@distrohelena/canton-typescript-sdk 0.1.19 → 0.1.21

package/node/start-local.sh

@@ -107,6 +107,14 @@ resolve_tls_enabled() {
   printf '%s\n' "$value"
 }
 
+localnet_http_scheme() {
+  if [[ "$(resolve_tls_enabled)" == "1" ]]; then
+    printf 'https\n'
+  else
+    printf 'http\n'
+  fi
+}
+
 resolve_tls_rotate() {
   local value="${LOCALNET_TLS_ROTATE:-0}"
   if [[ "$value" != "0" && "$value" != "1" ]]; then
@@ -136,6 +144,8 @@ prepare_tls_runtime_files() {
   local compose_file="$runtime_dir/compose-localnet.yaml"
   local tls_fragment_file="$runtime_dir/canton-tls.conf"
   local canton_config_file="$runtime_dir/canton-localnet.conf"
+  local onboarding_utils_source="$MODULES_DIR/splice-onboarding/docker/utils.sh"
+  local onboarding_utils_file="$runtime_dir/splice-onboarding-utils.sh"
   local supplied_count=0
 
   [[ -n "${LOCALNET_TLS_CERT_CHAIN_PATH:-}" ]] && ((supplied_count += 1))
@@ -207,6 +217,15 @@ EOF
     fi
   fi
 
+  if [[ ! -r "$onboarding_utils_source" ]]; then
+    echo "Unable to read Splice onboarding utilities at $onboarding_utils_source." >&2
+    return 1
+  fi
+  sed \
+    -e 's#http://\$participant#${LOCALNET_HTTP_SCHEME:-http}://$participant#g' \
+    -e 's#http://\$validator#${LOCALNET_HTTP_SCHEME:-http}://$validator#g' \
+    "$onboarding_utils_source" > "$onboarding_utils_file"
+
   : > "$tls_fragment_file"
   local participant profile
   for participant in app-provider app-user sv; do
@@ -244,6 +263,69 @@ services:
       - "$server_certificate_path:/app/localnet-tls/server.crt:ro"
       - "$server_key_path:/app/localnet-tls/server.key:ro"
       - "$ca_certificate_path:/app/localnet-tls/ca.crt:ro"
+  splice:
+    volumes:
+      - "$ca_certificate_path:/app/localnet-tls/ca.crt:ro"
+    environment:
+      - |
+        ADDITIONAL_CONFIG_LOCALNET_TLS=
+  splice-onboarding:
+    volumes:
+      - "$ca_certificate_path:/app/localnet-tls/ca.crt:ro"
+      - "$onboarding_utils_file:/app/utils.sh:ro"
+    environment:
+      - LOCALNET_HTTP_SCHEME=https
+      - CURL_CA_BUNDLE=/app/localnet-tls/ca.crt
+EOF
+  for participant in app-provider app-user sv; do
+    case "$participant" in
+      app-provider) profile="$APP_PROVIDER_PROFILE" ;;
+      app-user) profile="$APP_USER_PROFILE" ;;
+      sv) profile="$SV_PROFILE" ;;
+    esac
+    if [[ "$profile" == "off" ]]; then
+      continue
+    fi
+    if [[ "$participant" == "sv" ]]; then
+      cat >> "$compose_file" <<'EOF'
+          canton.validator-apps.sv-validator_backend.participant-client {
+            admin-api.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
+            ledger-api.client-config.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
+          }
+          canton.scan-apps.scan-app.participant-client {
+            admin-api.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
+            ledger-api.client-config.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
+          }
+          canton.sv-apps.sv.participant-client {
+            admin-api.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
+            ledger-api.client-config.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
+          }
+EOF
+    else
+      cat >> "$compose_file" <<EOF
+          canton.validator-apps.${participant}-validator_backend.participant-client {
+            admin-api.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
+            ledger-api.client-config.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
+          }
+EOF
+    fi
+  done
+  cat >> "$compose_file" <<EOF
+  pqs-app-provider:
+    environment:
+      SCRIBE_SOURCE_LEDGER_TLS_CAFILE: /app/localnet-tls/ca.crt
+    volumes:
+      - "$ca_certificate_path:/app/localnet-tls/ca.crt:ro"
+  pqs-app-user:
+    environment:
+      SCRIBE_SOURCE_LEDGER_TLS_CAFILE: /app/localnet-tls/ca.crt
+    volumes:
+      - "$ca_certificate_path:/app/localnet-tls/ca.crt:ro"
+  pqs-sv:
+    environment:
+      SCRIBE_SOURCE_LEDGER_TLS_CAFILE: /app/localnet-tls/ca.crt
+    volumes:
+      - "$ca_certificate_path:/app/localnet-tls/ca.crt:ro"
 EOF
   export LOCALNET_TLS_COMPOSE_FILE="$compose_file"
   export LOCALNET_TLS_FRAGMENT_FILE="$tls_fragment_file"
@@ -642,6 +724,19 @@ EOF
     done
   } > "$splice_config_file"
 
