adorsys / adorsys/didcomm-mediator-rs

Investigate excessive AWS Secrets Manager Secret Creation

Abierto
#445 0 comentarios 0 reacciones 1 asignado Reclamado por @Hermann-Core Ver en GitHub
Lenguaje dominante
Rust
Estrellas
13
Forks
1
Métricas de merge de PR
Sin PR fusionados en 30 d

Descripción

## Bug Description

A vast number of secrets are being created in AWS Secrets Manager, far exceeding the expected count for a single application instance.

## Suspected Culprit

In the DID generation and initialization logic within the `did-endpoint` plugin:

1. **Key Generation on Every Call**: The `didgen()` function in `crates/web-plugins/did-endpoint/src/didgen.rs` generates new cryptographic keys (Ed25519 and X25519) every time it is invoked.
2. **Unreliable Validation Trigger**: The plugin's `mount()` function in `crates/web-plugins/did-endpoint/src/plugin.rs` calls `didgen()` if `validate_diddoc()` fails.
3. **Transient Failure Handling**: The `validate_diddoc()` function can fail for reasons other than a missing DID document, such as transient network errors when communicating with the keystore or the repository. When this happens during application startup, a new DID document and new keys are generated, leading to new secrets being stored in AWS Secrets Manager.

## Proposed Solution

Modify the initialization logic in `crates/web-plugins/did-endpoint/src/plugin.rs` to only generate a new DID document if one does not already exist in the persistent storage (MongoDB).

Guía de contribución

No hay ninguna guía de contribución indexada para este repositorio

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.