@tdxvolt/volt-client-grpc 0.14.61 → 0.15.0

package/src/rpc-invocation.js

@@ -0,0 +1,277 @@
+import debug from "debug";
+import { VoltCredential } from "./volt-credential.js";
+import jwt from "jsonwebtoken";
+import EventEmitter from "events";
+
+const log = debug("rpc-invocation");
+
+class RpcInvocation extends EventEmitter {
+  #voltClient = null;
+  #voltConnection = null;
+  #token = null;
+  #encryptKey = null;
+  #encryptIV = null;
+  #invokeId = null;
+  #payload = null;
+  #isJSON = false;
+  #methodDescriptor = null;
+  #methodName = null;
+
+  constructor(voltClient, voltConnection) {
+    super();
+    this.#voltClient = voltClient;
+    this.#voltConnection = voltConnection;
+  }
+
+  get id() {
+    return this.#invokeId;
+  }
+
+  get payload() {
+    if (!this.#payload) {
+      return null;
+    }
+
+    let deserialisedPayload = null;
+
+    if (this.#isJSON) {
+      // Don't need to deserialise JSON payload.
+      deserialisedPayload = this.#payload;
+    } else if (this.#methodDescriptor) {
+      deserialisedPayload = this.#methodDescriptor.requestDeserialize(
+        this.#payload
+      );
+    } else {
+      log("unexpected: no method descriptor");
+      throw new Error(
+        "no method descriptor - set this before accessing payload"
+      );
+    }
+
+    return deserialisedPayload;
+  }
+
+  get methodName() {
+    return this.#methodName;
+  }
+
+  set methodDescriptor(methodDescriptor) {
+    this.#methodDescriptor = methodDescriptor;
+  }
+
+  #decodeToken(token) {
+    // We don't verify the token at this point, as we don't know the public key.
+    // The rpc implementation should do the verification using the Volt API (e.g. CanAccessResource).
+    this.#token = jwt.decode(token);
+
+    if (this.#token.sk) {
+      // Decrypt the shared key and iv using the private key.
+      this.#encryptKey = VoltCredential.rsaDecrypt(
+        this.#voltClient.credential.cache.key,
+        this.#token.sk
+      );
+      this.#encryptIV = VoltCredential.rsaDecrypt(
+        this.#voltClient.credential.cache.key,
+        this.#token.iv
+      );
+    }
+
+    return Promise.resolve(this.#token);
+  }
+
+  initialise(invoke_request) {
+    this.#invokeId = invoke_request.invoke_id;
+
+    return this.#decodeToken(invoke_request.token)
+      .then(() => {
+        // Parse the initial payload.
+        return this.parsePayload(invoke_request);
+      })
+      .catch((err) => {
+        log("failure initialising invocation: %s", err.message);
+        return Promise.reject(err);
+      });
+  }
+
+  parsePayload(invoke_request) {
+    return new Promise((resolve, reject) => {
+      if (invoke_request.payload) {
+        let decryptedPayload;
+
+        if (this.#encryptKey) {
+          // Decrypt the actual payload using the shared key and iv.
+          decryptedPayload = VoltCredential.aesDecrypt(
+            invoke_request.payload,
+            this.#encryptKey,
+            this.#encryptIV
+          );
+        } else {
+          // No encryption => just use the payload.
+          decryptedPayload = invoke_request.payload;
+        }
+
+        const tunnelMethod = this.#voltClient.getVoltAPIClient().Tunnel;
+        const wrappedPayload =
+          tunnelMethod.responseDeserialize(decryptedPayload);
+
+        if (wrappedPayload.method_invoke) {
+          // This is the initial request payload.
+          this.#methodName = wrappedPayload.method_invoke.method_name;
+          this.#payload = wrappedPayload.method_invoke.request;
+          this.emit("payload", this);
+        } else if (wrappedPayload.method_payload) {
+          // This is a subsequent payload, e.g. for streaming rpcs.
+          this.#payload = wrappedPayload.method_payload.payload;
+          this.emit("payload", this);
+        } else if (wrappedPayload.method_end) {
+          this.#payload = wrappedPayload.method_end;
+          if (wrappedPayload.method_end.error) {
+            // The client has sent an error.
+            this.emit("error", this);
+          } else {
+            this.emit("end", this);
+          }
+        }
+
+        resolve();
