@super-protocol/pki-attestation-engine 3.0.0

package/dist/challengeValidator/challengeValidatorTdx.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeValidatorTdx = void 0;
+const pki_common_1 = require("@super-protocol/pki-common");
+const addons_tee_1 = require("@super-protocol/addons-tee");
+const sdk_js_1 = require("@super-protocol/sdk-js");
+class ChallengeValidatorTdx {
+    log;
+    verifierService = new addons_tee_1.SgxNative.DcapQuoteVerifyService();
+    constructor(log) {
+        this.log = log;
+    }
+    async validate(challenge) {
+        switch (challenge.type) {
+            case pki_common_1.ChallengeType.TDX:
+                const quote = Buffer.from(challenge.quoteBase64, 'base64');
+                try {
+                    try {
+                        await this.verifierService.validateQuoteVerifierEnclave(quote);
+                    }
+                    catch (e) {
+                        this.log.debug(`validateQuoteVerifierEnclave returned error: ${e}`);
+                        if (!e.hasOwnProperty('criticalError') ||
+                            e.criticalError) {
+                            throw e;
+                        }
+                    }
+                    const parser = new sdk_js_1.TeeTdxParser();
+                    const parsedQuote = parser.parseQuote(quote);
+                    this.log.debug(`Parsed quote: ${JSON.stringify(parsedQuote)}`);
+                    const parsedBody = parser.parseBody(parsedQuote.tdQuoteBody);
+                    const userData = parsedBody.reportData;
+                    this.log.debug(`Parsed report: ${JSON.stringify(parsedBody)}`);
+                    const mrenclave = sdk_js_1.TeeTdxParser.getMrEnclave(quote);
+                    return {
+                        success: true,
+                        validatedUserData: Buffer.from(userData.slice(0, 64)),
+                        validatedId: Buffer.from(mrenclave),
+                    };
+                }
+                catch (e) {
+                    return {
+                        success: false,
+                        error: e.message,
+                    };
+                }
+        }
+        throw new Error('Method not implemented.');
+    }
+}
+exports.ChallengeValidatorTdx = ChallengeValidatorTdx;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlVmFsaWRhdG9yVGR4LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NoYWxsZW5nZVZhbGlkYXRvci9jaGFsbGVuZ2VWYWxpZGF0b3JUZHgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsMkRBQTJFO0FBRTNFLDJEQUF1RDtBQUN2RCxtREFBc0Q7QUFFdEQsTUFBYSxxQkFBcUI7SUFHRDtJQUZyQixlQUFlLEdBQUcsSUFBSSxzQkFBUyxDQUFDLHNCQUFzQixFQUFFLENBQUM7SUFFakUsWUFBNkIsR0FBUTtRQUFSLFFBQUcsR0FBSCxHQUFHLENBQUs7SUFBRyxDQUFDO0lBRXpDLEtBQUssQ0FBQyxRQUFRLENBQUMsU0FBb0I7UUFDL0IsUUFBUSxTQUFTLENBQUMsSUFBSSxFQUFFLENBQUM7WUFDckIsS0FBSywwQkFBYSxDQUFDLEdBQUc7Z0JBQ2xCLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFdBQVcsRUFBRSxRQUFRLENBQUMsQ0FBQztnQkFDM0QsSUFBSSxDQUFDO29CQUNELElBQUksQ0FBQzt3QkFDRCxNQUFNLElBQUksQ0FBQyxlQUFlLENBQUMsNEJBQTRCLENBQ25ELEtBQUssQ0FDUixDQUFDO29CQUNOLENBQUM7b0JBQUMsT0FBTyxDQUFNLEVBQUUsQ0FBQzt3QkFDZCxJQUFJLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FDVixnREFBZ0QsQ0FBQyxFQUFFLENBQ3RELENBQUM7d0JBQ0YsSUFDSSxDQUFDLENBQUMsQ0FBQyxjQUFjLENBQUMsZUFBZSxDQUFDOzRCQUNsQyxDQUFDLENBQUMsYUFBYSxFQUNqQixDQUFDOzRCQUNDLE1BQU0sQ0FBQyxDQUFDO3dCQUNaLENBQUM7b0JBQ0wsQ0FBQztvQkFDRCxNQUFNLE1BQU0sR0FBRyxJQUFJLHFCQUFZLEVBQUUsQ0FBQztvQkFDbEMsTUFBTSxXQUFXLEdBQUcsTUFBTSxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQztvQkFDN0MsSUFBSSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQ1YsaUJBQWlCLElBQUksQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FDakQsQ0FBQztvQkFDRixNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsU0FBUyxDQUMvQixXQUFXLENBQUMsV0FBVyxDQUMxQixDQUFDO29CQUNGLE1BQU0sUUFBUSxHQUFHLFVBQVUsQ0FBQyxVQUFVLENBQUM7b0JBQ3ZDLElBQUksQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUNWLGtCQUFrQixJQUFJLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQ2pELENBQUM7b0JBQ0YsTUFBTSxTQUFTLEdBQUcscUJBQVksQ0FBQyxZQUFZLENBQUMsS0FBSyxDQUFDLENBQUM7b0JBRW5ELE9BQU87d0JBQ0gsT0FBTyxFQUFFLElBQUk7d0JBQ2IsaUJBQWlCLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQzt3QkFDckQsV0FBVyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO3FCQUN0QyxDQUFDO2dCQUNOLENBQUM7Z0JBQUMsT0FBTyxDQUFNLEVBQUUsQ0FBQztvQkFDZCxPQUFPO3dCQUNILE9BQU8sRUFBRSxLQUFLO3dCQUNkLEtBQUssRUFBRSxDQUFDLENBQUMsT0FBTztxQkFDbkIsQ0FBQztnQkFDTixDQUFDO1FBQ1QsQ0FBQztRQUNELE1BQU0sSUFBSSxLQUFLLENBQUMseUJBQXlCLENBQUMsQ0FBQztJQUMvQyxDQUFDO0NBQ0o7QUFyREQsc0RBcURDIn0=

package/dist/challengeValidator/challengeValidatorToken.d.ts

@@ -0,0 +1,8 @@
+import { Challenge, Log } from '@super-protocol/pki-common';
+import { ChallengeResult, ChallengeValidator } from './challengeValidator';
+export declare class ChallengeValidatorToken implements ChallengeValidator {
+    private readonly token;
+    private readonly log;
+    constructor(token: string, log: Log);
+    validate(challenge: Challenge): Promise<ChallengeResult>;
+}

