Directory parser is too brittle on bad data

[jeredfloyd]

Problem: The 2022-06-07 VCI Directory snapshot is malformed (strings instead of numbers, see below) for a single Issuer entry. This causes the entire Directory load to fail despite these errors not being noted as fatal.

Desired Behavior: An issuer entry with data format errors should cause that Issuer to be omitted and the rest of the Directory to load normally.

Steps to reproduce:

import {verify, Directory} from 'smart-health-card-decoder'

// Attempt to retrieve the 2022-06-07 snapshot
const vciDirectory = await Directory.create('https://raw.githubusercontent.com/the-commons-project/vci-directory/4501e9cab45ebf82e15f8612f91196226e524859/l\
ogs/vci_snapshot.json');
if(vciDirectory.errors) {
    console.log("errors: " + JSON.stringify(vciDirectory.errors, null, 2));
}
console.log("directory size: " + vciDirectory.export().directory.length);

Output:

errors: [
  {
    "message": "optional key.crlVersion is not a number",
    "code": 146,
    "fatal": false,
    "level": 3,
    "label": "KEY:https://www.hss.gov.nt.ca/covax"
  },
  {
    "message": "CRL.ctr must be a positive integer greater than 0 (ctr === 1)",
    "code": 140,
    "fatal": false,
    "level": 3,
    "label": "CRL"
  }
]
directory size: 0

Expected Output: directory size: 89

Data error from 2022-06-07 load:

@@ -4742,7 +4742,7 @@
             "keys": [
                 {
                     "alg": "ES256",
-                    "crlVersion": 0,
+                    "crlVersion": "1",
                     "crv": "P-256",
                     "date": 1631112755371,
                     "kid": "8C-9TNgyGuOqc-3FXyNRq6m5U9S1wyhCS1TvpgjzkoU",
@@ -4752,7 +4752,15 @@
                     "y": "_qaENBMJz6iLf1qyYMx2_D6fXxbbNoHbLcfdPF9rUI0"
                 }
             ],
-            "lastRetrieved": "2022-05-03T04:43:55Z"
+            "crls": [
+                {
+                    "ctr": "1",
+                    "kid": "8C-9TNgyGuOqc-3FXyNRq6m5U9S1wyhCS1TvpgjzkoU",
+                    "method": "rid",
+                    "rids": []
+                }
+            ],
+            "lastRetrieved": "2022-06-07T04:41:42Z"
         },
         {
             "issuer": {

[ljoy913]

thanks. I'll take a look.

[ljoy913]

I updated this with PR #17 that should fix this. The default behavior is to now omit the invalid issuers and return an additional error showing that the issuer is being omitted.

The original idea was the 'maintained' Directories would employ their own validation and that failures were likely come from developers building smaller custom directories - so it made sense to fail the entire thing until the developer got it correct.

Thanks for the detailed issue submission.

[jeredfloyd]

Fantastic; thanks!