@learncard/lca-api-service 1.3.2 → 1.4.0

package/test/signing-authority-http.spec.ts

@@ -0,0 +1,161 @@
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
+import type { APIGatewayProxyEventV2, Context as LambdaContext } from 'aws-lambda';
+import { client, mongodb } from '@mongo';
+import { SigningAuthorities } from '@accesslayer/signing-authority';
+import {
+    decryptSigningAuthoritySeed,
+    seedEncryption,
+    SeedEncryptionError,
+} from '@helpers/seedEncryption.helpers';
+import { createOpenApiAwsLambdaHandler } from '@helpers/shim';
+import { appRouter } from '../src/app';
+import { getUser } from './helpers/getClient';
+import {
+    runSeedMigrationBatch,
+    SEED_MIGRATION_RECEIPTS_COLLECTION,
+    SEED_MIGRATION_STATE_COLLECTION,
+} from '../src/migrations/signingAuthoritySeeds';
+
+let user: Awaited<ReturnType<typeof getUser>>;
+const handler = createOpenApiAwsLambdaHandler({
+    router: appRouter,
+    createContext: async () => ({
+        domain: 'localhost:3000',
+        tenant: { id: 'learncard', emailBranding: {}, resolvedVia: 'default' as const },
+        user: { did: user.learnCard.id.did(), isChallengeValid: true, authorizedDid: true },
+    }),
+});
+const request = async (path: string, body: unknown) =>
+    handler(
+        {
+            version: '2.0',
+            routeKey: 'ANY /api/{trpc+}',
+            rawPath: `/api${path}`,
+            rawQueryString: '',
+            headers: { 'content-type': 'application/json' },
+            pathParameters: { trpc: path.slice(1) },
+            requestContext: {
+                accountId: 'test',
+                apiId: 'test',
+                domainName: 'localhost',
+                domainPrefix: 'localhost',
+                http: {
+                    method: 'POST',
+                    path,
+                    protocol: 'HTTP/1.1',
+                    sourceIp: '127.0.0.1',
+                    userAgent: 'test',
+                },
+                requestId: 'test-request',
+                routeKey: 'ANY /api/{trpc+}',
+                stage: 'test',
+                time: '',
+                timeEpoch: 0,
+            },
+            body: JSON.stringify(body),
+            isBase64Encoded: false,
+        } satisfies APIGatewayProxyEventV2,
+        {} as LambdaContext
+    );
+
+beforeAll(async () => {
+    await client.connect();
+    user = await getUser();
+});
+afterAll(async () => {
+    await client.close();
+});
+beforeEach(async () => {
+    await SigningAuthorities.deleteMany({});
+    // Spec files share one database; another file may leave a migration lease or receipts behind.
+    await mongodb.collection(SEED_MIGRATION_STATE_COLLECTION).deleteMany({});
+    await mongodb.collection(SEED_MIGRATION_RECEIPTS_COLLECTION).deleteMany({});
+    vi.spyOn(console, 'error').mockImplementation(() => undefined);
+});
+afterEach(() => vi.restoreAllMocks());
+
+describe('encrypted signing-authority OpenAPI routes', () => {
+    it('keeps the same signing identity after migrating and purging a legacy seed', async () => {
+        const created = await request('/signing-authority/create', { name: 'migrated-http' });
+        const authority = JSON.parse(created.body);
+        const stored = await SigningAuthorities.findOne({ _id: authority._id });
+        const seed = await decryptSigningAuthoritySeed(stored!);
+        await SigningAuthorities.updateOne(
+            { _id: authority._id },
+            {
+                $set: { seed },
