@ethernity-cloud/sdk-js 1.1.1 → 1.4.0

package/nodenithy/build/securelock/src/securelock.js.tmpl

@@ -1,421 +1,444 @@
-require('dotenv').config();
-require('dotenv').config({path: './app/.env'});
-require('dotenv').config({path: '/app/.env'});
-
-const ethers = require('ethers');
-const fs = require("fs");
-const etny_crypto = require("./etny_crypto");
-const {DOReqMetadata, Order} = require("./models");
-const {getWalletAddress} = require("./wallet");
-const {executeTask} = require("./etny_exec");
-const {TaskStatus} = require("./task_status");
-const SwiftStreamService = require("./swift_stream_service");
-
-const contract_abi = require('./pox_abi');
-const image_registry_abi = require('./image_registry_abi');
-const {sha256} = require("./etny_crypto");
-
-class EtnySecureLock {
-    static debug = false;
-
-    constructor(swiftStreamClient) {
-        console.log('Initializing...');
-        this.version = 'v3';
-        this.swiftStreamService = swiftStreamClient;
-        this.etny_bucket = "__BUCKET_NAME__";
-        this.setInitializers();
-    }
-
-    setInitializers() {
-        this.is_valid_client_data = true;
-        this.key_file = "/private/__ENCLAVE_NAME_SECURELOCK__/key.pem";
-        this.cert_file = "/app/__ENCLAVE_NAME_SECURELOCK__/cert.pem";
-        this.pub_cert_file = "/app/__ENCLAVE_NAME_SECURELOCK__/enclave_pub_cert.pem";
-        this.payload = "payload.etny.securelock";
-        this.input = "input.txt.securelock";
-        this.result_file = "/app/result.txt";
-        this.transaction_file = "/app/transaction.txt";
-        this.smart_contract_address = "__SMART_CONTRACT_ADDRESS__";
-        this.image_registry_address = '__IMAGE_REGISTRY_ADDRESS__';
-        this.chain_id = __CHAIN_ID__;
-        this.web3_provider = "__RPC_URL__";
-        this.signed_tx_as_bytes = null;
-        this.client_challenge = "";
-
-        if (this.etny_mode === "TEST") {
-            this.key_file = "/private/key.pem";
-            this.cert_file = "/app/cert.pem";
-            this.payload = "./app/payload.js";
-            this.input = "./app/input.txt";
-            this.result_file = "./app/result.txt";
-            this.transaction_file = "./app/transaction.txt";
-            this.pub_cert_file = "./app/enclave_pub_cert.pem";
-        }
-
-        if (this.etny_mode === "LOCAL_TEST") {
-            this.key_file = "./certs/key.pem";
-            this.cert_file = "./certs/cert.pem";
-            this.payload = "./app/payload.js";
-            this.input = "./app/input.txt";
-            this.result_file = "./app/result.txt";
-            this.transaction_file = "./app/transaction.txt";
-            this.pub_cert_file = "./app/enclave_pub_cert.pem";
-        }
-    }
-
-    async create() {
-        //overriding default values with those read from .env file
-        this.loadEnv();
-        this.printEnv();
-        await this.savePublicCert();
-        this.initWeb3();
-        if (this.etny_mode === "PRODUCTION") {
-            this.resetPrivateCertFile();
-        }
-
-        return true;
-    }
-
-    loadEnv() {
-        if (process.env.ETNY_CHAIN_ID) {
-            this.chain_id = parseInt(process.env.ETNY_CHAIN_ID);
-        }
-
-        if (process.env.ETNY_SMART_CONTRACT_ADDRESS) {
-            this.smart_contract_address = process.env.ETNY_SMART_CONTRACT_ADDRESS.trim();
-        }
-
-        if (process.env.ETNY_WEB3_PROVIDER) {
-            this.web3_provider = process.env.ETNY_WEB3_PROVIDER.trim();
-        }
-
-        if (process.env.ETNY_CLIENT_CHALLENGE) {
-            this.client_challenge = process.env.ETNY_CLIENT_CHALLENGE.trim();
-        }
-        if (process.env.ETNY_ORDER_ID) {
-            this.order_id = parseInt(process.env.ETNY_ORDER_ID);
-        }
-    }
-
-    printEnv() {
-        console.log('CHAIN ID:', this.chain_id);
-        console.log('SMART CONTRACT ADDRESS:', this.smart_contract_address);
-        console.log('WEB3 PROVIDER:', this.web3_provider);
-        console.log('ENCRYPTED CHALLENGE:', this.client_challenge);
-        console.log('ORDER ID:', this.order_id);
-    }
-
-    initWeb3() {
