@bedrock/kms-http 14.2.0 → 14.3.1

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # bedrock-kms-http ChangeLog
 
+## 14.3.1 - 2022-05-16
+
+### Fixed
+- Use `@digitalbazaar/webkms-switch@10.2` to ensure that pre-cached `webkms`
+  request meta data is not overwritten and that a custom `getRootController`
+  function is used (to enable cache busting on KMS operations).
+
+## 14.3.0 - 2022-05-16
+
+### Added
+- Add debug logging for keystore config cache busting.
+
+## 14.2.1 - 2022-05-13
+
+### Fixed
+- Fix cache busting for invoked delegated zcap cases.
+
 ## 14.2.0 - 2022-05-13
 
 ### Changed

package/lib/http.js

@@ -191,6 +191,7 @@ bedrock.events.on('bedrock-express.configure.routes', app => {
   app.post(
     routes.keys,
     cors(),
+    getKeystoreConfig,
     handleOperation);
 
   // invoke KMS operation on an existing key
@@ -198,6 +199,7 @@ bedrock.events.on('bedrock-express.configure.routes', app => {
   app.post(
     routes.key,
     cors(),
+    getKeystoreConfig,
     handleOperation);
 
   // TODO: consider whether this should be exposed w/o authorization

package/lib/middleware.js

@@ -11,6 +11,7 @@ import {
   defaultDocumentLoader as documentLoader,
   defaultModuleManager as moduleManager
 } from '@bedrock/kms';
+import {logger} from './logger.js';
 import {reportOperationUsage} from './metering.js';
 const require = createRequire(import.meta.url);
 const {
@@ -45,7 +46,7 @@ export function createGetKeystoreConfig({routes}) {
         id: keystoreId, req, returnRecord: true
       });
       const {config: keystore} = configRecord;
-      req.webkms = {keystore, configRecord};
+      req.webkms = {...req.webkms, keystore, configRecord};
     }
     next();
   });
@@ -57,7 +58,10 @@ export function createKmsOperationMiddleware() {
   return createOperationMiddleware({
     ...kmsOperationOptions,
     storage, moduleManager, documentLoader,
-    expectedHost: config.server.host, getVerifier,
+    expectedHost: config.server.host,
+    // override `getRootController` to provide cache busting capability
+    getRootController: getKeystoreController,
+    getVerifier,
     inspectCapabilityChain,
     onError, onSuccess: reportOperationUsage, suiteFactory
   });
@@ -120,12 +124,15 @@ async function getKeystoreController({req}) {
   is retrieved.
 
   Algorithm: If the keystore config is less than five minutes old, then inspect
-  `req.ezcap.invocationParameters.capability` to ensure that either:
+  `req.ezcap.invocationParameters.capability` or `req.ezcap.capabilityToRevoke`
+  to ensure that:
 
-  1. The `capability` is the root zcap and the verification method ID or
-    controller match the keystore controller.
-  2. The `capability` is delegated and the controller of the first delegated
-    zcap in the chain is the keystore controller.
+  1. The `capability` is the root zcap and the ID or the controller of the
+    invoking verification method matches the keystore controller (note: can't
+    revoke a root zcap so this is an invoke-only case).
+  2. The `capability` (being invoked or revoked) is delegated and the
+    ID or controller of the delegating verification method for the first
+    delegated zcap in the chain matches the keystore controller.
 
   If neither condition is true, fetch a fresh version of the keystore config
   record and update `req.webkms`. */
@@ -144,31 +151,45 @@ async function getKeystoreController({req}) {
   const capability = req.ezcap?.invocationParameters?.capability ||
     req.ezcap.capabilityToRevoke;
 
-  let getFreshConfigRecord = false;
-
   // capability is root if it is a string; and it must be invoked because you
   // can't revoke a root zcap
   const isRoot = typeof capability === 'string';
+  let keyId;
   if(isRoot && req.ezcap.invocationParameters) {
-    // fetch verification method early to compare against keystore controller
-    const {signature: {params: {keyId}}} = req.ezcap;
-    const {verificationMethod} = await getVerifier({keyId, documentLoader});
-    getFreshConfigRecord =
-      !(verificationMethod.controller === req.webkms.keystore.controller ||
-      verificationMethod.id === req.webkms.keystore.controller);
+    // get verification method (key) ID from invocation params
+    ({signature: {params: {keyId}}} = req.ezcap);
   } else {
-    const second = capability?.proof?.capabilityChain[1];
-    if(second && second.controller !== req.webkms.keystore.controller) {
-      getFreshConfigRecord = true;
+    // get verification method (key) ID from first delegation proof
+    if(capability?.proof?.capabilityChain.length === 1) {
+      // capability *is* the delegated zcap
+      keyId = capability.proof?.verificationMethod;
+    } else {
+      // capability is delegated further down the chain
+      keyId = capability?.proof?.capabilityChain[1]?.proof?.verificationMethod;
     }
   }
 
