@learncard/create-http-bridge 1.1.251 → 1.1.254

package/README.md

@@ -15,10 +15,10 @@ https://docs.learncard.com
 
 ## Install
 
--   Clone this repo
--   Set up AWS CLI
--   Add a .env file exporting a wallet seed (e.g. `WALLET_SEED=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa`)
--   Run `bun run serverless-deploy`
+- Clone this repo
+- Set up AWS CLI
+- Add a .env file exporting a wallet seed (e.g. `WALLET_SEED=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa`)
+- Run `bun run serverless-deploy`
 
 ## Local VC-API conformance testing
 
@@ -34,8 +34,12 @@ bun --cwd ../../../../packages/plugins/didkit run build
 
 Stop and restart any running bridge after rebuilding; it loads the DIDKit WASM during
 initialization.
-When intentionally rebuilding DIDKit, review the new binary and update
-`EXPECTED_DIDKIT_SHA256` in `scripts/sync-didkit.ts`. To test an unreviewed local artifact
+When intentionally rebuilding DIDKit, review the new binary and run
+`bun scripts/sync-didkit.ts --update-integrity` from this package. Commit the updated
+`EXPECTED_DIDKIT_SHA256` guard together with the plugin artifact. The repository's
+`build-wasm-from-submodules.sh` helper does this explicitly after generation, and the
+WASM update automation includes the guard and artifacts in its PR. Ordinary builds only verify
+the pin; they never update it. To test an unreviewed local artifact
 without changing that pin, set `LOCAL_DIDKIT_PATH` as described below.
 
 Start the LearnCard HTTP bridge in the first terminal:

package/dist/index.js

@@ -416,7 +416,7 @@ const App = ({ name = "LearnCardHTTPBridge" }) => {
 };
 
 var name = "@learncard/create-http-bridge";
-var version = "1.1.251";
+var version = "1.1.254";
 var description = "Instantly create and deploy a Learn Card Bridge HTTP API via AWS Lambda!";
 var main = "dist/index.js";
 var bin = "dist/index.js";
@@ -436,6 +436,7 @@ var dependencies = {
 	commander: "^9.3.0",
 	cors: "^2.8.5",
 	express: "~4.21.0",
+	"express-rate-limit": "^7.1.5",
 	figlet: "^1.5.2",
 	immer: "^9.0.15",
 	ink: "^3.2.0",

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@learncard/create-http-bridge",
-    "version": "1.1.251",
+    "version": "1.1.254",
     "description": "Instantly create and deploy a Learn Card Bridge HTTP API via AWS Lambda!",
     "main": "dist/index.js",
     "bin": "dist/index.js",
@@ -14,12 +14,13 @@
     "author": "Learning Economy Foundation (www.learningeconomy.io)",
     "license": "MIT",
     "dependencies": {
-        "@learncard/init": "2.4.12",
-        "@learncard/types": "5.18.2",
+        "@learncard/init": "2.4.14",
+        "@learncard/types": "5.18.3",
         "@rollup/plugin-json": "^4.1.0",
         "commander": "^9.3.0",
         "cors": "^2.8.5",
         "express": "~4.21.0",
+        "express-rate-limit": "^7.1.5",
         "figlet": "^1.5.2",
         "immer": "^9.0.15",
         "ink": "^3.2.0",

package/scripts/sync-didkit.ts

@@ -1,20 +1,42 @@
 import { createHash } from 'crypto';
 import { readFile, writeFile } from 'fs/promises';
 