+      } else if (invoke_request.json_payload) {
+        let decryptedPayload;
+
+        this.#isJSON = true;
+
+        if (this.#encryptKey) {
+          // Decrypt the actual payload using the shared key and iv.
+          decryptedPayload = VoltCredential.aesDecrypt(
+            Buffer.from(invoke_request.json_payload, "base64"),
+            this.#encryptKey,
+            this.#encryptIV
+          );
+        } else {
+          // No encryption => just use the payload.
+          decryptedPayload = invoke_request.json_payload;
+        }
+
+        try {
+          const wrappedPayload = JSON.parse(decryptedPayload.toString());
+
+          if (wrappedPayload.method_invoke) {
+            this.#methodName = wrappedPayload.method_invoke.method_name;
+            this.#payload = JSON.parse(
+              wrappedPayload.method_invoke.json_request
+            );
+            this.emit("payload", this);
+          } else if (wrappedPayload.method_payload) {
+            this.#payload = JSON.parse(
+              wrappedPayload.method_payload.json_payload
+            );
+            this.emit("payload", this);
+          } else if (wrappedPayload.method_end) {
+            // We don't need to do anything here, since we notify the client when we receive the client_end.
+            log("method_end received");
+          }
+        } catch (err) {
+          log("JSON.parse failure parsing json_payload: %s", err.message);
+          reject(err);
+        }
+
+        resolve();
+      } else if (invoke_request.client_end) {
+        this.emit("end", this);
+      } else {
+        // Do we need to support json_payload here?
+        reject(new Error("No payload in invoke request"));
+      }
+    }).catch((err) => {
+      log("failure parsing payload: %s", err.message);
+      return Promise.reject(err);
+    });
+  }
+
+  sendResponse(response) {
+    let responsePayload;
+    if (this.#isJSON) {
+      responsePayload = JSON.stringify({
+        method_payload: { json_payload: JSON.stringify(response) }
+      });
+    } else {
+      // We need to serialise the response, and then wrap it in a RemoteRequest.
+      const serialisedResponse =
+        this.#methodDescriptor.responseSerialize(response);
+      const tunnelMethod = this.#voltClient.getVoltAPIClient().Tunnel;
+      responsePayload = tunnelMethod.requestSerialize({
+        method_payload: { payload: serialisedResponse }
+      });
+    }
+
+    if (this.#token.sk) {
+      // Encrypt the response using the shared key and iv.
+      responsePayload = VoltCredential.aesEncrypt(
+        responsePayload,
+        this.#encryptKey,
+        this.#encryptIV
+      );
+    }
+
+    const invokeResponse = {
+      invoke_id: this.#invokeId
+    };
+
+    if (this.#isJSON) {
+      invokeResponse.json_payload =
+        Buffer.from(responsePayload).toString("base64");
+    } else {
+      invokeResponse.payload = responsePayload;
+    }
+
+    this.#voltConnection.send({
+      invoke_response: invokeResponse
+    });
+  }
+
+  sendEnd(errorMessage) {
+    const tunnelMethod = this.#voltClient.getVoltAPIClient().Tunnel;
+
+    let endPayload;
+    if (errorMessage) {
+      endPayload = {
+        method_end: { error: errorMessage, ended: true }
+      };
+    } else {
+      endPayload = {
+        method_end: { ended: true }
+      };
+    }
+
+    if (this.#isJSON) {
+      endPayload = JSON.stringify(endPayload);
+    } else {
+      endPayload = tunnelMethod.requestSerialize(endPayload);
+    }
+
+    if (this.#token.sk) {
+      // Encrypt the response using the shared key and iv.
+      endPayload = VoltCredential.aesEncrypt(
+        endPayload,
+        this.#encryptKey,
+        this.#encryptIV
+      );
+    }
+
+    const invokeResponse = {
+      invoke_id: this.#invokeId,
+      server_end: true
+    };
+
+    if (this.#isJSON) {
+      invokeResponse.json_payload = Buffer.from(endPayload).toString("base64");
+    } else {
+      invokeResponse.payload = endPayload;
+    }
+
+    this.#voltConnection.send({
+      invoke_response: invokeResponse
+    });
+  }
+}
+
+export default RpcInvocation;

