@digitalbazaar/ezcap-express 4.3.0 → 5.0.0

package/CHANGELOG.md

@@ -1,5 +1,80 @@
 # @digitalbazaar/ezcap-express Changelog
 
+## 5.0.0 - 2022-01-11
+
+### Added
+- Add optional parameters `maxChainLength`, `maxDelegationTtl`, and
+  `maxTimestampDelta` to allow for more fine grained control. These parameters
+  all have defaults in `@digitalbazaar/zcap` that could previously not be set
+  to other values at this layer.
+- **BREAKING**: Add required `getVerifier` async function parameter. The
+  function will be passed `{keyId, documentLoader}` to verify an HTTP signature
+  and must return `{verifier, verificationMethod}`. The `verifier` object must
+  have a `verify` function that takes `{data, signature}` and returns a
+  boolean indicating whether the `Uint8Array` `signature` is verified
+  against the `Uint8Array` `data` -- or throws an error if there is a reason
+  the cryptographic signature verification check cannot be run.
+- Include `capabilityChain` in `req.zcapRevocation` when using revocation
+  middleware. This property includes the entire dereferenced chain.
+
+### Changed
+- **BREAKING**: Replace broken-out expected value parameters (e.g.,
+  `expectedHost`, `expectedTarget`), including duplicative / optional
+  parameters (e.g., `expectedAction`, `getExpectedAction`) with a single
+  async function `getExpectedValues({req})` that returns all required (and any
+  optional) expected values. This removes some optionality and simplifies
+  function signatures -- also allowing callers to decide how they want
+  to provide this information (e.g., by calling individual functions from
+  within `getExpectedValues` or whatever else).
+- **BREAKING**: The `authorizeZcapRevocation` middleware may now only be used
+  on routes ending in `/revocations/:revocationId`. The API params have also
+  changed as the only expected value that is needed from the user is
+  `expectedHost`. The rest of the expected values are hard coded according to
+  a conventional pattern for supporting revocation of any zcaps delegated from
+  a root capability for a service object. The service object's root capability
+  MUST have an invocation target that matches the service object's URL (aka its
+  "ID", `<serviceObjectId>`). So for the absolute URL:
+
+  `<serviceObjectId>/revocations/:revocationId`
+
+  A zcap can only be revoked using the middleware if its chain has a root
+  zcap with an invocation target that is prefixed with `<serviceObjectId>`.
+  The middleware will use the `expectedHost` value to construct the absolute
+  URL.
+- **BREAKING**: Require `suiteFactory` parameter, no default cryptosuites are
+  included with this package to ensure it is decoupled from particular
+  cryptosuites.
+
+### Fixed
+- **BREAKING**: HTTP status error codes have been fixed so that client errors
+  will result in 4xx status codes instead of 5xx status codes.
+
+### Remove
+- **BREAKING**: Remove `getExpectedRootCapabilityId` as there have been no
+  use cases that have needed it.
+- **BREAKING**: Remove deprecated `suite` param, use `suiteFactory` instead.
+
+## 4.5.0 - 2021-12-17
+
+### Fixed
+- Add `_createGetRevocationRootController` wrapper around
+  `_getRevocationRootController` and pass `getRootController` to it.
+
+### Added
+- Add tests for `authorizeZcapRevocation`.
+
+## 4.4.0 - 2021-12-15
+
+### Added
+- Add additional tests.
+
+## 4.3.1 - 2021-12-13
+
+### Fixed
+- Fix `expectedAction` to be `write` for `DELETE` method.
+- Throw error when no `expectedAction` is given for a given HTTP method and
+  provide defaults for all common HTTP methods.
+
 ## 4.3.0 - 2021-12-10
 
 ### Added

package/README.md

@@ -56,19 +56,22 @@ npm install
 ### Define getRootController
 
 ```js
+// this will only be called if `rootInvocationTarget` matches
+// one of the expected root invocation targets specified
 async function getRootController({
   req, rootCapabilityId, rootInvocationTarget
 }) {
-  // get associated capability controller from database
+  // get controller for a service object from a database
   let controller;
   try {
-    const record = await database.getMyThingById({
+    const record = await database.getMyServiceObjectById({
+      // typically, root invocation target is a service object ID
       id: rootInvocationTarget
     });
     controller = record.controller;
   } catch(e) {
     if(e.type === 'NotFoundError') {
-      const url = req.protocol + '://' + req.get('host') + req.url;
+      const url = `${req.protocol}://${req.get('host')}${req.originalUrl}`;
       throw new Error(
         `Invalid capability identifier "${rootCapabilityId}" ` +
         `for URL "${url}".`);
@@ -76,6 +79,8 @@ async function getRootController({
     throw e;
   }
 
+  // return the service object's controller so it will be
+  // added to the root capability for the service object
   return controller;
 }
 ```
@@ -113,13 +118,20 @@ async function documentLoader(url) {
 ```js
 const {authorizeZcapInvocation} = require('ezcap-express');
 
-async function authorizeMyZcapInvocation({expectedTarget, expectedAction} = {}) {
+async function authorizeMyZcapInvocation({expectedAction} = {}) {
   return authorizeZcapInvocation({
-    expectedHost: 'ezcap.example',
-    getRootController,
-    documentLoader,
-    expectedTarget,
-    expectedAction,
+    getExpectedValues({req}) {
+      const expectedHost = 'ezcap.example';
+      const {localId} = req.params;
+      const serviceObjectId =
+        `https://${expectedHost}/${encodeURIComponent(localId)}`;
+      return {
+        action: expectedAction,
+        host: expectedHost,
+        rootInvocationTarget: serviceObjectId
+      };
+    },
+    getRootController
   });
 };
 ```
@@ -132,7 +144,7 @@ import asyncHandler from 'express-async-handler';
 
 const app = express();
 
-app.post('/foo',
+app.post('/my-objects/:localId',
   authorizeMyZcapInvocation(),
   asyncHandler(async (req, res) => {
     // your code goes here
@@ -150,7 +162,7 @@ regarding the systems it interacts with:
 * The REST-ful systems center around reading and writing resources.
 
 If these assumptions do not apply to your system, the
-[zcapld](https://github.com/digitalbazaar/zcapld) library might
+[zcap](https://github.com/digitalbazaar/zcap) library might
 be a better, albeit more complex, solution for you.
 
 Looking at each of these core assumptions more closely will help explain how designing systems to these constraints make it much easier to think about
@@ -194,8 +206,8 @@ These are the two assumptions that ezcap makes and with those two assumptions,
 ## authorizeZcapInvocation(options) ⇒ <code>function</code>
 Authorizes an incoming request.
 