-        // Create an ethers.js provider connected to the Bloxberg network
-        this.w3 = new ethers.providers.JsonRpcProvider(this.web3_provider);
-        // Create an instance of the contract using the ABI and address
-        this.etny = new ethers.Contract(this.smart_contract_address, contract_abi, this.w3);
-        this.image_registry = new ethers.Contract(this.image_registry_address, image_registry_abi, this.w3);
-        // this.iamge_registry_signer = new ethers.Contract(this.image_registry_address, image_registry_abi.abi, this.walletSigner);
-    }
-
-    async readEnv() {
-        try {
-            console.log('Getting .env if exists...');
-            const envFile = await this.swiftStreamService.getFileContent(this.etny_bucket, ".env");
-            console.log("Env:", envFile);
-            console.log("Saving .env file...");
-            await fs.promises.writeFile('.env', envFile);
-            require('dotenv').config();
-
-            this.version = 'v3';
-            this.etny_mode = process.env.ETNY_MODE;
-            console.log(`ETNY Nodenithy [${this.version}] - running in ${this.etny_mode} MODE`);
-            //console.log(process.env);
-
-            return true;
-        } catch (e) {
-            return false;
-        }
-    }
-
-    extractSigner(message, signature) {
-        try {
-            return ethers.utils.verifyMessage(message, signature);
-        } catch (e) {
-            console.log('extractSigner:', e)
-        }
-    }
-
-    async validateClientPayload(payload_data, input_data) {
-        await this.getDORequestMetadata();
-        if (this._metadata.payload_metadata_obj.checksum !== null) {
-            try {
-                const payload_checksum = sha256(payload_data);
-                //console.log('payload checksum: ', payload_checksum, "===", this._metadata.payload_metadata_obj.checksum);
-                // check the wallet address that signed payload checksum is the one from order metadata
-                const payload_signer = this.extractSigner(payload_checksum, this._metadata.payload_metadata_obj.checksum);
-                //console.log("payload_signer", payload_signer);
-                //console.log("this._order_metadata.do_owner.toLowerCase()", this._order_metadata.do_owner.toLowerCase());
-                if (payload_signer.toLowerCase() !== this._order_metadata.do_owner.toLowerCase()) {
-                    this.task_code = TaskStatus.PAYLOAD_CHECKSUM_ERROR;
-                    this.task_result = 'PAYLOAD CHECKSUM DOESN\'T MATCH';
-                    this.is_valid_client_data = false;
-                    return;
-                }
-            } catch (e) {
-                console.log(e);
-            }
-
-        }
-        if (this._metadata.input_metadata_obj.checksum !== null) {
-            try {
-                const input_checksum = sha256(input_data);
-                //console.log('input checksum: ', input_checksum, '===', this._metadata.input_metadata_obj.checksum);
-                // check the wallet address that signed input checksum is the one from order metadata
-                const input_signer = this.extractSigner(input_checksum, this._metadata.input_metadata_obj.checksum);
-                //console.log("input_signer", input_signer);
-                //console.log("this._order_metadata.do_owner.toLowerCase()", this._order_metadata.do_owner.toLowerCase());
-                if (input_signer.toLowerCase() !== this._order_metadata.do_owner.toLowerCase()) {
-                    this.task_code = TaskStatus.INPUT_CHECKSUM_ERROR;
-                    this.task_result = 'INPUT CHECKSUM DOESN\'T MATCH';
-                    this.is_valid_client_data = false;
-                }
-            } catch (e) {
-                console.log(e);
-            }
-        }
-    }
-
-    wait(timeout) {
-        return new Promise(resolve => {
-            setTimeout(resolve, timeout);
-        });
-    }
-
-    async waitForObjectInBucket(bucketName, objectName, timeout = 600) {
-        let i = 0;
-        console.log(`Checking if object ${objectName} exists in bucket ${bucketName}`);
-        while (true) {
