@bedrock/kms-http 14.3.1 → 15.0.0

package/README.md

@@ -1,4 +1,4 @@
-# Bedrock Key Management System API module _(bedrock-kms-http)_
+# Bedrock Key Management System API module _(@bedrock/kms-http)_
 > HTTP APIs for Bedrock Key Management.
 
 ## Table of Contents
@@ -11,14 +11,14 @@
 
 ## Install
 
-- Node.js 12+ is required.
+- Node.js 16+ is required.
 
 ### NPM
 
 To install via NPM:
 
 ```
-npm install --save bedrock-kms-http
+npm install @bedrock/kms-http
 ```
 
 ### Development

package/lib/BedrockKeystoreConfigStorage.js

@@ -3,10 +3,8 @@
  */
 import * as bedrock from '@bedrock/core';
 import * as helpers from './helpers.js';
-import {createRequire} from 'node:module';
+import {KeystoreConfigStorage} from '@digitalbazaar/webkms-switch';
 import {keystores} from '@bedrock/kms';
-const require = createRequire(import.meta.url);
-const {KeystoreConfigStorage} = require('@digitalbazaar/webkms-switch');
 
 const {util: {BedrockError}} = bedrock;
 

package/lib/helpers.js

@@ -2,7 +2,7 @@
  * Copyright (c) 2019-2022 Digital Bazaar, Inc. All rights reserved.
  */
 import forwarded from 'forwarded';
-import {Netmask} from 'netmask';
+import ipaddr from 'ipaddr.js';
 
 export function getKeystoreId({host, req, localId, routes}) {
   if(!host) {
@@ -12,6 +12,7 @@ export function getKeystoreId({host, req, localId, routes}) {
 }
 
 export function verifyRequestIp({keystoreConfig, req}) {
+  // skip check if no IP allow list configured
   const {ipAllowList} = keystoreConfig;
   if(!ipAllowList) {
     return {verified: true};
@@ -22,15 +23,17 @@ export function verifyRequestIp({keystoreConfig, req}) {
   // IPs will be from the `x-forwarded-for` header.
   const sourceAddresses = forwarded(req);
 
-  // ipAllowList is an array of CIDRs
-  for(const cidr of ipAllowList) {
-    const netmask = new Netmask(cidr);
-    for(const address of sourceAddresses) {
-      if(netmask.contains(address)) {
-        return {verified: true};
-      }
-    }
-  }
+  // build list of allowed IP ranges from IPv4/IPv6 CIDRs
+  const ipAllowRangeList = {
+    allow: ipAllowList.map(cidr => ipaddr.parseCIDR(cidr))
+  };
+
+  // check if any source address allowed
+  const verified = sourceAddresses.some(address => {
+    const ip = ipaddr.parse(address);
+    // check if in allow list, else deny
+    return ipaddr.subnetMatch(ip, ipAllowRangeList, 'deny') === 'allow';
+  });
 
-  return {verified: false};
+  return {verified};
 }

package/lib/http.js

@@ -5,25 +5,23 @@ import * as bedrock from '@bedrock/core';
 import * as brZCapStorage from '@bedrock/zcap-storage';
 import * as helpers from './helpers.js';
 import * as middleware from './middleware.js';
-import {asyncHandler} from '@bedrock/express';
-import cors from 'cors';
-import {createRequire} from 'node:module';
-import {createValidateMiddleware as validate} from '@bedrock/validation';
 import {
-  defaultModuleManager as moduleManager,
-  keystores
+  keystores,
+  defaultModuleManager as moduleManager
 } from '@bedrock/kms';
-import {meters} from '@bedrock/meter-usage-reporter';
 import {
   postKeystoreBody,
-  updateKeystoreConfigBody,
-  postRevocationBody
+  postRevocationBody,
+  updateKeystoreConfigBody
 } from '../schemas/bedrock-kms-http.js';
 import {reportOperationUsage, SERVICE_TYPE} from './metering.js';
-const require = createRequire(import.meta.url);
-const {generateRandom} = require('@digitalbazaar/webkms-switch');
+import {asyncHandler} from '@bedrock/express';
+import {generateRandom} from '@digitalbazaar/webkms-switch';
+import {meters} from '@bedrock/meter-usage-reporter';
+import {createValidateMiddleware as validate} from '@bedrock/validation';
 
