@tdxvolt/volt-client-grpc 0.15.1 → 0.16.0-beta.10

package/lib/index.cjs

@@ -38,37 +38,37 @@ const constants = {
   collectionOperation: {
     add: "ADD",
     remove: "REMOVE",
-    update: "UPDATE",
+    update: "UPDATE"
   },
   crypto: {
     subjectDefaults: [
       {
         name: "countryName",
-        value: "GB",
+        value: "GB"
       },
       {
         name: "localityName",
-        value: "Southampton",
+        value: "Southampton"
       },
       {
         name: "organizationName",
-        value: "nquiringminds Ltd",
-      },
+        value: "nquiringminds Ltd"
+      }
     ],
-    userIdOID: "0.9.2342.19200300.100.1.1",
+    userIdOID: "0.9.2342.19200300.100.1.1"
   },
   defaultDIDHostName: "cloud.tdxvolt.com",
   didServiceType: {
-    voltConfig: "tdx-volt-config",
+    voltConfig: "tdx-volt-config"
   },
   identityType: {
     did: "did",
-    volt: "volt",
+    volt: "volt"
   },
   onlineStatus: {
     offline: "offline",
     online: "online",
-    unknown: "unknown",
+    unknown: "unknown"
   },
   publicKeyPrefix: "-----BEGIN PUBLIC KEY-----",
   privateKeyPrefix: "-----BEGIN RSA PRIVATE KEY-----",
@@ -79,14 +79,14 @@ const constants = {
     proxy: "proxy",
     proxyView: "proxy-view",
     vc: "vc",
-    vcView: "vc-view",
+    vcView: "vc-view"
   },
   voltStatus: {
     pending: "",
     online: "online",
     offline: "offline",
     deleted: "deleted",
-    revoked: "revoked",
+    revoked: "revoked"
   },
   /**
    * These top-level service types should map to a protobuf definition
@@ -96,16 +96,16 @@ const constants = {
     fileAPI: "tdx.volt_api.volt.v1.FileAPI",
     sqliteServerAPI: "tdx.volt_api.data.v1.SqliteServerAPI",
     sqliteDatabaseAPI: "tdx.volt_api.data.v1.SqliteDatabaseAPI",
-    ssiAPI: "tdx.volt_api.ssi.v1.SsiAPI",
+    ssiAPI: "tdx.volt_api.volt.v1.SsiAPI",
     relayAPI: "tdx.volt_api.relay.v1.RelayAPI",
     voltAPI: "tdx.volt_api.volt.v1.VoltAPI",
-    wireAPI: "tdx.volt_api.volt.v1.WireAPI",
+    wireAPI: "tdx.volt_api.volt.v1.WireAPI"
   },
   tunnelInvokeMethod: "/tdx.volt_api.volt.v1.VoltAPI/Invoke",
   tunnelPingInterval: 10000,
   tunnelPingTimeout: 2500,
   tunnelReconnectAfter: 30000,
-  tunnelTimeoutInterval: 10000 * 2, // This must always be greater than `tunnelPingInterval`.
+  tunnelTimeoutInterval: 10000 * 2 // This must always be greater than `tunnelPingInterval`.
 };
 
 const { pki: pki$2 } = forge__default["default"];
@@ -167,11 +167,16 @@ const createPublicKeyFingerprint = (key) => {
   return createBase58Hash(removeCarriageReturn(key));
 };
 
+const base64ToBase64Url = (base64) => {
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+
 const signBase64 = (key, msg) => {
   const md = forge__default["default"].md.sha256.create();
   md.update(msg);
   const signature = key.sign(md);
-  return forge__default["default"].util.encode64(signature);
+  const base64Standard = forge__default["default"].util.encode64(signature);
+  return base64ToBase64Url(base64Standard);
 };
 
 const verifyBase64 = (key, msg, signature) => {
@@ -240,7 +245,8 @@ const createRSAKey = (passphrase = "") => {
 const sha256Base64 = (msg) => {
   const md = forge__default["default"].md.sha256.create();
   md.update(msg);
-  return forge__default["default"].util.encode64(md.digest().bytes());
+  const base64Standard = forge__default["default"].util.encode64(md.digest().bytes());
+  return base64ToBase64Url(base64Standard);
 };
 
 const decryptPrivateKey = (pem, passphrase) => {
@@ -248,6 +254,20 @@ const decryptPrivateKey = (pem, passphrase) => {
   return forgePrivateKeyToPem(decryptedKey);
 };
 