-            await this.wait(1000);
-            i++;
-            if (i % 20 === 0)
-                console.log(`Checking if object ${objectName} exists in bucket ${bucketName}`);
-            if (i > timeout) {
-                break;
-            }
-            const [status, result] = await this.swiftStreamService.isObjectInBucket(bucketName, objectName);
-            if (result) {
-                break;
-            }
-        }
-
-        console.log('TrustedZone finished the execution');
-    }
-
-    async waitForPayloadAndInput() {
-        console.log('Waiting for payload and input');
-        await this.waitForObjectInBucket(this.etny_bucket, this.payload);
-        await this.waitForObjectInBucket(this.etny_bucket, this.input);
-    }
-
-    async getFileContentAndDecrypt(bucketName, objectName) {
-        try {
-            const encryptedBase64 = await this.swiftStreamService.getFileContent(bucketName, objectName);
-
-            const encryptedTuple = etny_crypto.encryptedDataFromBase64Json(encryptedBase64);
-            const decryptedResult = etny_crypto.decrypt(this.key_file, encryptedTuple);
-            return decryptedResult.toString();
-        } catch (e) {
-            console.log(`Failed to get ${objectName} file`);
-            return false;
-        }
-    }
-
-    async getTrustedZonePublicKey() {
-        try {
-            console.log('Getting the public key of the trusted zone enclave');
-            let imageHash = this._metadata.image_hash;
-            console.log('imageHash:', imageHash);
-            if (EtnySecureLock.debug) {
-                imageHash = 'v3-hash-1';
-            }
-            this.trustedZonePublicKey = await this.image_registry.getTrustedZoneImageCertPublicKey(imageHash);
-            console.log('Public key of the TrustedZone enclave from smart contract:', this.trustedZonePublicKey);
-        } catch (e) {
-            console.log('getTrustedZonePublicKey', e);
-        }
-    }
-
-    async getLatestTrustedZoneImageCertPublicKey() {
-        try {
-            console.log('Getting the public key of the trusted zone enclave');
-            this.trustedZonePublicKey = (await this.image_registry.getLatestTrustedZoneImageCertPublicKey("__TRUSTED_ZONE_IMAGE__", 'v3'))[1];
-            console.log('Public key of the TrustedZone enclave from smart contract:', this.trustedZonePublicKey);
-        } catch (e) {
-            console.log('getLatestTrustedZoneImageCertPublicKey', e);
-        }
-    }
-
-    async encryptFileAndPushToSwiftStream(fileData, fileName) {
-        try {
-            console.log(`Started saving file ${fileName}.securelock...`);
-            const encryptedInput = etny_crypto.encrypt(this.trustedZonePublicKey, fileData);
-            const encryptedInputBase64 = etny_crypto.encryptedDataToBase64Json(encryptedInput);
-
-            // File name should end with the '.securelock' extension
-            fileName += '.securelock';
-            // const data = Buffer.from(encryptedInputBase64, 'utf8');
-            const status = this.swiftStreamService.putFileContent(this.etny_bucket, fileName, '', encryptedInputBase64);
-            if (status) {
-                console.log(`File ${fileName} encrypted and saved to swift stream successfully`);
-            }
-        } catch (e) {
-            console.log('encryptFileAndPushToSwiftStream', e);
-        }
-    }
-
-    async getDORequestMetadata() {
-        const o_result = await this.etny.functions._getOrder(this.order_id);
-        const order = new Order(o_result, this.order_id);
-        //console.log('order', order);
-        this._order_metadata = order;
-        const o_metadata = await this.etny.functions._getDORequestMetadata(order.do_req);
-        this._metadata = new DOReqMetadata(o_metadata, order.do_req);
-        //console.log('metadata', this._metadata);
-    }
-
-    resetPrivateCertFile() {
-        //console.log('Resetting the cert file');
-        try {
-            // const fd = fs.openSync(this.private_key_file, 'w+');
-            fs.truncate(this.key_file, 0, function () {
-                //console.log('Private certificate file was cleaned.')