 const {config, util: {BedrockError}} = bedrock;
+const {cors} = middleware;
 
 bedrock.events.on('bedrock-express.configure.routes', app => {
   const cfg = config['kms-http'];

package/lib/metering.js

@@ -4,11 +4,11 @@
 import * as bedrock from '@bedrock/core';
 import * as brZCapStorage from '@bedrock/zcap-storage';
 import {
-  defaultModuleManager as moduleManager,
-  keystores
+  keystores,
+  defaultModuleManager as moduleManager
 } from '@bedrock/kms';
-import {meters} from '@bedrock/meter-usage-reporter';
 import {logger} from './logger.js';
+import {meters} from '@bedrock/meter-usage-reporter';
 
 // configure usage aggregator for webkms meters
 export const SERVICE_TYPE = 'webkms';

package/lib/middleware.js

@@ -4,26 +4,25 @@
 import * as bedrock from '@bedrock/core';
 import * as brZCapStorage from '@bedrock/zcap-storage';
 import * as helpers from './helpers.js';
-import {asyncHandler} from '@bedrock/express';
-import {BedrockKeystoreConfigStorage} from './BedrockKeystoreConfigStorage.js';
-import {createRequire} from 'node:module';
+import {
+  authorizeZcapInvocation as _authorizeZcapInvocation,
+  authorizeZcapRevocation as _authorizeZcapRevocation
+} from '@digitalbazaar/ezcap-express';
 import {
   defaultDocumentLoader as documentLoader,
   defaultModuleManager as moduleManager
 } from '@bedrock/kms';
+import {default as _cors} from 'cors';
+import {asyncHandler} from '@bedrock/express';
+import {BedrockKeystoreConfigStorage} from './BedrockKeystoreConfigStorage.js';
+import {createOperationMiddleware} from '@digitalbazaar/webkms-switch';
+import {CryptoLD} from 'crypto-ld';
+import {Ed25519Signature2020} from '@digitalbazaar/ed25519-signature-2020';
+import {
+  Ed25519VerificationKey2020
+} from '@digitalbazaar/ed25519-verification-key-2020';
 import {logger} from './logger.js';
 import {reportOperationUsage} from './metering.js';
-const require = createRequire(import.meta.url);
-const {
-  authorizeZcapInvocation: _authorizeZcapInvocation,
-  authorizeZcapRevocation: _authorizeZcapRevocation
-} = require('@digitalbazaar/ezcap-express');
-const {createOperationMiddleware} = require('@digitalbazaar/webkms-switch');
-const {CryptoLD} = require('crypto-ld');
-const {Ed25519Signature2020} =
-  require('@digitalbazaar/ed25519-signature-2020');
-const {Ed25519VerificationKey2020} =
-  require('@digitalbazaar/ed25519-verification-key-2020');
 
 const {config, util: {BedrockError}} = bedrock;
 
@@ -107,6 +106,11 @@ export function authorizeZcapRevocation() {
   });
 }
 
+export function cors() {
+  // `86400` is the max acceptable cache age for modern browsers
+  return _cors({maxAge: 86400});
+}
+
 async function getKeystoreController({req}) {
   /* The following code is to prevent false-negative authz errors that are the
   result of stale cached keystore configs.

