@tdxvolt/volt-client-grpc 0.11.0 → 0.11.3

package/src/volt-connection.js

@@ -50,58 +50,53 @@ function _doConnect() {
 	const helloPayload = {
 		hello: {},
 	};
-
-	this.call.start(grpcClient, helloPayload, (err, response) => {
-		if (err) {
-			log("error on connection stream [%s]", err.message);
-			_cleanUp.call(this);
-			this.emit("error", err);
-		} else {
-			switch (response.payload) {
-				case "ping": {
-					log("pinged");
-
-					// Received ping response from server => clear timeout.
-					if (this._pingTimeoutTimer) {
-						clearTimeout(this._pingTimeoutTimer);
-					}
-
-					// Schedule the next ping.
-					_startPingTimer.call(this);
-					break;
-				}
-				case "hello": {
-					if (!this._session) {
-						this._session = true;
-						this.emit("connected", this._session);
-					}
-					break;
-				}
-				case "evt": {
-					log("received event %s", response.evt.event_type);
-					this.emit("evt", response.evt);
-					break;
-				}
-				default:
-					log("unimplemented connect response payload: %s", response.payload);
-					break;
-			}
-		}
-	});
-
-	this.call
-		.wait()
-		.then(() => {
-			if (this._session) {
-				this.emit("connected", false);
-			}
-		})
-		.catch((err) => {
-			log("unexpected error on connect call [%s]", err.message);
-		})
-		.finally(() => {
-			_cleanUp.call(this);
-		});
+  
+  this.call.on("error", (err) => {
+    log("error on connection stream [%s]", err.message);
+    _cleanUp.call(this);
+    this.emit("error", err);
+  });
+
+  this.call.on("data", (response) => {
+    switch (response.payload) {
+      case "ping": {
+        log("pinged");
+
+        // Received ping response from server => clear timeout.
+        if (this._pingTimeoutTimer) {
+          clearTimeout(this._pingTimeoutTimer);
+        }
+
+        // Schedule the next ping.
+        _startPingTimer.call(this);
+        break;
+      }
+      case "hello": {
+        if (!this._session) {
+          this._session = true;
+          this.emit("connected", this._session);
+        }
+        break;
+      }
+      case "evt": {
+        log("received event %s", response.evt.event_type);
+        this.emit("evt", response.evt);
+        break;
+      }
+      default:
+        log("unimplemented connect response payload: %s", response.payload);
+        break;
+    }
+  });
+
+  this.call.on("end", () => {
+    if (this._session) {
+      this.emit("connected", false);
+    }
+    _cleanUp.call(this);
+  });
+
+	this.call.start(grpcClient, helloPayload);
 
 	_startPingTimer.call(this);
 }

package/src/volt-credential.js

@@ -13,225 +13,225 @@ const aesAlgorithm = "aes-256-cbc";
 const rs256Algorithm = "RS256";
 
 export class VoltCredential {
-	constructor(config, configPath) {
-		this._config = config;
-		this._voltConfig = config.volt;
-		this._configPath = configPath;
-		this._persistCache = !!configPath;
-
-		if (this._config.credential) {
-			this._cryptoCache = this._config.credential;
-		} else {
-			this._cryptoCache = {};
-		}
-
-		// Determine if we're dealing with an encrypted key.
-		if (
-			this._cryptoCache.key?.startsWith(constants.privateEncryptedKeyPrefix)
-		) {
-			if (!config.p) {
-				throw new Error("encrypted key but no passphrase given");
-			}
-
-			// Need to unencrypt the private key.
-			const decrypted = pki.decryptRsaPrivateKey(
-				this._cryptoCache.key,
-				config.p,
-			);
-			if (!decrypted) {
-				throw new Error("failed to decrypt key - check passphrase");
-			}
-			this._cryptoCache.key = pki.privateKeyToPem(decrypted);
-		}
-
-		if (this._voltConfig.ca_pem) {
-			if (!this._cryptoCache.ca) {
-				// Copy the volt signing CA to the crypto cache.
-				this._cryptoCache.ca = this._voltConfig.ca_pem;
-			}
-
-			// Pre-cache the target Volt public key by extracting it from the signing certificate.
-			const voltCert = forge.pki.certificateFromPem(this._voltConfig.ca_pem);
-
-			// Extract Volt public key (used for encrypting Relay payloads).