-            });
-            // fs.closeSync(fd);
-        } catch (e) {
-            //console.log('Error while removing the private key file content', e);
-        }
-        const content = fs.readFileSync(this.key_file, 'utf8');
-        //console.log('cert file content', content, '##################');
-    }
-
-    async savePublicCert() {
-        try {
-            const content = await fs.promises.readFile(this.cert_file, 'utf8');
-            await fs.promises.writeFile(this.pub_cert_file, content);
-            //console.log(`Public certificate saved to ${this.pub_cert_file}`);
-            console.log(`PUBLIC_KEY:`);
-            console.log(content);
-
-            await this.swiftStreamService.putFileContent(this.etny_bucket, 'cert.pem', this.pub_cert_file);
-        } catch (err) {
-            console.error(err);
-        }
-    }
-
-    async saveResult() {
-        try {
-            await this.getLatestTrustedZoneImageCertPublicKey();
-            await this.encryptFileAndPushToSwiftStream(this.task_result, 'result.txt');
-            await this.encryptFileAndPushToSwiftStream(this.task_code.toString(), 'result_code.txt');
-
-            const encrypted = etny_crypto.encryptWithPublicKey(this._metadata.public_key, this.task_result);
-            //console.log('Encrypted result:', encrypted.toString('hex'));
-            const result = await this.swiftStreamService.putFileContent(this.etny_bucket, 'result.txt', this.result_file, encrypted.toString('hex'));
-            //console.log('Save result put: ', result);
-        } catch (e) {
-            console.log('Save result: ', e);
-        }
-    }
-
-    async execute() {
-        const payload_data = await this.getFileContentAndDecrypt(this.etny_bucket, this.payload);
-        const input_data = await this.getFileContentAndDecrypt(this.etny_bucket, this.input);
-        console.log('Validating client payload and input...');
-        await this.validateClientPayload(payload_data, input_data);
-
-        if (this.is_valid_client_data) {
-            console.log('Client payload and input are valid');
-        } else {
-            console.log('Client payload and input are NOT valid');
-            return false;
-        }
-
-        const task_result = executeTask(payload_data, input_data);
-        console.log('TASK RESULT (code, data):', task_result);
-        this.task_code = task_result[0];
-        this.task_result = task_result[1];
-
-        return true;
-    }
-
-}
-
-function initSwiftStreamClient() {
-    console.log('Initializing SwiftStream Service...');
-    const swiftStreamClient = new SwiftStreamService(
-        EtnySecureLock.debug ? "localhost" : "etny-swift-stream",
-        9000,
-        "swiftstreamadmin",
-        "swiftstreamadmin");
-    console.log('SwiftStream Service started.');
-    console.log('################################');
-
-    return swiftStreamClient;
-}
-
-async function execute() {
-    console.log('########################################');
-    console.log('########################################');
-    console.log('########## [ETNY SecureLock] ##########');
-    console.log('########################################');
-    console.log('########################################');
-    console.log('');
-    console.log('');
-    console.log('');
-
-    const swiftStreamClient = initSwiftStreamClient();
-
-    const app = new EtnySecureLock(swiftStreamClient);
-
-    const hasReadEnvFile = await app.readEnv();
-    if (!hasReadEnvFile && !EtnySecureLock.debug) {
-        console.log(`Failed reading .env file.`);
-        await app.savePublicCert();
-        return;
-    }
-
-    if (process.env.ETNY_MODE === "PUBLIC_KEY") {
-        await app.savePublicCert();
-    } else {
-        console.log('Creating the application...');
-        const created = await app.create();
-
-        if (!created) {
-            console.log(`Failed at creation step, not able decoding input metadata, exiting.`);
-            return;
-        }
-
-        console.log('Waiting for payload and input to be downloaded...');
-        await app.waitForPayloadAndInput();
-
-        if (app.is_valid_client_data) {
-            console.log('Executing client code...');
-            const wasExecuted = await app.execute();
-            if (!wasExecuted) {
-                console.log('Failed execution of SecureLock enclave.')
-                return;
-            }
-        } else {
-            console.log(`Failed client payload and input validation, ${app.task_result}, exiting.`);
-            return;
-        }
-
-        await app.saveResult();
-        console.log('Finished process.');
-    }
-}
-
-(async () => {
-    try {
-        await execute();
-    } catch (e) {
-        console.log(e);
-    }
-})();
+// Force stdout/stderr to be synchronous (blocking). Under SCONE 6 + Node, when
+// the process exits quickly (e.g. the PUBLIC_KEY cert-harvest run, which prints
+// the cert then returns) Node's pipe-buffered stdout can be torn down before it
+// flushes, so the harvested "PUBLIC_KEY:" line is lost and the CI cannot read
+// the certificate. Setting the fd handles to blocking makes every console.log
+// write synchronously.
