@distrohelena/canton-typescript-sdk 0.1.20 → 0.1.22

package/node/start-local.sh

@@ -107,6 +107,14 @@ resolve_tls_enabled() {
   printf '%s\n' "$value"
 }
 
+localnet_http_scheme() {
+  if [[ "$(resolve_tls_enabled)" == "1" ]]; then
+    printf 'https\n'
+  else
+    printf 'http\n'
+  fi
+}
+
 resolve_tls_rotate() {
   local value="${LOCALNET_TLS_ROTATE:-0}"
   if [[ "$value" != "0" && "$value" != "1" ]]; then
@@ -136,6 +144,8 @@ prepare_tls_runtime_files() {
   local compose_file="$runtime_dir/compose-localnet.yaml"
   local tls_fragment_file="$runtime_dir/canton-tls.conf"
   local canton_config_file="$runtime_dir/canton-localnet.conf"
+  local onboarding_utils_source="$MODULES_DIR/splice-onboarding/docker/utils.sh"
+  local onboarding_utils_file="$runtime_dir/splice-onboarding-utils.sh"
   local supplied_count=0
 
   [[ -n "${LOCALNET_TLS_CERT_CHAIN_PATH:-}" ]] && ((supplied_count += 1))
@@ -180,6 +190,11 @@ prepare_tls_runtime_files() {
       openssl req -x509 -new -sha256 -days 3650 -key "$ca_key_path" \
         -subj "/CN=localnet-tls-ca" -out "$ca_certificate_path" >/dev/null 2>&1
     fi
+    if [[ -e "$server_certificate_path" ]] \
+      && ! openssl x509 -in "$server_certificate_path" -noout -ext subjectAltName 2>/dev/null \
+        | grep -Fq 'IP Address:127.0.0.1, IP Address:0.0.0.0'; then
+      rm -f "$server_key_path" "$server_certificate_path"
+    fi
     if [[ ! -e "$server_key_path" || ! -e "$server_certificate_path" ]]; then
       rm -f "$server_key_path" "$server_certificate_path"
       local csr_path="$runtime_dir/server.csr"
@@ -192,7 +207,7 @@ prepare_tls_runtime_files() {
 basicConstraints = CA:FALSE
 keyUsage = digitalSignature, keyEncipherment
 extendedKeyUsage = serverAuth
-subjectAltName = DNS:localhost, DNS:canton, IP:127.0.0.1
+subjectAltName = DNS:localhost, DNS:canton, IP:127.0.0.1, IP:0.0.0.0
 EOF
       openssl x509 -req -sha256 -days 3650 -in "$csr_path" \
         -CA "$ca_certificate_path" -CAkey "$ca_key_path" -CAcreateserial \
@@ -207,6 +222,15 @@ EOF
     fi
   fi
 
