@bedrock/kms-http 23.2.0 → 23.3.0

package/README.md

@@ -11,7 +11,10 @@
 
 ## Install
 
-- Node.js 18+ is required.
+This software requires and supports maintained recent versions of Node.js.
+Updates may remove support for older unmaintained platform versions. Please use
+dependency version lock files and testing to ensure compatibility with this
+software.
 
 ### NPM
 
@@ -36,7 +39,7 @@ npm install
 In `lib/index.js` (or `main.js`, as appropriate):
 
 ```js
-import 'bedrock-kms-http';
+import '@bedrock/kms-http';
 ```
 
 ### KMS HTTP API

package/lib/BedrockKeystoreConfigStorage.js

@@ -27,7 +27,7 @@ export class BedrockKeystoreConfigStorage extends KeystoreConfigStorage {
       throw new BedrockError(
         'Permission denied. Source IP is not allowed.', 'NotAllowedError', {
           httpStatusCode: 403,
-          public: true,
+          public: true
         });
     }
 
@@ -51,7 +51,7 @@ export class BedrockKeystoreConfigStorage extends KeystoreConfigStorage {
         throw new BedrockError(
           'Permission denied. Source IP is not allowed.', 'NotAllowedError', {
             httpStatusCode: 403,
-            public: true,
+            public: true
           });
       }
     }

package/lib/config.js

@@ -3,6 +3,7 @@
  */
 import {config} from '@bedrock/core';
 import '@bedrock/app-identity';
+import '@bedrock/express';
 import '@bedrock/meter-usage-reporter';
 import '@bedrock/validation';
 
@@ -64,3 +65,18 @@ cfg.kmsModuleProxy = {
   }
   */
 };
+
+// require raw JSON payloads for proxied routes to preserve specific content
+// expression as it is used in signed digests
+const createRawBodyParserOptions = () => ({
+  raw: {
+    type: ['json', '+json']
+  }
+});
+const bodyParserRoutes = config.express.bodyParser.routes;
+// for generating a new key
+bodyParserRoutes['/kms/keystores/:keystoreId/keys'] =
+  createRawBodyParserOptions();
+// for running a key operation on an existing key
+bodyParserRoutes['/kms/keystores/:keystoreId/keys/:keyId'] =
+  createRawBodyParserOptions();

package/lib/http.js

@@ -5,7 +5,7 @@ import * as bedrock from '@bedrock/core';
 import * as brZCapStorage from '@bedrock/zcap-storage';
 import * as helpers from './helpers.js';
 import * as middleware from './middleware.js';
-import {createProxyMiddleware, fixRequestBody} from 'http-proxy-middleware';
+import * as zlib from 'node:zlib';
 import {
   getConfigsQuery,
   postKeystoreBody,
@@ -18,6 +18,7 @@ import {
 } from '@bedrock/kms';
 import {reportOperationUsage, SERVICE_TYPE} from './metering.js';
 import {asyncHandler} from '@bedrock/express';
+import {createProxyMiddleware} from 'http-proxy-middleware';
 import {generateRandom} from '@digitalbazaar/webkms-switch';
 import {meters} from '@bedrock/meter-usage-reporter';
 import {createValidateMiddleware as validate} from '@bedrock/validation';
@@ -52,6 +53,8 @@ bedrock.events.on('bedrock-express.configure.routes', app => {
 
   // create KMS module proxy middleware for use with KMS operations
   const kmsModuleProxyMiddleware = _createKmsModuleProxyMiddleware();
+  // create raw => json parser for routes using KMS module proxy middleware
+  const rawBodyToJsonMiddleware = asyncHandler(_parseRawBodyAsJson);
 
   /* Note: CORS is used on all endpoints. This is safe because authorization
   uses HTTP signatures + capabilities, not cookies; CSRF is not possible. */
@@ -100,7 +103,7 @@ bedrock.events.on('bedrock-express.configure.routes', app => {
         // insufficient remaining storage
         throw new BedrockError('Permission denied.', 'NotAllowedError', {
           httpStatusCode: 403,
-          public: true,
+          public: true
         });
       }
 
@@ -220,6 +223,7 @@ bedrock.events.on('bedrock-express.configure.routes', app => {
     cors(),
     getKeystoreConfig,
     kmsModuleProxyMiddleware,
+    rawBodyToJsonMiddleware,
     handleOperation);
 
   // invoke KMS operation on an existing key
@@ -229,6 +233,7 @@ bedrock.events.on('bedrock-express.configure.routes', app => {
     cors(),
     getKeystoreConfig,
     kmsModuleProxyMiddleware,
+    rawBodyToJsonMiddleware,
     handleOperation);
 
   // TODO: consider whether this should be exposed w/o authorization
@@ -240,6 +245,7 @@ bedrock.events.on('bedrock-express.configure.routes', app => {
     cors(),
     getKeystoreConfig,
     kmsModuleProxyMiddleware,
+    rawBodyToJsonMiddleware,
     asyncHandler(async (req, res) => {
       const {webkms: {keystore}} = req;
       const keyId = `${keystore.id}/keys/${req.params.keyId}`;
@@ -278,7 +284,7 @@ bedrock.events.on('bedrock-express.configure.routes', app => {
         // meter is disabled, do not allow storage
         throw new BedrockError('Permission denied.', 'NotAllowedError', {
           httpStatusCode: 403,
-          public: true,
+          public: true
         });
       }
 
