@learncard/create-http-bridge 1.1.253 → 1.1.255

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # @learncard/create-http-bridge
 
+## 1.1.255
+
+### Patch Changes
+
+- Updated dependencies [[`6315fa3346cf75df2c6cbabe78962a9faa408781`](https://github.com/learningeconomy/LearnCard/commit/6315fa3346cf75df2c6cbabe78962a9faa408781), [`80d2ebf54bb5a643808f8f7d908cf68758903dce`](https://github.com/learningeconomy/LearnCard/commit/80d2ebf54bb5a643808f8f7d908cf68758903dce), [`75d1816d5bbbd17772ef4c1c6b4932deacb9ccb5`](https://github.com/learningeconomy/LearnCard/commit/75d1816d5bbbd17772ef4c1c6b4932deacb9ccb5)]:
+    - @learncard/types@5.19.0
+    - @learncard/init@2.4.15
+
+## 1.1.254
+
+### Patch Changes
+
+- [#1540](https://github.com/learningeconomy/LearnCard/pull/1540) [`55284a9b1613d46491a03d2d527b192eb2db64c9`](https://github.com/learningeconomy/LearnCard/commit/55284a9b1613d46491a03d2d527b192eb2db64c9) Thanks [@TaylorBeeston](https://github.com/TaylorBeeston)! - Rebuild DIDKit consumers from the LC-2160 Rust dependency remediation, removing vulnerable legacy dependency branches. Preserve seeded Ed25519 identities and JWE interoperability. Preserve DIDKit's independent workspace lock during WASM builds, and validate native prebuilds for SSI/DIDKit pin changes.
+
+    RSA Marvin (RUSTSEC-2023-0071) remains unresolved in rsa 0.9.10. Deployment requires separate authorized risk approval. Hosted WASM publication and its immutable default URL must be updated before this release ships.
+
+- [#1549](https://github.com/learningeconomy/LearnCard/pull/1549) [`9cc246bd0571b5b29c60b9dcff287c1b69e012cf`](https://github.com/learningeconomy/LearnCard/commit/9cc246bd0571b5b29c60b9dcff287c1b69e012cf) Thanks [@rhen92](https://github.com/rhen92)! - chore: [LC-2175] & [LC-2176] Fixing CodeQL alerts
+
+    **Breaking change in @learncard/openid4vc-plugin**: `defaultMakeId` now throws if
+    `crypto.getRandomValues` is unavailable (no `Math.random()` fallback). This affects
+    legacy environments without Web Crypto API — modern browsers and Node.js are unaffected.
+
+- Updated dependencies []:
+    - @learncard/init@2.4.14
+
 ## 1.1.253
 
 ### Patch Changes

package/dist/index.js

@@ -416,7 +416,7 @@ const App = ({ name = "LearnCardHTTPBridge" }) => {
 };
 
 var name = "@learncard/create-http-bridge";
-var version = "1.1.253";
+var version = "1.1.255";
 var description = "Instantly create and deploy a Learn Card Bridge HTTP API via AWS Lambda!";
 var main = "dist/index.js";
 var bin = "dist/index.js";
@@ -436,6 +436,7 @@ var dependencies = {
 	commander: "^9.3.0",
 	cors: "^2.8.5",
 	express: "~4.21.0",
+	"express-rate-limit": "^7.1.5",
 	figlet: "^1.5.2",
 	immer: "^9.0.15",
 	ink: "^3.2.0",

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@learncard/create-http-bridge",
-    "version": "1.1.253",
+    "version": "1.1.255",
     "description": "Instantly create and deploy a Learn Card Bridge HTTP API via AWS Lambda!",
     "main": "dist/index.js",
     "bin": "dist/index.js",
@@ -14,12 +14,13 @@
     "author": "Learning Economy Foundation (www.learningeconomy.io)",
     "license": "MIT",
     "dependencies": {
-        "@learncard/init": "2.4.13",
-        "@learncard/types": "5.18.3",
+        "@learncard/init": "2.4.15",
+        "@learncard/types": "5.19.0",
         "@rollup/plugin-json": "^4.1.0",
         "commander": "^9.3.0",
         "cors": "^2.8.5",
         "express": "~4.21.0",
+        "express-rate-limit": "^7.1.5",
         "figlet": "^1.5.2",
         "immer": "^9.0.15",
         "ink": "^3.2.0",

package/scripts/sync-didkit.ts

@@ -1,7 +1,7 @@
 import { createHash } from 'crypto';
 import { readFile, writeFile } from 'fs/promises';
 