+  if [[ ! -r "$onboarding_utils_source" ]]; then
+    echo "Unable to read Splice onboarding utilities at $onboarding_utils_source." >&2
+    return 1
+  fi
+  sed \
+    -e 's#http://\$participant#${LOCALNET_HTTP_SCHEME:-http}://$participant#g' \
+    -e 's#http://\$validator#${LOCALNET_HTTP_SCHEME:-http}://$validator#g' \
+    "$onboarding_utils_source" > "$onboarding_utils_file"
+
   : > "$tls_fragment_file"
   local participant profile
   for participant in app-provider app-user sv; do
@@ -250,6 +274,13 @@ services:
     environment:
       - |
         ADDITIONAL_CONFIG_LOCALNET_TLS=
+  splice-onboarding:
+    volumes:
+      - "$ca_certificate_path:/app/localnet-tls/ca.crt:ro"
+      - "$onboarding_utils_file:/app/utils.sh:ro"
+    environment:
+      - LOCALNET_HTTP_SCHEME=https
+      - CURL_CA_BUNDLE=/app/localnet-tls/ca.crt
 EOF
   for participant in app-provider app-user sv; do
     case "$participant" in
@@ -813,7 +844,7 @@ EOF
     if [[ "$(resolve_tls_enabled)" == "1" ]]; then
       printf '      - "%s:/app/localnet-tls/ca.crt:ro"\n' "${LOCALNET_TLS_CA_CERT_PATH}"
     fi
-    cat <<'EOF'
+    cat <<EOF
     command:
       - pipeline
       - ledger
@@ -946,6 +977,7 @@ provision_extra_pqs() {
       -e EXTRA_PARTICIPANT_PARTY_HINT="extra_${index}_${PARTY_HINT_BASE}" \
       -e EXTRA_PQS_USER_NAME="${name}-pqs-user" \
       -e EXTRA_PQS_CONFIG_FILE="${name}-pqs.conf" \
+      -e LOCALNET_HTTP_SCHEME="$(localnet_http_scheme)" \
       splice-onboarding \
       bash -lc '
 set -euo pipefail
@@ -979,6 +1011,7 @@ grant_validator_read_as_any_party_right() {
     -e VALIDATOR_USER_NAME="$validator_user_name" \
     -e VALIDATOR_AUTH_AUDIENCE="$auth_audience" \
     -e PARTICIPANT_JSON_API_PORT="$participant_json_port" \
+    -e LOCALNET_HTTP_SCHEME="$(localnet_http_scheme)" \
     splice-onboarding \
     bash -lc '
 set -euo pipefail
@@ -995,7 +1028,7 @@ payload="$(cat <<EOF
 }
 EOF
 )"
-curl_check "http://$participant/v2/users/$VALIDATOR_USER_NAME/rights" "$validator_token" "application/json" \
+curl_check "${LOCALNET_HTTP_SCHEME:-http}://$participant/v2/users/$VALIDATOR_USER_NAME/rights" "$validator_token" "application/json" \
   --data-raw "$payload" >/dev/null
 '
 }
@@ -1009,6 +1042,7 @@ grant_user_read_as_any_party_right() {
     -e TARGET_USER_NAME="$user_name" \
     -e TARGET_AUTH_AUDIENCE="$auth_audience" \
     -e PARTICIPANT_JSON_API_PORT="$participant_json_port" \
+    -e LOCALNET_HTTP_SCHEME="$(localnet_http_scheme)" \
     splice-onboarding \
     bash -lc '
 set -euo pipefail
@@ -1025,7 +1059,7 @@ payload="$(cat <<EOF
 }
 EOF
 )"
-curl_check "http://$participant/v2/users/$TARGET_USER_NAME/rights" "$admin_token" "application/json" \
+curl_check "${LOCALNET_HTTP_SCHEME:-http}://$participant/v2/users/$TARGET_USER_NAME/rights" "$admin_token" "application/json" \
   --data-raw "$payload" >/dev/null
 '
 }

package/node/test-start-local.sh

@@ -6,6 +6,7 @@ SCRIPT_DIR="$REPO_ROOT/node"
 REPO_ENV_FILE="$REPO_ROOT/.env"
 
 tmpdir="$(mktemp -d)"
+real_docker="$(command -v docker || true)"
 root_env_backup="$tmpdir/root-env.backup"
 root_env_exists=0
 if [[ -f "$REPO_ENV_FILE" ]]; then
@@ -53,15 +54,49 @@ run_case() {
     "$generated_dir"
   ln -s "$quickstart_dir" "$quickstart_root_dir/quickstart"
   printf '%s\n' "$makefile_targets" > "$quickstart_dir/Makefile"
-  printf 'DOCKER_NETWORK=quickstart\nSPLICE_VERSION=0.6.5\n' > "$quickstart_dir/.env"
+  printf '%s\n' \
+    'DOCKER_NETWORK=quickstart' \
+    'SPLICE_VERSION=0.6.5' \
+    'SCRIBE_IMAGE=scribe' \
+    'SCRIBE_VERSION=test' \
+    'POSTGRES_VERSION=16' \
+    'DB_USER=test' \
+    'DB_PASSWORD=test' \
+    > "$quickstart_dir/.env"
+  cat > "$quickstart_dir/compose.yaml" <<'EOF'
+volumes:
+  onboarding:
+
+services:
+  postgres:
+    image: postgres:16
+  canton:
+    image: canton:test
+  splice:
+    image: splice:test
+  splice-onboarding:
+    image: onboarding:test
+  pqs-app-provider:
+    image: pqs:test
+  pqs-app-user:
+    image: pqs:test
+  pqs-sv:
+    image: pqs:test
+EOF
   printf 'AUTH_MODE=%s\n' "$auth_mode" > "$quickstart_dir/.env.local"
-  : > "$quickstart_dir/compose.yaml"
   : > "$quickstart_dir/docker/modules/localnet/compose.yaml"
   : > "$quickstart_dir/docker/modules/localnet/compose.env"
   : > "$quickstart_dir/docker/modules/localnet/env/common.env"
   : > "$quickstart_dir/docker/modules/pqs/compose.yaml"
   : > "$quickstart_dir/docker/modules/pqs/compose.env"
   : > "$quickstart_dir/docker/modules/splice-onboarding/compose.yaml"
+  printf '%s\n' \
+    'curl_check "http://$participant/v2/users"' \
+    'curl_check "http://$validator/api/validator/v0/scan-proxy/dso-party-id"' \
+    > "$quickstart_dir/docker/modules/splice-onboarding/docker-utils.sh"
+  mkdir -p "$quickstart_dir/docker/modules/splice-onboarding/docker"
+  mv "$quickstart_dir/docker/modules/splice-onboarding/docker-utils.sh" \
+    "$quickstart_dir/docker/modules/splice-onboarding/docker/utils.sh"
   : > "$quickstart_dir/docker/modules/keycloak/compose.yaml"
   : > "$quickstart_dir/docker/modules/keycloak/compose.env"
 