+                $unset: { encryptedSeed: '', encryptedDek: '', keyVersion: '' },
+            }
+        );
+        for (const phase of ['prepare', 'verify', 'purge'] as const) {
+            const result = await runSeedMigrationBatch(
+                mongodb,
+                { phase },
+                { encryptedWritesEnabled: true }
+            );
+            expect(result.done).toBe(true);
+        }
+        expect(await SigningAuthorities.findOne({ _id: authority._id })).not.toHaveProperty('seed');
+        const response = await request('/credentials/issue', {
+            credential: user.learnCard.invoke.newCredential(),
+            signingAuthority: authority,
+        });
+        expect(response.statusCode).toBe(200);
+        const signed = JSON.parse(response.body);
+        expect(signed.issuer).toBe(authority.did);
+        expect((await user.learnCard.invoke.verifyCredential(signed)).errors).toHaveLength(0);
+    });
+
+    it('creates ciphertext-only records and issues a verifiable credential over HTTP', async () => {
+        const created = await request('/signing-authority/create', { name: 'http' });
+        expect(created.statusCode).toBe(200);
+        const authority = JSON.parse(created.body);
+        expect(authority).not.toHaveProperty('seed');
+        expect(authority).not.toHaveProperty('encryptedSeed');
+        expect(await SigningAuthorities.findOne({ name: 'http' })).not.toHaveProperty('seed');
+        const response = await request('/credentials/issue', {
+            credential: user.learnCard.invoke.newCredential(),
+            signingAuthority: authority,
+        });
+        expect(response.statusCode).toBe(200);
+        const verification = await user.learnCard.invoke.verifyCredential(
+            JSON.parse(response.body)
+        );
+        expect(verification.errors).toHaveLength(0);
+    });
+
+    it.each(['kms_access_denied', 'kms_unavailable', 'authentication_failed'] as const)(
+        'returns a generic 500 and structured logs on %s',
+        async category => {
+            const created = await request('/signing-authority/create', { name: category });
+            const authority = JSON.parse(created.body);
+            vi.spyOn(seedEncryption, 'decrypt').mockRejectedValueOnce(
+                new SeedEncryptionError(category, 'request-1')
+            );
+            const response = await request('/credentials/issue', {
+                credential: user.learnCard.invoke.newCredential(),
+                signingAuthority: authority,
+            });
+            expect(response.statusCode).toBe(500);
+            expect(response.body).toContain('Signing authority key is unavailable');
+            expect(response.body).not.toContain(category);
+            expect(response.body).not.toContain('request-1');
+            expect(console.error).toHaveBeenCalledWith(
+                expect.objectContaining({
+                    event: 'signing_authority_seed_failure',
+                    operation: 'decrypt',
+                    category,
+                })
+            );
+        }
+    );
+
+    it('does not insert a record when encryption fails during creation', async () => {
+        vi.spyOn(seedEncryption, 'encrypt').mockRejectedValueOnce(
+            new SeedEncryptionError('kms_unavailable')
+        );
+        const response = await request('/signing-authority/create', { name: 'failed-create' });
+        expect(response.statusCode).toBe(500);
+        expect(await SigningAuthorities.countDocuments()).toBe(0);
+    });
+});