-**Kind**: global function  
-**Returns**: <code>function</code> - Returns an Express.js middleware route handler.  
+**Kind**: global function
+**Returns**: <code>function</code> - Returns an Express.js middleware route handler.
 
 | Param | Type | Description |
 | --- | --- | --- |
@@ -204,12 +216,10 @@ Authorizes an incoming request.
 | [options.expectedAction] | <code>string</code> | The expected action for the   invoked capability. |
 | options.expectedHost | <code>string</code> | The expected host for the invoked   capability. |
 | [options.expectedTarget] | <code>string</code> \| <code>Array.&lt;string&gt;</code> | The expected   target(s) for the invoked capability. |
-| [options.getExpectedRootCapabilityId] | <code>function</code> | Used to return the   expected root capability identifiers for the expected targets. |
 | options.getRootController | <code>function</code> | Used to get the root capability   controller for the given root capability ID. |
 | [options.logger] | <code>object</code> | The logger instance to use. |
 | [options.suite] | <code>object</code> | The expected cryptography suite to use when   verifying digital signatures. |
 
-
 ## Contribute
 
 See [the contribute file](https://github.com/digitalbazaar/bedrock/blob/master/CONTRIBUTING.md)!

package/lib/authorize.js

@@ -1,87 +1,94 @@
 /*!
- * Copyright (c) 2021 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2021-2022 Digital Bazaar, Inc. All rights reserved.
  */
 import assert from 'assert-plus';
 import asyncHandler from 'express-async-handler';
-import {Ed25519Signature2020} from '@digitalbazaar/ed25519-signature-2020';
 import * as helpers from './helpers.js';
 import {verifyCapabilityInvocation} from 'http-signature-zcap-verify';
 
 /**
  * Authorizes an incoming request.
  *
+ * @typedef GetExpectedValues - See helpers.js.
+ *
  * @param {object} options - Options hashmap.
- * @param {object} options.documentLoader - Document loader used to load
- *   DID Documents, capability documents, and JSON-LD Contexts.
- * @param {string} options.expectedHost - The expected host for the invoked
- *   capability.
- * @param {Function} options.getExpectedTarget - Used to return the expected
- *   target(s) for the invoked capability.
- * @param {Function} options.getRootController - Used to get the root capability
- *   controller for the given root capability ID.
  * @param {boolean} [options.allowTargetAttenuation=true] - Allow the
  *   invocationTarget of a delegation chain to be increasingly restrictive
  *   based on a hierarchical RESTful URL structure.
- * @param {string} [options.expectedAction] - The expected action for the
- *   invoked capability; use this or `getExpectedAction`, not both.
- * @param {Function} [options.getExpectedAction] - Used to return the
- *   expected action for the invoked capability; use this or `expectedAction`,
- *   not both; if neither are provided, then the expected action will be
- *   determined based on the HTTP method from the request -- which is only safe
- *   provided that the handler code path is also determined based on the HTTP
- *   method in the request (i.e., typical method-based express/connect routing);
- *   if the handler code path is determined by some other means, e.g., the
- *   request body, then `getExpectedAction` MUST be used.
- * @param {Function} [options.getExpectedRootCapabilityId] - Used to return the
- *   expected root capability identifiers for the expected targets.
+ * @param {object} options.documentLoader - Document loader used to load
+ *   DID Documents, capability documents, and JSON-LD Contexts.
+ * @param {GetExpectedValues} options.getExpectedValues - Used to get the
+ *   expected values when checking the zcap invocation.
+ * @param {Function} options.getRootController - Used to get the controller
+ *   of the root capability in the invoked capability's chain.
+ * @param {Function<Promise>} options.getVerifier - An async function to
+ *   call to get a verifier and verification method for the key ID.
  * @param {Function} [options.inspectCapabilityChain] - A function that can
  *   inspect a capability chain, e.g., to check for revocations.
- * @param {Function} [options.onError] - An error handler handler for
+ * @param {number} [options.maxChainLength=10] - The maximum length of the
+ *   capability delegation chain.
+ * @param {number} [options.maxClockSkew=300] - A maximum number of seconds
+ *   that clocks may be skewed when checking capability expiration date-times
+ *   against `date`, when comparing invocation proof creation time against
+ *   delegation proof creation time, and when comparing the capability
+ *   invocation expiration time against `now`.
+ * @param {number} [options.maxDelegationTtl=1000*60*60*24*90] - The maximum
+ *   milliseconds to live for a delegated zcap as measured by the time
+ *   difference between `expires` and `created` on the delegation proof.
+* @param {Function} [options.onError] - An error handler handler for
  *   customizable error handling.
- * @param {object} [options.suite] - The expected cryptography suite to use
- *   when verifying digital signatures (deprecated; use `suiteFactory`
- *   instead).
- * @param {object} [options.suiteFactory] - A factory for creating the
- *   supported suite(s) to use when verifying digital signatures.
+ * @param {object} options.suiteFactory - A factory for creating the
+ *   supported suite(s) to use when verifying zcap delegation chains; this is
+ *   different from `getVerifier` which is used to produce a verifier for
+ *   verifying HTTP signatures used to invoke zcaps.
  *
  * @returns {Function} Returns an Express.js style middleware route handler.
  */
 export function authorizeZcapInvocation({
-  documentLoader, expectedHost, getExpectedTarget, getRootController,
-  allowTargetAttenuation = true, expectedAction, getExpectedAction,
-  getExpectedRootCapabilityId, inspectCapabilityChain,
-  onError, suite, suiteFactory
+  allowTargetAttenuation = true,
+  documentLoader, getExpectedValues, getRootController, getVerifier,
+  inspectCapabilityChain,
+  maxChainLength = 10,
+  // 300 second clock skew permitted by default
+  maxClockSkew = 300,
+  // 90 day max TTL by default
+  maxDelegationTtl = 1000 * 60 * 60 * 24 * 90,
+  onError,
+  suiteFactory
 } = {}) {
   // `helpers.createExpectationMiddleware` handles type checks on other params
+  assert.bool(allowTargetAttenuation, 'options.allowTargetAttenuation');
   assert.func(documentLoader, 'options.documentLoader');
   assert.func(getRootController, 'options.getRootController');
+  assert.func(getVerifier, 'options.getVerifier');
+  assert.number(maxChainLength, 'options.maxChainLength');
+  assert.number(maxClockSkew, 'options.maxClockSkew');
+  assert.number(maxDelegationTtl, 'options.maxDelegationTtl');
   assert.optionalFunc(inspectCapabilityChain, 'options.inspectCapabilityChain');
-  assert.optionalFunc(suiteFactory, 'options.suiteFactory');
-
-  // this code block is to be removed the next major release (5.0); `suite`
-  // should be removed as a parameter
-  if(!(suite && suiteFactory)) {
-    suiteFactory = () => new Ed25519Signature2020();
-  } else if(!suiteFactory) {
-    // backwards compatibility
-    suiteFactory = () => suite;
-  }
+  assert.func(suiteFactory, 'options.suiteFactory');
 