@@ -401,6 +436,30 @@ assert_file_contains "$tmpdir/generated/additional-config.extra-validators.conf"
 assert_file_contains "$tmpdir/generated/additional-config.extra-validators.conf" '  validator-party-hint = "${EXTRA_VALIDATOR_1_PARTY_HINT}"'
 assert_file_contains "$tmpdir/generated/additional-config.extra-validators.conf" '  domains.global.buy-extra-traffic {'
 assert_file_contains "$tmpdir/generated/additional-config.extra-validators.conf" 'canton.sv-apps.sv.expected-validator-onboardings += { secret = "${EXTRA_VALIDATOR_3_ONBOARDING_SECRET}" }'
+run_case $'.PHONY: start\nstart:\n' 'stub env AUTH_MODE=shared-secret' shared-secret default 2 '' '' 0 1
+assert_file_contains_text "$tmpdir/generated/additional-config.extra-participants.conf" 'canton.participants.extra-1.ledger-api.tls {'
+assert_file_contains_text "$tmpdir/generated/additional-config.extra-validators.conf" 'canton.validator-apps.extra-1-validator_backend.participant-client {'
+compose_config="$tmpdir/extra-tls-compose.config"
+if [[ -n "$real_docker" ]] && "$real_docker" compose version >/dev/null 2>&1; then
+  if ! "$real_docker" compose \
+  -f "$tmpdir/quickstart/compose.yaml" \
+  -f "$tmpdir/quickstart/docker/modules/localnet/compose.yaml" \
+  -f "$tmpdir/quickstart/docker/modules/splice-onboarding/compose.yaml" \
+  -f "$tmpdir/quickstart/docker/modules/pqs/compose.yaml" \
+  -f "$tmpdir/generated/compose-extra-participants.yaml" \
+  -f "$tmpdir/tls/compose-localnet.yaml" \
+  --env-file "$tmpdir/quickstart/.env" \
+  --env-file "$tmpdir/quickstart/.env.local" \
+  --env-file "$tmpdir/generated/extra-participants.env" \
+  config > "$compose_config" 2>&1; then
+    echo 'extra participants plus TLS did not produce valid merged Compose configuration' >&2
+    cat "$compose_config" >&2
+    exit 1
+  fi
+else
+  assert_file_contains_text "$tmpdir/generated/compose-extra-participants.yaml" '  postgres-pqs-extra-1:'
+  assert_file_contains_text "$tmpdir/generated/compose-extra-participants.yaml" '      postgres-pqs-extra-1:'
+fi
 run_case $'.PHONY: start-local-ledger\nstart-local-ledger:\n' 'stub docker compose -f compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/localnet/compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/splice-onboarding/compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/pqs/compose.yaml --env-file .env --env-file .env.local --env-file '"$tmpdir"'/quickstart/docker/modules/localnet/compose.env --env-file '"$tmpdir"'/quickstart/docker/modules/localnet/env/common.env --env-file '"$tmpdir"'/quickstart/docker/modules/pqs/compose.env --profile app-provider --profile pqs-app-provider --profile pqs-sv -f '"$tmpdir"'/tls/compose-localnet.yaml down -v --remove-orphans' shared-secret default 0 '' '' 0 1
 assert_file_contains_text "$tmpdir/tls/canton-tls.conf" 'canton.participants.app-provider.ledger-api.tls {'
 assert_file_contains_text "$tmpdir/tls/canton-tls.conf" 'canton.participants.app-provider.admin-api.tls {'
@@ -413,15 +472,26 @@ fi
 assert_file_contains_text "$tmpdir/tls/compose-localnet.yaml" '/app/localnet-tls/server.key:ro'
