@bedrock/kms-http 23.1.0 → 23.2.0

package/lib/config.js

@@ -1,5 +1,5 @@
 /*!
- * Copyright (c) 2019-2022 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2019-2026 Digital Bazaar, Inc.
  */
 import {config} from '@bedrock/core';
 import '@bedrock/app-identity';
@@ -35,3 +35,32 @@ cfg.kmsOperationOptions = {
   // 1000 year max TTL by default
   maxDelegationTtl: 1000 * 60 * 60 * 24 * 365 * 1000
 };
+
+/* Optional proxy feature: An application running bedrock-kms-http can use
+these configuration options to redirect KMS operations to another
+bedrock-kms-http application, called a "proxy target". The proxy target must
+shares the same database and be configured with the same public address
+(domain / origin) but it is expected to be run behind a firewall (with
+restricted access) and inside of an isolated environment, such as a secure
+enclave, to add an additional layer of security during the processing of
+KMS operations.
+
+The proxying application will not have access to secret key material or to
+secrets that can decrypt/unseal/unwrap other secrets, only the proxy target
+will have access to some or all of these (or be capable of using some or all
+of these via authz credentials only it can access). Both applications will
+have access to the same database and will be expected to run compatible
+versions of software to ensure database record compatibility. The proxy
+target MUST properly check authz on all incoming requests; authz is is NOT
+checked by the proxy.
+
+Proxy entries are defined by KMS module, i.e., at most one proxy target can
+be configured per KMS module. When requests for a particular KMS module arrive,
+they are forwarded in their entirety to the related proxy target. */
+cfg.kmsModuleProxy = {
+  /*
+  <kms-module-name>: {
+    proxyTarget: <address (base URL) for kms proxy target>
+  }
+  */
+};

package/lib/http.js

@@ -1,10 +1,11 @@
 /*!
- * Copyright (c) 2019-2025 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2019-2026 Digital Bazaar, Inc.
  */
 import * as bedrock from '@bedrock/core';
 import * as brZCapStorage from '@bedrock/zcap-storage';
 import * as helpers from './helpers.js';
 import * as middleware from './middleware.js';
+import {createProxyMiddleware, fixRequestBody} from 'http-proxy-middleware';
 import {
   getConfigsQuery,
   postKeystoreBody,
@@ -49,6 +50,9 @@ bedrock.events.on('bedrock-express.configure.routes', app => {
   // associated with a request
   const getKeystoreConfig = middleware.createGetKeystoreConfig({routes});
 
+  // create KMS module proxy middleware for use with KMS operations
+  const kmsModuleProxyMiddleware = _createKmsModuleProxyMiddleware();
+
   /* Note: CORS is used on all endpoints. This is safe because authorization
   uses HTTP signatures + capabilities, not cookies; CSRF is not possible. */
 
@@ -215,6 +219,7 @@ bedrock.events.on('bedrock-express.configure.routes', app => {
     routes.keys,
     cors(),
     getKeystoreConfig,
+    kmsModuleProxyMiddleware,
     handleOperation);
 
   // invoke KMS operation on an existing key
@@ -223,6 +228,7 @@ bedrock.events.on('bedrock-express.configure.routes', app => {
     routes.key,
     cors(),
     getKeystoreConfig,
+    kmsModuleProxyMiddleware,
     handleOperation);
 
   // TODO: consider whether this should be exposed w/o authorization
@@ -233,6 +239,7 @@ bedrock.events.on('bedrock-express.configure.routes', app => {
     routes.key,
     cors(),
     getKeystoreConfig,
+    kmsModuleProxyMiddleware,
     asyncHandler(async (req, res) => {
       const {webkms: {keystore}} = req;
       const keyId = `${keystore.id}/keys/${req.params.keyId}`;
@@ -286,3 +293,43 @@ bedrock.events.on('bedrock-express.configure.routes', app => {
       reportOperationUsage({req});
     }));
 });
+
+function _createKmsModuleProxyMiddleware() {
+  const cfg = config['kms-http'];
+
+  const kmsModuleProxyEntries = Object.entries(cfg.kmsModuleProxy ?? {});
+  if(kmsModuleProxyEntries.length === 0) {
+    // nothing to proxy; no-op
+    return function kmsModuleProxyMiddleware(req, res, next) {
+      next();
+    };
+  }
+
+  const map = new Map();
+  for(const [kmsModule, {proxyTarget}] of kmsModuleProxyEntries) {
+    map.set(kmsModule, createProxyMiddleware({
+      target: proxyTarget,
+      // do not rewrite host header
+      changeOrigin: false,
+      // match TLS certificate checking expectations w/bedrock config
+      secure: config['https-agent'].rejectUnauthorized,
+      // include x-forward* headers
+      xfwd: true,
+      // do not forward websockets
+      ws: false,
+      on: {
+        // required to rewrite body since it has been parsed
+        proxyReq: fixRequestBody
+      }
+    }));
+  }
+  return function kmsModuleProxyMiddleware(req, res, next) {
+    const {webkms: {keystore}} = req;
+    const {kmsModule} = keystore;
+    const mw = map.get(kmsModule);
+    if(!mw) {
+      return next();
+    }
+    mw(req, res, next);
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bedrock/kms-http",
-  "version": "23.1.0",
+  "version": "23.2.0",
   "type": "module",
   "description": "Bedrock KMS HTTP API",
   "main": "./lib/index.js",
@@ -35,6 +35,7 @@
     "cidr-regex": "^4.1.3",
     "cors": "^2.8.5",
     "forwarded": "^0.2.0",
+    "http-proxy-middleware": "^3.0.5",
     "ipaddr.js": "^2.2.0"
   },
   "peerDependencies": {