+const jwsSignature = (signature) => {
+  //
+  // Use an unattached payload JWS signature for the DID document proof.
+  // This is a JWS with an empty payload and a detached payload digest.
+  //
+  // (https://tools.ietf.org/html/rfc7797#appendix-F) as used in the VC spec
+  // (https://www.w3.org/TR/vc-data-model/).
+  //
+  const jwsHeader = base64ToBase64Url(
+    forge__default["default"].util.encode64('{"alg":"RS256","b64": false}')
+  );
+  return jwsHeader + ".." + signature;
+};
+
 var utils = /*#__PURE__*/Object.freeze({
   __proto__: null,
   createSecureContextOptions: createSecureContextOptions,
@@ -258,12 +278,14 @@ var utils = /*#__PURE__*/Object.freeze({
   removeCarriageReturn: removeCarriageReturn,
   createBase58Hash: createBase58Hash,
   createPublicKeyFingerprint: createPublicKeyFingerprint,
+  base64ToBase64Url: base64ToBase64Url,
   signBase64: signBase64,
   verifyBase64: verifyBase64,
   getDIDResolutionURL: getDIDResolutionURL,
   createRSAKey: createRSAKey,
   sha256Base64: sha256Base64,
-  decryptPrivateKey: decryptPrivateKey
+  decryptPrivateKey: decryptPrivateKey,
+  jwsSignature: jwsSignature
 });
 
 /* eslint-disable no-underscore-dangle */
@@ -567,8 +589,16 @@ class VoltCredential {
     return this._cryptoCache;
   }
 
-  get clientId() {
-    return this._cryptoCache.client_id;
+  get certificate() {
+    return this._cryptoCache.cert;
+  }
+
+  get sessionId() {
+    return this._cryptoCache.session_id;
+  }
+
+  get identityId() {
+    return this._cryptoCache.identity_id;
   }
 
   get voltPublicKey() {
@@ -656,7 +686,7 @@ class VoltCredential {
       aud: audience,
       iat: Math.floor(Date.now() / 1000) - ttl,
       exp: Math.floor(Date.now() / 1000) + ttl,
-      sub: this._cryptoCache.client_id
+      sub: this._cryptoCache.session_id
     };
 
     let sharedKey;
@@ -738,12 +768,13 @@ class VoltCredential {
   }
 
   static rsaEncrypt(key, buffer) {
-    return crypto__default["default"].publicEncrypt(key, buffer).toString("base64");
+    const cipher = crypto__default["default"].publicEncrypt(key, buffer);
+    return cipher.toString("base64url");
   }
 
   static rsaDecrypt(key, buffer) {
     const keyObj = crypto__default["default"].createPrivateKey(key);
-    const cipher = Buffer.from(buffer, "base64");
+    const cipher = Buffer.from(buffer, "base64url");
     return Buffer.from(crypto__default["default"].privateDecrypt(keyObj, cipher));
   }
 }
@@ -881,7 +912,7 @@ const log$4 = debug__default["default"]("volt-client-grpc:grpc-call");
 function _prepareInvokeRequest(
   request,
   method,
-  methodType = "METHOD_TYPE_UNARY",
+  methodType = "METHOD_TYPE_UNARY"
 ) {
   const isServiceRelayed =
     this._service?.service_description.host_type ===
@@ -894,7 +925,7 @@ function _prepareInvokeRequest(
       this._voltClient.voltConfig.id,
     this._service?.service_description.host_public_key ||
       this._voltClient.credential.voltPublicKey,
-    true,
+    true
   );
 
   let invokeRequest;
@@ -925,42 +956,40 @@ function _prepareInvokeRequest(
         method_name: this._grpcClient[method].path,
         method_type: methodType,
         token: methodToken.token,
-        request: requestPayload,
-      },
+        request: requestPayload
+      }
     };
 
-    let targetFingerprint = [];
+    let targetDID = [];
     let invokePayload;
     if (this._voltClient.isVoltRelay || isServiceRelayed) {
       // When sending via a relay we need to encrypt the payload.
       invokePayload = VoltCredential.aesEncrypt(
         tunnelMethod.responseSerialize(tunnelResp),
         methodToken.sharedKey.key,
-        methodToken.sharedKey.iv,
+        methodToken.sharedKey.iv
       );
     } else {
       invokePayload = tunnelMethod.responseSerialize(tunnelResp);
     }
 
     if (this._voltClient.isVoltRelay) {
-      targetFingerprint.push(this._voltClient.credential.voltFingerprint);
+      targetDID.push(this._voltClient.voltConfig.id);
     }
 
     if (isServiceRelayed) {
       // Add another relay hop if the target service is relayed.
       log$4("target service is relayed");
-      targetFingerprint.push(
-        this._service.service_description.host_fingerprint,
-      );
+      targetDID.push(this._service.service_description.host_client_id);
     }
 
-    log$4("target is %j", targetFingerprint);
+    log$4("target is %j", targetDID);
 
     invokeRequest = {
-      target_fingerprint: targetFingerprint,
+      target_did: targetDID,
       token: methodToken.token,
       payload: invokePayload,
-      target_service_id: isServiceRelayed ? this._service.id : undefined,
+      target_service_id: isServiceRelayed ? this._service.id : undefined
     };
 