package/test/signing-authority-seed-migration.spec.ts

@@ -0,0 +1,414 @@
+import { Collection, ObjectId } from 'mongodb';
+import { GenerateDataKeyCommand, KMSClient } from '@aws-sdk/client-kms';
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
+import { client, mongodb } from '@mongo';
+import { SIGNING_AUTHORITIES_COLLECTION } from '@models';
+import {
+    createSeedEncryption,
+    seedEncryption,
+    getSeedIdentity,
+    SeedEncryptionError,
+} from '@helpers/seedEncryption.helpers';
+import {
+    countSeedMigrationDocuments,
+    runSeedMigrationBatch,
+    SEED_MIGRATION_STATE_COLLECTION,
+    SEED_MIGRATION_RECEIPTS_COLLECTION,
+} from '../src/migrations/signingAuthoritySeeds';
+import type { MigrationSigningAuthority, SeedMigrationPhase } from '../src/types/seed-migration';
+
+const authorities = mongodb.collection<MigrationSigningAuthority>(SIGNING_AUTHORITIES_COLLECTION);
+const seed = 'a'.repeat(64);
+const legacy = (id: string | ObjectId = 'legacy'): MigrationSigningAuthority => ({
+    _id: id,
+    ownerDid: 'did:example:owner',
+    name: String(id),
+    did: 'did:key:example',
+    seed,
+});
+const batch = (phase: SeedMigrationPhase) =>
+    runSeedMigrationBatch(
+        mongodb,
+        { phase, batchSize: 1 },
+        {
+            encryptedWritesEnabled: true,
+        }
+    );
+const finish = async (phase: SeedMigrationPhase): Promise<void> => {
+    for (let attempts = 0; attempts < 20; attempts += 1) {
+        if ((await batch(phase)).done) return;
+    }
+    throw new Error('Migration did not finish');
+};
+const insertEncrypted = async (id: string): Promise<void> => {
+    const { seed: original, ...identity } = legacy(id);
+    await authorities.insertOne({
+        ...identity,
+        ...(await seedEncryption.encrypt(original!, getSeedIdentity(identity))),
+    });
+};
+
+beforeAll(async () => {
+    await client.connect();
+});
+afterAll(async () => {
+    await client.close();
+});
+beforeEach(async () => {
+    await authorities.deleteMany({});
+    await mongodb.collection(SEED_MIGRATION_STATE_COLLECTION).deleteMany({});
+    await mongodb.collection(SEED_MIGRATION_RECEIPTS_COLLECTION).deleteMany({});
+    vi.spyOn(console, 'info').mockImplementation(() => undefined);
+    vi.spyOn(console, 'error').mockImplementation(() => undefined);
+});
+afterEach(() => vi.restoreAllMocks());
+
+describe('signing-authority seed migration', () => {
+    it('verifies and purges mixed provider records after offline KMS opt-in', async () => {
+        const localConfig = { allowLocal: true, localKek: 'f'.repeat(64) };
+        const localRecord = legacy('local');
+        await authorities.insertOne({
+            ...localRecord,
+            ...(await createSeedEncryption(localConfig).encrypt(
+                seed,
+                getSeedIdentity(localRecord)
+            )),
+        });
+        await authorities.insertOne(legacy());
+
+        const kmsKeyArn = 'arn:aws:kms:us-east-1:123456789012:key/test';
+        const kms = new KMSClient({ region: 'us-east-1' });
+        vi.spyOn(kms, 'send').mockImplementation(async command => ({
+            Plaintext: new Uint8Array(32).fill(1),
+            KeyId: kmsKeyArn,
+            ...(command instanceof GenerateDataKeyCommand
+                ? { CiphertextBlob: Buffer.from('wrapped') }
+                : {}),
+        }));
+        const dualProvider = createSeedEncryption({ ...localConfig, kmsKeyArn }, kms);
+        vi.spyOn(seedEncryption, 'encrypt').mockImplementation(dualProvider.encrypt);
+        vi.spyOn(seedEncryption, 'decrypt').mockImplementation(dualProvider.decrypt);
+        await insertEncrypted('new-kms');
+
+        await finish('prepare');
+        await finish('verify');
+        await finish('purge');
+
+        expect(await countSeedMigrationDocuments(mongodb)).toEqual({
+            total: 3,
+            encrypted: 3,
+            legacyOnly: 0,
+            malformed: 0,
+            plaintextRemaining: 0,
+        });
+        // Prepare migrates plaintext; it does not rotate already-encrypted records.
+        expect((await authorities.findOne({ _id: 'local' }))?.keyVersion).toBe('local-v1');
+        expect((await authorities.findOne({ _id: 'legacy' }))?.keyVersion).toBe('kms-v1');
+        expect((await authorities.findOne({ _id: 'new-kms' }))?.keyVersion).toBe('kms-v1');
+    });
+
+    it('dry-runs without writes and rejects migration while plaintext writers are enabled', async () => {
+        await authorities.insertOne(legacy());
+        expect(await batch('dry-run')).toMatchObject({
+            done: true,
+            counts: { total: 1, legacyOnly: 1 },