-			this._voltPublicKey = forge.pki.publicKeyToPem(voltCert.publicKey);
-			this._voltFingerprint = voltUtils.createPublicKeyFingerprint(
-				this._voltPublicKey,
-			);
-		}
-	}
-
-	get config() {
-		return this._config;
-	}
-
-	get cache() {
-		return this._cryptoCache;
-	}
-
-	get voltFingerprint() {
-		return this._voltFingerprint;
-	}
-
-	getKey() {
-		const privateKey = pki.privateKeyFromPem(this._cryptoCache.key);
-		const publicKey = pki.rsa.setPublicKey(privateKey.n, privateKey.e);
-		return { privateKey, publicKey };
-	}
-
-	/**
-	 * Retrieves and re-hydrates the pub/priv key data from the crypto cache, or creates one if not found.
-	 */
-	createKey() {
-		if (this._cryptoCache.key) {
-			// Already have key data in the cache in pem format => create fully-formed pki instances.
-			log("createKey - key already exists");
-			return Promise.resolve(this.getKey());
-		} else {
-			log("creating key");
-			return new Promise((resolve, reject) => {
-				pki.rsa.generateKeyPair({ bits: 2048, workers: -1 }, (err, keypair) => {
-					if (err) {
-						log("failure creating key [%s]", err.message);
-						reject(err);
-					} else {
-						log("successfully created key");
-						const pem = pki.privateKeyToPem(keypair.privateKey);
-						this._cryptoCache.key = pem;
-						resolve(keypair);
-					}
-				});
-			});
-		}
-	}
-
-	/**
-	 * Create cryptocache from scratch.
-	 */
-	initialise() {
-		return this.createKey()
-			.then((/* keypair */) => {
-				return this.saveCache();
-			})
-			.then(() => {
-				return this._cryptoCache;
-			})
-			.catch((err) => {
-				log("failure initialising crypto [%s]", err.message);
-				return Promise.reject(err);
-			});
-	}
-
-	get isBound() {
-		return !!this._cryptoCache.cert;
-	}
-
-	/**
-	 * Signs the identity resource id using the private key.
-	 * @param {*} audience the token audience (usually the target volt)
-	 * @param {*} tunnelling flag indicating if the token is required for a tunnelled connection
-	 * @param {*} ttl time to live in seconds (default to 1 minute)
-	 */
-	getIdentityToken(audience, tunnelling = false, ttl = 60) {
-		if (!this._cryptoCache.key) {
-			throw new Error("crypto cache invalid");
-		}
-
-		const keyPair = this.getKey();
-		const publicKeyPem = pki.publicKeyToPem(keyPair.publicKey);
-		const base58Key = voltUtils.createPublicKeyFingerprint(publicKeyPem);
-
-		log("base58 key is %s", base58Key);
-
-		// Allow TTL either side of the current time.
-		// @todo - fix with server time sync on volt connection.
-		const payload = {
-			aud: audience,
-			iat: Math.floor(Date.now() / 1000) - ttl,
-			exp: Math.floor(Date.now() / 1000) + ttl,
-		};
-
-		let sharedKey;
-		if (tunnelling) {
-			// Initialise the Relay encryption key.
-			sharedKey = VoltCredential.aesCreateKey();
-
-			// Encrypt the key details using the target Volt public key and include this in the JWT payload.
-			payload.sk = VoltCredential.rsaEncrypt(
-				this._voltPublicKey,
-				sharedKey.key,
-			);
-			payload.iv = VoltCredential.rsaEncrypt(this._voltPublicKey, sharedKey.iv);
-		}
-
-		// Sign synchronously.
-		const token = jwt.sign(payload, this._cryptoCache.key, {
-			algorithm: rs256Algorithm,
-			keyid: base58Key,
-		});
-
-		// Return the token along with any encryption key details.
-		return {
-			token,
-			sharedKey,
-		};
-	}
-
-	/**
-	 * Creates the metadata required for a grpc call, including the Volt authentication token
-	 * and optionally tunnel encryption parameters.
-	 * @param {*} grpc
-	 * @param {*} audience
-	 * @param {*} tunnelling
-	 * @param {*} ttl
-	 * @returns
-	 */
-	getIdentityMetadata(grpc, audience, tunnelling = false, ttl = 60) {
-		const identityToken = this.getIdentityToken(
-			audience || this._voltConfig.id,
-			tunnelling,
-			ttl,
-		);
-		const metadata = new grpc.Metadata();
-		metadata.add(constants.authTokenName, identityToken.token);
-		return { ...identityToken, metadata };
-	}
-
-	saveCache() {
-		if (this._persistCache) {
-			const clone = { ...this._config, credential: { ...this._cryptoCache } };
-			if (this._config.p) {
-				// A passphrase option exists => encrypt the key before writing the cache file.
