@bedrock/kms-http 23.0.0 → 23.2.0

package/lib/BedrockKeystoreConfigStorage.js

@@ -33,4 +33,28 @@ export class BedrockKeystoreConfigStorage extends KeystoreConfigStorage {
 
     return returnRecord ? record : keystoreConfig;
   }
+
+  async getAll({
+    controller, req, query = {}, options = {}, returnRecord = false
+  } = {}) {
+    const records = await keystores.find({controller, query, options});
+    const keystoreConfigs = records.map(r => r.config);
+    // skip request checks if specifically requested
+    if(req === false) {
+      return returnRecord ? records : keystoreConfigs;
+    }
+    // verify that request is from an IP that is allowed to access the config
+    for(let i = 0; i < keystoreConfigs.length; ++i) {
+      const keystoreConfig = keystoreConfigs[i];
+      const {verified} = helpers.verifyRequestIp({keystoreConfig, req});
+      if(!verified) {
+        throw new BedrockError(
+          'Permission denied. Source IP is not allowed.', 'NotAllowedError', {
+            httpStatusCode: 403,
+            public: true,
+          });
+      }
+    }
+    return returnRecord ? records : keystoreConfigs;
+  }
 }

package/lib/config.js

@@ -1,5 +1,5 @@
 /*!
- * Copyright (c) 2019-2022 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2019-2026 Digital Bazaar, Inc.
  */
 import {config} from '@bedrock/core';
 import '@bedrock/app-identity';
@@ -35,3 +35,32 @@ cfg.kmsOperationOptions = {
   // 1000 year max TTL by default
   maxDelegationTtl: 1000 * 60 * 60 * 24 * 365 * 1000
 };
+
+/* Optional proxy feature: An application running bedrock-kms-http can use
+these configuration options to redirect KMS operations to another
+bedrock-kms-http application, called a "proxy target". The proxy target must
+shares the same database and be configured with the same public address
+(domain / origin) but it is expected to be run behind a firewall (with
+restricted access) and inside of an isolated environment, such as a secure
+enclave, to add an additional layer of security during the processing of
+KMS operations.
+
+The proxying application will not have access to secret key material or to
+secrets that can decrypt/unseal/unwrap other secrets, only the proxy target
+will have access to some or all of these (or be capable of using some or all
+of these via authz credentials only it can access). Both applications will
+have access to the same database and will be expected to run compatible
+versions of software to ensure database record compatibility. The proxy
+target MUST properly check authz on all incoming requests; authz is is NOT
+checked by the proxy.
+
+Proxy entries are defined by KMS module, i.e., at most one proxy target can
+be configured per KMS module. When requests for a particular KMS module arrive,
+they are forwarded in their entirety to the related proxy target. */
+cfg.kmsModuleProxy = {
+  /*
+  <kms-module-name>: {
+    proxyTarget: <address (base URL) for kms proxy target>
+  }
+  */
+};

package/lib/http.js

@@ -1,19 +1,21 @@
 /*!
- * Copyright (c) 2019-2022 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2019-2026 Digital Bazaar, Inc.
  */
 import * as bedrock from '@bedrock/core';
 import * as brZCapStorage from '@bedrock/zcap-storage';
 import * as helpers from './helpers.js';
 import * as middleware from './middleware.js';
+import {createProxyMiddleware, fixRequestBody} from 'http-proxy-middleware';
 import {
-  keystores,
-  defaultModuleManager as moduleManager
-} from '@bedrock/kms';
-import {
+  getConfigsQuery,
   postKeystoreBody,
   postRevocationBody,
   updateKeystoreConfigBody
 } from '../schemas/bedrock-kms-http.js';
+import {
+  keystores,
+  defaultModuleManager as moduleManager
+} from '@bedrock/kms';
 import {reportOperationUsage, SERVICE_TYPE} from './metering.js';
 import {asyncHandler} from '@bedrock/express';
 import {generateRandom} from '@digitalbazaar/webkms-switch';
@@ -21,7 +23,7 @@ import {meters} from '@bedrock/meter-usage-reporter';
 import {createValidateMiddleware as validate} from '@bedrock/validation';
 
 const {config, util: {BedrockError}} = bedrock;
-const {cors} = middleware;
+const {cors, storage} = middleware;
 
 bedrock.events.on('bedrock-express.configure.routes', app => {
   const cfg = config['kms-http'];
@@ -48,6 +50,9 @@ bedrock.events.on('bedrock-express.configure.routes', app => {
   // associated with a request
   const getKeystoreConfig = middleware.createGetKeystoreConfig({routes});
 
+  // create KMS module proxy middleware for use with KMS operations
+  const kmsModuleProxyMiddleware = _createKmsModuleProxyMiddleware();
+
   /* Note: CORS is used on all endpoints. This is safe because authorization
   uses HTTP signatures + capabilities, not cookies; CSRF is not possible. */
 
