Skip to content

fix: remove secrets from evault core #413

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
coodos merged 1 commit into from
Nov 12, 2025
Merged

fix: remove secrets from evault core #413

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 9 additions & 48 deletions infrastructure/evault-core/src/core/w3id/w3id.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,16 +1,11 @@
import { W3ID as W3IDClass, W3IDBuilder, hash } from "w3id";
import type { Driver } from "neo4j-driver";
import { W3IDBuilder, type W3ID as W3IDClass } from "w3id";
import { LogService } from "./log-service";
import { Driver } from "neo4j-driver";
import nacl from "tweetnacl";
import { createSigner } from "../utils/signer";
import { SecretsStore } from "../secrets/secrets-store";
import { uint8ArrayToHex } from "../utils/codec";

export class W3ID {
private static instance: W3IDClass;
private static secretsStore: SecretsStore;

private constructor() { }
private constructor() {}

static async get(options?: {
id: string;
Expand All @@ -20,50 +15,16 @@ export class W3ID {
if (W3ID.instance) return W3ID.instance;
if (!options)
throw new Error(
"No instance of W3ID exists yet, please create it by passing options"
"No instance of W3ID exists yet, please create it by passing options",
);

// Initialize secrets store if not already done
if (!W3ID.secretsStore) {
if (!options.password) {
throw new Error("Password is required for secrets store");
}
W3ID.secretsStore = new SecretsStore(
process.env.SECRETS_STORE_PATH!,
options.password
);
}

const repository = new LogService(options.driver);
const keyId = `w3id-${options.id}`;

try {
// Try to get existing seed
const { seed, nextKeyHash } = await W3ID.secretsStore.getSeed(keyId);
const keyPair = nacl.sign.keyPair.fromSeed(seed);
W3ID.instance = await new W3IDBuilder()
.withId(options.id)
.withRepository(repository)
.withGlobal(true)
.withSigner(createSigner(keyPair))
.withNextKeyHash(nextKeyHash)
.build();
} catch {
// If no seed exists, create new one
const keyPair = nacl.sign.keyPair();
const nextKeyPair = nacl.sign.keyPair();
const nextKeyHash = await hash(uint8ArrayToHex(nextKeyPair.publicKey));

// Store the seed
await W3ID.secretsStore.storeSeed(keyId, keyPair.secretKey, nextKeyHash);

W3ID.instance = await new W3IDBuilder()
.withId(options.id)
.withRepository(repository)
.withSigner(createSigner(keyPair))
.withNextKeyHash(nextKeyHash)
.build();
}
W3ID.instance = await new W3IDBuilder()
.withId(options.id)
.withRepository(repository)
.withGlobal(true)
.build();
Comment on lines 21 to +27

@coderabbitai coderabbitai Bot Nov 12, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

Remove unused repository or add signer.

The LogService repository is created and passed to the builder, but according to the W3IDBuilder.build() logic (see relevant code snippets), when no signer is provided, it returns new W3ID(id) and completely ignores the repository.

This means:

  1. The Neo4j storage is unnecessarily initialized
  2. The code is misleading, suggesting log functionality exists when it doesn't
  3. Resources are wasted

Either remove the repository creation entirely, or this indicates incomplete refactoring where the signer should still be provided.

Apply this diff if logs functionality is truly no longer needed:

-const repository = new LogService(options.driver);
-
 W3ID.instance = await new W3IDBuilder()
     .withId(options.id)
-    .withRepository(repository)
     .withGlobal(true)
     .build();

Run the following script to verify if any callers expect the W3ID instance to have logs functionality:

🏁 Script executed:

#!/bin/bash
# Description: Check if any code attempts to access logs or signing functionality on W3ID instances

# Search for access to logs property or signing methods on W3ID instances
rg -n --type=ts -C3 '\bW3ID\b.*\.(logs|sign|verify|signer)' 