package/package.json

@@ -1,9 +1,13 @@
 {
   "name": "@bedrock/kms-http",
-  "version": "14.3.1",
+  "version": "15.0.0",
   "type": "module",
   "description": "Bedrock KMS HTTP API",
   "main": "./lib/index.js",
+  "files": [
+    "lib/**/*.js",
+    "schemas/**/*.js"
+  ],
   "scripts": {
     "lint": "eslint ."
   },
@@ -24,35 +28,36 @@
   },
   "homepage": "https://github.com/digitalbazaar/bedrock-kms-http",
   "dependencies": {
-    "@digitalbazaar/ed25519-signature-2020": "^3.0.0",
-    "@digitalbazaar/ed25519-verification-key-2020": "^3.2.0",
-    "@digitalbazaar/ezcap-express": "^6.2.0",
-    "@digitalbazaar/webkms-switch": "^10.2.0",
+    "@digitalbazaar/ed25519-signature-2020": "^4.0.1",
+    "@digitalbazaar/ed25519-verification-key-2020": "^4.0.0",
+    "@digitalbazaar/ezcap-express": "^7.0.0",
+    "@digitalbazaar/webkms-switch": "^11.0.0",
     "cidr-regex": "^3.1.1",
     "cors": "^2.8.5",
-    "crypto-ld": "^6.0.0",
+    "crypto-ld": "^7.0.0",
     "forwarded": "^0.2.0",
-    "netmask": "^2.0.2"
+    "ipaddr.js": "^2.0.1"
   },
   "peerDependencies": {
-    "@bedrock/app-identity": "^3.0.0",
-    "@bedrock/core": "^6.0.0",
+    "@bedrock/app-identity": "^4.0.0",
+    "@bedrock/core": "^6.0.1",
     "@bedrock/express": "^8.0.0",
-    "@bedrock/kms": "^10.2.0",
-    "@bedrock/meter-usage-reporter": "^7.0.0",
+    "@bedrock/kms": "^11.0.0",
+    "@bedrock/meter-usage-reporter": "^8.0.0",
     "@bedrock/validation": "^7.0.0",
-    "@bedrock/zcap-storage": "^7.0.0"
+    "@bedrock/zcap-storage": "^8.0.0"
   },
   "directories": {
     "lib": "./lib"
   },
   "devDependencies": {
-    "eslint": "^7.32.0",
-    "eslint-config-digitalbazaar": "^2.8.0",
-    "eslint-plugin-jsdoc": "^39.2.9",
+    "eslint": "^8.18.0",
+    "eslint-config-digitalbazaar": "^4.0.1",
+    "eslint-plugin-jsdoc": "^39.3.3",
+    "eslint-plugin-unicorn": "^43.0.0",
     "jsdoc-to-markdown": "^7.1.1"
   },
   "engines": {
-    "node": ">=14"
+    "node": ">=16"
   }
 }

package/schemas/bedrock-kms-http.js

@@ -114,7 +114,7 @@ const ipAllowList = {
   items: {
     type: 'string',
     // leading and trailing slashes in regex must be removed
-    pattern: cidrRegex.v4({exact: true}).toString().slice(1, -1),
+    pattern: cidrRegex({exact: true}).toString().slice(1, -1),
   }
 };
 

package/.eslintrc.cjs

@@ -1,12 +0,0 @@
-module.exports = {
-  root: true,
-  parserOptions: {
-    // this is required for dynamic import()
-    ecmaVersion: 2020
-  },
-  env: {
-    node: true
-  },
-  extends: ['digitalbazaar', 'digitalbazaar/jsdoc'],
-  ignorePatterns: ['node_modules/']
-};

package/.github/workflows/main.yml

@@ -1,77 +0,0 @@
-name: Bedrock Node.js CI
-
-on: [push]
-
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    strategy:
-      matrix:
-        node-version: [16.x]
-    steps:
-    - uses: actions/checkout@v2
-    - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v1
-      with:
-        node-version: ${{ matrix.node-version }}
-    - run: npm install
-    - name: Run eslint
-      run: npm run lint
-  test-node:
-    needs: [lint]
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    services:
-      mongodb:
-        image: mongo:4.4
-        ports:
-          - 27017:27017
-    strategy:
-      matrix:
-        node-version: [14.x, 16.x]
-    steps:
-    - uses: actions/checkout@v2
-    - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v1
-      with:
-        node-version: ${{ matrix.node-version }}
-    - run: |
-        npm install
-        cd test
-        npm install
-    - name: Run test with Node.js ${{ matrix.node-version }}
-      run: |
-        cd test
-        npm test
-  coverage:
-    needs: [test-node]
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    services:
-      mongodb:
-        image: mongo:4.4
-        ports:
-          - 27017:27017
-    strategy:
-      matrix:
-        node-version: [16.x]
-    steps:
-    - uses: actions/checkout@v2
-    - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v1
-      with:
-        node-version: ${{ matrix.node-version }}
-    - run: |
-        npm install
-        cd test
-        npm install
-    - name: Generate coverage report
-      run: |
-        cd test
-        npm run coverage-ci
-    - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@v2
-      with:
-        file: ./test/coverage/lcov.info
-        fail_ci_if_error: true