   return [
     helpers.createExpectationMiddleware({
-      expectedHost, expectedAction, getExpectedAction, getExpectedTarget,
-      getExpectedRootCapabilityId, onError
+      getExpectedValues, onError
     }),
     authorizeZcapInvocationAfterParse({
-      documentLoader, getRootController, suiteFactory,
-      allowTargetAttenuation, inspectCapabilityChain, onError
+      allowTargetAttenuation, documentLoader, getRootController, getVerifier,
+      inspectCapabilityChain,
+      maxChainLength, maxClockSkew, maxDelegationTtl,
+      onError, suiteFactory
     })
   ];
 }
 
 export function authorizeZcapInvocationAfterParse({
-  documentLoader, getRootController, suiteFactory,
-  allowTargetAttenuation = true, inspectCapabilityChain, onError
+  allowTargetAttenuation = true,
+  documentLoader, getRootController, getVerifier, inspectCapabilityChain,
+  maxChainLength = 10,
+  // 300 second clock skew permitted by default
+  maxClockSkew = 300,
+  // 90 day max TTL by default
+  maxDelegationTtl = 1000 * 60 * 60 * 24 * 90,
+  onError, suiteFactory
 } = {}) {
   return asyncHandler(async (req, res, next) => {
     const {
@@ -89,30 +96,6 @@ export function authorizeZcapInvocationAfterParse({
       signature: {params: {keyId}}
     } = req.ezcap;
 
-    // retrieves the root capability that was invoked
-    async function getInvokedCapability({id}) {
-      let rootCapabilityId;
-      if(Array.isArray(expectedRootCapability)) {
-        rootCapabilityId = expectedRootCapability.find(_id => id === _id);
-      } else if(id === expectedRootCapability) {
-        rootCapabilityId = expectedRootCapability;
-      }
-      if(!rootCapabilityId) {
-        const error = new Error(
-          `The given capability "${id}" is not an expected root ` +
-          `capability "${expectedRootCapability}".`);
-        error.details = {
-          actual: id,
-          expected: expectedRootCapability,
-        };
-        return helpers.handleError({error, onError});
-      }
-      return helpers.getRootCapability({
-        getRootController, req, expectedHost, expectedTarget,
-        expectedAction, rootCapabilityId
-      });
-    }
-
     // perform the capability invocation...
     // `originalUrl` must be used to support nested express routers
     const {originalUrl: url, method, headers} = req;
@@ -122,27 +105,28 @@ export function authorizeZcapInvocationAfterParse({
       suite: await suiteFactory({req}),
       headers,
       expectedHost,
-      documentLoader: helpers.wrappedDocumentLoader({
-        documentLoader,
-        expectedAction,
-        expectedHost,
-        expectedTarget,
-        getRootController,
-        req,
+      documentLoader: helpers.createRootCapabilityLoader({
+        documentLoader, getRootController, req
       }),
-      getInvokedCapability,
-      expectedTarget,
+      getVerifier,
       expectedAction,
+      expectedTarget,
       expectedRootCapability,
       inspectCapabilityChain,
       keyId,
-      allowTargetAttenuation
+      allowTargetAttenuation,
+      maxChainLength,
+      maxClockSkew,
+      maxDelegationTtl
     });
 
     // return HTTP 403 if verification fails
     if(!result.verified) {
-      helpers.handleError({error: result.error, onError, throwError: false});
-      return res.status(403).send();
+      res.status(403);
+      helpers.handleError({
+        res, error: result.error, onError, throwError: false
+      });
+      return res.send();
     }
 
     // provide zcap verification results if verification succeeds

package/lib/helpers.js

@@ -1,39 +1,43 @@
 /*!
- * Copyright (c) 2021 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2021-2022 Digital Bazaar, Inc. All rights reserved.
  */
+import * as helpers from './helpers.js';
 import assert from 'assert-plus';
 import asyncHandler from 'express-async-handler';
-import {constants as zCapConstants} from '@digitalbazaar/zcapld';
-import * as helpers from './helpers.js';
+import {
+  createRootCapability,
+  constants as zcapConstants
+} from '@digitalbazaar/zcap';
 import {parseSignatureHeader} from 'http-signature-header';
 import {verifyHeaderValue} from '@digitalbazaar/http-digest-header';
 
-const {ZCAP_CONTEXT_URL} = zCapConstants;
+export const {ZCAP_ROOT_PREFIX} = zcapConstants;
 
-export const ZCAP_ROOT_PREFIX = 'urn:zcap:root:';
+const DEFAULT_ACTION_FOR_METHOD = new Map([
+  ['GET', 'read'],
+  ['HEAD', 'read'],
+  ['OPTIONS', 'read'],
+  ['POST', 'write'],
+  ['PUT', 'write'],
+  ['PATCH', 'write'],
+  ['DELETE', 'write'],
+  ['CONNECT', 'write'],
+  ['TRACE', 'write'],
+  ['PATCH', 'write']
+]);
 
 // middleware used to collect expected values for zcap authorization
 export function createExpectationMiddleware({
-  expectedHost, getExpectedTarget,
-  expectedAction, getExpectedAction,
-  getExpectedRootCapabilityId, onError
+  getExpectedValues, onError
 }) {
-  assert.string(expectedHost, 'options.expectedHost');
-  assert.func(getExpectedTarget, 'options.getExpectedTarget');
-  assert.optionalString(expectedAction, 'options.expectedAction');
-  assert.optionalFunc(getExpectedAction, 'options.getExpectedAction');
-  assert.optionalFunc(
-    getExpectedRootCapabilityId, 'options.getExpectedRootCapabilityId');
+  assert.func(getExpectedValues, 'options.getExpectedValues');
   assert.optionalFunc(onError, 'options.onError');
 
-  if(getExpectedAction && expectedAction !== undefined) {
-    throw new Error('Use "getExpectedAction" or "expectedAction", not both.');
-  }
-
   return asyncHandler(async (req, res, next) => {
     // cache ezcap express info
-    req.ezcap = {expectedHost};
+    req.ezcap = {};
 
