Prevent refreshed zcap expiry from exceeding parent expiry, if any.

Author: dlongley

lib/refreshedZcapCache.js

@@ -17,9 +17,11 @@ bedrock.events.on('bedrock.init', async () => {
   REFRESHED_ZCAP_CACHE = new LruCache(cfg.caches.refreshedZcap);
 });
 
-export async function getRefreshedZcap({profileId, capability}) {
+export async function getRefreshedZcap({
+  profileId, capability, capabilityChain
+}) {
   const key = _createCacheKey({profileId, capability});
-  const fn = () => _getUncached({profileId, capability});
+  const fn = () => _getUncached({profileId, capability, capabilityChain});
   return REFRESHED_ZCAP_CACHE.memoize({key, fn});
 }
 
@@ -50,7 +52,7 @@ async function _getZcapPolicy({profileId, delegateId}) {
   }
 }
 
-async function _getUncached({profileId, capability}) {
+async function _getUncached({profileId, capability, capabilityChain}) {
   // get the policy for the profile + controller (delegate)
   const {controller: delegateId} = capability;
   const {policy} = await _getZcapPolicy({profileId, delegateId});
@@ -92,10 +94,19 @@ async function _getUncached({profileId, capability}) {
 
   // compute new `expires` from policy, defaulting to max delegation TTL
   const now = Date.now();
-  const expires = new Date(
+  let expires = new Date(
     now + (policy.refresh?.constraints?.maxDelegationTtl ??
     authorizeZcapInvocationOptions.maxDelegationTtl));
 
+  // ensure policy computed expiry doesn't exceed parent capability
+  const parentZcap = capabilityChain.at(-2);
+  if(parentZcap.expires !== undefined) {
+    const parentExpires = new Date(parentZcap.expires);
+    if(expires > parentExpires) {
+      expires = parentExpires;
+    }
+  }
+
   return profileAgents.refreshCapability({
     capability, profileSigner, now, expires
   });

lib/zcaps.js

@@ -151,8 +151,11 @@ bedrock.events.on('bedrock-express.configure.routes', app => {
     middleware.verifyRefreshableZcapDelegation(),
     asyncHandler(async (req, res) => {
       const {profileId} = req.params;
-      const {body: capability} = req;
-      const zcap = await getRefreshedZcap({profileId, capability});
+      const {body: capability, verifyRefreshableZcapDelegation} = req;
+      const {capabilityChain} = verifyRefreshableZcapDelegation;
+      const zcap = await getRefreshedZcap({
+        profileId, capability, capabilityChain
+      });
       res.json(zcap);
     }));