@opentdf/sdk 0.1.0-beta.1718 → 0.2.0-beta.1941

package/tdf3/src/client/index.ts

@@ -1,51 +1,34 @@
 import { v4 } from 'uuid';
-import axios from 'axios';
 import {
   ZipReader,
-  fromBuffer,
-  fromDataSource,
   streamToBuffer,
-  isAppIdProviderCheck,
-  type Chunker,
   keyMiddleware as defaultKeyMiddleware,
 } from '../utils/index.js';
 import { base64 } from '../../../src/encodings/index.js';
 import {
   buildKeyAccess,
-  EncryptConfiguration,
+  type EncryptConfiguration,
   fetchKasPublicKey,
   loadTDFStream,
-  unwrapHtml,
   validatePolicyObject,
   readStream,
-  wrapHtml,
   writeStream,
 } from '../tdf.js';
+import { unwrapHtml } from '../utils/unwrap.js';
 import { OIDCRefreshTokenProvider } from '../../../src/auth/oidc-refreshtoken-provider.js';
 import { OIDCExternalJwtProvider } from '../../../src/auth/oidc-externaljwt-provider.js';
 import { CryptoService } from '../crypto/declarations.js';
-import {
-  type AuthProvider,
-  AppIdAuthProvider,
-  HttpRequest,
-  withHeaders,
-} from '../../../src/auth/auth.js';
-import EAS from '../../../src/auth/Eas.js';
-import {
-  cryptoPublicToPem,
-  pemToCryptoPublicKey,
-  rstrip,
-  validateSecureUrl,
-} from '../../../src/utils.js';
+import { type AuthProvider, HttpRequest, withHeaders } from '../../../src/auth/auth.js';
+import { pemToCryptoPublicKey, rstrip, validateSecureUrl } from '../../../src/utils.js';
 
 import {
-  EncryptParams,
-  DecryptParams,
+  type EncryptParams,
+  type DecryptParams,
   type Scope,
-  DecryptStreamMiddleware,
-  EncryptKeyMiddleware,
-  EncryptStreamMiddleware,
-  SplitStep,
+  type DecryptStreamMiddleware,
+  type EncryptKeyMiddleware,
+  type EncryptStreamMiddleware,
+  type SplitStep,
 } from './builders.js';
 import { DecoratedReadableStream } from './DecoratedReadableStream.js';
 
@@ -55,48 +38,51 @@ import {
   type DecryptSource,
   EncryptParamsBuilder,
 } from './builders.js';
-import { KasPublicKeyInfo, OriginAllowList } from '../../../src/access.js';
+import {
+  type KasPublicKeyInfo,
+  keyAlgorithmToPublicKeyAlgorithm,
+  OriginAllowList,
+} from '../../../src/access.js';
 import { ConfigurationError } from '../../../src/errors.js';
-import { EntityObject } from '../../../src/tdf/EntityObject.js';
 import { Binary } from '../binary.js';
 import { AesGcmCipher } from '../ciphers/aes-gcm-cipher.js';
 import { toCryptoKeyPair } from '../crypto/crypto-utils.js';
 import * as defaultCryptoService from '../crypto/index.js';
-import { type AttributeObject, AttributeSet, type Policy, SplitKey } from '../models/index.js';
+import {
+  type AttributeObject,
+  type KeyAccessType,
+  type Policy,
+  SplitKey,
+} from '../models/index.js';
 import { plan } from '../../../src/policy/granter.js';
 import { attributeFQNsAsValues } from '../../../src/policy/api.js';
 import { type Value } from '../../../src/policy/attributes.js';
+import { type Chunker, fromBuffer, fromSource } from '../../../src/seekable.js';
 
 const GLOBAL_BYTE_LIMIT = 64 * 1000 * 1000 * 1000; // 64 GB, see WS-9363.
-const HTML_BYTE_LIMIT = 100 * 1000 * 1000; // 100 MB, see WS-9476.
 