+    // parse signature header for zcap invocation
     const {headers} = req;
     try {
       const {params} = parseSignatureHeader(headers.authorization);
@@ -42,7 +46,8 @@ export function createExpectationMiddleware({
       const error = new Error('Missing or invalid "authorization" header.');
       error.name = 'DataError';
       error.cause = e;
-      return helpers.handleError({error, onError});
+      error.httpStatusCode = 400;
+      return helpers.handleError({res, error, onError});
     }
 
     // if body is present, ensure header digest value matches digest of body
@@ -53,7 +58,7 @@ export function createExpectationMiddleware({
           'A "digest" header must be present when an HTTP body is present.');
         error.name = 'DataError';
         error.httpStatusCode = 400;
-        return helpers.handleError({error, onError});
+        return helpers.handleError({res, error, onError});
       }
       const {verified} = await verifyHeaderValue({
         data: req.body, headerValue: expectedDigest});
@@ -62,55 +67,67 @@ export function createExpectationMiddleware({
           'The "digest" header value does not match digest of body.');
         error.name = 'DataError';
         error.httpStatusCode = 400;
-        return helpers.handleError({error, onError});
+        return helpers.handleError({res, error, onError});
       }
     } else {
       // prevent any unhandled `req.body` from being erroneously used
       req.body = undefined;
     }
 
+    // get all expected values
+    let expected;
     try {
-      // getExpectedTarget may throw an error
-      req.ezcap.expectedTarget = await helpers.getExpectedTarget(
-        {req, getExpectedTarget});
+      // `getExpectedValues` may throw
+      expected = await getExpectedValues({req});
+      _checkExpectedValues({expected});
     } catch(error) {
-      return helpers.handleError({error, onError});
+      return helpers.handleError({res, error, onError});
     }
 
-    // set expected action
-    req.ezcap.expectedAction = expectedAction;
-
-    // use `getExpectedAction` if provided
-    if(getExpectedAction) {
-      req.ezcap.expectedAction = await getExpectedAction({req});
+    // default expected target is always the full request URL
+    if(expected.target === undefined) {
+      expected.target = `https://${expected.host}${req.originalUrl}`;
     }
 
+    // get default expected action
     /* Note: This is safe as long as the server's request handling
     infrastructure differentiates based on HTTP method (as is typical practice
-    with express/connect routing. So, while the client specifies the HTTP
+    with express/connect routing). So, while the client specifies the HTTP
     method, the server specifies the handler for that HTTP method. For example,
     this middleware will ensure that if a client specifies "POST" then it
-    must be invoking a zcap that grants "write" action authority. Then, provided
-    that the server's router ensures that only the "POST" handler will be
-    executed (typical routing practice), all is well. If the handler code is
+    must be invoking a zcap that grants "write" action authority. Then,
+    provided that the server's router ensures that only the "POST" handler will
+    be executed (typical routing practice), all is well. If the handler code is
     chosen via some other means, e.g., via the request body, then the caller
     MUST provide the expected action and not rely on default behavior. */
-    if(req.ezcap.expectedAction === undefined) {
-      req.ezcap.expectedAction = req.method === 'POST' ? 'write' : 'read';
+    if(expected.action === undefined) {
+      expected.action = DEFAULT_ACTION_FOR_METHOD.get(req.method);
+      if(expected.action === undefined) {
+        const error = new Error(
+          `The HTTP method ${req.method} has no expected capability action.`);
+        error.name = 'NotSupportedError';
+        error.httpStatusCode = 400;
+        return helpers.handleError({res, error, onError});
+      }
     }
 
-    try {
-      req.ezcap.expectedRootCapability = await helpers
-        .getExpectedRootCapability({
-          req, expectedHost,
-          expectedTarget: req.ezcap.expectedTarget,
-          expectedAction: req.ezcap.expectedAction,
-          getExpectedRootCapabilityId
-        });
-    } catch(error) {
-      return helpers.handleError({error, onError});
+    // produce expected root capability from expected root invocation target
+    let expectedRootCapability;
+    const {rootInvocationTarget} = expected;
+    if(Array.isArray(rootInvocationTarget)) {
+      expectedRootCapability = rootInvocationTarget.map(
+        t => `${ZCAP_ROOT_PREFIX}${encodeURIComponent(t)}`);
+    } else {
+      expectedRootCapability =
+        `${ZCAP_ROOT_PREFIX}${encodeURIComponent(rootInvocationTarget)}`;
     }
 
+    // save expected values
+    req.ezcap.expectedAction = expected.action;
+    req.ezcap.expectedHost = expected.host;
+    req.ezcap.expectedRootCapability = expectedRootCapability;
+    req.ezcap.expectedTarget = expected.target;
+
     // call `next` on the next tick to ensure the promise from this function
     // resolves and does not reject because some subsequent middleware throws
     // an error
@@ -118,7 +135,12 @@ export function createExpectationMiddleware({
   });
 }
 
-export function handleError({error, onError, throwError = true}) {
+export function handleError({res, error, onError, throwError = true}) {
+  if(error.httpStatusCode) {
+    res.status(error.httpStatusCode);
+  } else if(res.status < 400) {
+    res.status(500);
+  }
   if(onError) {
     return onError({error});
   }
@@ -127,73 +149,36 @@ export function handleError({error, onError, throwError = true}) {
   }
 }
 
-export function wrappedDocumentLoader({
-  req, documentLoader, expectedHost, expectedTarget, expectedAction,
-  getRootController
+export function createRootCapabilityLoader({
+  documentLoader, getRootController, req
 }) {
-  return async url => {
+  return async function rootCapabilityLoader(...args) {
+    const [url] = args;
     if(url.startsWith(ZCAP_ROOT_PREFIX)) {
       const document = await getRootCapability({
-        getRootController, req, expectedHost, expectedTarget, expectedAction,
-        rootCapabilityId: url
+        getRootController, req, rootCapabilityId: url
       });
-
       return {
         contextUrl: null,
         documentUrl: url,
         document,
       };
     }
-
-    return documentLoader(url);
+    return documentLoader(...args);
   };
 }
 
