digitalbazaar / digitalbazaar/ezcap
Validate `signer` instances passed into the `ZcapClient` constructor.
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 8
- Forks
- 4
- Avg merge
- 3h 5m
- Merged PRs (30d)
- 1
Description
https://github.com/digitalbazaar/ezcap/blob/main/lib/ZcapClient.js#L49-L60
It is currently possible the initialize a ZcapClient supplying signer APIs that are associated with a key that has no private key material associated with it. When this happens, one later discovers when calling a client API such as delegate that the signer is not capable of performing a signing operation.
If possible, it would be good to validate that the signers passed to the ZcapClient constructor are actually valid.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the ZcapClient constructor in lib/ZcapClient.js#L49-L60 and inspect the signer behavior referenced in Ed25519VerificationKey2020.js#L405. Determine how to recognize signer instances without private key material and add coverage for constructor validation; done means invalid signers fail during construction rather than later during delegate or another signing operation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- api, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100