package/dist/challengeValidator/challengeValidatorToken.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeValidatorToken = void 0;
+const pki_common_1 = require("@super-protocol/pki-common");
+class ChallengeValidatorToken {
+    token;
+    log;
+    constructor(token, log) {
+        this.token = token;
+        this.log = log;
+    }
+    async validate(challenge) {
+        switch (challenge.type) {
+            case pki_common_1.ChallengeType.Token:
+                try {
+                    if (challenge.token !== this.token) {
+                        throw new Error('Invalid token');
+                    }
+                    this.log.info(`token challenge validated successfully`);
+                    return {
+                        success: true,
+                        validatedUserData: Buffer.from(challenge.userDataBase64, 'base64'),
+                        validatedId: Buffer.alloc(0), // empty as we don't have id in token challenge
+                    };
+                }
+                catch (e) {
+                    this.log.error(`challengeValidatorToken returned error: ${e}`);
+                    return {
+                        success: false,
+                        error: e.message,
+                    };
+                }
+        }
+        throw new Error('Method not implemented.');
+    }
+}
+exports.ChallengeValidatorToken = ChallengeValidatorToken;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlVmFsaWRhdG9yVG9rZW4uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY2hhbGxlbmdlVmFsaWRhdG9yL2NoYWxsZW5nZVZhbGlkYXRvclRva2VuLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLDJEQUEyRTtBQUczRSxNQUFhLHVCQUF1QjtJQUVYO0lBQ0E7SUFGckIsWUFDcUIsS0FBYSxFQUNiLEdBQVE7UUFEUixVQUFLLEdBQUwsS0FBSyxDQUFRO1FBQ2IsUUFBRyxHQUFILEdBQUcsQ0FBSztJQUMxQixDQUFDO0lBRUosS0FBSyxDQUFDLFFBQVEsQ0FBQyxTQUFvQjtRQUMvQixRQUFRLFNBQVMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNyQixLQUFLLDBCQUFhLENBQUMsS0FBSztnQkFDcEIsSUFBSSxDQUFDO29CQUNELElBQUksU0FBUyxDQUFDLEtBQUssS0FBSyxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7d0JBQ2pDLE1BQU0sSUFBSSxLQUFLLENBQUMsZUFBZSxDQUFDLENBQUM7b0JBQ3JDLENBQUM7b0JBQ0QsSUFBSSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsd0NBQXdDLENBQUMsQ0FBQztvQkFFeEQsT0FBTzt3QkFDSCxPQUFPLEVBQUUsSUFBSTt3QkFDYixpQkFBaUIsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUMxQixTQUFTLENBQUMsY0FBYyxFQUN4QixRQUFRLENBQ1g7d0JBQ0QsV0FBVyxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsK0NBQStDO3FCQUNoRixDQUFDO2dCQUNOLENBQUM7Z0JBQUMsT0FBTyxDQUFNLEVBQUUsQ0FBQztvQkFDZCxJQUFJLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FDViwyQ0FBMkMsQ0FBQyxFQUFFLENBQ2pELENBQUM7b0JBQ0YsT0FBTzt3QkFDSCxPQUFPLEVBQUUsS0FBSzt3QkFDZCxLQUFLLEVBQUUsQ0FBQyxDQUFDLE9BQU87cUJBQ25CLENBQUM7Z0JBQ04sQ0FBQztRQUNULENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLHlCQUF5QixDQUFDLENBQUM7SUFDL0MsQ0FBQztDQUNKO0FBbkNELDBEQW1DQyJ9

package/dist/challengeValidator/index.d.ts

@@ -0,0 +1,8 @@
+export * from './challengeValidator';
+export * from './validatorConfig';
+export { ChallengeValidatorCertificate } from './challengeValidatorCertificate';
+export { ChallengeValidatorNvidia } from './challengeValidatorNvidia';
+export { ChallengeValidatorSgx } from './challengeValidatorSgx';
+export { ChallengeValidatorTdx } from './challengeValidatorTdx';
+export { ChallengeValidatorSevSnp } from './challengeValidatorSevSnp';
+export { ChallengeValidatorToken } from './challengeValidatorToken';

package/dist/challengeValidator/index.js

@@ -0,0 +1,32 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeValidatorToken = exports.ChallengeValidatorSevSnp = exports.ChallengeValidatorTdx = exports.ChallengeValidatorSgx = exports.ChallengeValidatorNvidia = exports.ChallengeValidatorCertificate = void 0;
+__exportStar(require("./challengeValidator"), exports);
+__exportStar(require("./validatorConfig"), exports);
+var challengeValidatorCertificate_1 = require("./challengeValidatorCertificate");
+Object.defineProperty(exports, "ChallengeValidatorCertificate", { enumerable: true, get: function () { return challengeValidatorCertificate_1.ChallengeValidatorCertificate; } });
+var challengeValidatorNvidia_1 = require("./challengeValidatorNvidia");
+Object.defineProperty(exports, "ChallengeValidatorNvidia", { enumerable: true, get: function () { return challengeValidatorNvidia_1.ChallengeValidatorNvidia; } });
+var challengeValidatorSgx_1 = require("./challengeValidatorSgx");
+Object.defineProperty(exports, "ChallengeValidatorSgx", { enumerable: true, get: function () { return challengeValidatorSgx_1.ChallengeValidatorSgx; } });
+var challengeValidatorTdx_1 = require("./challengeValidatorTdx");
+Object.defineProperty(exports, "ChallengeValidatorTdx", { enumerable: true, get: function () { return challengeValidatorTdx_1.ChallengeValidatorTdx; } });
+var challengeValidatorSevSnp_1 = require("./challengeValidatorSevSnp");
+Object.defineProperty(exports, "ChallengeValidatorSevSnp", { enumerable: true, get: function () { return challengeValidatorSevSnp_1.ChallengeValidatorSevSnp; } });
+var challengeValidatorToken_1 = require("./challengeValidatorToken");
+Object.defineProperty(exports, "ChallengeValidatorToken", { enumerable: true, get: function () { return challengeValidatorToken_1.ChallengeValidatorToken; } });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY2hhbGxlbmdlVmFsaWRhdG9yL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsdURBQXFDO0FBQ3JDLG9EQUFrQztBQUNsQyxpRkFBZ0Y7QUFBdkUsOElBQUEsNkJBQTZCLE9BQUE7QUFDdEMsdUVBQXNFO0FBQTdELG9JQUFBLHdCQUF3QixPQUFBO0FBQ2pDLGlFQUFnRTtBQUF2RCw4SEFBQSxxQkFBcUIsT0FBQTtBQUM5QixpRUFBZ0U7QUFBdkQsOEhBQUEscUJBQXFCLE9BQUE7QUFDOUIsdUVBQXNFO0FBQTdELG9JQUFBLHdCQUF3QixPQUFBO0FBQ2pDLHFFQUFvRTtBQUEzRCxrSUFBQSx1QkFBdUIsT0FBQSJ9