package/src/utils.js

@@ -11,7 +11,7 @@ export const createSecureContextOptions = (cryptoOptions) => {
   const tlsOptions = {
     cert: Buffer.from(cryptoOptions.cert),
     ca: Buffer.from(cryptoOptions.ca),
-    key: Buffer.from(cryptoOptions.key),
+    key: Buffer.from(cryptoOptions.key)
   };
   return tlsOptions;
 };
@@ -27,7 +27,7 @@ export const getServiceAddress = (mdnsService) => {
     const ipv4 = _.find(mdnsService.addresses, (addy) => ip.isV4Format(addy));
     const serviceDetails = {
       host: ipv4,
-      port: mdnsService.port,
+      port: mdnsService.port
     };
 
     address = `${serviceDetails.host}:${serviceDetails.port}`;
@@ -103,3 +103,44 @@ export const getDIDResolutionURL = (didIn) => {
 
   return `https://${hostName}/api/identity/${didGUID}`;
 };
+
+const forgePrivateKeyToPem = (decryptedKey) => {
+  // Convert a Forge private key to an ASN.1 RSAPrivateKey
+  const asnPrivateKey = pki.privateKeyToAsn1(decryptedKey);
+
+  // Wrap an RSAPrivateKey ASN.1 object in a PKCS#8 ASN.1 PrivateKeyInfo
+  const privateKeyInfo = pki.wrapRsaPrivateKey(asnPrivateKey);
+
+  // Convert a PKCS#8 ASN.1 PrivateKeyInfo to PEM
+  return pki.privateKeyInfoToPem(privateKeyInfo);
+};
+
+export const createRSAKey = (passphrase = "") => {
+  return new Promise((resolve, reject) => {
+    pki.rsa.generateKeyPair({ bits: 2048, workers: -1 }, (err, keypair) => {
+      if (err) {
+        reject(err);
+      } else {
+        let pem;
+        if (passphrase) {
+          pem = pki.encryptRsaPrivateKey(keypair.privateKey, passphrase);
+        } else {
+          pem = forgePrivateKeyToPem(keypair.privateKey);
+        }
+
+        resolve({ keypair, pem });
+      }
+    });
+  });
+};
+
+export const sha256Base64 = (msg) => {
+  const md = forge.md.sha256.create();
+  md.update(msg);
+  return forge.util.encode64(md.digest().bytes());
+};
+
+export const decryptPrivateKey = (pem, passphrase) => {
+  const decryptedKey = pki.decryptRsaPrivateKey(pem, passphrase);
+  return forgePrivateKeyToPem(decryptedKey);
+};

package/src/volt-client-internal.js

@@ -5,11 +5,17 @@ import bent from "bent";
 import forge from "node-forge";
 import lodash from "lodash";
 import VoltConnection from "./volt-connection.js";
-import { getServiceDescriptors } from "./proto-utils.js";
+import { join } from "path";
+import {
+  createServiceProtobufFiles,
+  getServiceDescriptors,
+  getServiceDescriptorsFromPath
+} from "./proto-utils.js";
 import { createClient as createGrpcClient } from "./grpc-utils.js";
 import * as voltUtils from "./utils.js";
 import { constants } from "./constants.js";
 import GRPCCall from "./grpc-call.js";
+import RpcInvocation from "./rpc-invocation.js";
 
