@bedrock/kms-http 14.2.0 → 14.2.1

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # bedrock-kms-http ChangeLog
 
+## 14.2.1 - 2022-05-13
+
+### Fixed
+- Fix cache busting for invoked delegated zcap cases.
+
 ## 14.2.0 - 2022-05-13
 
 ### Changed

package/lib/middleware.js

@@ -120,12 +120,15 @@ async function getKeystoreController({req}) {
   is retrieved.
 
   Algorithm: If the keystore config is less than five minutes old, then inspect
-  `req.ezcap.invocationParameters.capability` to ensure that either:
+  `req.ezcap.invocationParameters.capability` or `req.ezcap.capabilityToRevoke`
+  to ensure that:
 
-  1. The `capability` is the root zcap and the verification method ID or
-    controller match the keystore controller.
-  2. The `capability` is delegated and the controller of the first delegated
-    zcap in the chain is the keystore controller.
+  1. The `capability` is the root zcap and the ID or the controller of the
+    invoking verification method matches the keystore controller (note: can't
+    revoke a root zcap so this is an invoke-only case).
+  2. The `capability` (being invoked or revoked) is delegated and the
+    ID or controller of the delegating verification method for the first
+    delegated zcap in the chain matches the keystore controller.
 
   If neither condition is true, fetch a fresh version of the keystore config
   record and update `req.webkms`. */
@@ -144,26 +147,35 @@ async function getKeystoreController({req}) {
   const capability = req.ezcap?.invocationParameters?.capability ||
     req.ezcap.capabilityToRevoke;
 
-  let getFreshConfigRecord = false;
-
   // capability is root if it is a string; and it must be invoked because you
   // can't revoke a root zcap
   const isRoot = typeof capability === 'string';
+  let keyId;
   if(isRoot && req.ezcap.invocationParameters) {
-    // fetch verification method early to compare against keystore controller
-    const {signature: {params: {keyId}}} = req.ezcap;
-    const {verificationMethod} = await getVerifier({keyId, documentLoader});
-    getFreshConfigRecord =
-      !(verificationMethod.controller === req.webkms.keystore.controller ||
-      verificationMethod.id === req.webkms.keystore.controller);
+    // get verification method (key) ID from invocation params
+    ({signature: {params: {keyId}}} = req.ezcap);
   } else {
-    const second = capability?.proof?.capabilityChain[1];
-    if(second && second.controller !== req.webkms.keystore.controller) {
-      getFreshConfigRecord = true;
+    // get verification method (key) ID from first delegation proof
+    if(capability?.proof?.capabilityChain.length === 1) {
+      // capability *is* the delegated zcap
+      keyId = capability.proof?.verificationMethod;
+    } else {
+      // capability is delegated further down the chain
+      keyId = capability?.proof?.capabilityChain[1]?.proof?.verificationMethod;
     }
   }
 
-  if(getFreshConfigRecord) {
+  if(!keyId) {
+    // no verification method to check, use cached keystore controller
+    return req.webkms.keystore.controller;
+  }
+
+  // fetch verification method early to compare against keystore controller
+  const {verificationMethod} = await getVerifier({keyId, documentLoader});
+
+  // get fresh record if VM ID nor controller matches keystore controller
+  if(!(verificationMethod.controller === req.webkms.keystore.controller ||
+    verificationMethod.id === req.webkms.keystore.controller)) {
     const configRecord = await storage.get({
       id: req.webkms.keystore.id, req, returnRecord: true, fresh: true
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bedrock/kms-http",
-  "version": "14.2.0",
+  "version": "14.2.1",
   "type": "module",
   "description": "Bedrock KMS HTTP API",
   "main": "./lib/index.js",
@@ -38,7 +38,7 @@
     "@bedrock/app-identity": "^3.0.0",
     "@bedrock/core": "^6.0.0",
     "@bedrock/express": "^8.0.0",
-    "@bedrock/kms": "^10.1.0",
+    "@bedrock/kms": "^10.2.0",
     "@bedrock/meter-usage-reporter": "^7.0.0",
     "@bedrock/validation": "^7.0.0",
     "@bedrock/zcap-storage": "^7.0.0"

package/test/mocha/11-keystore-kms-client.js

@@ -3,11 +3,14 @@
  */
 import * as helpers from './helpers.js';
 import {httpsAgent} from '@bedrock/https-agent';
+import {keystores} from '@bedrock/kms';
 import {createRequire} from 'node:module';
 const require = createRequire(import.meta.url);
 const {CapabilityAgent, KmsClient, KeystoreAgent} =
   require('@digitalbazaar/webkms-client');
 