-const EXPECTED_DIDKIT_SHA256 = '60efb6027699fda135db0d817f7a541bbd660ae88bec9cbec9796feeb3740b96';
+const EXPECTED_DIDKIT_SHA256 = '38e9e39677846cfec7f0521cc23d707e2c9e87ae9981f988d78747f023bf64ee';
 const sourceUrl = new URL(
     '../../plugins/didkit/src/didkit/pkg/didkit_wasm_bg.wasm',
     import.meta.url
 );
 const destinationUrl = new URL('../src/didkit_wasm_bg.wasm', import.meta.url);
+const args = process.argv.slice(2);
+const updateIntegrity = args.length === 1 && args[0] === '--update-integrity';
+
+if (args.length > 0 && !updateIntegrity) {
+    throw new Error('Usage: bun scripts/sync-didkit.ts [--update-integrity]');
+}
+if (updateIntegrity && process.env.LOCAL_DIDKIT_PATH) {
+    throw new Error('Unset LOCAL_DIDKIT_PATH before updating the canonical DIDKit integrity pin.');
+}
+
 if (!process.env.LOCAL_DIDKIT_PATH) {
     const didkit = await readFile(sourceUrl);
     const actualHash = createHash('sha256').update(didkit).digest('hex');
 
-    if (actualHash !== EXPECTED_DIDKIT_SHA256) {
+    if (updateIntegrity && actualHash !== EXPECTED_DIDKIT_SHA256) {
+        // Only intentional artifact generation/review may change the committed guard.
+        const scriptUrl = new URL(import.meta.url);
+        const script = await readFile(scriptUrl, 'utf8');
+        const declaration = `const EXPECTED_DIDKIT_SHA256 = '${EXPECTED_DIDKIT_SHA256}';`;
+        if (!script.includes(declaration)) {
+            throw new Error('Could not locate the DIDKit integrity pin to update.');
+        }
+        await writeFile(
+            scriptUrl,
+            script.replace(declaration, `const EXPECTED_DIDKIT_SHA256 = '${actualHash}';`)
+        );
+    } else if (actualHash !== EXPECTED_DIDKIT_SHA256) {
         throw new Error(
             `DIDKit WASM hash changed: expected ${EXPECTED_DIDKIT_SHA256}, received ${actualHash}. ` +
-                'Review the rebuilt artifact and update EXPECTED_DIDKIT_SHA256 intentionally.'
+                'Review the rebuilt artifact, then run sync-didkit.ts --update-integrity intentionally.'
         );
     }
 

package/src/app.ts

@@ -1,5 +1,6 @@
 import express from 'express';
 import cors from 'cors';
+import rateLimit from 'express-rate-limit';
 import { VCValidator, VPValidator, type UnsignedVC, type VP } from '@learncard/types';
 
 import { TypedRequest } from './types.helpers';
@@ -15,6 +16,15 @@ import {
 } from './validators';
 import { getLearnCard } from './learn-card';
 
+// Rate limiter for routes that perform expensive signing/verification operations
+const authRateLimiter = rateLimit({
+    windowMs: 60 * 1000, // 1 minute window
+    limit: 100, // limit each IP to 100 requests per windowMs
+    message: 'Too many requests, please try again later.',
+    standardHeaders: true,
+    legacyHeaders: false,
+});
+
 const router = express.Router();
 
 const app = express();
@@ -22,6 +32,15 @@ const app = express();
 const W3C_V1_CREDENTIALS_CONTEXT = 'https://www.w3.org/2018/credentials/v1';
 const W3C_ALT_V1_CREDENTIALS_CONTEXT = 'https://w3.org/2018/credentials/v1';
 
+// Trust proxy for correct IP detection behind load balancers.
+// Only enable when running behind a reverse proxy (nginx, AWS ALB, etc.)
+// Without a real proxy, this allows clients to spoof X-Forwarded-For and bypass rate limits.
+// Set TRUST_PROXY=1 (or number of proxy hops) when behind a load balancer.
+if (process.env.TRUST_PROXY) {
+    const trustProxy = parseInt(process.env.TRUST_PROXY, 10);
+    app.set('trust proxy', isNaN(trustProxy) ? process.env.TRUST_PROXY : trustProxy);
+}
+
 app.use(cors());
 app.use(express.json());
 