-export async function getExpectedRootCapability({
-  req, expectedHost, expectedTarget, expectedAction,
-  getExpectedRootCapabilityId
-}) {
-  if(getExpectedRootCapabilityId) {
-    // retrieve the root capability given the request and expected params
-    // return value can be a string or an array of strings
-    return getExpectedRootCapabilityId({
-      req, expectedHost, expectedTarget, expectedAction
-    });
-  }
-  if(Array.isArray(expectedTarget)) {
-    return expectedTarget.map(
-      t => `${ZCAP_ROOT_PREFIX}${encodeURIComponent(t)}`);
-  }
-  return `${ZCAP_ROOT_PREFIX}${encodeURIComponent(expectedTarget)}`;
-}
-
-export async function getExpectedTarget({req, getExpectedTarget}) {
-  const {expectedTarget} = await getExpectedTarget({req});
-  if(!(typeof expectedTarget === 'string' ||
-    Array.isArray(expectedTarget))) {
-    throw new Error(
-      'Return value from "getExpectedTarget" must be an object with ' +
-      '"expectedTarget" set to a string or an array.');
-  }
-  return expectedTarget;
-}
-
 export async function getRootCapability({
-  getRootController, req, expectedHost, expectedTarget, expectedAction,
-  rootCapabilityId
+  getRootController, req, rootCapabilityId
 }) {
   const rootInvocationTarget = decodeURIComponent(
     rootCapabilityId.substr(ZCAP_ROOT_PREFIX.length));
   const controller = await getRootController({
-    req, expectedHost, expectedTarget, expectedAction,
-    rootCapabilityId, rootInvocationTarget
+    req, rootCapabilityId, rootInvocationTarget
+  });
+  return createRootCapability({
+    controller, invocationTarget: rootInvocationTarget
   });
-  return {
-    '@context': ZCAP_CONTEXT_URL,
-    id: rootCapabilityId,
-    invocationTarget: rootInvocationTarget,
-    controller
-  };
 }
 
 export function hasBody({req}) {
@@ -203,3 +188,82 @@ export function hasBody({req}) {
     (req.get('transfer-encoding') !== undefined ||
     req.get('content-length') !== undefined);
 }
+
+function _checkExpectedValues({expected}) {
+  if(!(expected && typeof expected === 'object')) {
+    throw new TypeError('"getExpectedValues" must return an object.');
+  }
+
+  const {action, host, rootInvocationTarget, target} = expected;
+
+  // expected `action` is optional
+  if(!(action === undefined || typeof action === 'string')) {
+    throw new TypeError('Expected "action" must be a string.');
+  }
+
+  // expected `host` is required
+  if(typeof host !== 'string') {
+    throw new TypeError('Expected "host" must be a string.');
+  }
+
+  // expected `rootInvocationTarget` is required
+  if(!_checkExpectedRootInvocationTarget({rootInvocationTarget})) {
+    throw new Error(
+      'Expected "rootInvocationTarget" must be a string or an array of ' +
+      'strings, each of which expresses an absolute URI.');
+  }
+
+  // expected `target` is optional
+  if(target !== undefined && !(typeof target === 'string') &&
+    target.includes(':')) {
+    throw new Error(
+      'Expected "target" must be a string that expresses an absolute ' +
+      'URI.');
+  }
+}
+
+function _checkExpectedRootInvocationTarget({rootInvocationTarget}) {
+  // must be a string or an array of strings each of which represents an
+  // absolute URI
+  if(typeof rootInvocationTarget === 'string') {
+    return rootInvocationTarget.includes(':');
+  }
+  if(Array.isArray(rootInvocationTarget) && rootInvocationTarget.length > 0) {
+    return rootInvocationTarget.every(
+      s => typeof s === 'string' && s.includes(':'));
+  }
+  return false;
+}
+
+// documentation typedefs
+
+/**
+ * A function for returning expected values when checking a zcap invocation.
+ *
+ * @typedef {Function} GetExpectedValues
+ * @param {object} options - The options passed to the function.
+ * @param {object} options.req - The express request.
+ * @returns {ExpectedValues} - The expected values.
+ */
+
+/**
+ * The expected values for checking a zcap invocation performed via an HTTP
+ * request.
+ *
+ * @typedef {object} ExpectedValues
+ * @property {string} [action] - The expected capability action; if no action
+ *   is specified during an invocation check, then a default action will be
+ *   determined based on the HTTP method from the request -- which is only safe
+ *   provided that the handler code path is also determined based on the HTTP
+ *   method in the request (i.e., typical method-based express/connect
+ *   routing); if the handler code path is determined by some other means,
+ *   e.g., the request body, then `action` MUST be set.
+ * @property {string} host - The expected host in the request header.
+ * @property {string|Array} rootInvocationTarget - The expected invocation
+ *   target for every acceptable root capability; each string must express an
+ *   absolute URI.
+ * @property {string} [target] - The expected invocation target; if no target
+ *   is specified during an invocation check, then the target will default to
+ *   the absolute URL computed from the relative request URL and expected host
+ *   value.
+ */

package/lib/revoke.js

@@ -1,96 +1,211 @@
 /*!
- * Copyright (c) 2021 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2021-2022 Digital Bazaar, Inc. All rights reserved.
  */
-import assert from 'assert-plus';
-import asyncHandler from 'express-async-handler';
-import {CapabilityDelegation} from '@digitalbazaar/zcapld';
 import * as helpers from './helpers.js';
 import * as jsigs from 'jsonld-signatures';
+import assert from 'assert-plus';
+import asyncHandler from 'express-async-handler';
 import {authorizeZcapInvocationAfterParse} from './authorize.js';
+import {CapabilityDelegation} from '@digitalbazaar/zcap';
 