+try { if (process.stdout._handle && process.stdout._handle.setBlocking) process.stdout._handle.setBlocking(true); } catch (e) {}
+try { if (process.stderr._handle && process.stderr._handle.setBlocking) process.stderr._handle.setBlocking(true); } catch (e) {}
+
+require('dotenv').config();
+require('dotenv').config({path: './app/.env'});
+require('dotenv').config({path: '/app/.env'});
+
+const ethers = require('ethers');
+const fs = require("fs");
+const etny_crypto = require("./etny_crypto");
+const {DOReqMetadata, Order} = require("./models");
+const {getWalletAddress} = require("./wallet");
+const {executeTask} = require("./etny_exec");
+const {TaskStatus} = require("./task_status");
+const SwiftStreamService = require("./swift_stream_service");
+
+const contract_abi = require('./pox_abi');
+const image_registry_abi = require('./image_registry_abi');
+const {sha256} = require("./etny_crypto");
+const {generateCertFromMrEnclave} = require("./self_sign");
+
+// Baked per network by CI (render_network.sh): "mainnet" | "testnet". On testnet
+// the enclave self-signs its cert from MR_ENCLAVE (non-CAS mode); on mainnet the
+// cert/key are provisioned by CAS into the injection paths.
+const NETWORK_TYPE = "__ETNY_NETWORK_TYPE__";
+
+class EtnySecureLock {
+    static debug = false;
+
+    constructor(swiftStreamClient) {
+        console.log('Initializing...');
+        this.version = 'v3';
+        this.swiftStreamService = swiftStreamClient;
+        this.etny_bucket = "__ETNY_BUCKET__";
+        this.setInitializers();
+    }
+
+    setInitializers() {
+        this.is_valid_client_data = true;
+        this.key_file = "/private/__ENCLAVE_NAME_SECURELOCK__/key.pem";
+        this.cert_file = "/app/__ENCLAVE_NAME_SECURELOCK__/cert.pem";
+        this.pub_cert_file = "/app/__ENCLAVE_NAME_SECURELOCK__/enclave_pub_cert.pem";
+        this.payload = "payload.etny.securelock";
+        this.input = "input.txt.securelock";
+        this.result_file = "/app/result.txt";
+        this.transaction_file = "/app/transaction.txt";
+        this.smart_contract_address = "__ETNY_SMART_CONTRACT_ADDRESS__";
+        this.image_registry_address = '__ETNY_IMAGE_REGISTRY_ADDRESS__';
+        this.chain_id = __ETNY_CHAIN_ID__;
+        this.web3_provider = "__ETNY_WEB3_PROVIDER__";
+        this.signed_tx_as_bytes = null;
+        this.client_challenge = "";
+
+        if (this.etny_mode === "TEST") {
+            this.key_file = "/private/key.pem";
+            this.cert_file = "/app/cert.pem";
+            this.payload = "./app/payload.js";
+            this.input = "./app/input.txt";
+            this.result_file = "./app/result.txt";
+            this.transaction_file = "./app/transaction.txt";
+            this.pub_cert_file = "./app/enclave_pub_cert.pem";
+        }
+
+        if (this.etny_mode === "LOCAL_TEST") {
+            this.key_file = "./certs/key.pem";
+            this.cert_file = "./certs/cert.pem";
+            this.payload = "./app/payload.js";
+            this.input = "./app/input.txt";
+            this.result_file = "./app/result.txt";
+            this.transaction_file = "./app/transaction.txt";
+            this.pub_cert_file = "./app/enclave_pub_cert.pem";
+        }
+    }
+
+    async create() {
+        //overriding default values with those read from .env file
+        this.loadEnv();
+        this.printEnv();
+        await this.savePublicCert();
+        this.initWeb3();
+        if (this.etny_mode === "PRODUCTION") {
+            this.resetPrivateCertFile();
+        }
+
+        return true;
+    }
+
+    loadEnv() {
+        if (process.env.ETNY_CHAIN_ID) {
+            this.chain_id = parseInt(process.env.ETNY_CHAIN_ID);
+        }
+
+        if (process.env.ETNY_SMART_CONTRACT_ADDRESS) {
+            this.smart_contract_address = process.env.ETNY_SMART_CONTRACT_ADDRESS.trim();
+        }
+
+        if (process.env.ETNY_WEB3_PROVIDER) {
+            this.web3_provider = process.env.ETNY_WEB3_PROVIDER.trim();
+        }
+
+        if (process.env.IMAGE_REGISTRY_ADDRESS) {
+            this.image_registry_address = process.env.IMAGE_REGISTRY_ADDRESS.trim();
+        }
+
+        if (process.env.ETNY_BUCKET) {