@@ -49,7 +68,7 @@ app.delete('/credentials/:id', async (_req: TypedRequest<{}>, res) => {
     res.sendStatus(501);
 });
 
-app.post('/credentials/issue', async (req: TypedRequest<IssueEndpoint>, res) => {
+app.post('/credentials/issue', authRateLimiter, async (req: TypedRequest<IssueEndpoint>, res) => {
     try {
         const validationResult = await IssueEndpointValidator.spa(req.body);
 
@@ -99,52 +118,56 @@ app.post('/credentials/status', async (_req: TypedRequest<UpdateStatusEndpoint>,
     res.sendStatus(501);
 });
 
-app.post('/credentials/verify', async (req: TypedRequest<VerifyCredentialEndpoint>, res) => {
-    try {
-        const validationResult = await VerifyCredentialEndpointValidator.spa(req.body);
-
-        if (!validationResult.success) {
-            console.error(
-                '[/credentials/verify] Validation error: ',
-                validationResult.error.message,
-                '(received: ',
-                req.body,
-                ')'
+app.post(
+    '/credentials/verify',
+    authRateLimiter,
+    async (req: TypedRequest<VerifyCredentialEndpoint>, res) => {
+        try {
+            const validationResult = await VerifyCredentialEndpointValidator.spa(req.body);
+
+            if (!validationResult.success) {
+                console.error(
+                    '[/credentials/verify] Validation error: ',
+                    validationResult.error.message,
+                    '(received: ',
+                    req.body,
+                    ')'
+                );
+                return res.status(400).json(`Invalid input: ${validationResult.error.message}`);
+            }
+
+            const validatedBody = validationResult.data;
+            const learnCard = await getLearnCard();
+
+            const verificationResult = await learnCard.invoke.verifyCredential(
+                validatedBody.verifiableCredential,
+                validatedBody.options
             );
-            return res.status(400).json(`Invalid input: ${validationResult.error.message}`);
-        }
-
-        const validatedBody = validationResult.data;
-        const learnCard = await getLearnCard();
-
-        const verificationResult = await learnCard.invoke.verifyCredential(
-            validatedBody.verifiableCredential,
-            validatedBody.options
-        );
 
-        if (verificationResult.errors.length > 0) {
-            console.error(
-                '[/credentials/verify] Verification error(s): ',
-                verificationResult.errors,
-                '(received: ',
-                req.body
-            );
-            return res.status(400).json(verificationResult);
+            if (verificationResult.errors.length > 0) {
+                console.error(
+                    '[/credentials/verify] Verification error(s): ',
+                    verificationResult.errors,
+                    '(received: ',
+                    req.body
+                );
+                return res.status(400).json(verificationResult);
+            }
+
+            return res.status(200).json(verificationResult);
+        } catch (error) {
+            console.error('[/credentials/verify] Caught error: ', error, '(received: ', req.body);
+            return res.status(400).json(`Invalid input: ${error}`);
         }
-
-        return res.status(200).json(verificationResult);
-    } catch (error) {
-        console.error('[/credentials/verify] Caught error: ', error, '(received: ', req.body);
-        return res.status(400).json(`Invalid input: ${error}`);
     }
-});
+);
 
 app.post('/credentials/derive', async (_req: TypedRequest<{}>, res) => {
     res.sendStatus(501);
 });
 
 // This is non-standard! But very helpful for the VC-API plugin
-app.post('/presentations/issue', async (req: TypedRequest<IssueEndpoint>, res) => {
+app.post('/presentations/issue', authRateLimiter, async (req: TypedRequest<IssueEndpoint>, res) => {
     try {
         const validationResult = await IssuePresentationEndpointValidator.spa(req.body);
 
@@ -174,47 +197,51 @@ app.post('/presentations/issue', async (req: TypedRequest<IssueEndpoint>, res) =
     }
 });
 