+  if [[ "$(resolve_tls_enabled)" == "1" ]]; then
+    local index
+    for ((index = 1; index <= count; index++)); do
+      cat >> "$splice_config_file" <<EOF
+canton.validator-apps.extra-${index}-validator_backend.participant-client {
+  admin-api.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
+  ledger-api.client-config.tls.trust-collection-file = "/app/localnet-tls/ca.crt"
+}
+
+EOF
+    done
+  fi
+
   {
     cat <<'EOF'
 volumes:
@@ -731,8 +826,20 @@ EOF
       SCRIBE_TARGET_POSTGRES_USERNAME: \${DB_USER}
       SCRIBE_TARGET_POSTGRES_PASSWORD: \${DB_PASSWORD}
       SCRIBE_CONFIG: /onboarding/extra-${index}-pqs.conf
+EOF
+    if [[ "$(resolve_tls_enabled)" == "1" ]]; then
+      cat <<'EOF'
+      SCRIBE_SOURCE_LEDGER_TLS_CAFILE: /app/localnet-tls/ca.crt
+EOF
+    fi
+    cat <<EOF
     volumes:
       - onboarding:/onboarding
+EOF
+    if [[ "$(resolve_tls_enabled)" == "1" ]]; then
+      printf '      - "%s:/app/localnet-tls/ca.crt:ro"\n' "${LOCALNET_TLS_CA_CERT_PATH}"
+    fi
+    cat <<'EOF'
     command:
       - pipeline
       - ledger
@@ -865,6 +972,7 @@ provision_extra_pqs() {
       -e EXTRA_PARTICIPANT_PARTY_HINT="extra_${index}_${PARTY_HINT_BASE}" \
       -e EXTRA_PQS_USER_NAME="${name}-pqs-user" \
       -e EXTRA_PQS_CONFIG_FILE="${name}-pqs.conf" \
+      -e LOCALNET_HTTP_SCHEME="$(localnet_http_scheme)" \
       splice-onboarding \
       bash -lc '
 set -euo pipefail
@@ -898,6 +1006,7 @@ grant_validator_read_as_any_party_right() {
     -e VALIDATOR_USER_NAME="$validator_user_name" \
     -e VALIDATOR_AUTH_AUDIENCE="$auth_audience" \
     -e PARTICIPANT_JSON_API_PORT="$participant_json_port" \
+    -e LOCALNET_HTTP_SCHEME="$(localnet_http_scheme)" \
     splice-onboarding \
     bash -lc '
 set -euo pipefail
@@ -914,7 +1023,7 @@ payload="$(cat <<EOF
 }
 EOF
 )"
-curl_check "http://$participant/v2/users/$VALIDATOR_USER_NAME/rights" "$validator_token" "application/json" \
+curl_check "${LOCALNET_HTTP_SCHEME:-http}://$participant/v2/users/$VALIDATOR_USER_NAME/rights" "$validator_token" "application/json" \
   --data-raw "$payload" >/dev/null
 '
 }
@@ -928,6 +1037,7 @@ grant_user_read_as_any_party_right() {
     -e TARGET_USER_NAME="$user_name" \
     -e TARGET_AUTH_AUDIENCE="$auth_audience" \
     -e PARTICIPANT_JSON_API_PORT="$participant_json_port" \
+    -e LOCALNET_HTTP_SCHEME="$(localnet_http_scheme)" \
     splice-onboarding \
     bash -lc '
 set -euo pipefail
@@ -944,7 +1054,7 @@ payload="$(cat <<EOF
 }
 EOF
 )"
-curl_check "http://$participant/v2/users/$TARGET_USER_NAME/rights" "$admin_token" "application/json" \
+curl_check "${LOCALNET_HTTP_SCHEME:-http}://$participant/v2/users/$TARGET_USER_NAME/rights" "$admin_token" "application/json" \
   --data-raw "$payload" >/dev/null
 '
 }

package/node/test-start-local.sh

@@ -62,6 +62,13 @@ run_case() {
   : > "$quickstart_dir/docker/modules/pqs/compose.yaml"
   : > "$quickstart_dir/docker/modules/pqs/compose.env"
   : > "$quickstart_dir/docker/modules/splice-onboarding/compose.yaml"
+  printf '%s\n' \
+    'curl_check "http://$participant/v2/users"' \
+    'curl_check "http://$validator/api/validator/v0/scan-proxy/dso-party-id"' \
+    > "$quickstart_dir/docker/modules/splice-onboarding/docker-utils.sh"
+  mkdir -p "$quickstart_dir/docker/modules/splice-onboarding/docker"
+  mv "$quickstart_dir/docker/modules/splice-onboarding/docker-utils.sh" \
+    "$quickstart_dir/docker/modules/splice-onboarding/docker/utils.sh"
   : > "$quickstart_dir/docker/modules/keycloak/compose.yaml"
   : > "$quickstart_dir/docker/modules/keycloak/compose.env"
 
