diff --git a/config/default.js b/config/default.js index dc433ec..ee2ff16 100644 --- a/config/default.js +++ b/config/default.js @@ -38,6 +38,10 @@ module.exports = { name: process.env.SENDER_NAME, email: process.env.SENDER_EMAIL } + }, + + publicKey: { + purgeTimeInDays: process.env.PUBLIC_KEY_PURGE_TIME || 30 } }; diff --git a/src/service/public-key.js b/src/service/public-key.js index 74e5937..bb1115b 100644 --- a/src/service/public-key.js +++ b/src/service/public-key.js @@ -17,6 +17,7 @@ 'use strict'; +const config = require('config'); const util = require('./util'); const tpl = require('../email/templates.json'); @@ -66,6 +67,8 @@ class PublicKey { * @yield {undefined} */ async put({publicKeyArmored, primaryEmail, origin}) { + // lazily purge old/unverified keys on every key upload + await this._purgeOldUnverified(); // parse key block const key = this._pgp.parseKey(publicKeyArmored); // check for existing verfied key by id or email addresses @@ -79,6 +82,26 @@ class PublicKey { await this._sendVerifyEmail(key, primaryEmail, origin); } + /** + * Delete all keys where no user id has been verified after x days or where the + * 'uploaded' attribute is yet not available (to support legacy key documents). + * @yield {undefined} + */ + async _purgeOldUnverified() { + // create date in the past to compare with + const xDaysAgo = new Date(); + xDaysAgo.setDate(xDaysAgo.getDate() - config.publicKey.purgeTimeInDays); + // remove unverified keys older than x days (or no 'uploaded' attribute) + const query = { + 'userIds.verified': {$ne: true}, + $or: [ + {uploaded: {$exists: false}}, + {uploaded: {$lt: xDaysAgo}} + ] + }; + return this._mongo.remove(query, DB_TYPE); + } + /** * Persist the public key and its user ids in the database. * @param {Object} key public key parameters diff --git a/test/integration/public-key-test.js b/test/integration/public-key-test.js index 2d88ef4..3df4c07 100644 --- a/test/integration/public-key-test.js +++ b/test/integration/public-key-test.js @@ -104,6 +104,62 @@ describe('Public Key Integration Tests', function() { }); }); + describe('_purgeOldUnverified', () => { + let key; + + beforeEach(async () => { + key = pgp.parseKey(publicKeyArmored); + }); + + it('should work for no keys', async () => { + const r = await publicKey._purgeOldUnverified(); + expect(r.deletedCount).to.equal(0); + }); + + it('should not remove a current unverified key', async () => { + await publicKey._persisKey(key); + const r = await publicKey._purgeOldUnverified(); + expect(r.deletedCount).to.equal(0); + }); + + it('should not remove a current verified key', async () => { + key.userIds[0].verified = true; + await publicKey._persisKey(key); + const r = await publicKey._purgeOldUnverified(); + expect(r.deletedCount).to.equal(0); + }); + + it('should not remove an old verified key', async () => { + key.uploaded.setDate(key.uploaded.getDate() - 31); + key.userIds[0].verified = true; + await publicKey._persisKey(key); + const r = await publicKey._purgeOldUnverified(); + expect(r.deletedCount).to.equal(0); + }); + + it('should remove an old unverified key', async () => { + key.uploaded.setDate(key.uploaded.getDate() - 31); + await publicKey._persisKey(key); + const r = await publicKey._purgeOldUnverified(); + expect(r.deletedCount).to.equal(1); + }); + + it('should remove an unverified key with no uploaded attribute', async () => { + delete key.uploaded; + await publicKey._persisKey(key); + const r = await publicKey._purgeOldUnverified(); + expect(r.deletedCount).to.equal(1); + }); + + it('should not remove a verified key with no uploaded attribute', async () => { + key.userIds[0].verified = true; + delete key.uploaded; + await publicKey._persisKey(key); + const r = await publicKey._purgeOldUnverified(); + expect(r.deletedCount).to.equal(0); + }); + }); + describe('verify', () => { it('should update the document', async () => { await publicKey.put({publicKeyArmored, primaryEmail, origin});