 /**
  * Authorizes a request to submit a zcap revocation.
  *
+ * This middleware is opinionated; it MUST be attached to an endpoint that
+ * terminates in `/revocations/:revocationId`. This to enable the middleware to
+ * automatically generate expected values for running zcap checks and to
+ * support a common, conventional revocation API pattern.
+ *
+ * The pattern is in support of controlled objects on a service, aka
+ * "service objects". Each object's controller is used to populate the root
+ * zcap for the object's controller field. This root zcap has an invocation
+ * target that matches the URL for the service object, aka its
+ * "serviceObjectId".
+ *
+ * Therefore, any route that matches an invocation target for a root zcap for
+ * a service SHOULD attach this middleware to:
+ *
+ * `<serviceObjectId>/revocations/:revocationId`.
+ *
+ * This middleware will compute `serviceObjectId` by combining the expected
+ * host with the subpath from the request URL that occurs before
+ * `/revocations/`. It assumes that the request URL will have this pattern
+ * if the middleware code has been reached. IOW, `serviceObjectId` will
+ * be set using:
+ *
+ * `https://<expectedHost>/<URL subpath before "/revocations/">`.
+ *
+ * Note: This middleware does NOT support having `/revocations/` appear
+ * multiple places in the request URL.
+ *
+ * Attaching this middleware will enable any zcaps delegated from the service
+ * object's root zcap to be revoked without having to issue an additional zcap
+ * to use the revocation endpoint. This middleware makes that possible by
+ * supporting the invocation of a dynamically generated root zcap with an
+ * invocation target of:
+ *
+ * `<serviceObjectId>/revocations/:revocationId`.
+ *
+ * This middleware will set the `controller` of this root zcap to all
+ * controllers in the to-be-revoked zcap's delegation chain, permitting any
+ * participant to revoke it. An error will be thrown prior to populating this
+ * `controller` field if the root zcap in the to-be-revoked zcap's chain does
+ * not have `<serviceObjectId>` as its invocation target (or a prefix of it).
+ * This ensures that the only zcaps that have been delegated from a root zcap
+ * using the service object's ID as part of its invocation target can be
+ * revoked at its `/revocations` route, i.e., other zcaps intended for other
+ * service objects -- or entirely other services -- cannot be revoked via this
+ * middleware.
+ *
+ * This middleware will automatically generate two sets of expects values: one
+ * for checking the invocation to revoke a capability and one for verifying the
+ * delegation chain of the capability that is to be revoked. Only the expected
+ * host value can and must be given as a parameter.
+ *
+ * The expected values for checking the capability invocation will be:
+ *
+ * host: `<expectedHost>`,
+ * rootInvocationTarget: [
+ *   // root zcap with this target, RZ1, can be delegated w/target attenuation
+ *   // to allow delegates to revoke any zcap, Z1, with RZ1 as the root in its
+ *   // chain, even if the delegate is not a controller in Z1's chain
+ *   `<serviceObjectId>`,
+ *   // root zcap that this target, RZ2, can be used to revoke a zcap, Z2,
+ *   // with an "id" of `revocationId`; RZ2's controller will be populated
+ *   // using all controllers from Z2's chain, enabling any controller in that
+ *   // zcap's chain to invoke RZ2 to revoke Z2
+ *   `<serviceObjectId>/revocations/<revocationId>`,
+ * ],
+ * action: 'write'
+ * .
+ *
  * @param {object} options - Options hashmap.
  * @param {object} options.documentLoader - Document loader used to load
  *   DID Documents, capability documents, and JSON-LD Contexts.
- * @param {string} options.expectedHost - The expected host for the invoked
- *   capability.
- * @param {Function} options.getExpectedTarget - Used to return the expected
- *   target(s) for the invoked capability.
- * @param {Function} options.getRootController - Used to get the root
- *   capability controller for the given root capability ID.
- * @param {Function} options.suiteFactory - A factory for creating the
- *   supported suite(s) to use when verifying digital signatures.
- * @param {boolean} [options.allowTargetAttenuation=true] - Allow the
- *   invocationTarget of a delegation chain to be increasingly restrictive
- *   based on a hierarchical RESTful URL structure.
- * @param {Function} [options.getExpectedRootCapabilityId] - Used to return the
- *   expected root capability identifiers for the expected targets.
+ * @param {string} options.expectedHost - The expected host header value
+ *   when checking the zcap invocation.
+ * @param {Function} options.getRootController - Used to get the controller
+ *   of the root capability for the service object.
+ * @param {Function<Promise>} options.getVerifier - An async function to
+ *   call to get a verifier and verification method for the key ID.
  * @param {Function} [options.inspectCapabilityChain] - A function that can
- *   inspect a capability chain, e.g., to check for revocations.
+ *   inspect a capability chain, e.g., to check for revocations; it will be
+ *   used when verifying the invocation and the delegation chain for the
+ *   to-be-revoked capability.
  * @param {Function} [options.onError] - An error handler handler for
  *   customizable error handling.
+ * @param {object} options.suiteFactory - A factory for creating the
+ *   supported suite(s) to use when verifying zcap delegation chains; this is
+ *   different from `getVerifier` which is used to produce a verifier for
+ *   verifying HTTP signatures used to invoke zcaps.
  *
  * @returns {Function} Returns an Express.js style middleware route handler.
  */
 export function authorizeZcapRevocation({
-  documentLoader, expectedHost, getExpectedTarget, getRootController,
-  allowTargetAttenuation = true, getExpectedRootCapabilityId,
+  documentLoader, expectedHost, getRootController, getVerifier,
   inspectCapabilityChain, onError, suiteFactory
 }) {
-  assert.func(suiteFactory, 'options.suiteFactory');
+  // other middleware created below checks other params
+  assert.string(expectedHost, 'options.expectedHost');
+
+  /* Note: Here we wrap `getRootController` to support the aforementioned
+  zcap-specific root zcap. This will be used for checking both the invocation
+  and the revocation, though the revocation has an additional check below to
+  ensure that the submitted revocation's chain has a root zcap with an
+  acceptable invocation target. See the note below in
+  `getRevocationRootController`. */
+  getRootController = _wrapGetRootController({expectedHost, getRootController});
+
+  // computes expected values for the invocation
+  async function getExpectedValues({req}) {
+    const serviceObjectId = _parseServiceObjectId({req, expectedHost});
+    const {revocationId} = req.params;
+    return {
+      host: expectedHost,
+      rootInvocationTarget: [
+        serviceObjectId,
+        `${serviceObjectId}/revocations/${encodeURIComponent(revocationId)}`
+      ]
+    };
+  }
+
+  async function getRevocationRootController(
+    {req, rootCapabilityId, rootInvocationTarget}) {
+    /* Note: This check prevents the client from successfully submitting
+    revocations for unrelated service objects or services that could then use
+    update storage in a revocation database. */
+    const serviceObjectId = _parseServiceObjectId({req, expectedHost});
+    if(!(rootInvocationTarget === serviceObjectId ||
+      rootInvocationTarget.startsWith(`${serviceObjectId}/`))) {
+      const error = new Error(
+        `The root capability from the revocation's delegation chain must ` +
+        `have an invocation target that starts with "${serviceObjectId}".`);
+      error.name = 'NotAllowedError';
+      error.httpStatusCode = 403;
+      throw error;
+    }
+    return getRootController({req, rootCapabilityId, rootInvocationTarget});
+  }
 