@@ -319,7 +325,7 @@ function _createKmsModuleProxyMiddleware() {
       ws: false,
       on: {
         // required to rewrite body since it has been parsed
-        proxyReq: fixRequestBody
+        proxyReq: _reserializeRequestBody
       }
     }));
   }
@@ -333,3 +339,61 @@ function _createKmsModuleProxyMiddleware() {
     mw(req, res, next);
   };
 }
+
+// parses raw body to json
+function _parseRawBodyAsJson(req, res, next) {
+  try {
+    // special case empty body
+    req.body = req.body?.length > 0 ? JSON.parse(req.body.toString()) : {};
+    next();
+  } catch(cause) {
+    throw new BedrockError('Failed to parse expected JSON body.', {
+      name: 'DataError',
+      details: {httpStatusCode: 400, public: true},
+      cause
+    });
+  }
+}
+
+function _reserializeRequestBody(proxyReq, req) {
+  try {
+    if(!(req.body?.length > 0)) {
+      // nothing to send
+      return;
+    }
+
+    const contentType = proxyReq.getHeader('content-type');
+    if(!contentType) {
+      // nothing to send
+      return;
+    }
+
+    // reapply content-encoding
+    const contentEncoding = String(
+      proxyReq.getHeader('content-encoding')).toLowerCase();
+    let data = req.body;
+    if(contentEncoding === 'gzip') {
+      data = zlib.gzipSync(data);
+    } else if(contentEncoding === 'deflate') {
+      data = zlib.deflateSync(data);
+    } else if(contentEncoding === 'zstd') {
+      // note: not supported by body-parser, so unreachable
+      data = zlib.zstdCompressSync(data);
+    } else if(contentEncoding === 'br') {
+      // note: not supported by body-parser, so unreachable
+      data = zlib.brotliCompressSync(data);
+    } else {
+      proxyReq.removeHeader('content-encoding');
+    }
+
+    const transferEncoding = proxyReq.getHeader('transfer-encoding');
+    if(!transferEncoding) {
+      proxyReq.setHeader('content-length', Buffer.byteLength(data));
+    }
+    proxyReq.write(data);
+  } catch(e) {
+    // pass error through `proxyReq` processing channel
+    const error = e instanceof Error ? e : new Error(String(e));
+    proxyReq.destroy(error);
+  }
+}

package/lib/middleware.js

@@ -81,7 +81,7 @@ export function authorizeKeystoreZcapInvocation() {
         rootInvocationTarget: req.webkms.keystore.id
       };
     },
-    getRootController: getKeystoreController,
+    getRootController: getKeystoreController
   });
 }
 
@@ -210,13 +210,13 @@ function onError({error}) {
       error.message,
       error.name || 'NotAllowedError', {
         ...details,
-        public: true,
+        public: true
       }, error);
   }
   throw new BedrockError(
     'Authorization error.', 'NotAllowedError', {
       httpStatusCode: 403,
-      public: true,
+      public: true
     }, error);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bedrock/kms-http",
-  "version": "23.2.0",
+  "version": "23.3.0",
   "type": "module",
   "description": "Bedrock KMS HTTP API",
   "main": "./lib/index.js",
@@ -30,13 +30,13 @@
   "dependencies": {
     "@digitalbazaar/ed25519-multikey": "^1.3.1",
     "@digitalbazaar/ed25519-signature-2020": "^5.4.0",
-    "@digitalbazaar/ezcap-express": "^7.1.0",
+    "@digitalbazaar/ezcap-express": "^7.3.0",
     "@digitalbazaar/webkms-switch": "^12.0.0",
-    "cidr-regex": "^4.1.3",
-    "cors": "^2.8.5",
+    "cidr-regex": "^7.1.2",
+    "cors": "^2.8.6",
     "forwarded": "^0.2.0",
-    "http-proxy-middleware": "^3.0.5",
-    "ipaddr.js": "^2.2.0"
+    "http-proxy-middleware": "^4.2.0",
+    "ipaddr.js": "^2.5.0"
   },
   "peerDependencies": {
     "@bedrock/app-identity": "^4.0.0",
@@ -56,12 +56,10 @@
     "lib": "./lib"
   },
   "devDependencies": {
-    "eslint": "^8.57.1",
-    "eslint-config-digitalbazaar": "^5.2.0",
-    "eslint-plugin-jsdoc": "^50.6.3",
-    "eslint-plugin-unicorn": "^56.0.1"
+    "@digitalbazaar/eslint-config": "^9.0.0",
+    "eslint": "^10.13.0"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   }
 }

package/schemas/bedrock-kms-http.js

@@ -92,7 +92,7 @@ const delegatedZcap = {
         proofValue: {
           title: 'proofValue',
           type: 'string'
-        },
+        }
       }
     }
   }
@@ -109,7 +109,7 @@ const ipAllowList = {
   items: {
     type: 'string',
     // leading and trailing slashes in regex must be removed
-    pattern: cidrRegex({exact: true}).toString().slice(1, -1),
+    pattern: cidrRegex({exact: true}).toString().slice(1, -1)
   }
 };
 
@@ -146,7 +146,7 @@ const updateKeystoreConfigBody = {
   required: [
     'controller',
     'id',
-    'sequence',
+    'sequence'
   ],
   properties: {
     controller,