@@ -116,6 +121,30 @@ bedrock.events.on('bedrock-express.configure.routes', app => {
       res.status(201).location(id).json(record.config);
     }));
 
+  // get all keystores by controller query
+  app.get(
+    routes.keystores,
+    cors(),
+    validate({querySchema: getConfigsQuery}),
+    middleware.authorizeZcapInvocation({
+      async getExpectedValues() {
+        const {baseUri, host} = bedrock.config.server;
+        return {
+          host,
+          rootInvocationTarget: `${baseUri}${routes.keystores}`
+        };
+      },
+      async getRootController({req}) {
+        return req.query.controller;
+      }
+    }),
+    asyncHandler(async (req, res) => {
+      const controller = req.query.controller;
+      const options = {projection: {_id: 0, config: 1}, limit: 100};
+      const results = await storage.getAll({controller, req, options});
+      res.json({results});
+    }));
+
   // update keystore config
   app.options(routes.keystore, cors());
   app.post(
@@ -190,6 +219,7 @@ bedrock.events.on('bedrock-express.configure.routes', app => {
     routes.keys,
     cors(),
     getKeystoreConfig,
+    kmsModuleProxyMiddleware,
     handleOperation);
 
   // invoke KMS operation on an existing key
@@ -198,6 +228,7 @@ bedrock.events.on('bedrock-express.configure.routes', app => {
     routes.key,
     cors(),
     getKeystoreConfig,
+    kmsModuleProxyMiddleware,
     handleOperation);
 
   // TODO: consider whether this should be exposed w/o authorization
@@ -208,6 +239,7 @@ bedrock.events.on('bedrock-express.configure.routes', app => {
     routes.key,
     cors(),
     getKeystoreConfig,
+    kmsModuleProxyMiddleware,
     asyncHandler(async (req, res) => {
       const {webkms: {keystore}} = req;
       const keyId = `${keystore.id}/keys/${req.params.keyId}`;
@@ -261,3 +293,43 @@ bedrock.events.on('bedrock-express.configure.routes', app => {
       reportOperationUsage({req});
     }));
 });
+
+function _createKmsModuleProxyMiddleware() {
+  const cfg = config['kms-http'];
+
+  const kmsModuleProxyEntries = Object.entries(cfg.kmsModuleProxy ?? {});
+  if(kmsModuleProxyEntries.length === 0) {
+    // nothing to proxy; no-op
+    return function kmsModuleProxyMiddleware(req, res, next) {
+      next();
+    };
+  }
+
+  const map = new Map();
+  for(const [kmsModule, {proxyTarget}] of kmsModuleProxyEntries) {
+    map.set(kmsModule, createProxyMiddleware({
+      target: proxyTarget,
+      // do not rewrite host header
+      changeOrigin: false,
+      // match TLS certificate checking expectations w/bedrock config
+      secure: config['https-agent'].rejectUnauthorized,
+      // include x-forward* headers
+      xfwd: true,
+      // do not forward websockets
+      ws: false,
+      on: {
+        // required to rewrite body since it has been parsed
+        proxyReq: fixRequestBody
+      }
+    }));
+  }
+  return function kmsModuleProxyMiddleware(req, res, next) {
+    const {webkms: {keystore}} = req;
+    const {kmsModule} = keystore;
+    const mw = map.get(kmsModule);
+    if(!mw) {
+      return next();
+    }
+    mw(req, res, next);
+  };
+}

package/lib/middleware.js

@@ -24,7 +24,7 @@ const {helpers: {inspectCapabilityChain}} = brZCapStorage;
 
 const FIVE_MINUTES = 1000 * 60 * 5;
 
-const storage = new BedrockKeystoreConfigStorage();
+export const storage = new BedrockKeystoreConfigStorage();
 
 // creates middleware to get the keystore config for the current request and
 // caches it in `req.webkms.keystore`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bedrock/kms-http",
-  "version": "23.0.0",
+  "version": "23.2.0",
   "type": "module",
   "description": "Bedrock KMS HTTP API",
   "main": "./lib/index.js",
@@ -35,6 +35,7 @@
     "cidr-regex": "^4.1.3",
     "cors": "^2.8.5",
     "forwarded": "^0.2.0",
+    "http-proxy-middleware": "^3.0.5",
     "ipaddr.js": "^2.2.0"
   },
   "peerDependencies": {

package/schemas/bedrock-kms-http.js

@@ -162,7 +162,18 @@ const postRevocationBody = {
   ...delegatedZcap
 };
 
+const getConfigsQuery = {
+  title: 'Service Object Configuration Query',
+  type: 'object',
+  required: ['controller'],
+  additionalProperties: false,
+  properties: {
+    controller
+  }
+};
+
 export {
+  getConfigsQuery,
   postKeystoreBody,
   postRevocationBody,
   updateKeystoreConfigBody