Implement zcap refresh policy fetch endpoint.

Author: dlongley

lib/middleware.js

@@ -69,19 +69,21 @@ export function verifyRefreshableZcapDelegation() {
   return asyncHandler(async function verifyRefreshZcap(req, res, next) {
     const {body: capability} = req;
 
-    // these params are always present where this middleware is present
-    const {profileId, delegateId} = req.params;
-
-    // confirm the zcap controller (delegate) matches the route `delegateId`
-    if(capability.controller !== delegateId) {
+    // confirm the invoked zcap controller matches the controller of the zcap
+    // that is to be refreshed
+    if(capability.controller !== req.zcap.controller) {
       throw new BedrockError(
-        `The given capability's controller does not match the refresh ` +
-        `endpoint; the capability controller must be "${delegateId}".`, {
+        `The controller "${capability.controller}" of the capability to be ` +
+        `refreshed must equal the invoked capability's controller ` +
+        `${req.zcap.controller}.`, {
           name: 'NotAllowedError',
           details: {httpStatusCode: 403, public: true}
         });
     }
 
+    // `profileId` param always present where this middleware is used
+    const {profileId} = req.params;
+
     // verify CapabilityDelegation
     let delegator;
     const capture = {};

lib/refreshedZcapCache.js

@@ -17,23 +17,15 @@ bedrock.events.on('bedrock.init', async () => {
   REFRESHED_ZCAP_CACHE = new LruCache(cfg.caches.refreshedZcap);
 });
 
-export async function getRefreshedZcap({profileId, delegateId, capability}) {
-  const key = _createCacheKey({profileId, delegateId, capability});
-  const fn = () => _getUncached({profileId, delegateId, capability});
+export async function getRefreshedZcap({profileId, capability}) {
+  const key = _createCacheKey({profileId, capability});
+  const fn = () => _getUncached({profileId, capability});
   return REFRESHED_ZCAP_CACHE.memoize({key, fn});
 }
 
-function _createCacheKey({profileId, delegateId, capability}) {
-  const json = {profileId, delegateId, canonicalZcap: canonicalize(capability)};
-  const hash = createHash('sha256').update(json, 'utf8').digest('base64url');
-  return hash;
-}
-
-async function _getUncached({profileId, delegateId, capability}) {
-  // get the policy for the profile + controller (delegate)
-  let policy;
+export async function getRefreshZcapPolicy({profileId, delegateId}) {
   try {
-    policy = await brZcapStorage.policies.get({profileId, delegateId});
+    return brZcapStorage.policies.get({profileId, delegateId});
   } catch(e) {
     // no matching policy, so refresh is denied
     if(e.name === 'NotFoundError') {
@@ -46,6 +38,18 @@ async function _getUncached({profileId, delegateId, capability}) {
     }
     throw e;
   }
+}
+
+function _createCacheKey({profileId, capability}) {
+  const json = {profileId, canonicalZcap: canonicalize(capability)};
+  const hash = createHash('sha256').update(json, 'utf8').digest('base64url');
+  return hash;
+}
+
+async function _getUncached({profileId, capability}) {
+  // get the policy for the profile + controller (delegate)
+  const {controller: delegateId} = capability;
+  const policy = await getRefreshZcapPolicy({profileId, delegateId});
 
   // get the profile signer associated with the policy
   // FIXME: perhaps allow "any root profile agent" to be used, requiring

lib/zcaps.js

@@ -4,9 +4,9 @@
 import * as bedrock from '@bedrock/core';
 import * as middleware from './middleware.js';
 import * as schemas from '../schemas/bedrock-profile-http.js';
+import {getRefreshedZcap, getRefreshZcapPolicy} from './refreshedZcapCache.js';
 import {asyncHandler} from '@bedrock/express';
 import cors from 'cors';
-import {getRefreshedZcap} from './refreshedZcapCache.js';
 import {createValidateMiddleware as validate} from '@bedrock/validation';
 
 // FIXME: use below
@@ -125,9 +125,9 @@ bedrock.events.on('bedrock-express.configure.routes', app => {
     middleware.authorizeProfileZcapRequest(),
     middleware.verifyRefreshableZcapDelegation(),
     asyncHandler(async (req, res) => {
-      const {profileId, delegateId} = req.params;
+      const {profileId} = req.params;
       const {body: capability} = req;
-      const zcap = await getRefreshedZcap({profileId, delegateId, capability});
+      const zcap = await getRefreshedZcap({profileId, capability});
       res.json({zcap});
     }));
 
@@ -136,9 +136,13 @@ bedrock.events.on('bedrock-express.configure.routes', app => {
   app.post(
     routes.viewablePolicy,
     middleware.authorizeProfileZcapRequest(),
-    asyncHandler(async (/*req, res*/) => {
-      // FIXME: implement; use `controller` of invoked zcap to determine
-      // `delegateId` to look up policy details
-      throw new Error('Not implemented');
+    asyncHandler(async (req, res) => {
+      // use `controller` of invoked zcap to determine `delegateId` to look up
+      // policy details
+      const {profileId} = req.params;
+      const {controller: delegateId} = req.zcap;
+      const policy = await getRefreshZcapPolicy({profileId, delegateId});
+      // FIXME: attenuate policy
+      res.json({policy});
     }));
 });