-				const privateKey = pki.privateKeyFromPem(this._cryptoCache.key);
-				clone.credential.key = pki.encryptRsaPrivateKey(
-					privateKey,
-					this._config.p,
-				);
-			}
-			fs.writeFileSync(this._configPath, JSON.stringify(clone, null, 2));
-		}
-	}
-
-	static aesCreateKey() {
-		// Generate random key for the AES-256 algorithm (32 bytes = 256 bits).
-		const key = crypto.randomBytes(32);
-		const iv = crypto.randomBytes(16);
-		return { key, iv };
-	}
-
-	static aesEncrypt(buffer, key, iv) {
-		const cipher = crypto.createCipheriv(aesAlgorithm, key, iv);
-		const crypted = Buffer.concat([cipher.update(buffer), cipher.final()]);
-		return crypted;
-	}
-
-	static aesDecrypt(buffer, key, iv) {
-		const cipher = crypto.createDecipheriv(aesAlgorithm, key, iv);
-		const decrypted = Buffer.concat([cipher.update(buffer), cipher.final()]);
-		return decrypted;
-	}
-
-	static rsaEncrypt(key, buffer) {
-		return crypto.publicEncrypt(key, buffer).toString("base64");
-	}
+  constructor(config, configPath) {
+    this._config = config;
+    this._voltConfig = config.volt;
+    this._configPath = configPath;
+    this._persistCache = !!configPath;
+
+    if (this._config.credential) {
+      this._cryptoCache = this._config.credential;
+    } else {
+      this._cryptoCache = {};
+    }
+
+    // Determine if we're dealing with an encrypted key.
+    if (
+      this._cryptoCache.key?.startsWith(constants.privateEncryptedKeyPrefix)
+    ) {
+      if (!config.p) {
+        throw new Error("encrypted key but no passphrase given");
+      }
+
+      // Need to unencrypt the private key.
+      const decrypted = pki.decryptRsaPrivateKey(
+        this._cryptoCache.key,
+        config.p,
+      );
+      if (!decrypted) {
+        throw new Error("failed to decrypt key - check passphrase");
+      }
+      this._cryptoCache.key = pki.privateKeyToPem(decrypted);
+    }
+
+    if (this._voltConfig.ca_pem) {
+      if (!this._cryptoCache.ca) {
+        // Copy the volt signing CA to the crypto cache.
+        this._cryptoCache.ca = this._voltConfig.ca_pem;
+      }
+
+      // Pre-cache the target Volt public key by extracting it from the signing certificate.
+      const voltCert = forge.pki.certificateFromPem(this._voltConfig.ca_pem);
+
+      // Extract Volt public key (used for encrypting Relay payloads).
+      this._voltPublicKey = forge.pki.publicKeyToPem(voltCert.publicKey);
+      this._voltFingerprint = voltUtils.createPublicKeyFingerprint(
+        this._voltPublicKey,
+      );
+    }
+  }
+
+  get config() {
+    return this._config;
+  }
+
+  get cache() {
+    return this._cryptoCache;
+  }
+
+  get voltFingerprint() {
+    return this._voltFingerprint;
+  }
+
+  getKey() {
+    const privateKey = pki.privateKeyFromPem(this._cryptoCache.key);
+    const publicKey = pki.rsa.setPublicKey(privateKey.n, privateKey.e);
+    return { privateKey, publicKey };
+  }
+
+  /**
+   * Retrieves and re-hydrates the pub/priv key data from the crypto cache, or creates one if not found.
+   */
+  createKey() {
+    if (this._cryptoCache.key) {
+      // Already have key data in the cache in pem format => create fully-formed pki instances.
+      log("createKey - key already exists");
+      return Promise.resolve(this.getKey());
+    } else {
+      log("creating key");
+      return new Promise((resolve, reject) => {
+        pki.rsa.generateKeyPair({ bits: 2048, workers: -1 }, (err, keypair) => {
+          if (err) {
+            log("failure creating key [%s]", err.message);
+            reject(err);
+          } else {
+            log("successfully created key");
+            const pem = pki.privateKeyToPem(keypair.privateKey);
+            this._cryptoCache.key = pem;
+            resolve(keypair);
+          }
+        });
+      });
+    }
+  }
+
+  /**
+   * Create cryptocache from scratch.