@@ -412,11 +419,27 @@ if grep -Fq 'canton.participants.app-user.ledger-api.tls {' "$tmpdir/tls/canton-
 fi
 assert_file_contains_text "$tmpdir/tls/compose-localnet.yaml" '/app/localnet-tls/server.key:ro'
 assert_file_contains_text "$tmpdir/tls/compose-localnet.yaml" '/app/localnet-tls/ca.crt:ro'
+assert_file_contains_text "$tmpdir/tls/compose-localnet.yaml" 'ADDITIONAL_CONFIG_LOCALNET_TLS='
+assert_file_contains_text "$tmpdir/tls/compose-localnet.yaml" 'LOCALNET_HTTP_SCHEME=https'
+assert_file_contains_text "$tmpdir/tls/compose-localnet.yaml" 'CURL_CA_BUNDLE=/app/localnet-tls/ca.crt'
+assert_file_contains_text "$tmpdir/tls/compose-localnet.yaml" "$tmpdir/tls/splice-onboarding-utils.sh:/app/utils.sh:ro"
+assert_file_contains_text "$tmpdir/tls/compose-localnet.yaml" 'admin-api.tls.trust-collection-file = "/app/localnet-tls/ca.crt"'
+assert_file_contains_text "$tmpdir/tls/compose-localnet.yaml" 'ledger-api.client-config.tls.trust-collection-file = "/app/localnet-tls/ca.crt"'
+assert_file_contains_text "$tmpdir/tls/compose-localnet.yaml" 'SCRIBE_SOURCE_LEDGER_TLS_CAFILE: /app/localnet-tls/ca.crt'
+assert_file_contains_text "$tmpdir/tls/splice-onboarding-utils.sh" '${LOCALNET_HTTP_SCHEME:-http}://$participant/v2/users'
+assert_file_contains_text "$tmpdir/tls/splice-onboarding-utils.sh" '${LOCALNET_HTTP_SCHEME:-http}://$validator/api/validator/v0/scan-proxy/dso-party-id'
+if grep -Fq 'canton.validator-apps.app-user-validator_backend.participant-client' "$tmpdir/tls/compose-localnet.yaml"; then
+  echo "unexpected client TLS configuration for inactive app-user participant" >&2
+  exit 1
+fi
 assert_file_mode "$tmpdir/tls/server.key" 600
 assert_file_mode "$tmpdir/tls/ca.key" 600
 run_case $'.PHONY: start\nstart:\n' 'stub docker compose -f compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/localnet/compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/splice-onboarding/compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/pqs/compose.yaml --env-file .env --env-file .env.local --env-file '"$tmpdir"'/quickstart/docker/modules/localnet/compose.env --env-file '"$tmpdir"'/quickstart/docker/modules/localnet/env/common.env --env-file '"$tmpdir"'/quickstart/docker/modules/pqs/compose.env --profile app-provider --profile pqs-app-provider --profile pqs-sv -f '"$tmpdir"'/generated/compose-extra-participants.yaml --env-file '"$tmpdir"'/generated/extra-participants.env -f '"$tmpdir"'/tls/compose-localnet.yaml down -v --remove-orphans' shared-secret default 2 '' '' 0 1
 assert_file_contains_text "$tmpdir/generated/additional-config.extra-participants.conf" 'canton.participants.extra-1.ledger-api.tls {'
 assert_file_contains_text "$tmpdir/generated/additional-config.extra-participants.conf" 'canton.participants.extra-2.admin-api.tls {'
+assert_file_contains_text "$tmpdir/generated/additional-config.extra-validators.conf" 'canton.validator-apps.extra-1-validator_backend.participant-client {'
+assert_file_contains_text "$tmpdir/generated/additional-config.extra-validators.conf" 'admin-api.tls.trust-collection-file = "/app/localnet-tls/ca.crt"'
+assert_file_contains_text "$tmpdir/generated/compose-extra-participants.yaml" 'SCRIBE_SOURCE_LEDGER_TLS_CAFILE: /app/localnet-tls/ca.crt'
 
 mkdir -p "$tmpdir/supplied"
 openssl genrsa -out "$tmpdir/supplied/ca.key" 2048 >/dev/null 2>&1

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@distrohelena/canton-typescript-sdk",
-    "version": "0.1.19",
+    "version": "0.1.21",
     "license": "Apache-2.0",
     "type": "module",
     "main": "./dist/index.js",