 // No default config for now. Delegate to Virtru wrapper for endpoints.
 const defaultClientConfig = { oidcOrigin: '', cryptoService: defaultCryptoService };
 
-export const uploadBinaryToS3 = async function (
-  stream: ReadableStream<Uint8Array>,
-  uploadUrl: string,
-  fileSize: number
-) {
-  try {
-    const body: Uint8Array = await streamToBuffer(stream);
-
-    await axios.put(uploadUrl, body, {
-      headers: {
-        'Content-Length': fileSize,
-        'content-type': 'application/zip',
-        'cache-control': 'no-store',
-      },
-      maxContentLength: Infinity,
-      maxBodyLength: Infinity,
-    });
-  } catch (e) {
-    console.error(e);
-    throw e;
-  }
-};
 const getFirstTwoBytes = async (chunker: Chunker) => new TextDecoder().decode(await chunker(0, 2));
 
+// Convert a PEM string to a CryptoKey
+export const resolveKasInfo = async (
+  pem: string,
+  uri: string,
+  kid?: string
+): Promise<KasPublicKeyInfo> => {
+  const k: CryptoKey = await pemToCryptoPublicKey(pem);
+  const algorithm = keyAlgorithmToPublicKeyAlgorithm(k.algorithm);
+  return {
+    key: Promise.resolve(k),
+    publicKey: pem,
+    url: uri,
+    algorithm,
+    kid: kid,
+  };
+};
+
 const makeChunkable = async (source: DecryptSource) => {
   if (!source) {
     throw new ConfigurationError('invalid source');
@@ -118,7 +104,7 @@ const makeChunkable = async (source: DecryptSource) => {
       initialChunker = source.location;
       break;
     default:
-      initialChunker = await fromDataSource(source);
+      initialChunker = await fromSource(source);
   }
 
   const magic: string = await getFirstTwoBytes(initialChunker);
@@ -135,7 +121,7 @@ const makeChunkable = async (source: DecryptSource) => {
 
 export interface ClientConfig {
   cryptoService?: CryptoService;
-  organizationName?: string;
+  /// oauth client id; used to generate oauth authProvider
   clientId?: string;
   dpopEnabled?: boolean;
   dpopKeys?: Promise<CryptoKeyPair>;
@@ -160,7 +146,7 @@ export interface ClientConfig {
   kasPublicKey?: string;
   oidcOrigin?: string;
   externalJwt?: string;
-  authProvider?: AuthProvider | AppIdAuthProvider;
+  authProvider?: AuthProvider;
   readerUrl?: string;
   entityObjectEndpoint?: string;
   fileStreamServiceWorker?: string;
@@ -179,7 +165,7 @@ export async function createSessionKeys({
   cryptoService,
   dpopKeys,
 }: {
-  authProvider?: AuthProvider | AppIdAuthProvider;
+  authProvider?: AuthProvider;
   cryptoService: CryptoService;
   dpopKeys?: Promise<CryptoKeyPair>;
 }): Promise<CryptoKeyPair> {
@@ -197,7 +183,7 @@ export async function createSessionKeys({
   // Note that we base64 encode the PEM string here as a quick workaround, simply because
   // a formatted raw PEM string isn't a valid header value and sending it raw makes keycloak's
   // header parser barf. There are more subtle ways to solve this, but this works for now.
-  if (authProvider && !isAppIdProviderCheck(authProvider)) {
+  if (authProvider) {
     await authProvider?.updateClientPublicKey(signingKeys);
   }
   return signingKeys;
@@ -253,13 +239,13 @@ export class Client {
    */
   readonly allowedKases: OriginAllowList;
 
-  readonly kasKeys: Record<string, Promise<KasPublicKeyInfo>> = {};
+  readonly kasKeys: Record<string, Promise<KasPublicKeyInfo>[]> = {};
 
   readonly easEndpoint?: string;
 
   readonly clientId?: string;
 
-  readonly authProvider?: AuthProvider | AppIdAuthProvider;
+  readonly authProvider?: AuthProvider;
 
   readonly readerUrl?: string;
 
@@ -270,8 +256,6 @@ export class Client {
    */
   readonly dpopKeys: Promise<CryptoKeyPair>;
 
-  readonly eas?: EAS;
-
   readonly dpopEnabled: boolean;
 
   readonly clientConfig: ClientConfig;
@@ -330,14 +314,6 @@ export class Client {
     this.authProvider = config.authProvider;
     this.clientConfig = clientConfig;
 