+        });
+        expect(await mongodb.collection(SEED_MIGRATION_STATE_COLLECTION).countDocuments()).toBe(0);
+        await expect(
+            runSeedMigrationBatch(mongodb, { phase: 'prepare' }, { encryptedWritesEnabled: false })
+        ).rejects.toMatchObject({ category: 'encrypted_writes_required' });
+        expect(await authorities.findOne({ _id: 'legacy' })).toEqual(legacy());
+    });
+
+    it('migrates mixed rows idempotently, preserves BSON IDs/metadata, and removes plaintext only after verification', async () => {
+        const id = new ObjectId();
+        const missingDid = legacy(id);
+        delete missingDid.did;
+        await authorities.insertMany([
+            legacy(),
+            { ...missingDid, endpoint: 'https://example.com' },
+        ]);
+        await insertEncrypted('new');
+        await finish('prepare');
+        const prepared = await authorities.find().toArray();
+        expect(await countSeedMigrationDocuments(mongodb)).toEqual({
+            total: 3,
+            encrypted: 3,
+            legacyOnly: 0,
+            malformed: 0,
+            plaintextRemaining: 2,
+        });
+        await finish('prepare');
+        expect(await authorities.find().toArray()).toEqual(prepared);
+        await expect(batch('purge')).rejects.toMatchObject({ category: 'verification_required' });
+        expect(await authorities.countDocuments({ seed: { $exists: true } })).toBe(2);
+        await finish('verify');
+        const checkpoint = await mongodb.collection(SEED_MIGRATION_STATE_COLLECTION).findOne({});
+        expect(checkpoint?.counts.encrypted).toBe(checkpoint?.counts.total);
+        const receipts = await mongodb
+            .collection(SEED_MIGRATION_RECEIPTS_COLLECTION)
+            .find()
+            .toArray();
+        expect(JSON.stringify(receipts)).not.toContain(seed);
+        expect((await batch('purge')).done).toBe(false);
+        await finish('purge');
+        await finish('purge');
+        expect(await authorities.countDocuments({ seed: { $exists: true } })).toBe(0);
+        expect(await authorities.findOne({ _id: id })).toMatchObject({
+            _id: id,
+            endpoint: 'https://example.com',
+        });
+        for (const row of await authorities.find().toArray()) {
+            expect(Object.hasOwn(row, 'seed')).toBe(false);
+            expect(row.keyVersion).toBe('local-v1');
+            expect(
+                await seedEncryption.decrypt(
+                    {
+                        encryptedSeed: row.encryptedSeed,
+                        encryptedDek: row.encryptedDek,
+                        keyVersion: row.keyVersion,
+                    },
+                    getSeedIdentity(row)
+                )
+            ).toBe(seed);
+        }
+        expect(JSON.stringify(vi.mocked(console.info).mock.calls)).not.toContain(seed);
+    });
+
+    it('recovers when a batch stops after persisting ciphertext but before readback verification', async () => {
+        await authorities.insertOne(legacy());
+        vi.spyOn(seedEncryption, 'decrypt').mockRejectedValueOnce(
+            new SeedEncryptionError('kms_unavailable')
+        );
+        await expect(batch('prepare')).rejects.toMatchObject({ category: 'kms_unavailable' });
+        expect(await authorities.findOne({ _id: 'legacy' })).toMatchObject({
+            seed,
+            keyVersion: 'local-v1',
+        });
+        await finish('prepare');
+        await finish('verify');
+        await finish('purge');
+        expect(await authorities.countDocuments({ seed: { $exists: true } })).toBe(0);
+    });
+
+    it('blocks deletion when verification detects a seed mismatch or malformed envelope', async () => {
+        await authorities.insertOne(legacy());
+        await finish('prepare');
+        await authorities.updateOne({ _id: 'legacy' }, { $set: { seed: 'b'.repeat(64) } });
+        await expect(batch('verify')).rejects.toMatchObject({ category: 'seed_mismatch' });
+        await expect(batch('purge')).rejects.toMatchObject({ category: 'verification_required' });
+        await authorities.updateOne({ _id: 'legacy' }, { $set: { keyVersion: 'unknown' } });
+        await expect(batch('verify')).rejects.toMatchObject({ category: 'malformed_records' });
+        expect(await authorities.countDocuments({ seed: { $exists: true } })).toBe(1);
+    });
+
+    it('requires reverification after a verified envelope changes', async () => {
+        const original = legacy();
+        await authorities.insertOne(original);
+        await finish('prepare');
+        await finish('verify');
