@tdxvolt/volt-client-grpc 0.1.1 → 0.11.0

package/src/volt-client-internal.js

@@ -5,285 +5,355 @@ import bent from "bent";
 import forge from "node-forge";
 import lodash from "lodash";
 import VoltConnection from "./volt-connection.js";
-import {getServiceDescriptors} from "./proto-utils.js";
-import {createClient as createGrpcClient} from "./grpc-utils.js";
+import { getServiceDescriptors } from "./proto-utils.js";
+import { createClient as createGrpcClient } from "./grpc-utils.js";
 import * as voltUtils from "./utils.js";
-import {constants} from "./constants.js";
+import { constants } from "./constants.js";
 import GRPCCall from "./grpc-call.js";
 
-const {pki} = forge;
-const {filter, pick} = lodash;
+const { pki } = forge;
+const { filter, pick } = lodash;
 
 const log = debug("volt-client-grpc:volt-client-internal");
 const voltServices = [
-  constants.serviceType.voltAPI,
-  constants.serviceType.fileAPI,
-  constants.serviceType.sqliteDatabaseAPI,
-  constants.serviceType.sqliteServerAPI,
-  constants.serviceType.ssiAPI,
-  constants.serviceType.tunnelAPI,
-  constants.serviceType.wireAPI,
+	constants.serviceType.voltAPI,
+	constants.serviceType.fileAPI,
+	constants.serviceType.sqliteDatabaseAPI,
+	constants.serviceType.sqliteServerAPI,
+	constants.serviceType.ssiAPI,
+	constants.serviceType.relayAPI,
+	constants.serviceType.wireAPI,
 ];
 
 function issueBind(bindRequest, ttl) {
-  // eslint-disable-next-line no-use-before-define
-  return unaryCall.call(this, "Bind", bindRequest).then((bindResponse) => {
-    log("got binding request response %j", bindResponse);
-    if (bindResponse.status && bindResponse.status.code) {
-      log("error in bind response: %s", bindResponse.status.message);
-      return Promise.reject(new Error(bindResponse.status.message));
-    } else {
-      switch (bindResponse.decision) {
-        case "POLICY_DECISION_PERMIT":
-          //
-          // The request status is permit => cache the bind response info.
-          //
-
-          // This is the certificate assigned to us by the volt.
-          this._crypto.cache.cert = bindResponse.cert;
-
-          // This is the signing CA used by the volt (don't ov)
-          this._crypto.cache.ca = bindResponse.chain;
-
-          // Resource id is assigned by the volt.
-          this._crypto.cache.client_id = bindResponse.identity_id;
-          this._crypto.saveCache();
-          break;
-        case "POLICY_DECISION_DENY":
-          log(">>>>>>>>>>>>>>> access request is DENIED <<<<<<<<<<<<<<<<<<<");
-          break;
-        case "POLICY_DECISION_PROMPT":
-        case "POLICY_DECISION_PENDING":
-          log("access pending approval - waiting...");
-          break;
-        default:
-          log("ignoring unknown bind descision %s", bindResponse.status);
-          break;
-      }
-    }
-
-    return bindResponse.decision;
-  });
+	// eslint-disable-next-line no-use-before-define
+	return unaryCall.call(this, "Bind", bindRequest).then((bindResponse) => {
+		log("got binding request response %j", bindResponse);
+		if (bindResponse.status?.code) {
+			log("error in bind response: %s", bindResponse.status.message);
+			return Promise.reject(new Error(bindResponse.status.message));
+		} else {
+			switch (bindResponse.decision) {
+				case "POLICY_DECISION_PERMIT": {
+					//
+					// The request status is permit => cache the bind response info.
+					//
+
+					// This is the certificate assigned to us by the volt.
+					this._credential.cache.cert = bindResponse.cert;
+
+					// This is the signing CA used by the volt (don't ov)
+					this._credential.cache.ca = bindResponse.chain;
+
+					// Resource id is assigned by the volt.
+					this._credential.cache.client_id = bindResponse.identity_id;
+					this._credential.saveCache();
+					break;
+				}
+				case "POLICY_DECISION_DENY": {
+					log(">>>>>>>>>>>>>>> access request is DENIED <<<<<<<<<<<<<<<<<<<");
+					break;
+				}
+				case "POLICY_DECISION_PROMPT":
+				case "POLICY_DECISION_PENDING": {
+					log("access pending approval - waiting...");
+					break;
+				}
+				default:
+					log("ignoring unknown bind descision %s", bindResponse.status);
+					break;
+			}
+		}
+
+		return bindResponse.decision;
+	});
 }
 
 function findDIDDocumentService(document, serviceType) {
-  if (!document.service) {
-    return [];
-  }
+	if (!document.service) {
+		return [];
+	}
 
