adorsys / adorsys/didcomm-mediator-rs
Investigate excessive AWS Secrets Manager Secret Creation
- Lingua principale
- Rust
- Stelle
- 13
- Fork
- 1
- Metriche di merge delle PR
- Nessuna PR unita negli ultimi 30g
Descrizione
## Bug Description
A vast number of secrets are being created in AWS Secrets Manager, far exceeding the expected count for a single application instance.
## Suspected Culprit
In the DID generation and initialization logic within the `did-endpoint` plugin:
1. **Key Generation on Every Call**: The `didgen()` function in `crates/web-plugins/did-endpoint/src/didgen.rs` generates new cryptographic keys (Ed25519 and X25519) every time it is invoked.
2. **Unreliable Validation Trigger**: The plugin's `mount()` function in `crates/web-plugins/did-endpoint/src/plugin.rs` calls `didgen()` if `validate_diddoc()` fails.
3. **Transient Failure Handling**: The `validate_diddoc()` function can fail for reasons other than a missing DID document, such as transient network errors when communicating with the keystore or the repository. When this happens during application startup, a new DID document and new keys are generated, leading to new secrets being stored in AWS Secrets Manager.
## Proposed Solution
Modify the initialization logic in `crates/web-plugins/did-endpoint/src/plugin.rs` to only generate a new DID document if one does not already exist in the persistent storage (MongoDB).
Guida per i contributori
Nessuna guida per i contributori indicizzata per questo repository
Valutazione
Questa issue non è ancora stata valutata.