adorsys / adorsys/didcomm-mediator-rs
Investigate excessive AWS Secrets Manager Secret Creation
- Lenguaje dominante
- Rust
- Estrellas
- 13
- Forks
- 1
- Métricas de merge de PR
- Sin PR fusionados en 30 d
Descripción
## Bug Description
A vast number of secrets are being created in AWS Secrets Manager, far exceeding the expected count for a single application instance.
## Suspected Culprit
In the DID generation and initialization logic within the `did-endpoint` plugin:
1. **Key Generation on Every Call**: The `didgen()` function in `crates/web-plugins/did-endpoint/src/didgen.rs` generates new cryptographic keys (Ed25519 and X25519) every time it is invoked.
2. **Unreliable Validation Trigger**: The plugin's `mount()` function in `crates/web-plugins/did-endpoint/src/plugin.rs` calls `didgen()` if `validate_diddoc()` fails.
3. **Transient Failure Handling**: The `validate_diddoc()` function can fail for reasons other than a missing DID document, such as transient network errors when communicating with the keystore or the repository. When this happens during application startup, a new DID document and new keys are generated, leading to new secrets being stored in AWS Secrets Manager.
## Proposed Solution
Modify the initialization logic in `crates/web-plugins/did-endpoint/src/plugin.rs` to only generate a new DID document if one does not already exist in the persistent storage (MongoDB).
Guía de contribución
No hay ninguna guía de contribución indexada para este repositorio
Evaluación
Este issue todavía no se ha evaluado.