 const { pki } = forge;
 const { filter, pick } = lodash;
@@ -22,51 +28,53 @@ const voltServices = [
   constants.serviceType.sqliteServerAPI,
   constants.serviceType.ssiAPI,
   constants.serviceType.relayAPI,
-  constants.serviceType.wireAPI,
+  constants.serviceType.wireAPI
 ];
 
 function issueBind(bindRequest, ttl) {
   // eslint-disable-next-line no-use-before-define
-  return unaryCall.call(this, "Bind", bindRequest).then((bindResponse) => {
-    log("got binding request response %j", bindResponse);
-    if (bindResponse.status?.code) {
-      log("error in bind response: %s", bindResponse.status.message);
-      return Promise.reject(new Error(bindResponse.status.message));
-    } else {
-      switch (bindResponse.decision) {
-        case "POLICY_DECISION_PERMIT": {
-          //
-          // The request status is permit => cache the bind response info.
-          //
-
-          // This is the certificate assigned to us by the volt.
-          this._credential.cache.cert = bindResponse.cert;
-
-          // This is the signing CA used by the volt.
-          this._credential.cache.ca = bindResponse.chain;
-
-          // Identity resource id is assigned by the volt.
-          this._credential.cache.client_id = bindResponse.identity_id;
-          this._credential.saveCache();
-          break;
-        }
-        case "POLICY_DECISION_DENY": {
-          log(">>>>>>>>>>>>>>> access request is DENIED <<<<<<<<<<<<<<<<<<<");
-          break;
-        }
-        case "POLICY_DECISION_PROMPT":
-        case "POLICY_DECISION_PENDING": {
-          log("access pending approval - waiting...");
-          break;
+  return unaryCallInternal
+    .call(this, "Bind", bindRequest)
+    .then((bindResponse) => {
+      log("got binding request response %j", bindResponse);
+      if (bindResponse.status?.code) {
+        log("error in bind response: %s", bindResponse.status.message);
+        return Promise.reject(new Error(bindResponse.status.message));
+      } else {
+        switch (bindResponse.decision) {
+          case "POLICY_DECISION_PERMIT": {
+            //
+            // The request status is permit => cache the bind response info.
+            //
+
+            // This is the certificate assigned to us by the volt.
+            this._credential.cache.cert = bindResponse.cert;
+
+            // This is the signing CA used by the volt.
+            this._credential.cache.ca = bindResponse.chain;
+
+            // Identity resource id is assigned by the volt.
+            this._credential.cache.client_id = bindResponse.identity_id;
+            this._credential.saveCache();
+            break;
+          }
+          case "POLICY_DECISION_DENY": {
+            log(">>>>>>>>>>>>>>> access request is DENIED <<<<<<<<<<<<<<<<<<<");
+            break;
+          }
+          case "POLICY_DECISION_PROMPT":
+          case "POLICY_DECISION_PENDING": {
+            log("access pending approval - waiting...");
+            break;
+          }
+          default:
+            log("ignoring unknown bind descision %s", bindResponse.status);
+            break;
         }
-        default:
-          log("ignoring unknown bind descision %s", bindResponse.status);
-          break;
       }
-    }
 
-    return bindResponse.decision;
-  });
+      return bindResponse.decision;
+    });
 }
 
 function findDIDDocumentService(document, serviceType) {
@@ -90,13 +98,13 @@ export async function bindInternal() {
       log("attempting to retrieve Relay information from %s", relayURL);
       this._voltConfig.relay = await fetchVoltConfig.call(
         this,
-        `${relayURL}/discovery`,
+        `${relayURL}/discovery`
       );
       if (this._voltConfig.relay.ca_pem) {
         log(
           "Auto-fetched Relay CA %s, remote address %s",
           this._voltConfig.relay.ca_pem,
-          this._voltConfig.relay.address,
+          this._voltConfig.relay.address
         );
       } else {
         throw new Error("Unable to fetch Relay CA - cannot securely connect.");
@@ -109,7 +117,7 @@ export async function bindInternal() {
 
     if (!this._credential.cache.ca) {
       throw new Error(
-        "No certificate authority found in configuration for target Volt - check configuration",
+        "No certificate authority found in configuration for target Volt - check configuration"
       );
     }
 