-  // expected action is always `write` for submitting a revocation
-  const expectedAction = 'write';
   return [
-    helpers.createExpectationMiddleware({
-      expectedHost, expectedAction, getExpectedTarget,
-      getExpectedRootCapabilityId, onError
+    asyncHandler(async function(req, res, next) {
+      // ensure middleware is attached to opinionated route
+      if(!req.originalUrl.includes('/revocations/') ||
+        !req.params.revocationId) {
+        const error = new Error(
+          'Revocation middleware must be attached to a route ending in ' +
+          '"/revocations/:revocationId".');
+        error.httpStatusCode = 500;
+        return helpers.handleError({res, error, onError});
+      }
+      // proceed to next middleware on next tick to prevent subsequent
+      // middleware from potentially throwing here
+      process.nextTick(next);
     }),
-    verifyCapabilityDelegation({
-      documentLoader, getRootController, suiteFactory, inspectCapabilityChain,
-      onError
+    helpers.createExpectationMiddleware({getExpectedValues, onError}),
+    createCheckRevocationMiddleware({
+      documentLoader, getRootController: getRevocationRootController,
+      inspectCapabilityChain, onError, suiteFactory
     }),
     authorizeZcapInvocationAfterParse({
-      documentLoader, getRootController: _getRevocationRootController,
-      suiteFactory, allowTargetAttenuation, inspectCapabilityChain, onError
+      // target attenuation is always allowed on this endpoint
+      allowTargetAttenuation: true,
+      documentLoader, getRootController, getVerifier,
+      inspectCapabilityChain, onError, suiteFactory
     })
   ];
 }
 
-function verifyCapabilityDelegation({
-  documentLoader, getRootController, inspectCapabilityChain, suiteFactory,
-  onError
+function createCheckRevocationMiddleware({
+  documentLoader, getRootController, inspectCapabilityChain,
+  onError, suiteFactory
 }) {
-  return asyncHandler(async function getDelegator(req, res, next) {
-    const {
-      expectedAction, expectedHost, expectedTarget, expectedRootCapability
-    } = req.ezcap;
-
+  return asyncHandler(async function verifyRevocation(req, res, next) {
     const {body: capability} = req;
 
-    // early-disallow revocation of root zcaps that follow ID convention
+    // early-disallow revocation of root zcaps
     if(capability.id.startsWith(helpers.ZCAP_ROOT_PREFIX)) {
       const error = new Error('A root capability cannot be revoked.');
       error.name = 'NotAllowedError';
-      return helpers.handleError({error, onError});
+      error.httpStatusCode = 400;
+      return helpers.handleError({res, error, onError});
     }
 
     // verify CapabilityDelegation
     let delegator;
+    const capture = {};
     const chainControllers = [];
     try {
       const results = await _verifyDelegation({
+        req,
         capability,
-        documentLoader: helpers.wrappedDocumentLoader({
-          req, documentLoader, expectedHost, expectedTarget, expectedAction,
-          getRootController
+        documentLoader: helpers.createRootCapabilityLoader({
+          documentLoader, getRootController, req
         }),
-        expectedRootCapability,
         inspectCapabilityChain: _captureChainControllers({
           inspectCapabilityChain,
-          chainControllers
+          chainControllers,
+          capture
         }),
         suiteFactory
       });
@@ -100,10 +215,12 @@ function verifyCapabilityDelegation({
       const error = new Error('The provided capability delegation is invalid.');
       error.name = 'DataError';
       error.cause = e;
-      return helpers.handleError({error, onError});
+      error.httpStatusCode = 400;
+      return helpers.handleError({res, error, onError});
     }
 
-    req.zcapRevocation = {delegator, chainControllers};
+    const {capabilityChain} = capture;
+    req.zcapRevocation = {delegator, capabilityChain, chainControllers};
 
     // proceed to next middleware on next tick to prevent subsequent
     // middleware from potentially throwing here
@@ -112,18 +229,30 @@ function verifyCapabilityDelegation({
 }
 
 async function _verifyDelegation({
-  req, capability, documentLoader,
-  expectedRootCapability, inspectCapabilityChain, suiteFactory
+  req, capability, documentLoader, inspectCapabilityChain, suiteFactory
 }) {
+  // the expected values for the invocation are the same as those for checking
+  // the revocation delegation chain per the reasoning given in notes above
+  const {expectedRootCapability} = req.ezcap;
+  /* Note: We build the `expectedRootCapability` for the revoked capability
+  from the capability invocation expected values here. This is ok because the
+  revocation middleware feature presumes that the only zcaps that may be
+  revoked using it are rooted in the same authority... FIXME */
   const {verified, error, results} = await jsigs.verify(capability, {
-    suite: await suiteFactory({req}),
+    documentLoader,
     purpose: new CapabilityDelegation({
+      /* Note: Path-based target attenuation must always be true to support the
+      convention described above. This is not a security problem even if the
+      to-be-revoked zcap cannot be invoked (because the invocation endpoint
+      doesn't allow such attenuation). It just means zcaps that can be
+      delegated with attenuation rules that aren't supported by the invocation
+      endpoint can still be revoked. */
       allowTargetAttenuation: true,
       expectedRootCapability,
       inspectCapabilityChain,
       suite: await suiteFactory({req})
     }),
-    documentLoader
+    suite: await suiteFactory({req})
   });
   if(!verified) {
     throw error;
@@ -131,47 +260,61 @@ async function _verifyDelegation({
   return results;
 }
 
-async function _getRevocationRootController({
-  req, rootCapabilityId, rootInvocationTarget, getRootController,
-  revocationsSubPath = '/revocations/'
-}) {
-  // if `revocations` is not in the root invocation target, then defer to
-  // `getRootController` to try and provide the root controller
-  if(!rootInvocationTarget.includes(revocationsSubPath)) {
-    return getRootController({req, rootCapabilityId, rootInvocationTarget});
-  }
+function _wrapGetRootController({expectedHost, getRootController}) {
+  return async function _getRootController({
+    req, rootCapabilityId, rootInvocationTarget
+  }) {
+    const serviceObjectId = _parseServiceObjectId({req, expectedHost});
+    const {revocationId} = req.params;
+    const zcapSpecificRootTarget =
+      `${serviceObjectId}/revocations/${encodeURIComponent(revocationId)}`;
 
-  /* Note: If the invocation target is a zcap-specific revocation endpoint,
-  we use all zcap controllers from the submitted zcap's chain as the root
-  controller value for the target.
+    // if `rootInvocationTarget` doesn't match the zcap-specific root
+    // invocation target, then use user-provided `getRootController` to provide
+    // the controller
+    if(rootInvocationTarget !== zcapSpecificRootTarget) {
+      return getRootController({req, rootCapabilityId, rootInvocationTarget});
+    }
 
-  This approach allows any party that has delegated a zcap or received one
-  to be able to send it for revocation. Subsequent code (in the revocation
-  route handler) will confirm that the delegation is proper and the zcap from
-  which it was delegated has not itself been revoked.
+    /* Note: If the root invocation target is a zcap-specific revocation
+    endpoint, we use all zcap controllers from the to-be-revoked zcap's chain
+    as the root controller. This applies to populating the controller for the
+    root zcap in the invoked zcap's chain and for the root zcap in the
+    to-be-revoked zcap's chain.
 