-const EXPECTED_DIDKIT_SHA256 = 'a058bcc6f5e9f037c26e1b29d81dfc8ac94c8e4593ce39fa78f3c2f810796c2e';
+const EXPECTED_DIDKIT_SHA256 = '38e9e39677846cfec7f0521cc23d707e2c9e87ae9981f988d78747f023bf64ee';
 const sourceUrl = new URL(
     '../../plugins/didkit/src/didkit/pkg/didkit_wasm_bg.wasm',
     import.meta.url

package/src/app.ts

@@ -1,5 +1,6 @@
 import express from 'express';
 import cors from 'cors';
+import rateLimit from 'express-rate-limit';
 import { VCValidator, VPValidator, type UnsignedVC, type VP } from '@learncard/types';
 
 import { TypedRequest } from './types.helpers';
@@ -15,6 +16,15 @@ import {
 } from './validators';
 import { getLearnCard } from './learn-card';
 
+// Rate limiter for routes that perform expensive signing/verification operations
+const authRateLimiter = rateLimit({
+    windowMs: 60 * 1000, // 1 minute window
+    limit: 100, // limit each IP to 100 requests per windowMs
+    message: 'Too many requests, please try again later.',
+    standardHeaders: true,
+    legacyHeaders: false,
+});
+
 const router = express.Router();
 
 const app = express();
@@ -22,6 +32,15 @@ const app = express();
 const W3C_V1_CREDENTIALS_CONTEXT = 'https://www.w3.org/2018/credentials/v1';
 const W3C_ALT_V1_CREDENTIALS_CONTEXT = 'https://w3.org/2018/credentials/v1';
 
+// Trust proxy for correct IP detection behind load balancers.
+// Only enable when running behind a reverse proxy (nginx, AWS ALB, etc.)
+// Without a real proxy, this allows clients to spoof X-Forwarded-For and bypass rate limits.
+// Set TRUST_PROXY=1 (or number of proxy hops) when behind a load balancer.
+if (process.env.TRUST_PROXY) {
+    const trustProxy = parseInt(process.env.TRUST_PROXY, 10);
+    app.set('trust proxy', isNaN(trustProxy) ? process.env.TRUST_PROXY : trustProxy);
+}
+
 app.use(cors());
 app.use(express.json());
 
@@ -49,7 +68,7 @@ app.delete('/credentials/:id', async (_req: TypedRequest<{}>, res) => {
     res.sendStatus(501);
 });
 
-app.post('/credentials/issue', async (req: TypedRequest<IssueEndpoint>, res) => {
+app.post('/credentials/issue', authRateLimiter, async (req: TypedRequest<IssueEndpoint>, res) => {
     try {
         const validationResult = await IssueEndpointValidator.spa(req.body);
 
@@ -99,52 +118,56 @@ app.post('/credentials/status', async (_req: TypedRequest<UpdateStatusEndpoint>,
     res.sendStatus(501);
 });
 
-app.post('/credentials/verify', async (req: TypedRequest<VerifyCredentialEndpoint>, res) => {
-    try {
-        const validationResult = await VerifyCredentialEndpointValidator.spa(req.body);
-
-        if (!validationResult.success) {
-            console.error(
-                '[/credentials/verify] Validation error: ',
-                validationResult.error.message,
-                '(received: ',
-                req.body,
-                ')'
+app.post(
+    '/credentials/verify',
+    authRateLimiter,
+    async (req: TypedRequest<VerifyCredentialEndpoint>, res) => {
+        try {
+            const validationResult = await VerifyCredentialEndpointValidator.spa(req.body);
+
+            if (!validationResult.success) {
+                console.error(
+                    '[/credentials/verify] Validation error: ',
+                    validationResult.error.message,
+                    '(received: ',
+                    req.body,
+                    ')'
+                );
+                return res.status(400).json(`Invalid input: ${validationResult.error.message}`);
+            }
+
+            const validatedBody = validationResult.data;
+            const learnCard = await getLearnCard();
+
+            const verificationResult = await learnCard.invoke.verifyCredential(
+                validatedBody.verifiableCredential,
+                validatedBody.options
             );
-            return res.status(400).json(`Invalid input: ${validationResult.error.message}`);
-        }
-
-        const validatedBody = validationResult.data;
-        const learnCard = await getLearnCard();
-
-        const verificationResult = await learnCard.invoke.verifyCredential(
-            validatedBody.verifiableCredential,
-            validatedBody.options
-        );
 