-  const matches = filter(document.service, (svc) => svc.type === serviceType);
-  return matches;
+	const matches = filter(document.service, (svc) => svc.type === serviceType);
+	return matches;
 }
 
 export async function bindInternal() {
-  try {
-    // Build grpc client info.
-    if (this.isRemote) {
-      const getJSON = bent("json");
-      // @todo - currently Volt tunnel CA discovery is not secure.
-      const protocol =
-        this._config.tunnel_host?.startsWith("localhost:") || this._config.cloud_host?.startsWith("localhost:")
-          ? "http"
-          : "https";
-      const tunnelURL = `${protocol}://${this._config.tunnel_host || this._config.cloud_host}/info`;
-      log("attempting to retrieve tunnel information from %s", tunnelURL);
-      const tunnelInfo = await getJSON(tunnelURL);
-      if (!tunnelInfo.ca_pem) {
-        throw new Error("Unable to fetch tunnel CA - cannot securely connect.");
-      } else {
-        log("Auto-fetched tunnel CA %s, remote address %s", tunnelInfo.ca_pem, tunnelInfo.local_address);
-        this._crypto.cache.tunnel_ca_pem = tunnelInfo.ca_pem;
-        this._crypto.cache.tunnel_address = tunnelInfo.local_address;
-      }
-    }
-
-    if (!this._crypto.cache.ca) {
-      this._crypto.cache.ca = this._options.ca_pem;
-    }
-
-    if (!this._crypto.cache.ca) {
-      throw new Error("No certificate authority found in configuration for target Volt - check configuration");
-    }
-
-    const keyPair = this._crypto.getKey();
-    const publicKeyPem = pki.publicKeyToPem(keyPair.publicKey);
-
-    if (!this._crypto.cache.bindIp) {
-      // Default the IP address if none is specified. This is used to set the SAN in the
-      // certificate issued by the Volt.
-      this._crypto.cache.bindIp = ip.address();
-    }
-
-    this._crypto.saveCache();
-
-    // Form the request message.
-    const bindRequest = {
-      binding_name: this._config.client_name,
-      public_key: publicKeyPem,
-      host: this._crypto.cache.bindIp,
-      x509_credential: [],
-    };
-
-    if (this._crypto.cache.cert) {
-      bindRequest.x509_credential = [this._crypto.cache.cert + this._crypto.cache.ca];
-    }
-
-    if (this._options.challenge_code) {
-      bindRequest.challenge = voltUtils.signBase64(keyPair.privateKey, this._options.challenge_code);
-    } else {
-      log("****no Volt challenge code available**** => not sending challenge signature");
-    }
-
-    // For remote connections, add our cloud-issued certificate as an additional credential.
-    if (this._crypto.cache.tunnel_ca_pem && this._crypto.cache.cloud_cert) {
-      bindRequest.x509_credential = bindRequest.x509_credential.concat(
-        this._crypto.cache.cloud_cert + this._crypto.cache.tunnel_ca_pem
-      );
-    }
-
-    log("sending %d x509 credentials", bindRequest.x509_credential.length);
-    log("bind TTL is ", this._config.bindRequestTTL);
-
-    // This will block while the request is pending.
-    const pollInterval = 10000;
-    let decision = "";
-    do {
-      if (decision) {
-        // Wait a while before retrying.
-        // eslint-disable-next-line no-await-in-loop
-        await new Promise((resolve) => setTimeout(resolve, pollInterval));
-      }
-      // eslint-disable-next-line no-await-in-loop
-      decision = await issueBind.call(this, bindRequest, this._options.bindRequestTTL);
-      log("binding decision: %s", decision);