package/dist/challengeValidator/schemas.d.ts

@@ -0,0 +1,13 @@
+export declare const accessCredentialsSchema: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
+    storageType: import("@sinclair/typebox").TLiteral<"STORJ">;
+    credentials: import("@sinclair/typebox").TObject<{
+        token: import("@sinclair/typebox").TString;
+    }>;
+}>, import("@sinclair/typebox").TObject<{
+    storageType: import("@sinclair/typebox").TLiteral<"S3">;
+    credentials: import("@sinclair/typebox").TObject<{
+        accessKeyId: import("@sinclair/typebox").TString;
+        secretKey: import("@sinclair/typebox").TString;
+        endpoint: import("@sinclair/typebox").TString;
+    }>;
+}>]>;

package/dist/challengeValidator/schemas.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.accessCredentialsSchema = void 0;
+const typebox_1 = require("@sinclair/typebox");
+exports.accessCredentialsSchema = typebox_1.Type.Union([
+    typebox_1.Type.Object({
+        storageType: typebox_1.Type.Literal('STORJ'),
+        credentials: typebox_1.Type.Object({
+            token: typebox_1.Type.String(),
+        }),
+    }),
+    typebox_1.Type.Object({
+        storageType: typebox_1.Type.Literal('S3'),
+        credentials: typebox_1.Type.Object({
+            accessKeyId: typebox_1.Type.String(),
+            secretKey: typebox_1.Type.String(),
+            endpoint: typebox_1.Type.String(),
+        }),
+    }),
+]);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2NoZW1hcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jaGFsbGVuZ2VWYWxpZGF0b3Ivc2NoZW1hcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSwrQ0FBeUM7QUFFNUIsUUFBQSx1QkFBdUIsR0FBRyxjQUFJLENBQUMsS0FBSyxDQUFDO0lBQzlDLGNBQUksQ0FBQyxNQUFNLENBQUM7UUFDUixXQUFXLEVBQUUsY0FBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUM7UUFDbEMsV0FBVyxFQUFFLGNBQUksQ0FBQyxNQUFNLENBQUM7WUFDckIsS0FBSyxFQUFFLGNBQUksQ0FBQyxNQUFNLEVBQUU7U0FDdkIsQ0FBQztLQUNMLENBQUM7SUFDRixjQUFJLENBQUMsTUFBTSxDQUFDO1FBQ1IsV0FBVyxFQUFFLGNBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDO1FBQy9CLFdBQVcsRUFBRSxjQUFJLENBQUMsTUFBTSxDQUFDO1lBQ3JCLFdBQVcsRUFBRSxjQUFJLENBQUMsTUFBTSxFQUFFO1lBQzFCLFNBQVMsRUFBRSxjQUFJLENBQUMsTUFBTSxFQUFFO1lBQ3hCLFFBQVEsRUFBRSxjQUFJLENBQUMsTUFBTSxFQUFFO1NBQzFCLENBQUM7S0FDTCxDQUFDO0NBQ0wsQ0FBQyxDQUFDIn0=

package/dist/challengeValidator/validatorConfig.d.ts

@@ -0,0 +1,13 @@
+export interface SevValidationConfig {
+    sevTmp?: string;
+    cacheFolder?: string;
+    vmRepoOwner?: string;
+    vmRepo?: string;
+    releaseAsset?: string;
+    storageAccess?: Record<string, unknown>;
+    securityPolicy?: Record<string, unknown>;
+}
+export interface NvtrustWrapperConfig {
+    tmp?: string;
+    timeout?: number;
+}

package/dist/challengeValidator/validatorConfig.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmFsaWRhdG9yQ29uZmlnLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NoYWxsZW5nZVZhbGlkYXRvci92YWxpZGF0b3JDb25maWcudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiJ9

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export * from './certificateGenerator';
+export * from './challengeProvider';
+export * from './challengeValidator';

package/dist/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./certificateGenerator"), exports);
+__exportStar(require("./challengeProvider"), exports);
+__exportStar(require("./challengeValidator"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLHlEQUF1QztBQUN2QyxzREFBb0M7QUFDcEMsdURBQXFDIn0=

package/dist/validator/challengeValidator.d.ts

@@ -0,0 +1,18 @@
+/// <reference types="node" />
+import { Challenge } from '@super-protocol/pki-common';
+export interface SuccessChallengeResult {
+    success: true;
+    validatedUserData: Buffer;
+    validatedId: Buffer;
+    validatedCommonId?: Buffer;
+    validatedSolutionHash?: Buffer;
+}
+export interface UnsuccessfulChallengeResult {
+    success: false;
+    error: string;
+}
+export type ChallengeResult = SuccessChallengeResult | UnsuccessfulChallengeResult;
+export interface ChallengeValidator {
+    validate(challenge: Challenge, publicKeyPem?: string): Promise<ChallengeResult>;
+    initialize?: () => Promise<void>;
+}

package/dist/validator/challengeValidator.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlVmFsaWRhdG9yLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3ZhbGlkYXRvci9jaGFsbGVuZ2VWYWxpZGF0b3IudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiJ9

package/dist/validator/challengeValidatorCertificate.d.ts

@@ -0,0 +1,8 @@
+import { Challenge } from '@super-protocol/pki-common';
+import { ChallengeResult, ChallengeValidator } from './challengeValidator';
+import { Log } from '@super-protocol/pki-apps-common';
+export declare class ChallengeValidatorCertificate implements ChallengeValidator {
+    log: Log;
+    validate(challenge: Challenge, publicKeyPem: string): Promise<ChallengeResult>;
+    private verifyUserData;
+}