     // Replace the target method with a call to Invoke on the relay Volt.
@@ -973,7 +1002,7 @@ function _prepareInvokeRequest(
     meta: methodToken,
     method: callMethod,
     methodName: method,
-    request: invokeRequest,
+    request: invokeRequest
   };
 }
 
@@ -993,18 +1022,18 @@ function _preparePayloadRequest(request, invokeInfo) {
 
     const tunnelResp = {
       method_payload: {
-        payload: requestPayload,
-      },
+        payload: requestPayload
+      }
     };
 
     const invokePayload = VoltCredential.aesEncrypt(
       tunnelMethod.responseSerialize(tunnelResp),
       invokeInfo.meta.sharedKey.key,
-      invokeInfo.meta.sharedKey.iv,
+      invokeInfo.meta.sharedKey.iv
     );
 
     payloadRequest = {
-      payload: invokePayload,
+      payload: invokePayload
     };
   } else {
     payloadRequest = request;
@@ -1028,7 +1057,7 @@ function _parseResponse(method, meta, response) {
         decryptedPayload = VoltCredential.aesDecrypt(
           response.payload,
           meta.sharedKey.key,
-          meta.sharedKey.iv,
+          meta.sharedKey.iv
         );
       } else {
         decryptedPayload = response.payload;
@@ -1039,12 +1068,12 @@ function _parseResponse(method, meta, response) {
       if (responsePayload.payload === "method_payload") {
         try {
           invokeResponse.payload = this._grpcClient[method].responseDeserialize(
-            responsePayload.method_payload.payload,
+            responsePayload.method_payload.payload
           );
         } catch (err) {
           log$4("failure deserialising payload for %s", this._methodName);
           throw new Error(
-            "failure deserialising payload - check protobuf definition matches with data being sent",
+            "failure deserialising payload - check protobuf definition matches with data being sent"
           );
         }
       } else if (responsePayload.payload === "method_end") {
@@ -1058,11 +1087,11 @@ function _parseResponse(method, meta, response) {
         "Tunnel status received: %s, code %d, description: %s",
         response.status.message,
         response.status.code,
-        response.status.description || "n/a",
+        response.status.description || "n/a"
       );
       invokeResponse = {
         ended: true,
-        error: `Error in tunnel: ${response.status.message}`,
+        error: `Error in tunnel: ${response.status.message}`
       };
     } else {
       invokeResponse.methodId = response.invoke_id;
@@ -1072,11 +1101,11 @@ function _parseResponse(method, meta, response) {
     const decryptedPayload = VoltCredential.aesDecrypt(
       response,
       meta.sharedKey.key,
-      meta.sharedKey.iv,
+      meta.sharedKey.iv
     );
     invokeResponse = {
       payload:
-        this._grpcClient[method].responseDeserializeOriginal(decryptedPayload),
+        this._grpcClient[method].responseDeserializeOriginal(decryptedPayload)
     };
   } else {
     invokeResponse = { payload: response };
@@ -1106,7 +1135,7 @@ class GRPCCall extends EventEmitter__default["default"] {
       this,
       request,
       this._methodName,
-      this._methodType,
+      this._methodType
     );
 
     const isServiceRelayed =
@@ -1121,7 +1150,7 @@ class GRPCCall extends EventEmitter__default["default"] {
     }
 
     this._call = callClient[this._initialRequest.method](
-      this._initialRequest.meta.metadata,
+      this._initialRequest.meta.metadata
     );
 
     this._call.on("data", (streamResponse) => {
@@ -1130,14 +1159,14 @@ class GRPCCall extends EventEmitter__default["default"] {
           this,
           this._methodName,
           this._initialRequest.meta,
-          streamResponse,
+          streamResponse
         );
         if (parsedResponse.payload) {
           // Interpret a non-empty status message as an error.
           if (parsedResponse.payload?.status?.message) {
             this.emit(
               "error",
-              new Error(parsedResponse.payload.status.message),
+              new Error(parsedResponse.payload.status.message)
             );
           } else {
             this.emit("data", parsedResponse.payload);
@@ -1156,7 +1185,7 @@ class GRPCCall extends EventEmitter__default["default"] {
         log$4(
           "failure processing %s call response: %s",
           this._methodName,
-          err.message,
+          err.message
         );
         this.emit("error", err);
       }
@@ -1178,7 +1207,7 @@ class GRPCCall extends EventEmitter__default["default"] {
       log$4(
         "ended call %s, method id: %s",
         this._methodName,
-        this._initialRequest.methodId || "n/a - not tunnelling",
+        this._initialRequest.methodId || "n/a - not tunnelling"
       );
       this.emit("end");
     });
@@ -1211,7 +1240,7 @@ class GRPCCall extends EventEmitter__default["default"] {
       const payloadRequest = _preparePayloadRequest.call(
         this,
         request,
-        this._initialRequest,
+        this._initialRequest
       );
       return this._call.write(payloadRequest);
     } else {
@@ -1219,7 +1248,7 @@ class GRPCCall extends EventEmitter__default["default"] {
         this,
         request,
         this._methodName,
-        this._methodType,
+        this._methodType
       );
 