-    } while (decision === "POLICY_DECISION_PROMPT" || decision === "POLICY_DECISION_PENDING");
-
-    return decision === "POLICY_DECISION_PERMIT";
-  } catch (err) {
-    log("failure binding to Volt [%s]", err.message);
-    throw err;
-  }
+	try {
+		// Check if we need to resolve a Relay volt.
+		if (
+			typeof this._voltConfig?.relay === "string" ||
+			this._voltConfig?.relay?.http_address
+		) {
+			const relayURL =
+				this._voltConfig.relay?.http_address || this._voltConfig.relay;
+			log("attempting to retrieve Relay information from %s", relayURL);
+			this._voltConfig.relay = await fetchVoltConfig.call(
+				this,
+				`${relayURL}/discovery`,
+			);
+			if (this._voltConfig.relay.ca_pem) {
+				log(
+					"Auto-fetched Relay CA %s, remote address %s",
+					this._voltConfig.relay.ca_pem,
+					this._voltConfig.relay.address,
+				);
+			} else {
+				throw new Error("Unable to fetch Relay CA - cannot securely connect.");
+			}
+		}
+
+		if (!this._credential.cache.ca) {
+			this._credential.cache.ca = this._voltConfig.ca_pem;
+		}
+
+		if (!this._credential.cache.ca) {
+			throw new Error(
+				"No certificate authority found in configuration for target Volt - check configuration",
+			);
+		}
+
+		const keyPair = this._credential.getKey();
+		const publicKeyPem = pki.publicKeyToPem(keyPair.publicKey);
+
+		if (!this._credential.cache.bindIp) {
+			// Default the IP address if none is specified. This is used to set the SAN in the
+			// certificate issued by the Volt.
+			this._credential.cache.bindIp = ip.address();
+		}
+
+		this._credential.saveCache();
+
+		// Form the request message.
+		const bindRequest = {
+			binding_name: this._config.client_name,
+			public_key: publicKeyPem,
+			host: this._credential.cache.bindIp,
+			x509_credential: [],
+		};
+
+		if (this._credential.cache.cert) {
+			bindRequest.x509_credential = [
+				this._credential.cache.cert + this._credential.cache.ca,
+			];
+		}
+
+		if (this._voltConfig.challenge_code) {
+			bindRequest.challenge = voltUtils.signBase64(
+				keyPair.privateKey,
+				this._voltConfig.challenge_code,
+			);
+		} else {
+			log(
+				"****no Volt challenge code available**** => not sending challenge signature",
+			);
+		}
+
+		// For remote connections, add our cloud-issued certificate as an additional credential.
+		if (this._config?.relay?.ca_pem && this._credential.cache.cloud_cert) {
+			bindRequest.x509_credential = bindRequest.x509_credential.concat(
+				this._credential.cache.cloud_cert + this._config.relay.ca_pem,
+			);
+		}
+
+		log("sending %d x509 credentials", bindRequest.x509_credential.length);
+		log("bind TTL is ", this._config.bindRequestTTL);
+
+		// This will block while the request is pending.
+		const pollInterval = 10000;
+		let decision = "";
+		do {
+			if (decision) {
+				// Wait a while before retrying.
+				// eslint-disable-next-line no-await-in-loop
+				await new Promise((resolve) => setTimeout(resolve, pollInterval));
+			}
+			// eslint-disable-next-line no-await-in-loop
+			decision = await issueBind.call(
+				this,
+				bindRequest,
+				this._voltConfig.bindRequestTTL,
+			);
+			log("binding decision: %s", decision);
+		} while (
+			decision === "POLICY_DECISION_PROMPT" ||
+			decision === "POLICY_DECISION_PENDING"
+		);
+
+		return decision === "POLICY_DECISION_PERMIT";
+	} catch (err) {
+		log("failure binding to Volt [%s]", err.message);
+		throw err;
+	}
 }
 