package/dist/validator/challengeValidatorCertificate.js

@@ -0,0 +1,70 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeValidatorCertificate = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+const pki_common_1 = require("@super-protocol/pki-common");
+const inversify_1 = require("inversify");
+const sdk_js_1 = require("@super-protocol/sdk-js");
+const pki_apps_common_1 = require("@super-protocol/pki-apps-common");
+let ChallengeValidatorCertificate = class ChallengeValidatorCertificate {
+    log = new pki_apps_common_1.MockLog();
+    async validate(challenge, publicKeyPem) {
+        switch (challenge.type) {
+            case pki_common_1.ChallengeType.Certificate:
+                try {
+                    await sdk_js_1.TeeCertificateService.validateTeeCertChainOrFail(challenge.orderCertificate + challenge.orderCABundle);
+                    this.verifyUserData(publicKeyPem, challenge.userDataSignatureBase64, challenge.orderCertificate);
+                    return {
+                        success: true,
+                        validatedUserData: (0, pki_common_1.getPublicKeyPemHash)(publicKeyPem),
+                        validatedId: sdk_js_1.CertificatesHelper.getExtensionValue(challenge.orderCertificate, pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_ID) ?? Buffer.alloc(0),
+                        validatedCommonId: sdk_js_1.CertificatesHelper.getExtensionValue(challenge.orderCertificate, pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_COMMON_ID),
+                        validatedSolutionHash: sdk_js_1.CertificatesHelper.getExtensionValue(challenge.orderCertificate, sdk_js_1.constants.OID_CUSTOM_EXTENSION_USER_DATA),
+                    };
+                }
+                catch (e) {
+                    return {
+                        success: false,
+                        error: e.message,
+                    };
+                }
+        }
+        throw new Error('Method not implemented.');
+    }
+    async verifyUserData(publicKeyPem, signatureBase64, certificatePem) {
+        const cert = await sdk_js_1.CertificateGenerator.checkAndParseCert(certificatePem);
+        const certPublicKeyPem = await sdk_js_1.CryptoKeysTransformer.cryptoKeyToSpkiPem(cert.publicKey);
+        const certPublicKeyKeyObj = crypto_1.default.createPublicKey(certPublicKeyPem);
+        const publicKeyHash = (0, pki_common_1.getPublicKeyPemHash)(publicKeyPem);
+        const isValid = await sdk_js_1.Crypto.verify({
+            data: publicKeyHash,
+            signature: signatureBase64,
+            publicKey: certPublicKeyKeyObj,
+            signatureFormat: 'base64',
+        });
+        if (!isValid) {
+            throw Error('Signature verification failed');
+        }
+    }
+};
+exports.ChallengeValidatorCertificate = ChallengeValidatorCertificate;
+__decorate([
+    (0, inversify_1.inject)(pki_apps_common_1.CommonInjectable.Logger),
+    __metadata("design:type", Object)
+], ChallengeValidatorCertificate.prototype, "log", void 0);
+exports.ChallengeValidatorCertificate = ChallengeValidatorCertificate = __decorate([
+    (0, inversify_1.injectable)()
+], ChallengeValidatorCertificate);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlVmFsaWRhdG9yQ2VydGlmaWNhdGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdmFsaWRhdG9yL2NoYWxsZW5nZVZhbGlkYXRvckNlcnRpZmljYXRlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7OztBQUFBLG9EQUE0QjtBQUM1QiwyREFNb0M7QUFFcEMseUNBQStDO0FBQy9DLG1EQU9nQztBQUVoQyxxRUFJeUM7QUFHbEMsSUFBTSw2QkFBNkIsR0FBbkMsTUFBTSw2QkFBNkI7SUFFL0IsR0FBRyxHQUFRLElBQUkseUJBQU8sRUFBRSxDQUFDO0lBRWhDLEtBQUssQ0FBQyxRQUFRLENBQ1YsU0FBb0IsRUFDcEIsWUFBb0I7UUFFcEIsUUFBUSxTQUFTLENBQUMsSUFBSSxFQUFFLENBQUM7WUFDckIsS0FBSywwQkFBYSxDQUFDLFdBQVc7Z0JBQzFCLElBQUksQ0FBQztvQkFDRCxNQUFNLDhCQUFxQixDQUFDLDBCQUEwQixDQUNsRCxTQUFTLENBQUMsZ0JBQWdCLEdBQUcsU0FBUyxDQUFDLGFBQWEsQ0FDdkQsQ0FBQztvQkFDRixJQUFJLENBQUMsY0FBYyxDQUNmLFlBQVksRUFDWixTQUFTLENBQUMsdUJBQXVCLEVBQ2pDLFNBQVMsQ0FBQyxnQkFBZ0IsQ0FDN0IsQ0FBQztvQkFDRixPQUFPO3dCQUNILE9BQU8sRUFBRSxJQUFJO3dCQUNiLGlCQUFpQixFQUFFLElBQUEsZ0NBQW1CLEVBQUMsWUFBWSxDQUFDO3dCQUNwRCxXQUFXLEVBQ1AsMkJBQWtCLENBQUMsaUJBQWlCLENBQ2hDLFNBQVMsQ0FBQyxnQkFBZ0IsRUFDMUIsOENBQWlDLENBQ3BDLElBQUksTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7d0JBQ3hCLGlCQUFpQixFQUFFLDJCQUFrQixDQUFDLGlCQUFpQixDQUNuRCxTQUFTLENBQUMsZ0JBQWdCLEVBQzFCLHFEQUF3QyxDQUMzQzt3QkFDRCxxQkFBcUIsRUFDakIsMkJBQWtCLENBQUMsaUJBQWlCLENBQ2hDLFNBQVMsQ0FBQyxnQkFBZ0IsRUFDMUIsa0JBQVMsQ0FBQyw4QkFBOEIsQ0FDM0M7cUJBQ1IsQ0FBQztnQkFDTixDQUFDO2dCQUFDLE9BQU8sQ0FBTSxFQUFFLENBQUM7b0JBQ2QsT0FBTzt3QkFDSCxPQUFPLEVBQUUsS0FBSzt3QkFDZCxLQUFLLEVBQUUsQ0FBQyxDQUFDLE9BQU87cUJBQ25CLENBQUM7Z0JBQ04sQ0FBQztRQUNULENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLHlCQUF5QixDQUFDLENBQUM7SUFDL0MsQ0FBQztJQUVPLEtBQUssQ0FBQyxjQUFjLENBQ3hCLFlBQW9CLEVBQ3BCLGVBQXVCLEVBQ3ZCLGNBQXNCO1FBRXRCLE1BQU0sSUFBSSxHQUNOLE1BQU0sNkJBQW9CLENBQUMsaUJBQWlCLENBQUMsY0FBYyxDQUFDLENBQUM7UUFDakUsTUFBTSxnQkFBZ0IsR0FBRyxNQUFNLDhCQUFxQixDQUFDLGtCQUFrQixDQUNuRSxJQUFJLENBQUMsU0FBUyxDQUNqQixDQUFDO1FBQ0YsTUFBTSxtQkFBbUIsR0FBRyxnQkFBTSxDQUFDLGVBQWUsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1FBRXJFLE1BQU0sYUFBYSxHQUFHLElBQUEsZ0NBQW1CLEVBQUMsWUFBWSxDQUFDLENBQUM7UUFFeEQsTUFBTSxPQUFPLEdBQUcsTUFBTSxlQUFNLENBQUMsTUFBTSxDQUFDO1lBQ2hDLElBQUksRUFBRSxhQUFhO1lBQ25CLFNBQVMsRUFBRSxlQUFlO1lBQzFCLFNBQVMsRUFBRSxtQkFBbUI7WUFDOUIsZUFBZSxFQUFFLFFBQVE7U0FDNUIsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ1gsTUFBTSxLQUFLLENBQUMsK0JBQStCLENBQUMsQ0FBQztRQUNqRCxDQUFDO0lBQ0wsQ0FBQztDQUNKLENBQUE7QUF2RVksc0VBQTZCO0FBRS9CO0lBRE4sSUFBQSxrQkFBTSxFQUFDLGtDQUFnQixDQUFDLE1BQU0sQ0FBQzs7MERBQ0E7d0NBRnZCLDZCQUE2QjtJQUR6QyxJQUFBLHNCQUFVLEdBQUU7R0FDQSw2QkFBNkIsQ0F1RXpDIn0=