-    if (this.authProvider && isAppIdProviderCheck(this.authProvider)) {
-      this.eas = new EAS({
-        authProvider: this.authProvider,
-        endpoint:
-          clientConfig.entityObjectEndpoint ?? `${clientConfig.easEndpoint}/api/entityobject`,
-      });
-    }
-
     this.clientId = clientConfig.clientId;
     if (!this.authProvider) {
       if (!clientConfig.clientId) {
@@ -369,12 +345,9 @@ export class Client {
       dpopKeys: clientConfig.dpopKeys,
     });
     if (clientConfig.kasPublicKey) {
-      this.kasKeys[this.kasEndpoint] = Promise.resolve({
-        url: this.kasEndpoint,
-        algorithm: 'rsa:2048',
-        key: pemToCryptoPublicKey(clientConfig.kasPublicKey),
-        publicKey: clientConfig.kasPublicKey,
-      });
+      this.kasKeys[this.kasEndpoint] = [
+        resolveKasInfo(clientConfig.kasPublicKey, this.kasEndpoint),
+      ];
     }
   }
 
@@ -383,38 +356,39 @@ export class Client {
    *
    * @param scope dissem and attributes for constructing the policy
    * @param source source object of unencrypted data
-   * @param [asHtml] If we should wrap the TDF data in a self-opening HTML wrapper. Defaults to false
    * @param [autoconfigure] If we should use scope.attributes to configure KAOs
    * @param [metadata] Additional non-secret data to store with the TDF
    * @param [opts] Test only
    * @param [mimeType] mime type of source. defaults to `unknown`
-   * @param [offline] Where to store the policy. Defaults to `false` - which results in `upsert` events to store/update a policy
    * @param [windowSize] - segment size in bytes. Defaults to a a million bytes.
    * @param [keyMiddleware] - function that handle keys
    * @param [streamMiddleware] - function that handle stream
    * @param [eo] - (deprecated) entity object
    * @return a {@link https://nodejs.org/api/stream.html#stream_class_stream_readable|Readable} a new stream containing the TDF ciphertext
    */
-  async encrypt({
-    scope = { attributes: [], dissem: [] },
-    autoconfigure,
-    source,
-    asHtml = false,
-    metadata,
-    mimeType,
-    offline = false,
-    windowSize = DEFAULT_SEGMENT_SIZE,
-    eo,
-    keyMiddleware = defaultKeyMiddleware,
-    streamMiddleware = async (stream: DecoratedReadableStream) => stream,
-    splitPlan,
-    assertionConfigs = [],
-  }: EncryptParams): Promise<DecoratedReadableStream> {
+  async encrypt(opts: EncryptParams): Promise<DecoratedReadableStream> {
+    if (opts.offline === false) {
+      throw new ConfigurationError('online mode not supported');
+    }
+    if (opts.asHtml) {
+      throw new ConfigurationError('html mode not supported');
+    }
     const dpopKeys = await this.dpopKeys;
+    const {
+      autoconfigure,
+      metadata,
+      mimeType = 'unknown',
+      windowSize = DEFAULT_SEGMENT_SIZE,
+      keyMiddleware = defaultKeyMiddleware,
+      streamMiddleware = async (stream: DecoratedReadableStream) => stream,
+      wrappingKeyAlgorithm = 'rsa:2048',
+    } = opts;
+    const scope = opts.scope ?? { attributes: [], dissem: [] };
 
     const policyObject = asPolicy(scope);
     validatePolicyObject(policyObject);
 
+    let splitPlan = opts.splitPlan;
     if (!splitPlan && autoconfigure) {
       let avs: Value[] = scope.attributeValues ?? [];
       const fqns: string[] = scope.attributes
@@ -440,7 +414,7 @@ export class Client {
         }
       }
       if (
-        avs.length != scope.attributes?.length ||
+        avs.length != (scope.attributes?.length || 0) ||
         !avs.map(({ fqn }) => fqn).every((a) => fqns.indexOf(a) >= 0)
       ) {
         throw new ConfigurationError(
@@ -453,18 +427,9 @@ export class Client {
       splitPlan = detailedPlan.map((kat) => {
         const { kas, sid } = kat;
         if (kas?.publicKey?.cached?.keys && !(kas.uri in this.kasKeys)) {
-          const keys = kas.publicKey.cached.keys.filter(
-            ({ alg }) => alg == 'KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048'
-          );
+          const keys = kas.publicKey.cached.keys;
           if (keys?.length) {
-            const key = keys[0];
-            this.kasKeys[kas.uri] = Promise.resolve({
-              key: pemToCryptoPublicKey(key.pem),
-              publicKey: key.pem,
-              url: kas.uri,
-              algorithm: 'rsa:2048',
-              kid: key.kid,
-            });
+            this.kasKeys[kas.uri] = keys.map((key) => resolveKasInfo(key.pem, kas.uri, key.kid));
           }
         }
         return { kas: kas.uri, sid };
@@ -473,27 +438,40 @@ export class Client {
 
     // TODO: Refactor underlying builder to remove some of this unnecessary config.
 
