@opentdf/sdk 0.4.0-beta.4 → 0.4.0-beta.41

package/src/auth/oidc.ts

@@ -12,6 +12,8 @@ export type CommonCredentials = {
   clientId: string;
   /** The endpoint of the OIDC IdP to authenticate against, ex. 'https://virtru.com/auth' */
   oidcOrigin: string;
+  oidcTokenEndpoint?: string;
+  oidcUserInfoEndpoint?: string;
   /** Whether or not DPoP is enabled. */
   dpopEnabled?: boolean;
 
@@ -89,6 +91,8 @@ export class AccessToken {
   data?: AccessTokenResponse;
 
   baseUrl: string;
+  tokenEndpoint: string;
+  userInfoEndpoint: string;
 
   signingKey?: CryptoKeyPair;
 
@@ -119,6 +123,9 @@ export class AccessToken {
     this.config = cfg;
     this.request = request;
     this.baseUrl = rstrip(cfg.oidcOrigin, '/');
+    this.tokenEndpoint = cfg.oidcTokenEndpoint || `${this.baseUrl}/protocol/openid-connect/token`;
+    this.userInfoEndpoint =
+      cfg.oidcUserInfoEndpoint || `${this.baseUrl}/protocol/openid-connect/userinfo`;
     this.signingKey = cfg.signingKey;
   }
 
@@ -128,21 +135,20 @@ export class AccessToken {
    * @returns
    */
   async info(accessToken: string): Promise<unknown> {
-    const url = `${this.baseUrl}/protocol/openid-connect/userinfo`;
     const headers = {
       ...this.extraHeaders,
       Authorization: `Bearer ${accessToken}`,
     } as Record<string, string>;
     if (this.config.dpopEnabled && this.signingKey) {
-      headers.DPoP = await dpopFn(this.signingKey, url, 'POST');
+      headers.DPoP = await dpopFn(this.signingKey, this.userInfoEndpoint, 'POST');
     }
-    const response = await (this.request || fetch)(url, {
+    const response = await (this.request || fetch)(this.userInfoEndpoint, {
       headers,
     });
     if (!response.ok) {
       console.error(await response.text());
       throw new TdfError(
-        `auth info fail: GET [${url}] => ${response.status} ${response.statusText}`
+        `auth info fail: GET [${this.userInfoEndpoint}] => ${response.status} ${response.statusText}`
       );
     }
 
@@ -171,7 +177,6 @@ export class AccessToken {
   }
 
   async accessTokenLookup(cfg: OIDCCredentials) {
-    const url = `${this.baseUrl}/protocol/openid-connect/token`;
     let body;
     switch (cfg.exchange) {
       case 'client':
@@ -198,11 +203,11 @@ export class AccessToken {
         };
         break;
     }
-    const response = await this.doPost(url, body);
+    const response = await this.doPost(this.tokenEndpoint, body);
     if (!response.ok) {
       console.error(await response.text());
       throw new TdfError(
-        `token/code exchange fail: POST [${url}] => ${response.status} ${response.statusText}`
+        `token/code exchange fail: POST [${this.tokenEndpoint}] => ${response.status} ${response.statusText}`
       );
     }
     return response.json();

package/src/auth/providers.ts

@@ -36,6 +36,8 @@ export const clientSecretAuthProvider = async (
     clientId: clientConfig.clientId,
     clientSecret: clientConfig.clientSecret,
     oidcOrigin: clientConfig.oidcOrigin,
+    oidcTokenEndpoint: clientConfig.oidcTokenEndpoint,
+    oidcUserInfoEndpoint: clientConfig.oidcUserInfoEndpoint,
   });
 };
 
@@ -62,6 +64,8 @@ export const externalAuthProvider = async (
     clientId: clientConfig.clientId,
     externalJwt: clientConfig.externalJwt,
     oidcOrigin: clientConfig.oidcOrigin,
+    oidcTokenEndpoint: clientConfig.oidcTokenEndpoint,
+    oidcUserInfoEndpoint: clientConfig.oidcUserInfoEndpoint,
   });
 };
 
@@ -86,6 +90,8 @@ export const refreshAuthProvider = async (
     clientId: clientConfig.clientId,
     refreshToken: clientConfig.refreshToken,
     oidcOrigin: clientConfig.oidcOrigin,
+    oidcTokenEndpoint: clientConfig.oidcTokenEndpoint,
+    oidcUserInfoEndpoint: clientConfig.oidcUserInfoEndpoint,
   });
 };
 

package/src/index.ts

@@ -2,6 +2,7 @@ export { type AuthProvider, type HttpMethod, HttpRequest, withHeaders } from './
 export * as AuthProviders from './auth/providers.js';
 export { attributeFQNsAsValues } from './policy/api.js';
 export { version, clientType, tdfSpecVersion } from './version.js';
+export { PlatformClient, type PlatformClientOptions, type PlatformServices } from './platform.js';
 export * from './opentdf.js';
 export * from './seekable.js';
 export * from '../tdf3/src/models/index.js';

package/src/nanoclients.ts

@@ -46,7 +46,7 @@ export class NanoTDFClient extends Client {
     const kasUrl = nanotdf.header.getKasRewrapUrl();
 