package/dist/validator/challengeValidatorNvidia.d.ts

@@ -0,0 +1,10 @@
+/// <reference types="node" />
+import { NvtrustWrapperConfig } from './validatorConfig';
+import { Challenge, NetworkType } from '@super-protocol/pki-common';
+import { Log } from '@super-protocol/pki-apps-common';
+export declare class ChallengeValidatorNvidia {
+    private readonly log;
+    private readonly config?;
+    constructor(log: Log, config?: NvtrustWrapperConfig | undefined);
+    validate(challenge: Challenge, userData: Buffer, networkType?: NetworkType): Promise<void>;
+}

package/dist/validator/challengeValidatorNvidia.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeValidatorNvidia = void 0;
+const sp_nvtrust_wrapper_1 = require("@super-protocol/sp-nvtrust-wrapper");
+const pki_common_1 = require("@super-protocol/pki-common");
+const challengeProvider_1 = require("../challengeProvider");
+class ChallengeValidatorNvidia {
+    log;
+    config;
+    constructor(log, config) {
+        this.log = log;
+        this.config = config;
+    }
+    async validate(challenge, userData, networkType) {
+        this.log.debug(`NVIDIA validation networkType: ${networkType}`);
+        if (!(0, pki_common_1.hasChallengeNvidiaToken)(challenge)) {
+            return;
+        }
+        const tokenHash = challengeProvider_1.ChallengeNvidiaCCHelper.getTokenHash(challenge.nvidiaTokens);
+        if (userData.length < 64) {
+            throw new Error('userData must be at least 64 bytes');
+        }
+        const expectedHash = userData.slice(32, 64);
+        const tokenHashHex = tokenHash.toString('hex');
+        const expectedHashHex = expectedHash.toString('hex');
+        this.log.debug(`NVIDIA tokenHash: ${tokenHashHex}, expectedHash: ${expectedHashHex}`);
+        if (tokenHashHex !== expectedHashHex) {
+            throw new Error('Nvidia hash included in the challenge does not match the hash of the nvidia token specified in the request');
+        }
+        const nvtrusWrapper = new sp_nvtrust_wrapper_1.NvtrustWrapper(this.config?.tmp ?? '/sp/nvtrust-tmp', this.config?.timeout ?? 60000);
+        let nvidiaTokenValidationResult = {
+            success: false,
+        };
+        try {
+            nvidiaTokenValidationResult = await nvtrusWrapper.validateToken({
+                device: sp_nvtrust_wrapper_1.NvidiaDeviceType.GPU,
+                policy: sp_nvtrust_wrapper_1.defaultGPUpolicy,
+                token: { jwt: challenge.nvidiaTokens.gpuToken },
+            });
+            if (nvidiaTokenValidationResult.success !== true) {
+                throw new Error('Failed to verify Nvidia GPU token: validateToken returned success=false');
+            }
+            if (networkType === 'trusted') {
+                const gpusInfo = sp_nvtrust_wrapper_1.NvtrustWrapper.extractGPUInfoFromToken({
+                    jwt: challenge.nvidiaTokens.gpuToken,
+                });
+                const debugGpuNumbers = gpusInfo.gpus
+                    .map((gpu, index) => ({ gpu, gpuNumber: index + 1 }))
+                    .filter(({ gpu }) => gpu.dbgStat === true)
+                    .map(({ gpuNumber }) => gpuNumber);
+                const hasDebugEnabledGpu = debugGpuNumbers.length > 0;
+                if (hasDebugEnabledGpu) {
+                    const debugGpuNumbersText = debugGpuNumbers.join(', ');
+                    throw new Error(`Trusted network does not allow NVIDIA GPUs with dbgStat=true. Debug enabled on GPU(s): ${debugGpuNumbersText}`);
+                }
+            }
+        }
+        catch (error) {
+            if (error instanceof sp_nvtrust_wrapper_1.NvtrustWrapperCallError) {
+                this.log.error(`NvtrustWrapperCallError: ${error.message}`);
+                if (error.traceback?.trim()) {
+                    this.log.debug(`Traceback:\n${error.traceback}`);
+                }
+                const logEntries = Object.entries(error.logs ?? {});
+                if (logEntries.length > 0) {
+                    this.log.debug('Logs from nvtrust wrapper:');
+                    for (const [fileName, logContent] of logEntries) {
+                        this.log.debug(`--- ${fileName} ---`);
+                        this.log.debug(String(logContent));
+                    }
+                }
+            }
+            else {
+                this.log.error(`Error during NVIDIA token validation: ${error}`);
+            }
+            throw error;
+        }
+    }
+}