+            this.etny_bucket = process.env.ETNY_BUCKET.trim();
+        }
+
+        if (process.env.ETNY_CLIENT_CHALLENGE) {
+            this.client_challenge = process.env.ETNY_CLIENT_CHALLENGE.trim();
+        }
+        if (process.env.ETNY_ORDER_ID) {
+            this.order_id = parseInt(process.env.ETNY_ORDER_ID);
+        }
+    }
+
+    printEnv() {
+        console.log('CHAIN ID:', this.chain_id);
+        console.log('SMART CONTRACT ADDRESS:', this.smart_contract_address);
+        console.log('WEB3 PROVIDER:', this.web3_provider);
+        console.log('ENCRYPTED CHALLENGE:', this.client_challenge);
+        console.log('ORDER ID:', this.order_id);
+    }
+
+    initWeb3() {
+        // Create an ethers.js provider connected to the Bloxberg network
+        this.w3 = new ethers.providers.JsonRpcProvider(this.web3_provider);
+        // Create an instance of the contract using the ABI and address
+        this.etny = new ethers.Contract(this.smart_contract_address, contract_abi, this.w3);
+        this.image_registry = new ethers.Contract(this.image_registry_address, image_registry_abi, this.w3);
+        // this.iamge_registry_signer = new ethers.Contract(this.image_registry_address, image_registry_abi.abi, this.walletSigner);
+    }
+
+    async readEnv() {
+        try {
+            console.log('Getting .env if exists...');
+            const envFile = await this.swiftStreamService.getFileContent(this.etny_bucket, ".env");
+            console.log("Env:", envFile);
+            console.log("Saving .env file...");
+            await fs.promises.writeFile('.env', envFile);
+            require('dotenv').config();
+
+            this.version = 'v3';
+            this.etny_mode = process.env.ETNY_MODE;
+            console.log(`ETNY Nodenithy [${this.version}] - running in ${this.etny_mode} MODE`);
+            //console.log(process.env);
+
+            return true;
+        } catch (e) {
+            return false;
+        }
+    }
+
+    // v4 checksum validation: the DO-request is submitted on-chain by the owner,
+    // so the metadata checksum is already authenticated by the transaction sender;
+    // we only confirm the file content hashes to that recorded checksum. Empty
+    // input carries no checksum (has_checksum === false) and is skipped. Kept
+    // identical across securelock / trustedzone / validator so all three agree.
+    async validateClientPayload(payload_data, input_data) {
+        await this.getDORequestMetadata();
+
+        const pmeta = this._metadata.payload_metadata_obj;
+        if (pmeta.has_checksum) {
+            const expected = pmeta.checksum.toLowerCase().replace(/^0x/, '');
+            if (sha256(payload_data) !== expected) {
+                this.task_code = TaskStatus.PAYLOAD_CHECKSUM_ERROR;
+                this.task_result = 'PAYLOAD CHECKSUM DOESN\'T MATCH';
+                this.is_valid_client_data = false;
+                return;
+            }
+        } else {
+            // payload is required and must carry a checksum
+            this.task_code = TaskStatus.PAYLOAD_CHECKSUM_ERROR;
+            this.task_result = 'PAYLOAD CHECKSUM DOESN\'T EXIST';
+            this.is_valid_client_data = false;
+            return;
+        }
+
+        const imeta = this._metadata.input_metadata_obj;
+        if (imeta.has_checksum) {
+            const expected = imeta.checksum.toLowerCase().replace(/^0x/, '');
+            if (sha256(input_data) !== expected) {
+                this.task_code = TaskStatus.INPUT_CHECKSUM_ERROR;
+                this.task_result = 'INPUT CHECKSUM DOESN\'T MATCH';
+                this.is_valid_client_data = false;
+            }
+        }
+    }
+
+    wait(timeout) {
+        return new Promise(resolve => {
+            setTimeout(resolve, timeout);
+        });
+    }
+
+    async waitForObjectInBucket(bucketName, objectName, timeout = 600) {
+        let i = 0;
+        console.log(`Checking if object ${objectName} exists in bucket ${bucketName}`);
+        while (true) {
+            await this.wait(1000);
+            i++;
+            if (i % 20 === 0)
+                console.log(`Checking if object ${objectName} exists in bucket ${bucketName}`);