-        if (verificationResult.errors.length > 0) {
-            console.error(
-                '[/credentials/verify] Verification error(s): ',
-                verificationResult.errors,
-                '(received: ',
-                req.body
-            );
-            return res.status(400).json(verificationResult);
+            if (verificationResult.errors.length > 0) {
+                console.error(
+                    '[/credentials/verify] Verification error(s): ',
+                    verificationResult.errors,
+                    '(received: ',
+                    req.body
+                );
+                return res.status(400).json(verificationResult);
+            }
+
+            return res.status(200).json(verificationResult);
+        } catch (error) {
+            console.error('[/credentials/verify] Caught error: ', error, '(received: ', req.body);
+            return res.status(400).json(`Invalid input: ${error}`);
         }
-
-        return res.status(200).json(verificationResult);
-    } catch (error) {
-        console.error('[/credentials/verify] Caught error: ', error, '(received: ', req.body);
-        return res.status(400).json(`Invalid input: ${error}`);
     }
-});
+);
 
 app.post('/credentials/derive', async (_req: TypedRequest<{}>, res) => {
     res.sendStatus(501);
 });
 
 // This is non-standard! But very helpful for the VC-API plugin
-app.post('/presentations/issue', async (req: TypedRequest<IssueEndpoint>, res) => {
+app.post('/presentations/issue', authRateLimiter, async (req: TypedRequest<IssueEndpoint>, res) => {
     try {
         const validationResult = await IssuePresentationEndpointValidator.spa(req.body);
 
@@ -174,47 +197,51 @@ app.post('/presentations/issue', async (req: TypedRequest<IssueEndpoint>, res) =
     }
 });
 
-app.post('/presentations/verify', async (req: TypedRequest<VerifyPresentationEndpoint>, res) => {
-    try {
-        const validationResult = await VerifyPresentationEndpointValidator.spa(req.body);
-
-        if (!validationResult.success) {
-            console.error(
-                '[/presentations/verify] Validation error: ',
-                validationResult.error.message,
-                '(received: ',
-                req.body,
-                ')'
+app.post(
+    '/presentations/verify',
+    authRateLimiter,
+    async (req: TypedRequest<VerifyPresentationEndpoint>, res) => {
+        try {
+            const validationResult = await VerifyPresentationEndpointValidator.spa(req.body);
+
+            if (!validationResult.success) {
+                console.error(
+                    '[/presentations/verify] Validation error: ',
+                    validationResult.error.message,
+                    '(received: ',
+                    req.body,
+                    ')'
+                );
+                return res.status(400).json(`Invalid input: ${validationResult.error.message}`);
+            }
+
+            const validatedBody = validationResult.data;
+            const learnCard = await getLearnCard();
+
+            if ('presentation' in validatedBody) return res.sendStatus(501);
+
+            const verificationResult = await learnCard.invoke.verifyPresentation(
+                validatedBody.verifiablePresentation,
+                validatedBody.options
             );
-            return res.status(400).json(`Invalid input: ${validationResult.error.message}`);
-        }
-
-        const validatedBody = validationResult.data;
-        const learnCard = await getLearnCard();
-
-        if ('presentation' in validatedBody) return res.sendStatus(501);
-
-        const verificationResult = await learnCard.invoke.verifyPresentation(
-            validatedBody.verifiablePresentation,
-            validatedBody.options
-        );
 
-        if (verificationResult.errors.length > 0) {
-            console.error(
-                '[/presentations/verify] Verification error(s): ',
-                verificationResult.errors,
-                '(received: ',
-                req.body
-            );
-            return res.status(400).json(verificationResult);
+            if (verificationResult.errors.length > 0) {
+                console.error(
+                    '[/presentations/verify] Verification error(s): ',
+                    verificationResult.errors,
+                    '(received: ',
+                    req.body
+                );
+                return res.status(400).json(verificationResult);
+            }
+
+            return res.status(200).json(verificationResult);
+        } catch (error) {
+            console.error('[/presentations/verify] Caught error: ', error, '(received: ', req.body);
+            return res.status(400).json(`Invalid input: ${error}`);
         }
-
-        return res.status(200).json(verificationResult);
-    } catch (error) {
-        console.error('[/presentations/verify] Caught error: ', error, '(received: ', req.body);
-        return res.status(400).json(`Invalid input: ${error}`);
     }
-});
+);
 
 app.post('/presentations/prove', async (_req: TypedRequest<{}>, res) => {
     res.sendStatus(501);
@@ -232,74 +259,80 @@ app.delete('/presentations/:id', async (_req: TypedRequest<{}>, res) => {
     res.sendStatus(501);
 });
 
