adorsys / adorsys/didcomm-mediator-rs

Investigate excessive AWS Secrets Manager Secret Creation

Aperta
#445 0 commenti 0 reazioni 1 assegnatario Rivendicata da @Hermann-Core Vedi su GitHub
Lingua principale
Rust
Stelle
13
Fork
1
Metriche di merge delle PR
Nessuna PR unita negli ultimi 30g

Descrizione

## Bug Description

A vast number of secrets are being created in AWS Secrets Manager, far exceeding the expected count for a single application instance.

## Suspected Culprit

In the DID generation and initialization logic within the `did-endpoint` plugin:

1. **Key Generation on Every Call**: The `didgen()` function in `crates/web-plugins/did-endpoint/src/didgen.rs` generates new cryptographic keys (Ed25519 and X25519) every time it is invoked.
2. **Unreliable Validation Trigger**: The plugin's `mount()` function in `crates/web-plugins/did-endpoint/src/plugin.rs` calls `didgen()` if `validate_diddoc()` fails.
3. **Transient Failure Handling**: The `validate_diddoc()` function can fail for reasons other than a missing DID document, such as transient network errors when communicating with the keystore or the repository. When this happens during application startup, a new DID document and new keys are generated, leading to new secrets being stored in AWS Secrets Manager.

## Proposed Solution

Modify the initialization logic in `crates/web-plugins/did-endpoint/src/plugin.rs` to only generate a new DID document if one does not already exist in the persistent storage (MongoDB).

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.