-  To be clear, if the delegation chain is:
+    This approach allows any party that has delegated a zcap or received one
+    (where the root zcap includes `serviceObjectId` as a prefix in its
+    invocation target) to be able to send it for revocation. Other code
+    (in the revocation route handler) will confirm that the delegation is
+    proper and the zcap from which it was delegated has not itself been
+    revoked.
 
-  root -> A -> B
+    As an example, if the delegation chain is:
 
-  Any zcap controller in the chain of B may invoke a root zcap with a
-  `target` of `<baseUrl>/revocations/<ID of B>` (and an ID of
-  `urn:zcap:root:encodeURIComponent(<baseUrl>/revocations/<ID of B>)`). This
-  means that `root`, `A`, or `B` may revoke `B`.
+    root -> A -> B
 
-  As long no other zcap in the chain of `B` (e.g., `A`) has already been
-  revoked, then `B` will be revoked and stored as a revocation until `B`
-  expires. */
+    Any zcap controller in the chain of B may invoke a root zcap with an
+    `invocationTarget` of `<baseUrl>/revocations/<ID of B>` (and an ID of
+    `urn:zcap:root:encodeURIComponent(<baseUrl>/revocations/<ID of B>)`). This
+    means that `root`, `A`, or `B` may revoke `B`.
 
-  // use all `chainControllers`
-  // presumes `verifyCapabilityDelegation` middleware already called
-  return req.zcapRevocation.chainControllers;
+    As long no other zcap in the chain of `B` (e.g., `A`) has already been
+    revoked, then `B` will be revoked and stored as a revocation (storage must
+    be done via custom code after this middleware) until `B` expires. */
+
+    // use all `chainControllers`
+    // presumes `verifyCapabilityDelegation` middleware already called
+    return req.zcapRevocation.chainControllers;
+  };
 }
 
-function _captureChainControllers({inspectCapabilityChain, chainControllers}) {
+function _captureChainControllers({
+  inspectCapabilityChain, chainControllers, capture
+}) {
   return async function _inspectCapabilityChain(chainDetails) {
     // collect every controller in the chain
     const {capabilityChain} = chainDetails;
+    capture.capabilityChain = capabilityChain;
     for(const capability of capabilityChain.values()) {
       chainControllers.push(..._getCapabilityControllers({capability}));
     }
@@ -180,10 +323,13 @@ function _captureChainControllers({inspectCapabilityChain, chainControllers}) {
 }
 
 function _getCapabilityControllers({capability}) {
-  const {controller, id} = capability;
-  const result = controller || id;
-  if(!result) {
-    return [];
-  }
-  return Array.isArray(result) ? result : [result];
+  const {controller} = capability;
+  return Array.isArray(controller) ? controller : [controller];
+}
+
+function _parseServiceObjectId({req, expectedHost}) {
+  // `serviceObjectId` is full URL prior to `/revocations/`
+  const idx = req.originalUrl.indexOf('/revocations/');
+  const path = req.originalUrl.substring(0, idx);
+  return `https://${expectedHost}${path}`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@digitalbazaar/ezcap-express",
-  "version": "4.3.0",
+  "version": "5.0.0",
   "main": "lib",
   "module": "main.js",
   "repository": {
@@ -16,27 +16,42 @@
     "generate-readme": "jsdoc2md -t readme-template.hbs lib/*.js > README.md",
     "lint": "eslint .",
     "test": "npm run test-node",
-    "test-node": "cross-env NODE_ENV=test mocha -r esm --preserve-symlinks -t 30000 -A -R ${REPORTER:-spec} --require tests/test-mocha.js tests/*.spec.js"
+    "test-node": "cross-env NODE_ENV=test mocha -r esm --preserve-symlinks -t 30000 -A -R ${REPORTER:-spec} --require tests/test-mocha.js tests/*.spec.js",
+    "coverage": "cross-env NODE_ENV=test ESM_OPTIONS='{cache:false}' nyc --reporter=lcov --reporter=text-summary npm test",
+    "coverage-ci": "cross-env NODE_ENV=test ESM_OPTIONS='{cache:false}' nyc --reporter=lcovonly npm test",
+    "coverage-report": "nyc report"
   },
   "dependencies": {
-    "@digitalbazaar/ed25519-signature-2020": "^3.0.0",
     "@digitalbazaar/http-digest-header": "^1.0.1",
-    "@digitalbazaar/zcapld": "^5.1.2",
+    "@digitalbazaar/zcap": "^7.0.0",
     "assert-plus": "^1.0.0",
     "esm": "^3.2.25",
     "express-async-handler": "^1.1.4",
     "http-signature-header": "^2.0.2",
-    "http-signature-zcap-verify": "^8.1.1",
+    "http-signature-zcap-verify": "^9.0.0",
     "jsonld-signatures": "^9.3.0"
   },
   "devDependencies": {
+    "@digitalbazaar/ed25519-signature-2020": "^3.0.0",
+    "@digitalbazaar/ed25519-verification-key-2020": "^3.2.0",
+    "@digitalbazaar/did-method-key": "^2.0.0",
+    "@digitalbazaar/ezcap": "^2.0.0",
+    "@digitalbazaar/http-client": "^2.0.1",
+    "@digitalbazaar/security-document-loader": "^1.1.1",
+    "bnid": "^2.1.0",
     "chai": "^4.2.0",
+    "chai-http": "^4.3.0",
     "cross-env": "^7.0.2",
+    "crypto-ld": "^6.0.0",
     "eslint": "^7.30.0",
     "eslint-config-digitalbazaar": "^2.6.1",
     "eslint-plugin-jsdoc": "^32.2.0",
+    "express": "^4.17.1",
+    "http-signature-zcap-invoke": "^4.0.0",
     "jsdoc-to-markdown": "^6.0.1",
-    "mocha": "^8.1.3"
+    "mocha": "^8.1.3",
+    "nyc": "^15.1.0",
+    "zcap-context": "^1.2.1"
   },
   "engines": {
     "node": ">=14.0.0"