-app.post('/presentations/verify', async (req: TypedRequest<VerifyPresentationEndpoint>, res) => {
-    try {
-        const validationResult = await VerifyPresentationEndpointValidator.spa(req.body);
-
-        if (!validationResult.success) {
-            console.error(
-                '[/presentations/verify] Validation error: ',
-                validationResult.error.message,
-                '(received: ',
-                req.body,
-                ')'
+app.post(
+    '/presentations/verify',
+    authRateLimiter,
+    async (req: TypedRequest<VerifyPresentationEndpoint>, res) => {
+        try {
+            const validationResult = await VerifyPresentationEndpointValidator.spa(req.body);
+
+            if (!validationResult.success) {
+                console.error(
+                    '[/presentations/verify] Validation error: ',
+                    validationResult.error.message,
+                    '(received: ',
+                    req.body,
+                    ')'
+                );
+                return res.status(400).json(`Invalid input: ${validationResult.error.message}`);
+            }
+
+            const validatedBody = validationResult.data;
+            const learnCard = await getLearnCard();
+
+            if ('presentation' in validatedBody) return res.sendStatus(501);
+
+            const verificationResult = await learnCard.invoke.verifyPresentation(
+                validatedBody.verifiablePresentation,
+                validatedBody.options
             );
-            return res.status(400).json(`Invalid input: ${validationResult.error.message}`);
-        }
-
-        const validatedBody = validationResult.data;
-        const learnCard = await getLearnCard();
-
-        if ('presentation' in validatedBody) return res.sendStatus(501);
-
-        const verificationResult = await learnCard.invoke.verifyPresentation(
-            validatedBody.verifiablePresentation,
-            validatedBody.options
-        );
 
-        if (verificationResult.errors.length > 0) {
-            console.error(
-                '[/presentations/verify] Verification error(s): ',
-                verificationResult.errors,
-                '(received: ',
-                req.body
-            );
-            return res.status(400).json(verificationResult);
+            if (verificationResult.errors.length > 0) {
+                console.error(
+                    '[/presentations/verify] Verification error(s): ',
+                    verificationResult.errors,
+                    '(received: ',
+                    req.body
+                );
+                return res.status(400).json(verificationResult);
+            }
+
+            return res.status(200).json(verificationResult);
+        } catch (error) {
+            console.error('[/presentations/verify] Caught error: ', error, '(received: ', req.body);
+            return res.status(400).json(`Invalid input: ${error}`);
         }
-
-        return res.status(200).json(verificationResult);
-    } catch (error) {
-        console.error('[/presentations/verify] Caught error: ', error, '(received: ', req.body);
-        return res.status(400).json(`Invalid input: ${error}`);
     }
-});
+);
 
 app.post('/presentations/prove', async (_req: TypedRequest<{}>, res) => {
     res.sendStatus(501);
@@ -232,74 +259,80 @@ app.delete('/presentations/:id', async (_req: TypedRequest<{}>, res) => {
     res.sendStatus(501);
 });
 
-app.post('/exchanges/:uri', async (req: TypedRequest<VP, { challenge?: string }>, res) => {
-    try {
-        const validationResult = await VPValidator.spa(req.body);
-
-        if (!validationResult.success) {
-            console.error(
-                '[/exchanges/:uri] Validation error: ',
-                validationResult.error.message,
-                '(received: ',
-                req.body,
-                ')'
+app.post(
+    '/exchanges/:uri',
+    authRateLimiter,
+    async (req: TypedRequest<VP, { challenge?: string }>, res) => {
+        try {
+            const validationResult = await VPValidator.spa(req.body);
+
+            if (!validationResult.success) {
+                console.error(
+                    '[/exchanges/:uri] Validation error: ',
+                    validationResult.error.message,
+                    '(received: ',
+                    req.body,
+                    ')'
+                );
+                return res.status(400).json(`Invalid input: ${validationResult.error.message}`);
+            }
+
+            const validatedBody = validationResult.data;
+            const learnCard = await getLearnCard();
+            const challenge = Array.isArray(validatedBody.proof)
+                ? validatedBody.proof[0]?.challenge
+                : validatedBody.proof.challenge;
+
+            const verification = await learnCard.invoke.verifyPresentation(validatedBody, {
+                challenge,
+                proofPurpose: 'authentication',
+            });
+
+            if (verification.warnings.length > 0 || verification.errors.length > 0) {
+                console.error(
+                    '[/exchanges/:uri] Validation error: ',
+                    verification,
+                    '(received: ',
+                    req.body,
+                    ')'
+                );
+                return res
+                    .status(400)
+                    .json({ reason: 'Invalid DID Auth VP', verificationResult: verification });
+            }
+
+            const subject = validatedBody.holder;
+
+            const credentialResult = VCValidator.safeParse(
+                await learnCard.read.get(req.params.uri)
             );
-            return res.status(400).json(`Invalid input: ${validationResult.error.message}`);
-        }
 
