@calimero-network/mero-js 27.3.0 → 27.4.0

package/dist/index.mjs

@@ -1000,6 +1000,7 @@ var NODE_RELEASE_SIGNER = Object.freeze({
 });
 var MEASUREMENTS = ["mrtd", "rtmr0", "rtmr1", "rtmr2", "rtmr3"];
 var DEFAULT_RELEASE_MIRROR = "https://cloud.calimero.network";
+var DEFAULT_COLLATERAL_MIRROR = `${DEFAULT_RELEASE_MIRROR}/api/tee/pcs`;
 async function verifySignedNodeRelease(publishedMrtds, bundle, options = {}) {
   const body = typeof publishedMrtds === "string" ? new TextEncoder().encode(publishedMrtds) : publishedMrtds;
   await verifyCosignBundle(
@@ -1164,6 +1165,34 @@ async function releaseFor(version, policy, fetchImpl) {
   if (source === "github") return fetchGithubNodeRelease(version, { fetch: fetchImpl });
   return fetchNodeRelease(cloudNodeReleaseUrl(source ?? DEFAULT_RELEASE_MIRROR, version), { fetch: fetchImpl });
 }
+function defaultCollateral(policy) {
+  const source = policy.collateralSource ?? DEFAULT_COLLATERAL_MIRROR;
+  if (source === "intel") {
+    return async (quote) => (await dcap("getCollateralFromPcs"))(quote);
+  }
+  return async (quote) => (await dcap("getCollateral"))(source, quote);
+}
+function freshCollateral(fetch2, policy) {
+  const maxDays = policy.maxCollateralAgeDays;
+  if (maxDays === void 0) return fetch2;
+  return async (quote) => {
+    const collateral = await fetch2(quote);
+    let issued;
+    try {
+      issued = Date.parse(JSON.parse(collateral.tcb_info).issueDate ?? "");
+    } catch {
+      issued = Number.NaN;
+    }
+    if (!Number.isFinite(issued)) throw new Error("The quote's collateral names no TCB info issue date");
+    const ageDays = ((policy.now ?? Date.now)() - issued) / 864e5;
+    if (ageDays > maxDays) {
+      throw new Error(
+        `The quote's collateral was issued ${Math.floor(ageDays)} days ago, more than the ${maxDays} this client accepts`
+      );
+    }
+    return collateral;
+  };
+}
 async function verifyRelease(doc, args, policy, fetchImpl) {
   const version = claimedRelease(doc, policy.minReleaseVersion);
   const trusted = await trustSignedRelease({
@@ -1174,7 +1203,7 @@ async function verifyRelease(doc, args, policy, fetchImpl) {
     identity: policy.identity,
     issuer: policy.issuer
   });
-  const fetchCollateral = policy.fetchCollateral ?? (async (quote) => (await dcap("getCollateralFromPcs"))(quote));
+  const fetchCollateral = freshCollateral(policy.fetchCollateral ?? defaultCollateral(policy), policy);
   const verifier = createQuoteVerifier({
     dcapVerify: policy.dcapVerify ?? await dcap("verify"),
     fetchCollateral,
@@ -2869,6 +2898,7 @@ export {
   ConfirmCancelled,
   ConfirmRequired,
   ConsentStale,
+  DEFAULT_COLLATERAL_MIRROR,
   DEFAULT_ORG_CAPABILITIES,
   DEFAULT_RELEASE_MIRROR,
   GITHUB_RELEASES,
@@ -2909,6 +2939,7 @@ export {
   fetchAttestedKey,
   fetchGithubNodeRelease,
   fetchNodeRelease,
+  freshCollateral,
   fromB64url,
   generateOwnerKey,
   orgCapabilities,