-  if(getFreshConfigRecord) {
+  if(!keyId) {
+    logger.debug(
+      'No verification method found in zcap when trying to bust keystore ' +
+      'config cache.');
+
+    // no verification method to check, use cached keystore controller
+    return req.webkms.keystore.controller;
+  }
+
+  // fetch verification method early to compare against keystore controller
+  const {verificationMethod} = await getVerifier({keyId, documentLoader});
+
+  // get fresh record if VM ID nor controller matches keystore controller
+  if(!(verificationMethod.controller === req.webkms.keystore.controller ||
+    verificationMethod.id === req.webkms.keystore.controller)) {
     const configRecord = await storage.get({
       id: req.webkms.keystore.id, req, returnRecord: true, fresh: true
     });
     const {config: keystore} = configRecord;
-    req.webkms = {keystore, configRecord};
+    req.webkms = {...req.webkms, keystore, configRecord};
+    logger.debug('Forced fresh keystore config retrieval during zcap check.');
   }
 
   return req.webkms.keystore.controller;
@@ -225,10 +246,7 @@ function onError({error}) {
   if(!(error instanceof BedrockError)) {
     // always expose cause message and name; expose cause details as
     // BedrockError if error is marked public
-    let details = {};
-    if(error.details && error.details.public) {
-      details = error.details;
-    }
+    const details = error.details?.public ? error.details : {};
     error = new BedrockError(
       error.message,
       error.name || 'NotAllowedError', {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bedrock/kms-http",
-  "version": "14.2.0",
+  "version": "14.3.1",
   "type": "module",
   "description": "Bedrock KMS HTTP API",
   "main": "./lib/index.js",
@@ -27,7 +27,7 @@
     "@digitalbazaar/ed25519-signature-2020": "^3.0.0",
     "@digitalbazaar/ed25519-verification-key-2020": "^3.2.0",
     "@digitalbazaar/ezcap-express": "^6.2.0",
-    "@digitalbazaar/webkms-switch": "^10.0.0",
+    "@digitalbazaar/webkms-switch": "^10.2.0",
     "cidr-regex": "^3.1.1",
     "cors": "^2.8.5",
     "crypto-ld": "^6.0.0",
@@ -38,7 +38,7 @@
     "@bedrock/app-identity": "^3.0.0",
     "@bedrock/core": "^6.0.0",
     "@bedrock/express": "^8.0.0",
-    "@bedrock/kms": "^10.1.0",
+    "@bedrock/kms": "^10.2.0",
     "@bedrock/meter-usage-reporter": "^7.0.0",
     "@bedrock/validation": "^7.0.0",
     "@bedrock/zcap-storage": "^7.0.0"

package/test/mocha/11-keystore-kms-client.js

@@ -3,11 +3,14 @@
  */
 import * as helpers from './helpers.js';
 import {httpsAgent} from '@bedrock/https-agent';
+import {keystores} from '@bedrock/kms';
 import {createRequire} from 'node:module';
 const require = createRequire(import.meta.url);
 const {CapabilityAgent, KmsClient, KeystoreAgent} =
   require('@digitalbazaar/webkms-client');
 