 assert_file_contains_text "$tmpdir/tls/compose-localnet.yaml" '/app/localnet-tls/ca.crt:ro'
 assert_file_contains_text "$tmpdir/tls/compose-localnet.yaml" 'ADDITIONAL_CONFIG_LOCALNET_TLS='
+assert_file_contains_text "$tmpdir/tls/compose-localnet.yaml" 'LOCALNET_HTTP_SCHEME=https'
+assert_file_contains_text "$tmpdir/tls/compose-localnet.yaml" 'CURL_CA_BUNDLE=/app/localnet-tls/ca.crt'
+assert_file_contains_text "$tmpdir/tls/compose-localnet.yaml" "$tmpdir/tls/splice-onboarding-utils.sh:/app/utils.sh:ro"
 assert_file_contains_text "$tmpdir/tls/compose-localnet.yaml" 'admin-api.tls.trust-collection-file = "/app/localnet-tls/ca.crt"'
 assert_file_contains_text "$tmpdir/tls/compose-localnet.yaml" 'ledger-api.client-config.tls.trust-collection-file = "/app/localnet-tls/ca.crt"'
 assert_file_contains_text "$tmpdir/tls/compose-localnet.yaml" 'SCRIBE_SOURCE_LEDGER_TLS_CAFILE: /app/localnet-tls/ca.crt'
+assert_file_contains_text "$tmpdir/tls/splice-onboarding-utils.sh" '${LOCALNET_HTTP_SCHEME:-http}://$participant/v2/users'
+assert_file_contains_text "$tmpdir/tls/splice-onboarding-utils.sh" '${LOCALNET_HTTP_SCHEME:-http}://$validator/api/validator/v0/scan-proxy/dso-party-id'
 if grep -Fq 'canton.validator-apps.app-user-validator_backend.participant-client' "$tmpdir/tls/compose-localnet.yaml"; then
   echo "unexpected client TLS configuration for inactive app-user participant" >&2
   exit 1
 fi
 assert_file_mode "$tmpdir/tls/server.key" 600
 assert_file_mode "$tmpdir/tls/ca.key" 600
+if ! openssl x509 -in "$tmpdir/tls/server.crt" -text -noout \
+  | grep -Fq 'IP Address:127.0.0.1, IP Address:0.0.0.0'; then
+  echo 'generated TLS certificate is missing the 0.0.0.0 subject alternative name' >&2
+  openssl x509 -in "$tmpdir/tls/server.crt" -text -noout >&2
+  exit 1
+fi
 run_case $'.PHONY: start\nstart:\n' 'stub docker compose -f compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/localnet/compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/splice-onboarding/compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/pqs/compose.yaml --env-file .env --env-file .env.local --env-file '"$tmpdir"'/quickstart/docker/modules/localnet/compose.env --env-file '"$tmpdir"'/quickstart/docker/modules/localnet/env/common.env --env-file '"$tmpdir"'/quickstart/docker/modules/pqs/compose.env --profile app-provider --profile pqs-app-provider --profile pqs-sv -f '"$tmpdir"'/generated/compose-extra-participants.yaml --env-file '"$tmpdir"'/generated/extra-participants.env -f '"$tmpdir"'/tls/compose-localnet.yaml down -v --remove-orphans' shared-secret default 2 '' '' 0 1
 assert_file_contains_text "$tmpdir/generated/additional-config.extra-participants.conf" 'canton.participants.extra-1.ledger-api.tls {'
 assert_file_contains_text "$tmpdir/generated/additional-config.extra-participants.conf" 'canton.participants.extra-2.admin-api.tls {'

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@distrohelena/canton-typescript-sdk",
-    "version": "0.1.20",
+    "version": "0.1.22",
     "license": "Apache-2.0",
     "type": "module",
     "main": "./dist/index.js",