 export function connectInternal() {
-  try {
-    if (this._voltConnection) {
-      log("connectInternal - Volt connection already exists");
-      return Promise.resolve();
-    }
-
-    const onDisconnected = () => {
-      this._connected = false;
-      this._session = null;
-
-      if (this._cachedClient) {
-        this._grpc.closeClient(this._cachedClient);
-        this._cachedClient = null;
-      }
-
-      if (this._cachedRemoteClient) {
-        this._grpc.closeClient(this._cachedRemoteClient);
-        this._cachedRemoteClient = null;
-      }
-    };
-
-    this._voltConnection = new VoltConnection(this, this._grpc, this._options);
-
-    this._voltConnection.on("connected", (session) => {
-      this._session = session;
-      this._connected = !!session;
-      if (!this._connected) {
-        onDisconnected();
-      }
-      this.emit("connected", !!session);
-    });
-
-    this._voltConnection.on("error", (err) => {
-      // Should auto-reconnect.
-      log("Volt connection error [%s]", err.message);
-      if (this._connected) {
-        onDisconnected();
-        this.emit("connected", false);
-      }
-    });
-
-    this._voltConnection.on("evt", (evt) => {
-      this.emit("evt", evt);
-    });
-
-    return this._voltConnection.connect();
-  } catch (err) {
-    log("connect - error [%s]", err.message);
-    throw err;
-  }
+	try {
+		if (this._voltConnection) {
+			log("connectInternal - Volt connection already exists");
+			return Promise.resolve();
+		}
+
+		const onDisconnected = () => {
+			this._connected = false;
+			this._session = null;
+
+			if (this._cachedClient) {
+				this._grpc.closeClient(this._cachedClient);
+				this._cachedClient = null;
+			}
+
+			if (this._cachedRemoteClient) {
+				this._grpc.closeClient(this._cachedRemoteClient);
+				this._cachedRemoteClient = null;
+			}
+		};
+
+		this._voltConnection = new VoltConnection(this, this._grpc);
+
+		this._voltConnection.on("connected", (session) => {
+			this._session = session;
+			this._connected = !!session;
+			if (!this._connected) {
+				onDisconnected();
+			}
+			this.emit("connected", !!session);
+		});
+
+		this._voltConnection.on("error", (err) => {
+			// Should auto-reconnect.
+			log("Volt connection error [%s]", err.message);
+			if (this._connected) {
+				onDisconnected();
+				this.emit("connected", false);
+			}
+		});
+
+		this._voltConnection.on("evt", (evt) => {
+			this.emit("evt", evt);
+		});
+
+		return this._voltConnection.connect();
+	} catch (err) {
+		log("connect - error [%s]", err.message);
+		throw err;
+	}
 }
 
 export function getVoltAPIClientInternal() {
-  if (!this._cachedClient) {
-    const serviceAddress = this.isRemote ? this._crypto.cache.tunnel_address : this._options.local_address;
-    log("creating cached VoltAPI service client on %s", serviceAddress);
-    let serviceDescriptors = {};
-    voltServices.forEach((pkg) => {
-      const packageDescriptors = getServiceDescriptors(this._grpc, pkg);
-      serviceDescriptors = {...serviceDescriptors, ...packageDescriptors};
-    });
-
-    this._cachedClient = createGrpcClient(
-      this._grpc,
-      serviceDescriptors,
-      serviceAddress,
-      this._crypto.cache,
-      this.isRemote && !this.isVoltTunnel,
-      this._config.cloud_host ? this._options.id : "",
-      this._config.cloud_host ? this._options.id : ""
-    );
-  }
-
-  return this._cachedClient;
+	if (!this._cachedClient) {
+		const serviceAddress = this.isRemote
+			? this._config.relay.address
+			: this._voltConfig.address;
+		log("creating cached VoltAPI service client on %s", serviceAddress);
+		let serviceDescriptors = {};
+		voltServices.forEach((pkg) => {
+			const packageDescriptors = getServiceDescriptors(this._grpc, pkg);
+			serviceDescriptors = { ...serviceDescriptors, ...packageDescriptors };
+		});
+
+		this._cachedClient = createGrpcClient(
+			this._grpc,
+			serviceDescriptors,
+			serviceAddress,
+			this._credential,
+			this.isRemote && !this.isVoltRelay,
+			this._config?.relay?.cloud ? this._voltConfig.id : "",
+			this._config?.relay?.cloud ? this._voltConfig.id : "",
+		);
+	}
+
+	return this._cachedClient;
 }
 
 export function unaryCall(method, request) {
-  const grpcClient = this.getVoltAPIClient();
+	return new Promise((resolve, reject) => {
+		const grpcClient = this.getVoltAPIClient();
 
