@bedrock/kms-http 14.2.1 → 14.4.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # bedrock-kms-http ChangeLog
 
+## 14.4.0 - 2022-05-19
+
+### Added
+- Add max age header for CORS, defaulting to the max acceptable time for
+  modern browsers of 86400 seconds (24 hours).
+
+## 14.3.1 - 2022-05-16
+
+### Fixed
+- Use `@digitalbazaar/webkms-switch@10.2` to ensure that pre-cached `webkms`
+  request meta data is not overwritten and that a custom `getRootController`
+  function is used (to enable cache busting on KMS operations).
+
+## 14.3.0 - 2022-05-16
+
+### Added
+- Add debug logging for keystore config cache busting.
+
 ## 14.2.1 - 2022-05-13
 
 ### Fixed

package/lib/http.js

@@ -6,7 +6,6 @@ import * as brZCapStorage from '@bedrock/zcap-storage';
 import * as helpers from './helpers.js';
 import * as middleware from './middleware.js';
 import {asyncHandler} from '@bedrock/express';
-import cors from 'cors';
 import {createRequire} from 'node:module';
 import {createValidateMiddleware as validate} from '@bedrock/validation';
 import {
@@ -24,6 +23,7 @@ const require = createRequire(import.meta.url);
 const {generateRandom} = require('@digitalbazaar/webkms-switch');
 
 const {config, util: {BedrockError}} = bedrock;
+const {cors} = middleware;
 
 bedrock.events.on('bedrock-express.configure.routes', app => {
   const cfg = config['kms-http'];
@@ -191,6 +191,7 @@ bedrock.events.on('bedrock-express.configure.routes', app => {
   app.post(
     routes.keys,
     cors(),
+    getKeystoreConfig,
     handleOperation);
 
   // invoke KMS operation on an existing key
@@ -198,6 +199,7 @@ bedrock.events.on('bedrock-express.configure.routes', app => {
   app.post(
     routes.key,
     cors(),
+    getKeystoreConfig,
     handleOperation);
 
   // TODO: consider whether this should be exposed w/o authorization

package/lib/middleware.js

@@ -7,10 +7,12 @@ import * as helpers from './helpers.js';
 import {asyncHandler} from '@bedrock/express';
 import {BedrockKeystoreConfigStorage} from './BedrockKeystoreConfigStorage.js';
 import {createRequire} from 'node:module';
+import {default as _cors} from 'cors';
 import {
   defaultDocumentLoader as documentLoader,
   defaultModuleManager as moduleManager
 } from '@bedrock/kms';
+import {logger} from './logger.js';
 import {reportOperationUsage} from './metering.js';
 const require = createRequire(import.meta.url);
 const {
@@ -45,7 +47,7 @@ export function createGetKeystoreConfig({routes}) {
         id: keystoreId, req, returnRecord: true
       });
       const {config: keystore} = configRecord;
-      req.webkms = {keystore, configRecord};
+      req.webkms = {...req.webkms, keystore, configRecord};
     }
     next();
   });
@@ -57,7 +59,10 @@ export function createKmsOperationMiddleware() {
   return createOperationMiddleware({
     ...kmsOperationOptions,
     storage, moduleManager, documentLoader,
-    expectedHost: config.server.host, getVerifier,
+    expectedHost: config.server.host,
+    // override `getRootController` to provide cache busting capability
+    getRootController: getKeystoreController,
+    getVerifier,
     inspectCapabilityChain,
     onError, onSuccess: reportOperationUsage, suiteFactory
   });
@@ -103,6 +108,11 @@ export function authorizeZcapRevocation() {
   });
 }
 
+export function cors() {
+  // `86400` is the max acceptable cache age for modern browsers
+  return _cors({maxAge: 86400});
+}
+
 async function getKeystoreController({req}) {
   /* The following code is to prevent false-negative authz errors that are the
   result of stale cached keystore configs.
@@ -166,6 +176,10 @@ async function getKeystoreController({req}) {
   }
 
   if(!keyId) {
+    logger.debug(
+      'No verification method found in zcap when trying to bust keystore ' +
+      'config cache.');
+
     // no verification method to check, use cached keystore controller
     return req.webkms.keystore.controller;
   }
@@ -180,7 +194,8 @@ async function getKeystoreController({req}) {
       id: req.webkms.keystore.id, req, returnRecord: true, fresh: true
     });
     const {config: keystore} = configRecord;
-    req.webkms = {keystore, configRecord};
+    req.webkms = {...req.webkms, keystore, configRecord};
+    logger.debug('Forced fresh keystore config retrieval during zcap check.');
   }
 