+   */
+  initialise() {
+    return this.createKey()
+      .then((/* keypair */) => {
+        return this.saveCache();
+      })
+      .then(() => {
+        return this._cryptoCache;
+      })
+      .catch((err) => {
+        log("failure initialising crypto [%s]", err.message);
+        return Promise.reject(err);
+      });
+  }
+
+  get isBound() {
+    return !!this._cryptoCache.cert;
+  }
+
+  /**
+   * Signs the identity resource id using the private key.
+   * @param {*} audience the token audience (usually the target volt)
+   * @param {*} tunnelling flag indicating if the token is required for a tunnelled connection
+   * @param {*} ttl time to live in seconds (default to 1 minute)
+   */
+  getIdentityToken(audience, tunnelling = false, ttl = 60) {
+    if (!this._cryptoCache.key) {
+      throw new Error("crypto cache invalid");
+    }
+
+    const keyPair = this.getKey();
+    const publicKeyPem = pki.publicKeyToPem(keyPair.publicKey);
+    const base58Key = voltUtils.createPublicKeyFingerprint(publicKeyPem);
+
+    log("base58 key is %s", base58Key);
+
+    // Allow TTL either side of the current time.
+    // @todo - fix with server time sync on volt connection.
+    const payload = {
+      aud: audience,
+      iat: Math.floor(Date.now() / 1000) - ttl,
+      exp: Math.floor(Date.now() / 1000) + ttl,
+    };
+
+    let sharedKey;
+    if (tunnelling) {
+      // Initialise the Relay encryption key.
+      sharedKey = VoltCredential.aesCreateKey();
+
+      // Encrypt the key details using the target Volt public key and include this in the JWT payload.
+      payload.sk = VoltCredential.rsaEncrypt(
+        this._voltPublicKey,
+        sharedKey.key,
+      );
+      payload.iv = VoltCredential.rsaEncrypt(this._voltPublicKey, sharedKey.iv);
+    }
+
+    // Sign synchronously.
+    const token = jwt.sign(payload, this._cryptoCache.key, {
+      algorithm: rs256Algorithm,
+      keyid: base58Key,
+    });
+
+    // Return the token along with any encryption key details.
+    return {
+      token,
+      sharedKey,
+    };
+  }
+
+  /**
+   * Creates the metadata required for a grpc call, including the Volt authentication token
+   * and optionally tunnel encryption parameters.
+   * @param {*} grpc
+   * @param {*} audience
+   * @param {*} tunnelling
+   * @param {*} ttl
+   * @returns
+   */
+  getIdentityMetadata(grpc, audience, tunnelling = false, ttl = 60) {
+    const identityToken = this.getIdentityToken(
+      audience || this._voltConfig.id,
+      tunnelling,
+      ttl,
+    );
+    const metadata = new grpc.Metadata();
+    metadata.add(constants.authTokenName, identityToken.token);
+    return { ...identityToken, metadata };
+  }
+
+  saveCache() {
+    if (this._persistCache) {
+      const clone = { ...this._config, credential: { ...this._cryptoCache } };
+      if (this._config.p) {
+        // A passphrase option exists => encrypt the key before writing the cache file.
+        const privateKey = pki.privateKeyFromPem(this._cryptoCache.key);
+        clone.credential.key = pki.encryptRsaPrivateKey(
+          privateKey,
+          this._config.p,
+        );
+      }
+      fs.writeFileSync(this._configPath, JSON.stringify(clone, null, 2));
+    }
+  }
+
+  static aesCreateKey() {
+    // Generate random key for the AES-256 algorithm (32 bytes = 256 bits).
+    const key = crypto.randomBytes(32);
+    const iv = crypto.randomBytes(16);
+    return { key, iv };
+  }
+
+  static aesEncrypt(buffer, key, iv) {
+    const cipher = crypto.createCipheriv(aesAlgorithm, key, iv);
+    const crypted = Buffer.concat([cipher.update(buffer), cipher.final()]);
+    return crypted;
+  }
+
+  static aesDecrypt(buffer, key, iv) {
+    const cipher = crypto.createDecipheriv(aesAlgorithm, key, iv);
+    const decrypted = Buffer.concat([cipher.update(buffer), cipher.final()]);
+    return decrypted;
+  }
+
+  static rsaEncrypt(key, buffer) {
+    return crypto.publicEncrypt(key, buffer).toString("base64");
+  }
 }