-    const byteLimit = asHtml ? HTML_BYTE_LIMIT : GLOBAL_BYTE_LIMIT;
+    const maxByteLimit = GLOBAL_BYTE_LIMIT;
+    const byteLimit =
+      opts.byteLimit === undefined || opts.byteLimit <= 0 || opts.byteLimit > maxByteLimit
+        ? maxByteLimit
+        : opts.byteLimit;
     const encryptionInformation = new SplitKey(new AesGcmCipher(this.cryptoService));
-    let attributeSet: undefined | AttributeSet;
-    let entity: undefined | EntityObject;
-    if (eo) {
-      entity = eo;
-      const s = new AttributeSet();
-      eo.attributes.forEach((attr) => s.addJwtAttribute(attr));
-      attributeSet = s;
-    }
-
-    const splits: SplitStep[] = splitPlan?.length ? splitPlan : [{ kas: this.kasEndpoint }];
+    const splits: SplitStep[] = splitPlan?.length
+      ? splitPlan
+      : [{ kas: opts.defaultKASEndpoint ?? this.kasEndpoint }];
     encryptionInformation.keyAccess = await Promise.all(
       splits.map(async ({ kas, sid }) => {
         if (!(kas in this.kasKeys)) {
-          this.kasKeys[kas] = fetchKasPublicKey(kas);
+          this.kasKeys[kas] = [fetchKasPublicKey(kas, wrappingKeyAlgorithm)];
+        }
+        const kasPublicKey = await Promise.any(this.kasKeys[kas]);
+        if (kasPublicKey.algorithm !== wrappingKeyAlgorithm) {
+          console.warn(
+            `Mismatched wrapping key algorithm: [${kasPublicKey.algorithm}] is not requested type, [${wrappingKeyAlgorithm}]`
+          );
+        }
+        let type: KeyAccessType;
+        switch (kasPublicKey.algorithm) {
+          case 'rsa:2048':
+            type = 'wrapped';
+            break;
+          case 'ec:secp256r1':
+            type = 'ec-wrapped';
+            break;
+          default:
+            throw new ConfigurationError(`Unsupported algorithm ${kasPublicKey.algorithm}`);
         }
-        const kasPublicKey = await this.kasKeys[kas];
         return buildKeyAccess({
-          attributeSet,
-          type: offline ? 'wrapped' : 'remote',
+          alg: kasPublicKey.algorithm,
+          type,
           url: kasPublicKey.url,
           kid: kasPublicKey.kid,
           publicKey: kasPublicKey.publicKey,
@@ -505,43 +483,24 @@ export class Client {
     const { keyForEncryption, keyForManifest } = await (keyMiddleware as EncryptKeyMiddleware)();
     const ecfg: EncryptConfiguration = {
       allowList: this.allowedKases,
-      attributeSet,
       byteLimit,
       cryptoService: this.cryptoService,
       dpopKeys,
       encryptionInformation,
-      entity,
       segmentSizeDefault: windowSize,
       integrityAlgorithm: 'HS256',
       segmentIntegrityAlgorithm: 'GMAC',
-      contentStream: source,
+      contentStream: opts.source,
       mimeType,
       policy: policyObject,
       authProvider: this.authProvider,
       progressHandler: this.clientConfig.progressHandler,
       keyForEncryption,
       keyForManifest,
-      assertionConfigs,
+      assertionConfigs: opts.assertionConfigs,
     };
 
-    const stream = await (streamMiddleware as EncryptStreamMiddleware)(await writeStream(ecfg));
-
-    if (!asHtml) {
-      return stream;
-    }
-
-    // Wrap if it's html.
-    if (!stream.manifest) {
-      throw new Error('internal: missing manifest in encrypt function');
-    }
-    const htmlBuf = wrapHtml(await stream.toBuffer(), stream.manifest, this.readerUrl ?? '');
-
-    return new DecoratedReadableStream({
-      pull(controller: ReadableStreamDefaultController) {
-        controller.enqueue(htmlBuf);
-        controller.close();
-      },
-    });
+    return (streamMiddleware as EncryptStreamMiddleware)(await writeStream(ecfg));
   }
 