+            if (i > timeout) {
+                break;
+            }
+            const [status, result] = await this.swiftStreamService.isObjectInBucket(bucketName, objectName);
+            if (result) {
+                break;
+            }
+        }
+
+        console.log('TrustedZone finished the execution');
+    }
+
+    async waitForPayloadAndInput() {
+        console.log('Waiting for payload and input');
+        await this.waitForObjectInBucket(this.etny_bucket, this.payload);
+        await this.waitForObjectInBucket(this.etny_bucket, this.input);
+    }
+
+    async getFileContentAndDecrypt(bucketName, objectName) {
+        try {
+            const encryptedBase64 = await this.swiftStreamService.getFileContent(bucketName, objectName);
+
+            const encryptedTuple = etny_crypto.encryptedDataFromBase64Json(encryptedBase64);
+            const decryptedResult = etny_crypto.decrypt(this.key_file, encryptedTuple);
+            return decryptedResult.toString();
+        } catch (e) {
+            console.log(`Failed to get ${objectName} file`);
+            return false;
+        }
+    }
+
+    async getTrustedZonePublicKey() {
+        try {
+            console.log('Getting the public key of the trusted zone enclave');
+            let imageHash = this._metadata.image_hash;
+            console.log('imageHash:', imageHash);
+            if (EtnySecureLock.debug) {
+                imageHash = 'v3-hash-1';
+            }
+            this.trustedZonePublicKey = await this.image_registry.getTrustedZoneImageCertPublicKey(imageHash);
+            console.log('Public key of the TrustedZone enclave from smart contract:', this.trustedZonePublicKey);
+        } catch (e) {
+            console.log('getTrustedZonePublicKey', e);
+        }
+    }
+
+    async encryptFileAndPushToSwiftStream(fileData, fileName) {
+        try {
+            console.log(`Started saving file ${fileName}.securelock...`);
+            const encryptedInput = etny_crypto.encrypt(this.trustedZonePublicKey, fileData);
+            const encryptedInputBase64 = etny_crypto.encryptedDataToBase64Json(encryptedInput);
+
+            // File name should end with the '.securelock' extension
+            fileName += '.securelock';
+            // const data = Buffer.from(encryptedInputBase64, 'utf8');
+            const status = this.swiftStreamService.putFileContent(this.etny_bucket, fileName, '', encryptedInputBase64);
+            if (status) {
+                console.log(`File ${fileName} encrypted and saved to swift stream successfully`);
+            }
+        } catch (e) {
+            console.log('encryptFileAndPushToSwiftStream', e);
+        }
+    }
+
+    async getDORequestMetadata() {
+        const o_result = await this.etny.functions._getOrder(this.order_id);
+        const order = new Order(o_result, this.order_id);
+        //console.log('order', order);
+        this._order_metadata = order;
+        const o_metadata = await this.etny.functions._getDORequestMetadata(order.do_req);
+        this._metadata = new DOReqMetadata(o_metadata, order.do_req);
+        //console.log('metadata', this._metadata);
+    }
+
+    resetPrivateCertFile() {
+        //console.log('Resetting the cert file');
+        try {
+            // const fd = fs.openSync(this.private_key_file, 'w+');
+            fs.truncate(this.key_file, 0, function () {
+                //console.log('Private certificate file was cleaned.')
+            });
+            // fs.closeSync(fd);
+        } catch (e) {
+            //console.log('Error while removing the private key file content', e);
+        }
+        const content = fs.readFileSync(this.key_file, 'utf8');
+        //console.log('cert file content', content, '##################');
+    }
+
+    // Testnet non-CAS mode: derive a deterministic self-signed cert/key from this
+    // enclave's MR_ENCLAVE and write them to the paths the rest of the code reads
+    // (key_file for decrypt, cert_file for savePublicCert). No-op on mainnet,
+    // where CAS injects the cert/key into those same paths. Idempotent: the key
+    // is a pure function of MR_ENCLAVE so it is identical across restarts.