# Search for IDLogManager usage that might depend on W3ID logs
rg -n --type=ts -C3 'IDLogManager'

# Check for any tests that verify signing/logging behavior
rg -n --type=ts -C3 'W3ID.*log|W3ID.*sign' -g '*test*' -g '*spec*'

Length of output: 8651


---

🏁 Script executed:

```shell
#!/bin/bash
# Find the exact file referenced in the review
fd -type f -name "w3id.ts" | grep -E "(evault-core|w3id)" | head -20

# Also search for files containing LogService
rg -l "LogService" --type=ts | head -10

Length of output: 315


---

🏁 Script executed:

```shell
#!/bin/bash
# View the specific file and lines mentioned in the review
echo "=== File: infrastructure/evault-core/src/core/w3id/w3id.ts ==="
cat infrastructure/evault-core/src/core/w3id/w3id.ts

echo ""
echo "=== Also check log-service.ts ==="
cat infrastructure/evault-core/src/core/w3id/log-service.ts

Length of output: 1909


---

🏁 Script executed:

```shell
#!/bin/bash
# Find package.json for evault-core
echo "=== package.json in evault-core ==="
cat infrastructure/evault-core/package.json | grep -A 50 '"dependencies"'

# Check if w3id is a local package reference
echo ""
echo "=== Check workspaces or monorepo setup ==="
cat package.json 2>/dev/null | head -40

Length of output: 2859

Remove unused repository creation.

The LogService repository is created and passed to W3IDBuilder, but since no signer is provided, the builder's build() method returns new W3ID(id) without the logs parameter. This means the repository is never used.

From infrastructure/w3id/src/w3id.ts (the actual W3IDBuilder implementation in this monorepo), when no signer is provided, the builder ignores the repository entirely. The code wastefully initializes Neo4j storage that will never be accessed.

Remove the unused repository creation:

-const repository = new LogService(options.driver);
-
 W3ID.instance = await new W3IDBuilder()
     .withId(options.id)
-    .withRepository(repository)
     .withGlobal(true)
     .build();

If logging functionality is needed, add .withSigner() to the builder chain.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
const repository = new LogService(options.driver);
const keyId = `w3id-${options.id}`;
try {
// Try to get existing seed
const { seed, nextKeyHash } = await W3ID.secretsStore.getSeed(keyId);
const keyPair = nacl.sign.keyPair.fromSeed(seed);
W3ID.instance = await new W3IDBuilder()
.withId(options.id)
.withRepository(repository)
.withGlobal(true)
.withSigner(createSigner(keyPair))
.withNextKeyHash(nextKeyHash)
.build();
} catch {
// If no seed exists, create new one
const keyPair = nacl.sign.keyPair();
const nextKeyPair = nacl.sign.keyPair();
const nextKeyHash = await hash(uint8ArrayToHex(nextKeyPair.publicKey));
// Store the seed
await W3ID.secretsStore.storeSeed(keyId, keyPair.secretKey, nextKeyHash);
W3ID.instance = await new W3IDBuilder()
.withId(options.id)
.withRepository(repository)
.withSigner(createSigner(keyPair))
.withNextKeyHash(nextKeyHash)
.build();
}
W3ID.instance = await new W3IDBuilder()
.withId(options.id)
.withRepository(repository)
.withGlobal(true)
.build();
W3ID.instance = await new W3IDBuilder()
.withId(options.id)
.withGlobal(true)
.build();
🤖 Prompt for AI Agents 
in infrastructure/evault-core/src/core/w3id/w3id.ts around lines 21 to 27, the
code instantiates LogService and passes it to W3IDBuilder but the builder
returns a plain W3ID when no signer is provided so the repository is never used;
remove the unused repository creation and the .withRepository(...) call (and any
related unused imports), or if you actually need logging functionality, supply a
signer by adding .withSigner(...) to the builder chain so the repository will be
consumed.


return W3ID.instance;
}
Expand Down