+        const replacement = await seedEncryption.encrypt(seed, getSeedIdentity(original));
+        await authorities.updateOne({ _id: original._id }, { $set: replacement });
+        await expect(batch('purge')).rejects.toMatchObject({ category: 'reverification_required' });
+        expect(await authorities.countDocuments({ seed: { $exists: true } })).toBe(1);
+        await finish('verify');
+        await finish('purge');
+        expect(await authorities.countDocuments({ seed: { $exists: true } })).toBe(0);
+    });
+
+    it('verifies concurrent encrypted inserts and resumes verification without skipping records', async () => {
+        await authorities.insertMany([legacy('one'), legacy('two')]);
+        await finish('prepare');
+        expect((await batch('verify')).done).toBe(false);
+        await insertEncrypted('inserted-before-cursor');
+        await finish('verify');
+        expect(await mongodb.collection(SEED_MIGRATION_RECEIPTS_COLLECTION).countDocuments()).toBe(
+            3
+        );
+        await insertEncrypted('created-after-verification');
+        await finish('purge');
+        expect(await countSeedMigrationDocuments(mongodb)).toMatchObject({
+            total: 4,
+            encrypted: 4,
+            plaintextRemaining: 0,
+        });
+    });
+
+    it('does not unset a seed when the row changes between decryption and the conditional write', async () => {
+        await authorities.insertOne(legacy());
+        await finish('prepare');
+        await finish('verify');
+        const decrypt = seedEncryption.decrypt;
+        vi.spyOn(seedEncryption, 'decrypt').mockImplementationOnce(async (...args) => {
+            const result = await decrypt(...args);
+            await authorities.updateOne(
+                { _id: 'legacy' },
+                { $set: { name: 'changed-concurrently' } }
+            );
+            return result;
+        });
+        await expect(batch('purge')).rejects.toMatchObject({ category: 'document_changed' });
+        expect(await authorities.countDocuments({ seed: { $exists: true } })).toBe(1);
+        expect(
+            await mongodb.collection(SEED_MIGRATION_STATE_COLLECTION).findOne({})
+        ).not.toHaveProperty('verifiedEpoch');
+    });
+
+    it('excludes competing workers and recovers an expired lease', async () => {
+        await authorities.insertOne(legacy());
+        await batch('prepare');
+        await mongodb.collection(SEED_MIGRATION_STATE_COLLECTION).updateMany(
+            {},
+            {
+                $set: { leaseOwner: 'other-worker', leaseExpiresAt: new Date(Date.now() + 60_000) },
+            }
+        );
+        await expect(batch('verify')).rejects.toMatchObject({ category: 'worker_busy' });
+        await mongodb.collection(SEED_MIGRATION_STATE_COLLECTION).updateMany(
+            {},
+            {
+                $set: { leaseExpiresAt: new Date(0) },
+            }
+        );
+        await finish('verify');
+        await finish('purge');
+    });
+
+    it('reconciles only at scan boundaries and resumes across string and BSON IDs', async () => {
+        await authorities.insertMany([
+            legacy('a'),
+            legacy('b'),
+            legacy(new ObjectId()),
+            legacy(new ObjectId()),
+        ]);
+        const aggregate = vi.spyOn(Collection.prototype, 'aggregate');
+        for (const phase of ['prepare', 'verify', 'purge'] as const) {
+            aggregate.mockClear();
+            const first = await batch(phase);
+            expect(first).toMatchObject({ done: false, processed: 1, countsReconciled: false });
+            expect(
+                await mongodb.collection(SEED_MIGRATION_STATE_COLLECTION).findOne({})
+            ).toHaveProperty('cursor', 'a');
+            let result = first;
+            while (!result.done) result = await batch(phase);
+            expect(result.countsReconciled).toBe(true);
+            const pipelines = aggregate.mock.calls.map(([pipeline]) => pipeline!);
+            expect(pipelines.filter(pipeline => pipeline[0]?.$group)).toHaveLength(2);
+            expect(pipelines.filter(pipeline => pipeline[0]?.$lookup)).toHaveLength(
+                phase === 'verify' ? 1 : 0
+            );
+        }
+        expect(await countSeedMigrationDocuments(mongodb)).toMatchObject({
+            total: 4,
+            encrypted: 4,
+            plaintextRemaining: 0,
+        });
+    });
+
+    it('rechecks inserts and modified envelopes behind the verification cursor', async () => {
+        await authorities.insertMany([legacy('b'), legacy('c')]);
+        await finish('prepare');
+        await batch('verify');