+exports.ChallengeValidatorNvidia = ChallengeValidatorNvidia;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlVmFsaWRhdG9yTnZpZGlhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3ZhbGlkYXRvci9jaGFsbGVuZ2VWYWxpZGF0b3JOdmlkaWEudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsMkVBTTRDO0FBRTVDLDJEQUlvQztBQUNwQyw0REFBK0Q7QUFHL0QsTUFBYSx3QkFBd0I7SUFFWjtJQUNBO0lBRnJCLFlBQ3FCLEdBQVEsRUFDUixNQUE2QjtRQUQ3QixRQUFHLEdBQUgsR0FBRyxDQUFLO1FBQ1IsV0FBTSxHQUFOLE1BQU0sQ0FBdUI7SUFDL0MsQ0FBQztJQUVKLEtBQUssQ0FBQyxRQUFRLENBQ1YsU0FBb0IsRUFDcEIsUUFBZ0IsRUFDaEIsV0FBeUI7UUFFekIsSUFBSSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsa0NBQWtDLFdBQVcsRUFBRSxDQUFDLENBQUM7UUFDaEUsSUFBSSxDQUFDLElBQUEsb0NBQXVCLEVBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztZQUN0QyxPQUFPO1FBQ1gsQ0FBQztRQUVELE1BQU0sU0FBUyxHQUFHLDJDQUF1QixDQUFDLFlBQVksQ0FDbEQsU0FBUyxDQUFDLFlBQVksQ0FDekIsQ0FBQztRQUVGLElBQUksUUFBUSxDQUFDLE1BQU0sR0FBRyxFQUFFLEVBQUUsQ0FBQztZQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLG9DQUFvQyxDQUFDLENBQUM7UUFDMUQsQ0FBQztRQUNELE1BQU0sWUFBWSxHQUFHLFFBQVEsQ0FBQyxLQUFLLENBQUMsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQzVDLE1BQU0sWUFBWSxHQUFHLFNBQVMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDL0MsTUFBTSxlQUFlLEdBQUcsWUFBWSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNyRCxJQUFJLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FDVixxQkFBcUIsWUFBWSxtQkFBbUIsZUFBZSxFQUFFLENBQ3hFLENBQUM7UUFDRixJQUFJLFlBQVksS0FBSyxlQUFlLEVBQUUsQ0FBQztZQUNuQyxNQUFNLElBQUksS0FBSyxDQUNYLDRHQUE0RyxDQUMvRyxDQUFDO1FBQ04sQ0FBQztRQUVELE1BQU0sYUFBYSxHQUFHLElBQUksbUNBQWMsQ0FDcEMsSUFBSSxDQUFDLE1BQU0sRUFBRSxHQUFHLElBQUksaUJBQWlCLEVBQ3JDLElBQUksQ0FBQyxNQUFNLEVBQUUsT0FBTyxJQUFJLEtBQUssQ0FDaEMsQ0FBQztRQUVGLElBQUksMkJBQTJCLEdBQXVCO1lBQ2xELE9BQU8sRUFBRSxLQUFLO1NBQ2pCLENBQUM7UUFDRixJQUFJLENBQUM7WUFDRCwyQkFBMkIsR0FBRyxNQUFNLGFBQWEsQ0FBQyxhQUFhLENBQUM7Z0JBQzVELE1BQU0sRUFBRSxxQ0FBZ0IsQ0FBQyxHQUFHO2dCQUM1QixNQUFNLEVBQUUscUNBQWdCO2dCQUN4QixLQUFLLEVBQUUsRUFBRSxHQUFHLEVBQUUsU0FBUyxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUU7YUFDbEQsQ0FBQyxDQUFDO1lBQ0gsSUFBSSwyQkFBMkIsQ0FBQyxPQUFPLEtBQUssSUFBSSxFQUFFLENBQUM7Z0JBQy9DLE1BQU0sSUFBSSxLQUFLLENBQ1gseUVBQXlFLENBQzVFLENBQUM7WUFDTixDQUFDO1lBRUQsSUFBSSxXQUFXLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQzVCLE1BQU0sUUFBUSxHQUFHLG1DQUFjLENBQUMsdUJBQXVCLENBQUM7b0JBQ3BELEdBQUcsRUFBRSxTQUFTLENBQUMsWUFBWSxDQUFDLFFBQVE7aUJBQ3ZDLENBQUMsQ0FBQztnQkFDSCxNQUFNLGVBQWUsR0FBRyxRQUFRLENBQUMsSUFBSTtxQkFDaEMsR0FBRyxDQUFDLENBQUMsR0FBRyxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLEdBQUcsRUFBRSxTQUFTLEVBQUUsS0FBSyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUM7cUJBQ3BELE1BQU0sQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLEVBQUUsRUFBRSxDQUFDLEdBQUcsQ0FBQyxPQUFPLEtBQUssSUFBSSxDQUFDO3FCQUN6QyxHQUFHLENBQUMsQ0FBQyxFQUFFLFNBQVMsRUFBRSxFQUFFLEVBQUUsQ0FBQyxTQUFTLENBQUMsQ0FBQztnQkFDdkMsTUFBTSxrQkFBa0IsR0FBRyxlQUFlLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQztnQkFDdEQsSUFBSSxrQkFBa0IsRUFBRSxDQUFDO29CQUNyQixNQUFNLG1CQUFtQixHQUFHLGVBQWUsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7b0JBQ3ZELE1BQU0sSUFBSSxLQUFLLENBQ1gsMEZBQTBGLG1CQUFtQixFQUFFLENBQ2xILENBQUM7Z0JBQ04sQ0FBQztZQUNMLENBQUM7UUFDTCxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNiLElBQUksS0FBSyxZQUFZLDRDQUF1QixFQUFFLENBQUM7Z0JBQzNDLElBQUksQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLDRCQUE0QixLQUFLLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQztnQkFDNUQsSUFBSSxLQUFLLENBQUMsU0FBUyxFQUFFLElBQUksRUFBRSxFQUFFLENBQUM7b0JBQzFCLElBQUksQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLGVBQWUsS0FBSyxDQUFDLFNBQVMsRUFBRSxDQUFDLENBQUM7Z0JBQ3JELENBQUM7Z0JBQ0QsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsSUFBSSxJQUFJLEVBQUUsQ0FBQyxDQUFDO2dCQUNwRCxJQUFJLFVBQVUsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7b0JBQ3hCLElBQUksQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLDRCQUE0QixDQUFDLENBQUM7b0JBQzdDLEtBQUssTUFBTSxDQUFDLFFBQVEsRUFBRSxVQUFVLENBQUMsSUFBSSxVQUFVLEVBQUUsQ0FBQzt3QkFDOUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxRQUFRLE1BQU0sQ0FBQyxDQUFDO3dCQUN0QyxJQUFJLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQztvQkFDdkMsQ0FBQztnQkFDTCxDQUFDO1lBQ0wsQ0FBQztpQkFBTSxDQUFDO2dCQUNKLElBQUksQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUNWLHlDQUF5QyxLQUFLLEVBQUUsQ0FDbkQsQ0FBQztZQUNOLENBQUM7WUFFRCxNQUFNLEtBQUssQ0FBQztRQUNoQixDQUFDO0lBQ0wsQ0FBQztDQUNKO0FBOUZELDREQThGQyJ9

package/dist/validator/challengeValidatorSevSnp.d.ts

@@ -0,0 +1,14 @@
+import { Challenge } from '@super-protocol/pki-common';
+import { Log } from '@super-protocol/pki-apps-common';
+import { ChallengeResult, ChallengeValidator } from './challengeValidator';
+import { SevValidationConfig } from './validatorConfig';
+export declare class ChallengeValidatorSevSnp implements ChallengeValidator {
+    private readonly log;
+    private measureInstance;
+    private readonly sevTmp;
+    private static instance;
+    private readonly securityPolicy;
+    static getInstance(log: Log, config?: SevValidationConfig): ChallengeValidatorSevSnp;
+    private constructor();
+    validate(challenge: Challenge): Promise<ChallengeResult>;
+}