+    generateSelfSignedCertIfTestnet() {
+        if (NETWORK_TYPE !== "testnet") return;
+        console.log("[SecureLock] TESTNET: self-signing certificate from MR_ENCLAVE (no CAS) [TESTNET-INSECURE]");
+        const {privateKeyPem, certPem, mrEnclaveHex} = generateCertFromMrEnclave("SecureLock Enclave");
+        console.log(`[SecureLock] MR_ENCLAVE: ${mrEnclaveHex}`);
+        for (const f of [this.key_file, this.cert_file, this.pub_cert_file]) {
+            try { fs.mkdirSync(require('path').dirname(f), {recursive: true}); } catch (e) {}
+        }
+        fs.writeFileSync(this.key_file, privateKeyPem);
+        fs.writeFileSync(this.cert_file, certPem);
+    }
+
+    async savePublicCert() {
+        try {
+            const content = await fs.promises.readFile(this.cert_file, 'utf8');
+            await fs.promises.writeFile(this.pub_cert_file, content);
+            //console.log(`Public certificate saved to ${this.pub_cert_file}`);
+            console.log(`PUBLIC_KEY:`);
+            console.log(content);
+
+            await this.swiftStreamService.putFileContent(this.etny_bucket, 'cert.pem', this.pub_cert_file);
+        } catch (err) {
+            console.error(err);
+        }
+    }
+
+    async saveResult() {
+        try {
+            await this.getTrustedZonePublicKey();
+            await this.encryptFileAndPushToSwiftStream(this.task_result, 'result.txt');
+            await this.encryptFileAndPushToSwiftStream(this.task_code.toString(), 'result_code.txt');
+
+            const encrypted = etny_crypto.encryptWithPublicKey(this._metadata.public_key, this.task_result);
+            //console.log('Encrypted result:', encrypted.toString('hex'));
+            const result = await this.swiftStreamService.putFileContent(this.etny_bucket, 'result.txt', this.result_file, encrypted.toString('hex'));
+            //console.log('Save result put: ', result);
+        } catch (e) {
+            console.log('Save result: ', e);
+        }
+    }
+
+    async execute() {
+        const payload_data = await this.getFileContentAndDecrypt(this.etny_bucket, this.payload);
+        const input_data = await this.getFileContentAndDecrypt(this.etny_bucket, this.input);
+        console.log('Validating client payload and input...');
+        await this.validateClientPayload(payload_data, input_data);
+
+        if (this.is_valid_client_data) {
+            console.log('Client payload and input are valid');
+        } else {
+            console.log('Client payload and input are NOT valid');
+            return false;
+        }
+
+        const task_result = executeTask(payload_data, input_data);
+        console.log('TASK RESULT (code, data):', task_result);
+        this.task_code = task_result[0];
+        this.task_result = task_result[1];
+
+        return true;
+    }
+
+}
+
+function initSwiftStreamClient() {
+    console.log('Initializing SwiftStream Service...');
+    const swiftStreamClient = new SwiftStreamService(
+        EtnySecureLock.debug ? "localhost" : "etny-swift-stream",
+        9000,
+        "swiftstreamadmin",
+        "swiftstreamadmin");
+    console.log('SwiftStream Service started.');
+    console.log('################################');
+
+    return swiftStreamClient;
+}
+
+async function execute() {
+    console.log('########################################');
+    console.log('########################################');
+    console.log('########## [ETNY SecureLock] ##########');
+    console.log('########################################');
+    console.log('########################################');
+    console.log('');
+    console.log('');
+    console.log('');
+
+    const swiftStreamClient = initSwiftStreamClient();
+
+    const app = new EtnySecureLock(swiftStreamClient);
+
+    // Testnet: materialize the self-signed cert/key from MR_ENCLAVE into the
+    // file paths before anything reads them (harvest + decrypt). No-op on mainnet
+    // (CAS provides those files).
+    app.generateSelfSignedCertIfTestnet();
+
+    const hasReadEnvFile = await app.readEnv();
+    if (!hasReadEnvFile && !EtnySecureLock.debug) {
+        console.log(`Failed reading .env file.`);
+        await app.savePublicCert();
+        return;
+    }
+
+    if (process.env.ETNY_MODE === "PUBLIC_KEY") {
+        await app.savePublicCert();
+    } else {
+        console.log('Creating the application...');
+        const created = await app.create();
+
+        if (!created) {
+            console.log(`Failed at creation step, not able decoding input metadata, exiting.`);
+            return;
+        }
+
+        console.log('Waiting for payload and input to be downloaded...');
+        await app.waitForPayloadAndInput();
+
+        if (app.is_valid_client_data) {
+            console.log('Executing client code...');
+            const wasExecuted = await app.execute();
+            if (!wasExecuted) {
+                console.log('Failed execution of SecureLock enclave.')
+                return;
+            }
+        } else {
+            console.log(`Failed client payload and input validation, ${app.task_result}, exiting.`);
+            return;
+        }
+
+        await app.saveResult();
+        console.log('Finished process.');
+    }
+}
+
+(async () => {
+    try {
+        await execute();
+    } catch (e) {
+        console.log(e);
+    }
+})();