zcap that is to be revoked (in which case we must not update again to
+    // ensure the keystore config used is consistent)
+    return req.webkms.keystore.controller;
+  }
+
+  // check for a zcap from the invocation params or for one to be revoked; the
+  // same rules above will be used to check if we need a fresh config record
+  const capability = req.ezcap?.invocationParameters?.capability ||
+    req.ezcap.capabilityToRevoke;
+
+  let getFreshConfigRecord = false;
+
+  // capability is root if it is a string; and it must be invoked because you
+  // can't revoke a root zcap
+  const isRoot = typeof capability === 'string';
+  if(isRoot && req.ezcap.invocationParameters) {
+    // fetch verification method early to compare against keystore controller
+    const {signature: {params: {keyId}}} = req.ezcap;
+    const {verificationMethod} = await getVerifier({keyId, documentLoader});
+    getFreshConfigRecord =
+      !(verificationMethod.controller === req.webkms.keystore.controller ||
+      verificationMethod.id === req.webkms.keystore.controller);
+  } else {
+    const second = capability?.proof?.capabilityChain[1];
+    if(second && second.controller !== req.webkms.keystore.controller) {
+      getFreshConfigRecord = true;
+    }
+  }
+
+  if(getFreshConfigRecord) {
+    const configRecord = await storage.get({
+      id: req.webkms.keystore.id, req, returnRecord: true, fresh: true
+    });
+    const {config: keystore} = configRecord;
+    req.webkms = {keystore, configRecord};
+  }
+
+  return req.webkms.keystore.controller;
+}
+
 // hook used to verify zcap invocation HTTP signatures
 async function getVerifier({keyId, documentLoader}) {
   const key = await cryptoLd.fromKeyId({id: keyId, documentLoader});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bedrock/kms-http",
-  "version": "14.1.0",
+  "version": "14.2.0",
   "type": "module",
   "description": "Bedrock KMS HTTP API",
   "main": "./lib/index.js",
@@ -26,7 +26,7 @@
   "dependencies": {
     "@digitalbazaar/ed25519-signature-2020": "^3.0.0",
     "@digitalbazaar/ed25519-verification-key-2020": "^3.2.0",
-    "@digitalbazaar/ezcap-express": "^6.0.0",
+    "@digitalbazaar/ezcap-express": "^6.2.0",
     "@digitalbazaar/webkms-switch": "^10.0.0",
     "cidr-regex": "^3.1.1",
     "cors": "^2.8.5",
@@ -38,7 +38,7 @@
     "@bedrock/app-identity": "^3.0.0",
     "@bedrock/core": "^6.0.0",
     "@bedrock/express": "^8.0.0",
-    "@bedrock/kms": "^10.0.0",
+    "@bedrock/kms": "^10.1.0",
     "@bedrock/meter-usage-reporter": "^7.0.0",
     "@bedrock/validation": "^7.0.0",
     "@bedrock/zcap-storage": "^7.0.0"