@bedrock/kms-http 22.1.0 → 23.1.0

package/lib/BedrockKeystoreConfigStorage.js

@@ -33,4 +33,28 @@ export class BedrockKeystoreConfigStorage extends KeystoreConfigStorage {
 
     return returnRecord ? record : keystoreConfig;
   }
+
+  async getAll({
+    controller, req, query = {}, options = {}, returnRecord = false
+  } = {}) {
+    const records = await keystores.find({controller, query, options});
+    const keystoreConfigs = records.map(r => r.config);
+    // skip request checks if specifically requested
+    if(req === false) {
+      return returnRecord ? records : keystoreConfigs;
+    }
+    // verify that request is from an IP that is allowed to access the config
+    for(let i = 0; i < keystoreConfigs.length; ++i) {
+      const keystoreConfig = keystoreConfigs[i];
+      const {verified} = helpers.verifyRequestIp({keystoreConfig, req});
+      if(!verified) {
+        throw new BedrockError(
+          'Permission denied. Source IP is not allowed.', 'NotAllowedError', {
+            httpStatusCode: 403,
+            public: true,
+          });
+      }
+    }
+    return returnRecord ? records : keystoreConfigs;
+  }
 }

package/lib/helpers.js

@@ -1,14 +1,13 @@
 /*!
- * Copyright (c) 2019-2022 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2019-2025 Digital Bazaar, Inc. All rights reserved.
  */
+import * as bedrock from '@bedrock/core';
 import forwarded from 'forwarded';
 import ipaddr from 'ipaddr.js';
 
-export function getKeystoreId({host, req, localId, routes}) {
-  if(!host) {
-    host = req.get('host');
-  }
-  return `https://${host}${routes.keystores}/${localId}`;
+export function getKeystoreId({localId, routes}) {
+  const {baseUri} = bedrock.config.server;
+  return `${baseUri}${routes.keystores}/${localId}`;
 }
 
 export function verifyRequestIp({keystoreConfig, req}) {

package/lib/http.js

@@ -1,19 +1,20 @@
 /*!
- * Copyright (c) 2019-2022 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2019-2025 Digital Bazaar, Inc. All rights reserved.
  */
 import * as bedrock from '@bedrock/core';
 import * as brZCapStorage from '@bedrock/zcap-storage';
 import * as helpers from './helpers.js';
 import * as middleware from './middleware.js';
 import {
-  keystores,
-  defaultModuleManager as moduleManager
-} from '@bedrock/kms';
-import {
+  getConfigsQuery,
   postKeystoreBody,
   postRevocationBody,
   updateKeystoreConfigBody
 } from '../schemas/bedrock-kms-http.js';
+import {
+  keystores,
+  defaultModuleManager as moduleManager
+} from '@bedrock/kms';
 import {reportOperationUsage, SERVICE_TYPE} from './metering.js';
 import {asyncHandler} from '@bedrock/express';
 import {generateRandom} from '@digitalbazaar/webkms-switch';
@@ -21,7 +22,7 @@ import {meters} from '@bedrock/meter-usage-reporter';
 import {createValidateMiddleware as validate} from '@bedrock/validation';
 
 const {config, util: {BedrockError}} = bedrock;
-const {cors} = middleware;
+const {cors, storage} = middleware;
 
 bedrock.events.on('bedrock-express.configure.routes', app => {
   const cfg = config['kms-http'];
@@ -110,12 +111,36 @@ bedrock.events.on('bedrock-express.configure.routes', app => {
 
       // create a keystore for the controller
       const random = await generateRandom();
-      const id = helpers.getKeystoreId({req, localId: random, routes});
+      const id = helpers.getKeystoreId({localId: random, routes});
       const config = {id, meterId, ...req.body};
       const record = await keystores.insert({config});
       res.status(201).location(id).json(record.config);
     }));
 
+  // get all keystores by controller query
+  app.get(
+    routes.keystores,
+    cors(),
+    validate({querySchema: getConfigsQuery}),
+    middleware.authorizeZcapInvocation({
+      async getExpectedValues() {
+        const {baseUri, host} = bedrock.config.server;
+        return {
+          host,
+          rootInvocationTarget: `${baseUri}${routes.keystores}`
+        };
+      },
+      async getRootController({req}) {
+        return req.query.controller;
+      }
+    }),
+    asyncHandler(async (req, res) => {
+      const controller = req.query.controller;
+      const options = {projection: {_id: 0, config: 1}, limit: 100};
+      const results = await storage.getAll({controller, req, options});
+      res.json({results});
+    }));
+
   // update keystore config
   app.options(routes.keystore, cors());
   app.post(

package/lib/middleware.js

@@ -24,7 +24,7 @@ const {helpers: {inspectCapabilityChain}} = brZCapStorage;
 
 const FIVE_MINUTES = 1000 * 60 * 5;
 
-const storage = new BedrockKeystoreConfigStorage();
+export const storage = new BedrockKeystoreConfigStorage();
 
 // creates middleware to get the keystore config for the current request and
 // caches it in `req.webkms.keystore`
@@ -32,7 +32,7 @@ export function createGetKeystoreConfig({routes}) {
   return asyncHandler(async function _getKeystoreConfig(req, res, next) {
     if(!req.webkms) {
       const keystoreId = helpers.getKeystoreId(
-        {req, localId: req.params.keystoreId, routes});
+        {localId: req.params.keystoreId, routes});
       const configRecord = await storage.get({
         id: keystoreId, req, returnRecord: true
       });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bedrock/kms-http",
-  "version": "22.1.0",
+  "version": "23.1.0",
   "type": "module",
   "description": "Bedrock KMS HTTP API",
   "main": "./lib/index.js",

package/schemas/bedrock-kms-http.js

@@ -162,7 +162,18 @@ const postRevocationBody = {
   ...delegatedZcap
 };
 
+const getConfigsQuery = {
+  title: 'Service Object Configuration Query',
+  type: 'object',
+  required: ['controller'],
+  additionalProperties: false,
+  properties: {
+    controller
+  }
+};
+
 export {
+  getConfigsQuery,
   postKeystoreBody,
   postRevocationBody,
   updateKeystoreConfigBody