package/dist/validator/challengeValidatorSevSnp.js

@@ -0,0 +1,137 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeValidatorSevSnp = void 0;
+const path = __importStar(require("path"));
+const addons_tee_1 = require("@super-protocol/addons-tee");
+const pki_common_1 = require("@super-protocol/pki-common");
+const sdk_js_1 = require("@super-protocol/sdk-js");
+const schemas_1 = require("./schemas");
+class ChallengeValidatorSevSnp {
+    log;
+    measureInstance;
+    sevTmp;
+    static instance;
+    securityPolicy;
+    static getInstance(log, config) {
+        if (!ChallengeValidatorSevSnp.instance) {
+            ChallengeValidatorSevSnp.instance = new ChallengeValidatorSevSnp(log, config);
+        }
+        return ChallengeValidatorSevSnp.instance;
+    }
+    constructor(log, config) {
+        this.log = log;
+        this.log.debug(`SEV config: ${JSON.stringify(config)}`);
+        this.sevTmp = config?.sevTmp ?? '/tmp';
+        const cacheFolder = config?.cacheFolder ??
+            path.join(this.sevTmp, 'snp-mrenclave-cache');
+        let storageAccess;
+        if (config?.storageAccess) {
+            const { isValid } = (0, sdk_js_1.validateBySchema)(config.storageAccess, schemas_1.accessCredentialsSchema);
+            if (!isValid) {
+                throw new Error(`sev storageAccess is not valid!})`);
+            }
+            storageAccess = config.storageAccess;
+        }
+        if (config?.securityPolicy) {
+            try {
+                this.securityPolicy = addons_tee_1.SgxNative.SevSNP.parsePolicySet(config.securityPolicy);
+            }
+            catch (error) {
+                this.log.error(`Failed to parse SEV-SNP security policy: ${error}`);
+                throw new Error(`Invalid SEV-SNP security policy configuration: ${error}`);
+            }
+        }
+        this.measureInstance = new addons_tee_1.SgxNative.SNPMrEnclaveCalculator({
+            cacheFolder,
+            vmRepo: config?.vmRepo,
+            vmRepoOwner: config?.vmRepoOwner,
+            releaseAsset: config?.releaseAsset,
+            storageAccess,
+            rmPrevCache: false,
+        });
+    }
+    async validate(challenge) {
+        switch (challenge.type) {
+            case pki_common_1.ChallengeType.SEVSNP:
+                try {
+                    let report;
+                    try {
+                        report = addons_tee_1.SgxNative.SevSNP.deserializeSNPReport(Buffer.from(challenge.serializedReportBase64, 'base64'));
+                    }
+                    catch (e) {
+                        this.log.error(`deserializeSNPReport returned error: ${e}`);
+                        throw e;
+                    }
+                    try {
+                        await addons_tee_1.SgxNative.SevSNP.verifyReport(report, {
+                            timeoutMs: 60000,
+                            tmpDirTemplate: `${this.sevTmp}/verify-`,
+                        });
+                    }
+                    catch (e) {
+                        this.log.error(`verifyReport returned error: ${e}`);
+                        throw e;
+                    }
+                    if (!report.snpReport?.rawReport) {
+                        throw new Error('Missing snpReport or rawReport');
+                    }
+                    try {
+                        if (this.securityPolicy) {
+                            await addons_tee_1.SgxNative.SevSNP.verifyPolicy(Buffer.from(report.snpReport?.rawReport), this.securityPolicy);
+                        }
+                    }
+                    catch (e) {
+                        this.log.error(`verifyPolicy returned error: ${e}`);
+                        throw e;
+                    }
+                    const userData = await addons_tee_1.SgxNative.SevSNP.getReportData(Buffer.from(report.snpReport.rawReport));
+                    let mrenclave;
+                    try {
+                        mrenclave =
+                            await this.measureInstance.getSingleCoreMrEnclave(report.snpReport);
+                    }
+                    catch (e) {
+                        this.log.error(`getSingleCoreMrEnclave returned error: ${e}`);
+                        throw e;
+                    }
+                    return {
+                        success: true,
+                        validatedUserData: Buffer.from(userData.slice(0, 64)),
+                        validatedId: mrenclave,
+                    };
+                }
+                catch (e) {
+                    return {
+                        success: false,
+                        error: e.message,
+                    };
+                }
+        }
+        throw new Error('Method not implemented.');
+    }
+}