   return req.webkms.keystore.controller;
@@ -237,10 +252,7 @@ function onError({error}) {
   if(!(error instanceof BedrockError)) {
     // always expose cause message and name; expose cause details as
     // BedrockError if error is marked public
-    let details = {};
-    if(error.details && error.details.public) {
-      details = error.details;
-    }
+    const details = error.details?.public ? error.details : {};
     error = new BedrockError(
       error.message,
       error.name || 'NotAllowedError', {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bedrock/kms-http",
-  "version": "14.2.1",
+  "version": "14.4.0",
   "type": "module",
   "description": "Bedrock KMS HTTP API",
   "main": "./lib/index.js",
@@ -27,7 +27,7 @@
     "@digitalbazaar/ed25519-signature-2020": "^3.0.0",
     "@digitalbazaar/ed25519-verification-key-2020": "^3.2.0",
     "@digitalbazaar/ezcap-express": "^6.2.0",
-    "@digitalbazaar/webkms-switch": "^10.0.0",
+    "@digitalbazaar/webkms-switch": "^10.2.0",
     "cidr-regex": "^3.1.1",
     "cors": "^2.8.5",
     "crypto-ld": "^6.0.0",

package/test/mocha/11-keystore-kms-client.js

@@ -67,7 +67,7 @@ describe('keystore API interactions using webkms-client', () => {
       bobKeystoreAgent.keystoreId);
   });
 
-  it('updates config controller twice proving cache busting', async () => {
+  it('updates config and uses key proving cache busting', async () => {
     const keystoreId = aliceKeystoreConfig.id;
     const kmsClient = new KmsClient({httpsAgent});
 
@@ -88,6 +88,9 @@ describe('keystore API interactions using webkms-client', () => {
     const agent3KeystoreAgent = new KeystoreAgent(
       {capabilityAgent: agent3, keystoreId, kmsClient});
 
+    // generate a key for use
+    const hmacKey = await aliceKeystoreAgent.generateKey({type: 'hmac'});
+
     // delegate zcap for updating config from agent2 to agent3 to test
     // cache busting with delegated zcap
     const rootCapability = ZCAP_ROOT_PREFIX + encodeURIComponent(keystoreId);
@@ -120,7 +123,7 @@ describe('keystore API interactions using webkms-client', () => {
       // disable cache delete functionality on update
       keystores._disableClearCacheOnUpdate(true);
 
-      // update controller alice => agent1 (no cache busting required
+      // update controller alice => agent1 (no cache busting required)
       {
         config.sequence++;
         config.controller = agent1.id;
@@ -164,6 +167,72 @@ describe('keystore API interactions using webkms-client', () => {
         result.config.controller.should.eql(agent1.id);
         ({config} = result);
       }
+
+      // update controller back to alice to test key op cache busting
+      {
+        config.sequence++;
+        config.controller = aliceCapabilityAgent.id;
+        const result = await agent1KeystoreAgent.updateConfig({config});
+        result.config.id.should.eql(config.id);
+        result.config.controller.should.eql(aliceCapabilityAgent.id);
+        ({config} = result);
+      }
+
+      // use hmac key as alice (requires cache busting by inspecting root
+      // zcap)
+      await hmacKey.sign({data: new Uint8Array([0])});
+
+      // update controller alice => agent1 (no cache busting required)
+      {
+        config.sequence++;
+        config.controller = agent1.id;
+        const result = await aliceKeystoreAgent.updateConfig({config});
+        result.config.id.should.eql(config.id);
+        result.config.controller.should.eql(agent1.id);
+        ({config} = result);
+      }
+
+      // use hmac key as agent1 (requires cache busting by
+      // inspecting the root zcap)
+      hmacKey.invocationSigner = agent1.getSigner();
+      // use different data each time to avoid hmac caching
+      await hmacKey.sign({data: new Uint8Array([1])});
+
+      // update controller agent1 => agent2 (requires cache busting by
+      // inspecting the root zcap)
+      {
+        config.sequence++;
+        config.controller = agent2.id;
+        const result = await agent1KeystoreAgent.updateConfig({config});
+        result.config.id.should.eql(config.id);
+        result.config.controller.should.eql(agent2.id);
+        ({config} = result);
+      }
+
+      // use hmac key as agent3 (requires cache busting by
+      // inspecting a delegated zcap)
+      hmacKey.capability = agent3Zcap;
+      hmacKey.invocationSigner = agent3.getSigner();
+      // use different data each time to avoid hmac caching
+      await hmacKey.sign({data: new Uint8Array([1])});
+
+      // update controller agent2 => agent3 (cache should already be fresh)
+      {
+        config.sequence++;
+        config.controller = agent3.id;
+        const result = await agent3KeystoreAgent.updateConfig(
+          {capability: agent3Zcap, config});
+        result.config.id.should.eql(config.id);
+        result.config.controller.should.eql(agent3.id);
+        ({config} = result);
+      }
+
+      // use hmac key as agent1 (requires cache busting by
+      // inspecting a deep delegated zcap)
+      hmacKey.capability = agent1Zcap;
+      hmacKey.invocationSigner = agent1.getSigner();
+      // use different data each time to avoid hmac caching
+      await hmacKey.sign({data: new Uint8Array([1])});
     } catch(e) {
       assertNoError(e);
     } finally {