-        const validatedBody = validationResult.data;
-        const learnCard = await getLearnCard();
-        const challenge = Array.isArray(validatedBody.proof)
-            ? validatedBody.proof[0]?.challenge
-            : validatedBody.proof.challenge;
+            if (!credentialResult.success) return res.status(404).json('Credential not found');
 
-        const verification = await learnCard.invoke.verifyPresentation(validatedBody, {
-            challenge,
-            proofPurpose: 'authentication',
-        });
+            const credential = credentialResult.data;
 
-        if (verification.warnings.length > 0 || verification.errors.length > 0) {
-            console.error(
-                '[/exchanges/:uri] Validation error: ',
-                verification,
-                '(received: ',
-                req.body,
-                ')'
-            );
-            return res
-                .status(400)
-                .json({ reason: 'Invalid DID Auth VP', verificationResult: verification });
-        }
-
-        const subject = validatedBody.holder;
-
-        const credentialResult = VCValidator.safeParse(await learnCard.read.get(req.params.uri));
+            credential.issuer = {
+                ...(typeof credential.issuer === 'string' ? {} : credential.issuer),
+                id: learnCard.id.did(),
+            };
+            credential.issuanceDate = new Date().toISOString();
 
-        if (!credentialResult.success) return res.status(404).json('Credential not found');
+            if (!Array.isArray(credential.credentialSubject) && subject) {
+                credential.credentialSubject.id = subject;
+            }
 
-        const credential = credentialResult.data;
+            const { proof, ...unsignedCredential } = credential;
+            void proof;
 
-        credential.issuer = {
-            ...(typeof credential.issuer === 'string' ? {} : credential.issuer),
-            id: learnCard.id.did(),
-        };
-        credential.issuanceDate = new Date().toISOString();
+            const newVc = await learnCard.invoke.issueCredential(unsignedCredential);
 
-        if (!Array.isArray(credential.credentialSubject) && subject) {
-            credential.credentialSubject.id = subject;
+            return res.status(201).json(newVc);
+        } catch (error) {
+            console.error('[/exchanges/:uri] Caught error: ', error, '(received: ', req.body);
+            return res.status(400).json(`Invalid input: ${error}`);
         }
-
-        const { proof, ...unsignedCredential } = credential;
-        void proof;
-
-        const newVc = await learnCard.invoke.issueCredential(unsignedCredential);
-
-        return res.status(201).json(newVc);
-    } catch (error) {
-        console.error('[/exchanges/:uri] Caught error: ', error, '(received: ', req.body);
-        return res.status(400).json(`Invalid input: ${error}`);
     }
-});
+);
 
 app.post('/exchanges/:exchangeId/:transactionId', async (_req: TypedRequest<{}>, res) => {
     res.sendStatus(501);

package/tsconfig.json

@@ -1,4 +1,5 @@
 {
+    "extends": "../../tsconfig.library.json",
     "compilerOptions": {
         "lib": ["es2017"],
         "module": "esnext",