+        await insertEncrypted('a');
+        const changed = { ...legacy('b'), name: 'renamed' };
+        await authorities.updateOne(
+            { _id: 'b' },
+            {
+                $set: {
+                    name: changed.name,
+                    ...(await seedEncryption.encrypt(seed, getSeedIdentity(changed))),
+                },
+            }
+        );
+        await batch('verify');
+        expect(await batch('verify')).toMatchObject({
+            done: false,
+            processed: 0,
+            countsReconciled: true,
+            rescanRequired: true,
+        });
+        expect(
+            await mongodb.collection(SEED_MIGRATION_STATE_COLLECTION).findOne({})
+        ).not.toHaveProperty('verifiedEpoch');
+        await finish('verify');
+        expect(
+            await mongodb
+                .collection(SEED_MIGRATION_RECEIPTS_COLLECTION)
+                .findOne({ _id: 'b' } as never)
+        ).toHaveProperty('name', 'renamed');
+        await finish('purge');
+        expect(await authorities.countDocuments({ seed: { $exists: true } })).toBe(0);
+    });
+
+    it('resumes after yielding to the invocation time budget', async () => {
+        await authorities.insertMany([legacy('a'), legacy('b')]);
+        const remainingTime = vi.fn().mockReturnValueOnce(60_000).mockReturnValue(10_000);
+        expect(
+            await runSeedMigrationBatch(
+                mongodb,
+                { phase: 'prepare', batchSize: 10 },
+                { encryptedWritesEnabled: true, remainingTime }
+            )
+        ).toMatchObject({ done: false, processed: 1, countsReconciled: false });
+        expect(
+            await mongodb.collection(SEED_MIGRATION_STATE_COLLECTION).findOne({})
+        ).toHaveProperty('cursor', 'a');
+        await finish('prepare');
+        await finish('verify');
+        await finish('purge');
+        expect(await authorities.countDocuments({ seed: { $exists: true } })).toBe(0);
+    });
+
+    it.each(['checkpoint', 'lease', 'both'])(
+        'preserves the original failure when %s cleanup fails',
+        async failing => {
+            await authorities.insertOne(legacy());
+            await finish('prepare');
+            await finish('verify');
+            vi.spyOn(seedEncryption, 'decrypt').mockRejectedValueOnce(
+                new SeedEncryptionError('kms_unavailable', 'request-123')
+            );
+            const updateOne = Collection.prototype.updateOne;
+            vi.spyOn(Collection.prototype, 'updateOne').mockImplementation(function (...args) {
+                const update = args[1];
+                if (
+                    this.collectionName === SEED_MIGRATION_STATE_COLLECTION &&
+                    ((failing !== 'lease' && update.$set?.status === 'failed') ||
+                        (failing !== 'checkpoint' && update.$unset?.leaseOwner !== undefined))
+                ) {
+                    throw new Error(seed);
+                }
+                return updateOne.apply(this, args);
+            });
+            await expect(batch('purge')).rejects.toMatchObject({ category: 'kms_unavailable' });
+            const state = await mongodb.collection(SEED_MIGRATION_STATE_COLLECTION).findOne({});
+            expect(state).not.toHaveProperty('verifiedEpoch');
+            expect(await authorities.countDocuments({ seed: { $exists: true } })).toBe(1);
+            expect(console.error).toHaveBeenCalledWith(
+                expect.objectContaining({
+                    category: 'kms_unavailable',
+                    awsRequestId: 'request-123',
+                })
+            );
+            expect(JSON.stringify(vi.mocked(console.error).mock.calls)).not.toContain(seed);
+        }
+    );
+
+    it('logs a failed lease release without replacing a successful batch result', async () => {
+        await authorities.insertOne(legacy());
+        const updateOne = Collection.prototype.updateOne;
+        vi.spyOn(Collection.prototype, 'updateOne').mockImplementation(function (...args) {
+            if (
+                this.collectionName === SEED_MIGRATION_STATE_COLLECTION &&
+                args[1].$unset?.leaseOwner !== undefined
+            )
+                throw new Error(seed);
+            return updateOne.apply(this, args);
+        });
+        await expect(batch('prepare')).resolves.toMatchObject({ processed: 1 });
+        expect(console.error).toHaveBeenCalledWith(
+            expect.objectContaining({ operation: 'migration_lease_release' })
+        );
+        await expect(batch('prepare')).rejects.toMatchObject({ category: 'worker_busy' });
+    });
+});