+const ZCAP_ROOT_PREFIX = 'urn:zcap:root:';
+
 describe('keystore API interactions using webkms-client', () => {
   let aliceCapabilityAgent;
   let aliceKeystoreConfig;
@@ -63,4 +66,108 @@ describe('keystore API interactions using webkms-client', () => {
     err.data.details.expected.should.equal(
       bobKeystoreAgent.keystoreId);
   });
+
+  it('updates config controller twice proving cache busting', async () => {
+    const keystoreId = aliceKeystoreConfig.id;
+    const kmsClient = new KmsClient({httpsAgent});
+
+    // create zcap agents to take over the keystore
+    const agent1 = await CapabilityAgent.fromSecret(
+      {secret: 'bd926f4c-38e4-4c3a-9a17-0e2608ee0a01', handle: 'primary'});
+    const agent2 = await CapabilityAgent.fromSecret(
+      {secret: 'd830baa9-02a6-4bd3-9072-de256b0b6c2d', handle: 'primary'});
+    const agent3 = await CapabilityAgent.fromSecret(
+      {secret: '37224754-647e-469a-9639-193a2833c69a', handle: 'primary'});
+
+    const aliceKeystoreAgent = new KeystoreAgent(
+      {capabilityAgent: aliceCapabilityAgent, keystoreId, kmsClient});
+    const agent1KeystoreAgent = new KeystoreAgent(
+      {capabilityAgent: agent1, keystoreId, kmsClient});
+    // const agent2KeystoreAgent = new KeystoreAgent(
+    //   {capabilityAgent: agent2, keystoreId, kmsClient});
+    const agent3KeystoreAgent = new KeystoreAgent(
+      {capabilityAgent: agent3, keystoreId, kmsClient});
+
+    // delegate zcap for updating config from agent2 to agent3 to test
+    // cache busting with delegated zcap
+    const rootCapability = ZCAP_ROOT_PREFIX + encodeURIComponent(keystoreId);
+    const agent3Zcap = await helpers.delegate({
+      parentCapability: rootCapability,
+      controller: agent3.id,
+      invocationTarget: keystoreId,
+      delegator: agent2
+    });
+
+    // delegate zcap for updating config from agent3 to agent2 to agent1 to
+    // test cache busting with deep delegated zcap
+    const agent2Zcap = await helpers.delegate({
+      parentCapability: rootCapability,
+      controller: agent2.id,
+      invocationTarget: keystoreId,
+      delegator: agent3
+    });
+    const agent1Zcap = await helpers.delegate({
+      parentCapability: agent2Zcap,
+      controller: agent1.id,
+      invocationTarget: keystoreId,
+      delegator: agent2
+    });
+
+    // update Alice's keystore config controller to agent1
+    let config = {...aliceKeystoreConfig};
+
+    try {
+      // disable cache delete functionality on update
+      keystores._disableClearCacheOnUpdate(true);
+
+      // update controller alice => agent1 (no cache busting required
+      {
+        config.sequence++;
+        config.controller = agent1.id;
+        const result = await aliceKeystoreAgent.updateConfig({config});
+        result.config.id.should.eql(config.id);
+        result.config.controller.should.eql(agent1.id);
+        ({config} = result);
+      }
+
+      // update controller agent1 => agent2 (requires cache busting by
+      // inspecting the root zcap)
+      {
+        config.sequence++;
+        config.controller = agent2.id;
+        const result = await agent1KeystoreAgent.updateConfig({config});
+        result.config.id.should.eql(config.id);
+        result.config.controller.should.eql(agent2.id);
+        ({config} = result);
+      }
+
+      // update controller agent2 => agent3 (requires cache busting by
+      // inspecting a delegated zcap)
+      {
+        config.sequence++;
+        config.controller = agent3.id;
+        const result = await agent3KeystoreAgent.updateConfig(
+          {capability: agent3Zcap, config});
+        result.config.id.should.eql(config.id);
+        result.config.controller.should.eql(agent3.id);
+        ({config} = result);
+      }
+
+      // update controller agent3 => agent1 (requires cache busting by
+      // inspecting a deep delegated zcap)
+      {
+        config.sequence++;
+        config.controller = agent1.id;
+        const result = await agent1KeystoreAgent.updateConfig(
+          {capability: agent1Zcap, config});
+        result.config.id.should.eql(config.id);
+        result.config.controller.should.eql(agent1.id);
+        ({config} = result);
+      }
+    } catch(e) {
+      assertNoError(e);
+    } finally {
+      keystores._disableClearCacheOnUpdate(false);
+    }
+  });
 });