@@ -129,30 +137,30 @@ export async function bindInternal() {
       binding_name: this._config.client_name,
       public_key: publicKeyPem,
       host: this._credential.cache.bindIp,
-      x509_credential: [],
+      x509_credential: []
     };
 
     if (this._credential.cache.cert) {
       bindRequest.x509_credential = [
-        this._credential.cache.cert + this._credential.cache.ca,
+        this._credential.cache.cert + this._credential.cache.ca
       ];
     }
 
     if (this._voltConfig.challenge_code) {
       bindRequest.challenge = voltUtils.signBase64(
         keyPair.privateKey,
-        this._voltConfig.challenge_code,
+        this._voltConfig.challenge_code
       );
     } else {
       log(
-        "****no Volt challenge code available**** => not sending challenge signature",
+        "****no Volt challenge code available**** => not sending challenge signature"
       );
     }
 
     // For remote connections, add our cloud-issued certificate as an additional credential.
     if (this._voltConfig?.relay?.ca_pem && this._credential.cache.cloud_cert) {
       bindRequest.x509_credential = bindRequest.x509_credential.concat(
-        this._credential.cache.cloud_cert + this._voltConfig.relay.ca_pem,
+        this._credential.cache.cloud_cert + this._voltConfig.relay.ca_pem
       );
     }
 
@@ -172,7 +180,7 @@ export async function bindInternal() {
       decision = await issueBind.call(
         this,
         bindRequest,
-        this._voltConfig.bindRequestTTL,
+        this._voltConfig.bindRequestTTL
       );
       log("binding decision: %s", decision);
     } while (
@@ -233,6 +241,34 @@ export function connectInternal(helloPayload) {
       this.emit("evt", evt);
     });
 
+    this._voltConnection.on("ping", (ping) => {
+      this.emit("ping", ping);
+    });
+
+    this._voltConnection.on("invoke_request", (invoke_request) => {
+      const invokeId = invoke_request.invoke_id;
+      if (this._activeRPC[invokeId]) {
+        this._activeRPC[invokeId].parsePayload(invoke_request);
+      } else {
+        const rpcInvocation = new RpcInvocation(this, this._voltConnection);
+
+        rpcInvocation.on("end", () => {
+          log("removing active RPC [%s]", invokeId);
+          this._activeRPC[invokeId] = undefined;
+        });
+
+        rpcInvocation
+          .initialise(invoke_request)
+          .then(() => {
+            this._activeRPC[invokeId] = rpcInvocation;
+            this.emit("invoke_request", rpcInvocation);
+          })
+          .catch((err) => {
+            log("invoke_request - error [%s]", err.message);
+          });
+      }
+    });
+
     return this._voltConnection.connect(helloPayload);
   } catch (err) {
     log("connect - error [%s]", err.message);
@@ -259,18 +295,69 @@ export function getVoltAPIClientInternal() {
       this._credential,
       this.isRemote && !this.isVoltRelay,
       this._voltConfig?.relay?.cloud ? this._voltConfig.id : "",
-      this._voltConfig?.relay?.cloud ? this._voltConfig.id : "",
+      this._voltConfig?.relay?.cloud ? this._voltConfig.id : ""
     );
   }
 