-app.post('/exchanges/:uri', async (req: TypedRequest<VP, { challenge?: string }>, res) => {
-    try {
-        const validationResult = await VPValidator.spa(req.body);
-
-        if (!validationResult.success) {
-            console.error(
-                '[/exchanges/:uri] Validation error: ',
-                validationResult.error.message,
-                '(received: ',
-                req.body,
-                ')'
+app.post(
+    '/exchanges/:uri',
+    authRateLimiter,
+    async (req: TypedRequest<VP, { challenge?: string }>, res) => {
+        try {
+            const validationResult = await VPValidator.spa(req.body);
+
+            if (!validationResult.success) {
+                console.error(
+                    '[/exchanges/:uri] Validation error: ',
+                    validationResult.error.message,
+                    '(received: ',
+                    req.body,
+                    ')'
+                );
+                return res.status(400).json(`Invalid input: ${validationResult.error.message}`);
+            }
+
+            const validatedBody = validationResult.data;
+            const learnCard = await getLearnCard();
+            const challenge = Array.isArray(validatedBody.proof)
+                ? validatedBody.proof[0]?.challenge
+                : validatedBody.proof.challenge;
+
+            const verification = await learnCard.invoke.verifyPresentation(validatedBody, {
+                challenge,
+                proofPurpose: 'authentication',
+            });
+
+            if (verification.warnings.length > 0 || verification.errors.length > 0) {
+                console.error(
+                    '[/exchanges/:uri] Validation error: ',
+                    verification,
+                    '(received: ',
+                    req.body,
+                    ')'
+                );
+                return res
+                    .status(400)
+                    .json({ reason: 'Invalid DID Auth VP', verificationResult: verification });
+            }
+
+            const subject = validatedBody.holder;
+
+            const credentialResult = VCValidator.safeParse(
+                await learnCard.read.get(req.params.uri)
             );
-            return res.status(400).json(`Invalid input: ${validationResult.error.message}`);
-        }
 
-        const validatedBody = validationResult.data;
-        const learnCard = await getLearnCard();
-        const challenge = Array.isArray(validatedBody.proof)
-            ? validatedBody.proof[0]?.challenge
-            : validatedBody.proof.challenge;
+            if (!credentialResult.success) return res.status(404).json('Credential not found');
 
-        const verification = await learnCard.invoke.verifyPresentation(validatedBody, {
-            challenge,
-            proofPurpose: 'authentication',
-        });
+            const credential = credentialResult.data;
 
-        if (verification.warnings.length > 0 || verification.errors.length > 0) {
-            console.error(
-                '[/exchanges/:uri] Validation error: ',
-                verification,
-                '(received: ',
-                req.body,
-                ')'
-            );
-            return res
-                .status(400)
-                .json({ reason: 'Invalid DID Auth VP', verificationResult: verification });
-        }
-
-        const subject = validatedBody.holder;
-
-        const credentialResult = VCValidator.safeParse(await learnCard.read.get(req.params.uri));
+            credential.issuer = {
+                ...(typeof credential.issuer === 'string' ? {} : credential.issuer),
+                id: learnCard.id.did(),
+            };
+            credential.issuanceDate = new Date().toISOString();
 
-        if (!credentialResult.success) return res.status(404).json('Credential not found');
+            if (!Array.isArray(credential.credentialSubject) && subject) {
+                credential.credentialSubject.id = subject;
+            }
 
-        const credential = credentialResult.data;
+            const { proof, ...unsignedCredential } = credential;
+            void proof;
 
-        credential.issuer = {
-            ...(typeof credential.issuer === 'string' ? {} : credential.issuer),
-            id: learnCard.id.did(),
-        };
-        credential.issuanceDate = new Date().toISOString();
+            const newVc = await learnCard.invoke.issueCredential(unsignedCredential);
 
-        if (!Array.isArray(credential.credentialSubject) && subject) {
-            credential.credentialSubject.id = subject;
+            return res.status(201).json(newVc);
+        } catch (error) {
+            console.error('[/exchanges/:uri] Caught error: ', error, '(received: ', req.body);
+            return res.status(400).json(`Invalid input: ${error}`);
         }
-
-        const { proof, ...unsignedCredential } = credential;
-        void proof;
-
-        const newVc = await learnCard.invoke.issueCredential(unsignedCredential);
-
-        return res.status(201).json(newVc);
-    } catch (error) {
-        console.error('[/exchanges/:uri] Caught error: ', error, '(received: ', req.body);
-        return res.status(400).json(`Invalid input: ${error}`);
     }
-});
+);
 
 app.post('/exchanges/:exchangeId/:transactionId', async (_req: TypedRequest<{}>, res) => {
     res.sendStatus(501);