package/test/signing-authority.spec.ts

@@ -2,6 +2,7 @@ import { vi } from 'vitest';
 
 import { getClient, getUser } from './helpers/getClient';
 import { SigningAuthorities } from '@accesslayer/signing-authority';
+import { createSigningAuthorityForDID } from '@accesslayer/signing-authority/create';
 
 /**
  * More info on Signing Authorities:
@@ -63,6 +64,16 @@ describe('Signing Authority', () => {
             did: expect.stringMatching(/^did:/),
             endpoint: expect.stringContaining('/api'),
         });
+        const stored = await SigningAuthorities.findOne({ _id: signingAuthority._id });
+        expect(stored).not.toHaveProperty('seed');
+        expect(stored).toMatchObject({
+            encryptedSeed: expect.any(String),
+            encryptedDek: expect.any(String),
+            keyVersion: 'local-v1',
+        });
+        for (const field of ['seed', 'encryptedSeed', 'encryptedDek', 'keyVersion']) {
+            expect(signingAuthority).not.toHaveProperty(field);
+        }
     });
 
     it('should prevent creating a signing authority with the same name', async () => {
@@ -75,9 +86,38 @@ describe('Signing Authority', () => {
         ).rejects.toThrow();
     });
 
+    it('logs the Mongo code for a duplicate insert without exposing keys or duplicate values', async () => {
+        await SigningAuthorities.createIndex({ ownerDid: 1, name: 1 }, { unique: true });
+        const logger = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+        const name = 'private-duplicate-name';
+        const owner = userA.learnCard.id.did();
+        try {
+            expect(await createSigningAuthorityForDID(owner, name)).toEqual(expect.any(String));
+            expect(await createSigningAuthorityForDID(owner, name)).toBe(false);
+            expect(logger).toHaveBeenCalledWith(
+                expect.objectContaining({
+                    operation: 'create',
+                    errorName: 'MongoServerError',
+                    mongoCode: 11000,
+                })
+            );
+            const logs = JSON.stringify(logger.mock.calls);
+            expect(logs).not.toContain('e'.repeat(64));
+            expect(logs).not.toContain(name);
+            expect(logs).not.toContain(owner);
+        } finally {
+            logger.mockRestore();
+        }
+    });
+
     it('should allow you to retrieve your signing authorities after creation', async () => {
         await userA.clients.fullAuth.signingAuthority.createSigningAuthority({ name: 'mysa' });
         const sas = await userA.clients.fullAuth.signingAuthority.signingAuthorities();
+        for (const authority of sas) {
+            for (const field of ['seed', 'encryptedSeed', 'encryptedDek', 'keyVersion']) {
+                expect(authority).not.toHaveProperty(field);
+            }
+        }
         if (sas && sas[0]) {
             expect(sas[0].name).toBe('mysa');
             expect(sas[0].ownerDid).toBe(userA.learnCard.id.did());

package/vitest.config.ts

@@ -2,6 +2,6 @@ import { createVitestConfig, nodePreset } from '../../../vitest.shared';
 
 export default createVitestConfig(nodePreset, {
     test: {
-        include: ['src/**/*.test.ts'],
+        include: ['src/**/*.test.ts', '*Lambda.test.ts'],
     },
 });

package/vitest.integration.config.ts

@@ -8,6 +8,11 @@ export default createVitestConfig(serviceIntegrationPreset, {
     test: {
         globalSetup: './vitest-setup.ts',
         include: ['test/**/*.spec.ts'],
+        env: {
+            IS_E2E_TEST: 'true',
+            ESCROW_RELAY_URL: 'https://escrow-relay.example',
+            ESCROW_RELAY_AUTH_TOKEN: 'relay-auth-token',
+        },
         alias: { '@mongo': require.resolve('./test/helpers/mock-mongo.ts') },
     },
 });

package/dist/cache/signing-authority.d.ts

@@ -1,6 +0,0 @@
-import { SigningAuthorityMeta } from 'types/signing-authority';
-export declare const getSigningAuthorityKey: (did: string, name: string) => string;
-export declare const getSigningAuthorityForDid: (did: string, name: string) => Promise<string | null | undefined>;
-export declare const getSigningAuthoritiesForDid: (did: string) => Promise<SigningAuthorityMeta[]>;
-export declare const addSigningAuthorityForDid: (did: string, name: string, seed: string) => Promise<"OK" | undefined>;
-export declare const deleteSigningAuthorityForDid: (did: string, name: string) => Promise<number | undefined>;