+exports.ChallengeValidatorSevSnp = ChallengeValidatorSevSnp;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlVmFsaWRhdG9yU2V2U25wLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3ZhbGlkYXRvci9jaGFsbGVuZ2VWYWxpZGF0b3JTZXZTbnAudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSwyQ0FBNkI7QUFDN0IsMkRBQXVEO0FBQ3ZELDJEQUFzRTtBQUl0RSxtREFBeUU7QUFDekUsdUNBQW9EO0FBRXBELE1BQWEsd0JBQXdCO0lBcUJaO0lBcEJiLGVBQWUsQ0FBbUM7SUFDekMsTUFBTSxDQUFTO0lBQ3hCLE1BQU0sQ0FBQyxRQUFRLENBQTJCO0lBQ2pDLGNBQWMsQ0FBa0M7SUFFMUQsTUFBTSxDQUFDLFdBQVcsQ0FDckIsR0FBUSxFQUNSLE1BQTRCO1FBRTVCLElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNyQyx3QkFBd0IsQ0FBQyxRQUFRLEdBQUcsSUFBSSx3QkFBd0IsQ0FDNUQsR0FBRyxFQUNILE1BQU0sQ0FDVCxDQUFDO1FBQ04sQ0FBQztRQUVELE9BQU8sd0JBQXdCLENBQUMsUUFBUSxDQUFDO0lBQzdDLENBQUM7SUFFRCxZQUNxQixHQUFRLEVBQ3pCLE1BQTRCO1FBRFgsUUFBRyxHQUFILEdBQUcsQ0FBSztRQUd6QixJQUFJLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxlQUFlLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ3hELElBQUksQ0FBQyxNQUFNLEdBQUcsTUFBTSxFQUFFLE1BQU0sSUFBSSxNQUFNLENBQUM7UUFDdkMsTUFBTSxXQUFXLEdBQ2IsTUFBTSxFQUFFLFdBQVc7WUFDbkIsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLHFCQUFxQixDQUFDLENBQUM7UUFFbEQsSUFBSSxhQUF3QyxDQUFDO1FBQzdDLElBQUksTUFBTSxFQUFFLGFBQWEsRUFBRSxDQUFDO1lBQ3hCLE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxJQUFBLHlCQUFnQixFQUNoQyxNQUFNLENBQUMsYUFBYSxFQUNwQixpQ0FBdUIsQ0FDMUIsQ0FBQztZQUNGLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDWCxNQUFNLElBQUksS0FBSyxDQUFDLG1DQUFtQyxDQUFDLENBQUM7WUFDekQsQ0FBQztZQUVELGFBQWEsR0FBRyxNQUFNLENBQUMsYUFBOEIsQ0FBQztRQUMxRCxDQUFDO1FBQ0QsSUFBSSxNQUFNLEVBQUUsY0FBYyxFQUFFLENBQUM7WUFDekIsSUFBSSxDQUFDO2dCQUNELElBQUksQ0FBQyxjQUFjLEdBQUcsc0JBQVMsQ0FBQyxNQUFNLENBQUMsY0FBYyxDQUNqRCxNQUFNLENBQUMsY0FBYyxDQUN4QixDQUFDO1lBQ04sQ0FBQztZQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQ2IsSUFBSSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQ1YsNENBQTRDLEtBQUssRUFBRSxDQUN0RCxDQUFDO2dCQUNGLE1BQU0sSUFBSSxLQUFLLENBQ1gsa0RBQWtELEtBQUssRUFBRSxDQUM1RCxDQUFDO1lBQ04sQ0FBQztRQUNMLENBQUM7UUFFRCxJQUFJLENBQUMsZUFBZSxHQUFHLElBQUksc0JBQVMsQ0FBQyxzQkFBc0IsQ0FBQztZQUN4RCxXQUFXO1lBQ1gsTUFBTSxFQUFFLE1BQU0sRUFBRSxNQUFNO1lBQ3RCLFdBQVcsRUFBRSxNQUFNLEVBQUUsV0FBVztZQUNoQyxZQUFZLEVBQUUsTUFBTSxFQUFFLFlBQVk7WUFDbEMsYUFBYTtZQUNiLFdBQVcsRUFBRSxLQUFLO1NBQ3JCLENBQUMsQ0FBQztJQUNQLENBQUM7SUFFRCxLQUFLLENBQUMsUUFBUSxDQUFDLFNBQW9CO1FBQy9CLFFBQVEsU0FBUyxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ3JCLEtBQUssMEJBQWEsQ0FBQyxNQUFNO2dCQUNyQixJQUFJLENBQUM7b0JBQ0QsSUFBSSxNQUFvQyxDQUFDO29CQUN6QyxJQUFJLENBQUM7d0JBQ0QsTUFBTSxHQUFHLHNCQUFTLENBQUMsTUFBTSxDQUFDLG9CQUFvQixDQUMxQyxNQUFNLENBQUMsSUFBSSxDQUNQLFNBQVMsQ0FBQyxzQkFBc0IsRUFDaEMsUUFBUSxDQUNYLENBQ0osQ0FBQztvQkFDTixDQUFDO29CQUFDLE9BQU8sQ0FBTSxFQUFFLENBQUM7d0JBQ2QsSUFBSSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQ1Ysd0NBQXdDLENBQUMsRUFBRSxDQUM5QyxDQUFDO3dCQUNGLE1BQU0sQ0FBQyxDQUFDO29CQUNaLENBQUM7b0JBRUQsSUFBSSxDQUFDO3dCQUNELE1BQU0sc0JBQVMsQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLE1BQU0sRUFBRTs0QkFDeEMsU0FBUyxFQUFFLEtBQUs7NEJBQ2hCLGNBQWMsRUFBRSxHQUFHLElBQUksQ0FBQyxNQUFNLFVBQVU7eUJBQzNDLENBQUMsQ0FBQztvQkFDUCxDQUFDO29CQUFDLE9BQU8sQ0FBTSxFQUFFLENBQUM7d0JBQ2QsSUFBSSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsZ0NBQWdDLENBQUMsRUFBRSxDQUFDLENBQUM7d0JBQ3BELE1BQU0sQ0FBQyxDQUFDO29CQUNaLENBQUM7b0JBRUQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsU0FBUyxFQUFFLENBQUM7d0JBQy9CLE1BQU0sSUFBSSxLQUFLLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztvQkFDdEQsQ0FBQztvQkFFRCxJQUFJLENBQUM7d0JBQ0QsSUFBSSxJQUFJLENBQUMsY0FBYyxFQUFFLENBQUM7NEJBQ3RCLE1BQU0sc0JBQVMsQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUMvQixNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsU0FBUyxDQUFDLEVBQ3hDLElBQUksQ0FBQyxjQUFjLENBQ3RCLENBQUM7d0JBQ04sQ0FBQztvQkFDTCxDQUFDO29CQUFDLE9BQU8sQ0FBTSxFQUFFLENBQUM7d0JBQ2QsSUFBSSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsZ0NBQWdDLENBQUMsRUFBRSxDQUFDLENBQUM7d0JBQ3BELE1BQU0sQ0FBQyxDQUFDO29CQUNaLENBQUM7b0JBRUQsTUFBTSxRQUFRLEdBQUcsTUFBTSxzQkFBUyxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQ2pELE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUMsQ0FDMUMsQ0FBQztvQkFDRixJQUFJLFNBQWlCLENBQUM7b0JBQ3RCLElBQUksQ0FBQzt3QkFDRCxTQUFTOzRCQUNMLE1BQU0sSUFBSSxDQUFDLGVBQWUsQ0FBQyxzQkFBc0IsQ0FDN0MsTUFBTSxDQUFDLFNBQVMsQ0FDbkIsQ0FBQztvQkFDVixDQUFDO29CQUFDLE9BQU8sQ0FBTSxFQUFFLENBQUM7d0JBQ2QsSUFBSSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQ1YsMENBQTBDLENBQUMsRUFBRSxDQUNoRCxDQUFDO3dCQUNGLE1BQU0sQ0FBQyxDQUFDO29CQUNaLENBQUM7b0JBRUQsT0FBTzt3QkFDSCxPQUFPLEVBQUUsSUFBSTt3QkFDYixpQkFBaUIsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDO3dCQUNyRCxXQUFXLEVBQUUsU0FBUztxQkFDekIsQ0FBQztnQkFDTixDQUFDO2dCQUFDLE9BQU8sQ0FBTSxFQUFFLENBQUM7b0JBQ2QsT0FBTzt3QkFDSCxPQUFPLEVBQUUsS0FBSzt3QkFDZCxLQUFLLEVBQUUsQ0FBQyxDQUFDLE9BQU87cUJBQ25CLENBQUM7Z0JBQ04sQ0FBQztRQUNULENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLHlCQUF5QixDQUFDLENBQUM7SUFDL0MsQ0FBQztDQUNKO0FBOUlELDREQThJQyJ9

package/dist/validator/challengeValidatorSgx.d.ts

@@ -0,0 +1,8 @@
+import { Challenge } from '@super-protocol/pki-common';
+import { ChallengeResult, ChallengeValidator } from './challengeValidator';
+import { Log } from '@super-protocol/pki-apps-common';
+export declare class ChallengeValidatorSgx implements ChallengeValidator {
+    log: Log;
+    private verifierService;
+    validate(challenge: Challenge): Promise<ChallengeResult>;
+}