-  const call = new GRPCCall(this, method, "METHOD_TYPE_UNARY");
-  call.start(grpcClient, request);
-  return call.wait();
+		const call = new GRPCCall(this, method, "METHOD_TYPE_UNARY");
+
+		let response = null;
+
+		call.on("data", (payload) => {
+			// Cache the response and wait for `end`.
+			response = payload;
+		});
+
+		call.on("error", reject);
+
+		call.on("end", () => {
+			if (!response) {
+				return reject(new Error("no response received"));
+			}
+
+			// Convert non-OK status to a JS error.
+			if (response.status?.message) {
+				reject(new Error(response.status.message));
+			} else {
+				resolve(response);
+			}
+		});
+
+		call.start(grpcClient, request);
+	});
+}
+
+export async function fetchVoltConfig(discovery_url) {
+	try {
+		const getJSON = bent("json");
+		const fullVoltConfig = await getJSON(discovery_url);
+
+		if (!fullVoltConfig || typeof fullVoltConfig !== "object") {
+			throw new Error(`invalid config resolved from: ${discovery_url}`);
+		}
+
+		const voltConfig = pick(
+			fullVoltConfig,
+			"id",
+			"display_name",
+			"public_key",
+			"fingerprint",
+			"address",
+			"ca_pem",
+			"challenge_code",
+			"cloud",
+			"relay",
+		);
+
+		return voltConfig;
+	} catch (err) {
+		throw new Error(
+			`Failure loading config from ${discovery_url}: ${err.message}`,
+		);
+	}
 }
 
-export async function fetchVoltConfig(volt_did) {
-  const didResolution = voltUtils.getDIDResolutionURL(volt_did);
-  if (!didResolution) {
-    throw new Error(`Invalid Volt DID: ${volt_did}`);
-  }
-
-  const getJSON = bent("json");
-  const didDocument = await getJSON(didResolution);
-  const voltConfigServices = findDIDDocumentService(didDocument, constants.didServiceType.voltConfig);
-  if (voltConfigServices.length !== 1) {
-    log(
-      "Unexpected number of Volt configuration endpoints found in DID document for %s, services found: %d",
-      volt_did,
-      voltConfigServices.length
-    );
-  }
-  const serviceEndpoint = voltConfigServices[0].serviceEndpoint;
-  const resolvedConfig = await getJSON(serviceEndpoint);
-
-  const voltConfig = pick(
-    resolvedConfig,
-    "id",
-    "display_name",
-    "public_key",
-    "fingerprint",
-    "local_address",
-    "ca_pem",
-    "challenge_code"
-  );
-
-  return {
-    volt: voltConfig,
-    tunnel_ca_pem: resolvedConfig.tunnel_ca_pem,
-    tunnel_address: resolvedConfig.tunnel_address,
-    cloud_host: resolvedConfig.tunnel_address.split(":")[0],
-  };
+export async function fetchVoltConfigFromDID(volt_did) {
+	try {
+		const didResolution = voltUtils.getDIDResolutionURL(volt_did);
+		if (!didResolution) {
+			throw new Error(`Invalid Volt DID: ${volt_did}`);
+		}
+
+		const getJSON = bent("json");
+		const didDocument = await getJSON(didResolution);
+		const voltConfigServices = findDIDDocumentService(
+			didDocument,
+			constants.didServiceType.voltConfig,
+		);
+		if (voltConfigServices.length !== 1) {
+			log(
+				"Unexpected number of Volt configuration endpoints found in DID document for %s, services found: %d",
+				volt_did,
+				voltConfigServices.length,
+			);
+		}
+
+		const serviceEndpoint = voltConfigServices[0].serviceEndpoint;
+		return await fetchVoltConfig.call(this, serviceEndpoint);
+	} catch (err) {
+		throw new Error(
+			`Failure fetching Volt config from DID document ${volt_did}: ${err.message}`,
+		);
+	}
 }