+const ZCAP_ROOT_PREFIX = 'urn:zcap:root:';
+
 describe('keystore API interactions using webkms-client', () => {
   let aliceCapabilityAgent;
   let aliceKeystoreConfig;
@@ -63,4 +66,177 @@ describe('keystore API interactions using webkms-client', () => {
     err.data.details.expected.should.equal(
       bobKeystoreAgent.keystoreId);
   });
+
+  it('updates config and uses key proving cache busting', async () => {
+    const keystoreId = aliceKeystoreConfig.id;
+    const kmsClient = new KmsClient({httpsAgent});
+
+    // create zcap agents to take over the keystore
+    const agent1 = await CapabilityAgent.fromSecret(
+      {secret: 'bd926f4c-38e4-4c3a-9a17-0e2608ee0a01', handle: 'primary'});
+    const agent2 = await CapabilityAgent.fromSecret(
+      {secret: 'd830baa9-02a6-4bd3-9072-de256b0b6c2d', handle: 'primary'});
+    const agent3 = await CapabilityAgent.fromSecret(
+      {secret: '37224754-647e-469a-9639-193a2833c69a', handle: 'primary'});
+
+    const aliceKeystoreAgent = new KeystoreAgent(
+      {capabilityAgent: aliceCapabilityAgent, keystoreId, kmsClient});
+    const agent1KeystoreAgent = new KeystoreAgent(
+      {capabilityAgent: agent1, keystoreId, kmsClient});
+    // const agent2KeystoreAgent = new KeystoreAgent(
+    //   {capabilityAgent: agent2, keystoreId, kmsClient});
+    const agent3KeystoreAgent = new KeystoreAgent(
+      {capabilityAgent: agent3, keystoreId, kmsClient});
+
+    // generate a key for use
+    const hmacKey = await aliceKeystoreAgent.generateKey({type: 'hmac'});
+
+    // delegate zcap for updating config from agent2 to agent3 to test
+    // cache busting with delegated zcap
+    const rootCapability = ZCAP_ROOT_PREFIX + encodeURIComponent(keystoreId);
+    const agent3Zcap = await helpers.delegate({
+      parentCapability: rootCapability,
+      controller: agent3.id,
+      invocationTarget: keystoreId,
+      delegator: agent2
+    });
+
+    // delegate zcap for updating config from agent3 to agent2 to agent1 to
+    // test cache busting with deep delegated zcap
+    const agent2Zcap = await helpers.delegate({
+      parentCapability: rootCapability,
+      controller: agent2.id,
+      invocationTarget: keystoreId,
+      delegator: agent3
+    });
+    const agent1Zcap = await helpers.delegate({
+      parentCapability: agent2Zcap,
+      controller: agent1.id,
+      invocationTarget: keystoreId,
+      delegator: agent2
+    });
+
+    // update Alice's keystore config controller to agent1
+    let config = {...aliceKeystoreConfig};
+
+    try {
+      // disable cache delete functionality on update
+      keystores._disableClearCacheOnUpdate(true);
+
+      // update controller alice => agent1 (no cache busting required)
+      {
+        config.sequence++;
+        config.controller = agent1.id;
+        const result = await aliceKeystoreAgent.updateConfig({config});
+        result.config.id.should.eql(config.id);
+        result.config.controller.should.eql(agent1.id);
+        ({config} = result);
+      }
+
+      // update controller agent1 => agent2 (requires cache busting by
+      // inspecting the root zcap)
+      {
+        config.sequence++;
+        config.controller = agent2.id;
+        const result = await agent1KeystoreAgent.updateConfig({config});
+        result.config.id.should.eql(config.id);
+        result.config.controller.should.eql(agent2.id);
+        ({config} = result);
+      }
+
+      // update controller agent2 => agent3 (requires cache busting by
+      // inspecting a delegated zcap)
+      {
+        config.sequence++;
+        config.controller = agent3.id;
+        const result = await agent3KeystoreAgent.updateConfig(
+          {capability: agent3Zcap, config});
+        result.config.id.should.eql(config.id);
+        result.config.controller.should.eql(agent3.id);
+        ({config} = result);
+      }
+
+      // update controller agent3 => agent1 (requires cache busting by
+      // inspecting a deep delegated zcap)
+      {
+        config.sequence++;
+        config.controller = agent1.id;
+        const result = await agent1KeystoreAgent.updateConfig(
+          {capability: agent1Zcap, config});
+        result.config.id.should.eql(config.id);
+        result.config.controller.should.eql(agent1.id);
+        ({config} = result);
+      }
+
+      // update controller back to alice to test key op cache busting
+      {
+        config.sequence++;
+        config.controller = aliceCapabilityAgent.id;
+        const result = await agent1KeystoreAgent.updateConfig({config});
+        result.config.id.should.eql(config.id);
+        result.config.controller.should.eql(aliceCapabilityAgent.id);
+        ({config} = result);
+      }
+
+      // use hmac key as alice (requires cache busting by inspecting root
+      // zcap)
+      await hmacKey.sign({data: new Uint8Array([0])});
+
+      // update controller alice => agent1 (no cache busting required)
+      {
+        config.sequence++;
+        config.controller = agent1.id;
+        const result = await aliceKeystoreAgent.updateConfig({config});
+        result.config.id.should.eql(config.id);
+        result.config.controller.should.eql(agent1.id);
+        ({config} = result);
+      }
+
+      // use hmac key as agent1 (requires cache busting by
+      // inspecting the root zcap)
+      hmacKey.invocationSigner = agent1.getSigner();
+      // use different data each time to avoid hmac caching
+      await hmacKey.sign({data: new Uint8Array([1])});
+
+      // update controller agent1 => agent2 (requires cache busting by
+      // inspecting the root zcap)
+      {
+        config.sequence++;
+        config.controller = agent2.id;
+        const result = await agent1KeystoreAgent.updateConfig({config});
+        result.config.id.should.eql(config.id);
+        result.config.controller.should.eql(agent2.id);
+        ({config} = result);
+      }
+
+      // use hmac key as agent3 (requires cache busting by
+      // inspecting a delegated zcap)
+      hmacKey.capability = agent3Zcap;
+      hmacKey.invocationSigner = agent3.getSigner();
+      // use different data each time to avoid hmac caching
+      await hmacKey.sign({data: new Uint8Array([1])});
+
+      // update controller agent2 => agent3 (cache should already be fresh)
+      {
+        config.sequence++;
+        config.controller = agent3.id;
+        const result = await agent3KeystoreAgent.updateConfig(
+          {capability: agent3Zcap, config});
+        result.config.id.should.eql(config.id);
+        result.config.controller.should.eql(agent3.id);
+        ({config} = result);
+      }
+
+      // use hmac key as agent1 (requires cache busting by
+      // inspecting a deep delegated zcap)
+      hmacKey.capability = agent1Zcap;
+      hmacKey.invocationSigner = agent1.getSigner();
+      // use different data each time to avoid hmac caching
+      await hmacKey.sign({data: new Uint8Array([1])});
+    } catch(e) {
+      assertNoError(e);
+    } finally {
+      keystores._disableClearCacheOnUpdate(false);
+    }
+  });
 });