   return this._cachedClient;
 }
 
-export function unaryCall(method, request) {
-  return new Promise((resolve, reject) => {
-    const grpcClient = this.getVoltAPIClient();
+export function getAPIClientInternal(service) {
+  if (!this._cachedService[service.id]) {
+    const isRelayedService =
+      service.service_description.host_type === "SERVICE_HOST_TYPE_RELAYED";
+
+    const serviceAddress = this.isRemote
+      ? this._voltConfig.relay.address
+      : service.service_description.host_address;
+
+    createServiceProtobufFiles(service, "./service-proto");
+
+    log("creating API service client on %s", serviceAddress);
+    let serviceDescriptors = {};
+    const fullProtoPath = join(process.cwd(), "./service-proto");
+    for (let api of service.service_description.service_api) {
+      const packageDescriptors = getServiceDescriptorsFromPath(
+        this._grpc,
+        fullProtoPath,
+        api
+      );
+      serviceDescriptors = { ...serviceDescriptors, ...packageDescriptors };
+    }
+
+    this._cachedService[service.id] = createGrpcClient(
+      this._grpc,
+      serviceDescriptors,
+      serviceAddress,
+      this._credential,
+      this.isRemote && !this.isVoltRelay,
+      this._voltConfig?.relay?.cloud ? this._voltConfig.id : "",
+      this._voltConfig?.relay?.cloud ? this._voltConfig.id : ""
+    );
+  }
 
-    const call = new GRPCCall(this, method, "METHOD_TYPE_UNARY");
+  return this._cachedService[service.id];
+}
+
+export function getServiceClient(service) {
+  let grpcClient;
+  if (
+    service &&
+    service?.service_description.host_type !== "SERVICE_HOST_TYPE_BUILTIN"
+  ) {
+    grpcClient = getAPIClientInternal.call(this, service);
+  } else {
+    grpcClient = getVoltAPIClientInternal.call(this);
+  }
+
+  return grpcClient;
+}
+
+export function unaryCallInternal(method, request, service) {
+  const grpcClient = getServiceClient.call(this, service);
+
+  return new Promise((resolve, reject) => {
+    const call = new GRPCCall(this, method, "METHOD_TYPE_UNARY", service);
 
     let response = null;
 
@@ -298,6 +385,16 @@ export function unaryCall(method, request) {
   });
 }
 
+export function streamingCallInternal(methodType, method, request, service) {
+  const grpcClient = getServiceClient.call(this, service);
+
+  const call = new GRPCCall(this, method, methodType, service);
+
+  call.start(grpcClient, request);
+
+  return call;
+}
+
 export async function fetchVoltConfig(discovery_url) {
   try {
     const getJSON = bent("json");
@@ -317,13 +414,13 @@ export async function fetchVoltConfig(discovery_url) {
       "ca_pem",
       "challenge_code",
       "cloud",
-      "relay",
+      "relay"
     );
 
     return voltConfig;
   } catch (err) {
     throw new Error(
-      `Failure loading config from ${discovery_url}: ${err.message}`,
+      `Failure loading config from ${discovery_url}: ${err.message}`
     );
   }
 }
@@ -339,13 +436,13 @@ export async function fetchVoltConfigFromDID(volt_did) {
     const didDocument = await getJSON(didResolution);
     const voltConfigServices = findDIDDocumentService(
       didDocument,
-      constants.didServiceType.voltConfig,
+      constants.didServiceType.voltConfig
     );
     if (voltConfigServices.length !== 1) {
       log(
         "Unexpected number of Volt configuration endpoints found in DID document for %s, services found: %d",
         volt_did,
-        voltConfigServices.length,
+        voltConfigServices.length
       );
     }
 
@@ -353,7 +450,7 @@ export async function fetchVoltConfigFromDID(volt_did) {
     return await fetchVoltConfig.call(this, serviceEndpoint);
   } catch (err) {
     throw new Error(
-      `Failure fetching Volt config from DID document ${volt_did}: ${err.message}`,
+      `Failure fetching Volt config from DID document ${volt_did}: ${err.message}`
     );
   }
 }