     // Rewrap key on every request
-    const ukey = await this.rewrapKey(
+    const { unwrappedKey: ukey } = await this.rewrapKey(
       nanotdf.header.toBuffer(),
       kasUrl,
       nanotdf.header.magicNumberVersion,
@@ -73,7 +73,7 @@ export class NanoTDFClient extends Client {
 
     const legacyVersion = '0.0.0';
     // Rewrap key on every request
-    const key = await this.rewrapKey(
+    const { unwrappedKey: key } = await this.rewrapKey(
       nanotdf.header.toBuffer(),
       nanotdf.header.getKasRewrapUrl(),
       nanotdf.header.magicNumberVersion,
@@ -351,7 +351,7 @@ export class NanoTDFDatasetClient extends Client {
     // TODO: The version number should be fetched from the API
     const version = '0.0.1';
     // Rewrap key on every request
-    const ukey = await this.rewrapKey(
+    const { unwrappedKey: ukey } = await this.rewrapKey(
       nanotdf.header.toBuffer(),
       nanotdf.header.getKasRewrapUrl(),
       nanotdf.header.magicNumberVersion,

package/src/nanotdf/Client.ts

@@ -10,10 +10,16 @@ import {
 } from '../access.js';
 import { AuthProvider, isAuthProvider, reqSignature } from '../auth/providers.js';
 import { ConfigurationError, DecryptError, TdfError, UnsafeUrlError } from '../errors.js';
-import { cryptoPublicToPem, pemToCryptoPublicKey, validateSecureUrl } from '../utils.js';
+import {
+  cryptoPublicToPem,
+  getRequiredObligationFQNs,
+  pemToCryptoPublicKey,
+  validateSecureUrl,
+} from '../utils.js';
 
 export interface ClientConfig {
   allowedKases?: string[];
+  fulfillableObligationFQNs?: string[];
   ignoreAllowList?: boolean;
   authProvider: AuthProvider;
   dpopEnabled?: boolean;
@@ -23,6 +29,11 @@ export interface ClientConfig {
   platformUrl: string;
 }
 
+type RewrapKeyResult = {
+  unwrappedKey: CryptoKey;
+  requiredObligations: string[];
+};
+
 function toJWSAlg(c: CryptoKey): string {
   const { algorithm } = c;
   switch (algorithm.name) {
@@ -106,6 +117,7 @@ export default class Client {
   static readonly IV_SIZE = 12;
 
   allowedKases?: OriginAllowList;
+  readonly fulfillableObligationFQNs: string[];
   /*
     These variables are expected to be either assigned during initialization or within the methods.
     This is needed as the flow is very specific. Errors should be thrown if the necessary step is not completed.
@@ -168,6 +180,7 @@ export default class Client {
     } else {
       const {
         allowedKases,
+        fulfillableObligationFQNs = [],
         ignoreAllowList,
         authProvider,
         dpopEnabled,
@@ -184,6 +197,7 @@ export default class Client {
       if (allowedKases?.length || ignoreAllowList) {
         this.allowedKases = new OriginAllowList(allowedKases || [], ignoreAllowList);
       }
+      this.fulfillableObligationFQNs = fulfillableObligationFQNs;
       this.dpopEnabled = !!dpopEnabled;
       if (dpopKeys) {
         this.requestSignerKeyPair = dpopKeys;
@@ -223,7 +237,7 @@ export default class Client {
     kasRewrapUrl: string,
     magicNumberVersion: ArrayBufferLike,
     clientVersion: string
-  ): Promise<CryptoKey> {
+  ): Promise<RewrapKeyResult> {
     let allowedKases = this.allowedKases;
 
     if (!allowedKases) {
@@ -265,10 +279,15 @@ export default class Client {
     });
 
     // Wrapped
-    const wrappedKey = await fetchWrappedKey(kasRewrapUrl, signedRequestToken, this.authProvider);
+    const rewrapResp = await fetchWrappedKey(
+      kasRewrapUrl,
+      signedRequestToken,
+      this.authProvider,
+      this.fulfillableObligationFQNs
+    );
 
     // Extract the iv and ciphertext
-    const entityWrappedKey = wrappedKey.entityWrappedKey;
+    const entityWrappedKey = rewrapResp.entityWrappedKey;
     const ivLength =
       clientVersion == Client.SDK_INITIAL_RELEASE ? Client.INITIAL_RELEASE_IV_SIZE : Client.IV_SIZE;
     const iv = entityWrappedKey.subarray(0, ivLength);
@@ -277,7 +296,7 @@ export default class Client {
     let kasPublicKey;
     try {
       // Let us import public key as a cert or public key
-      kasPublicKey = await pemToCryptoPublicKey(wrappedKey.sessionPublicKey);
+      kasPublicKey = await pemToCryptoPublicKey(rewrapResp.sessionPublicKey);
     } catch (cause) {
       throw new ConfigurationError(
         `internal: [${kasRewrapUrl}] PEM Public Key to crypto public key failed. Is PEM formatted correctly?`,
@@ -346,6 +365,9 @@ export default class Client {
       throw new DecryptError('Unable to import raw key.', cause);
     }
 
-    return unwrappedKey;
+    return {
+      requiredObligations: getRequiredObligationFQNs(rewrapResp),
+      unwrappedKey: unwrappedKey,
+    };
   }
 }