   /**
@@ -556,47 +515,40 @@ export class Client {
    * @see DecryptParamsBuilder
    */
   async decrypt({
-    eo,
     source,
+    allowList,
     keyMiddleware = async (key: Binary) => key,
     streamMiddleware = async (stream: DecoratedReadableStream) => stream,
     assertionVerificationKeys,
     noVerifyAssertions,
     concurrencyLimit = 1,
+    wrappingKeyAlgorithm,
   }: DecryptParams): Promise<DecoratedReadableStream> {
     const dpopKeys = await this.dpopKeys;
-    let entityObject;
-    if (this.eas || eo) {
-      const sessionPublicKey = await cryptoPublicToPem(dpopKeys.publicKey);
-      if (eo && eo.publicKey == sessionPublicKey) {
-        entityObject = eo;
-      } else if (this.eas) {
-        entityObject = await this.eas.fetchEntityObject({
-          publicKey: sessionPublicKey,
-        });
-      }
-    }
     if (!this.authProvider) {
       throw new ConfigurationError('AuthProvider missing');
     }
     const chunker = await makeChunkable(source);
+    if (!allowList) {
+      allowList = this.allowedKases;
+    }
 
     // Await in order to catch any errors from this call.
     // TODO: Write error event to stream and don't await.
     return await (streamMiddleware as DecryptStreamMiddleware)(
       await readStream({
-        allowList: this.allowedKases,
+        allowList,
         authProvider: this.authProvider,
         chunker,
         concurrencyLimit,
         cryptoService: this.cryptoService,
         dpopKeys,
-        entity: entityObject,
         fileStreamServiceWorker: this.clientConfig.fileStreamServiceWorker,
         keyMiddleware,
         progressHandler: this.clientConfig.progressHandler,
         assertionVerificationKeys,
         noVerifyAssertions,
+        wrappingKeyAlgorithm,
       })
     );
   }
@@ -628,12 +580,4 @@ export class Client {
 
 export type { AuthProvider };
 
-export {
-  AppIdAuthProvider,
-  DecryptParamsBuilder,
-  DecryptSource,
-  EncryptParamsBuilder,
-  HttpRequest,
-  fromDataSource,
-  withHeaders,
-};
+export { DecryptParamsBuilder, DecryptSource, EncryptParamsBuilder, HttpRequest, withHeaders };

package/tdf3/src/index.ts

@@ -1,4 +1,4 @@
 export * as Client from './client/index.js';
 export { Client as TDF3Client } from './client/index.js';
 export * as Errors from '../../src/errors.js';
-export { version, clientType } from './version.js';
+export { clientType, tdfSpecVersion, version } from '../../src/version.js';

package/tdf3/src/models/encryption-information.ts

@@ -78,7 +78,7 @@ export class SplitKey {
   }
 
   async getKeyAccessObjects(policy: Policy, keyInfo: KeyInfo): Promise<KeyAccessObject[]> {
-    const splitIds = [...new Set(this.keyAccess.map(({ sid }) => sid))].sort((a, b) =>
+    const splitIds = [...new Set(this.keyAccess.map(({ sid }) => sid))].sort((a = '', b = '') =>
       a.localeCompare(b)
     );
     const unwrappedKeySplitBuffers = await keySplit(
@@ -93,7 +93,7 @@ export class SplitKey {
     const keyAccessObjects = [];
     for (const item of this.keyAccess) {
       // use the key split to encrypt metadata for each key access object
-      const unwrappedKeySplitBuffer = splitsByName[item.sid];
+      const unwrappedKeySplitBuffer = splitsByName[item.sid || ''];
       const unwrappedKeySplitBinary = Binary.fromArrayBuffer(unwrappedKeySplitBuffer.buffer);
 
       const metadata = item.metadata || '';

package/tdf3/src/models/index.ts

@@ -4,5 +4,4 @@ export * from './key-access.js';
 export * from './manifest.js';
 export * from './payload.js';
 export * from './policy.js';
-export * from './upsert-response.js';
 export * from '../assertions.js';