       return this._call.write(this._initialRequest.request);
@@ -1244,10 +1273,9 @@ function _cleanUp(immediateReconnect) {
     this._pingTimeoutTimer = 0;
   }
 
-  if (
-    !this._dying &&
-    (immediateReconnect || (this._autoRetry && !this._reconnectTimer))
-  ) {
+  if (this._dying) {
+    clearTimeout(this._reconnectTimer);
+  } else if (immediateReconnect || (this._autoRetry && !this._reconnectTimer)) {
     this._reconnectTimer = setTimeout(
       () => {
         this._reconnectTimer = 0;
@@ -1691,30 +1719,31 @@ const voltServices = [
   constants.serviceType.wireAPI
 ];
 
-function issueBind(bindRequest, ttl) {
+function issueAuthenticate(authenticateRequest, ttl) {
   // eslint-disable-next-line no-use-before-define
   return unaryCallInternal
-    .call(this, "Bind", bindRequest)
-    .then((bindResponse) => {
-      log$1("got binding request response %j", bindResponse);
-      if (bindResponse.status?.code) {
-        log$1("error in bind response: %s", bindResponse.status.message);
-        return Promise.reject(new Error(bindResponse.status.message));
+    .call(this, "Authenticate", authenticateRequest)
+    .then((authenticateResponse) => {
+      log$1("got authenticate response %j", authenticateResponse);
+      if (authenticateResponse.status?.code) {
+        log$1("error in bind response: %s", authenticateResponse.status.message);
+        return Promise.reject(new Error(authenticateResponse.status.message));
       } else {
-        switch (bindResponse.decision) {
+        switch (authenticateResponse.decision) {
           case "POLICY_DECISION_PERMIT": {
             //
             // The request status is permit => cache the bind response info.
             //
 
             // This is the certificate assigned to us by the volt.
-            this._credential.cache.cert = bindResponse.cert;
+            this._credential.cache.cert = authenticateResponse.cert;
 
             // This is the signing CA used by the volt.
-            this._credential.cache.ca = bindResponse.chain;
+            this._credential.cache.ca = authenticateResponse.chain;
 
             // Identity resource id is assigned by the volt.
-            this._credential.cache.client_id = bindResponse.identity_id;
+            this._credential.cache.session_id = authenticateResponse.session_id;
+
             this._credential.saveCache();
             break;
           }
@@ -1728,12 +1757,15 @@ function issueBind(bindRequest, ttl) {
             break;
           }
           default:
-            log$1("ignoring unknown bind descision %s", bindResponse.status);
+            log$1(
+              "ignoring unknown bind descision %s",
+              authenticateResponse.status
+            );
             break;
         }
       }
 
-      return bindResponse.decision;
+      return authenticateResponse.decision;
     });
 }
 
@@ -1746,7 +1778,7 @@ function findDIDDocumentService(document, serviceType) {
   return matches;
 }
 
-async function bindInternal() {
+async function authenticateInternal(useDID = true) {
   try {
     // Check if we need to resolve a Relay volt.
     if (
@@ -1760,6 +1792,7 @@ async function bindInternal() {
         this,
         `${relayURL}/discovery`
       );
+
       if (this._voltConfig.relay.ca_pem) {
         log$1(
           "Auto-fetched Relay CA %s, remote address %s",
@@ -1782,7 +1815,9 @@ async function bindInternal() {
     }
 
     const keyPair = this._credential.getKey();
-    const publicKeyPem = pki.publicKeyToPem(keyPair.publicKey);
+    const publicKeyPem = removeCarriageReturn(
+      pki.publicKeyToPem(keyPair.publicKey)
+    );
 
     if (!this._credential.cache.bindIp) {
       // Default the IP address if none is specified. This is used to set the SAN in the
@@ -1793,21 +1828,13 @@ async function bindInternal() {
     this._credential.saveCache();
 
     // Form the request message.
-    const bindRequest = {
+    const authenticateRequest = {
       binding_name: this._config.client_name,
-      public_key: publicKeyPem,
-      host: this._credential.cache.bindIp,
-      x509_credential: []
+      host: this._credential.cache.bindIp
     };
 
-    if (this._credential.cache.cert) {
-      bindRequest.x509_credential = [
-        this._credential.cache.cert + this._credential.cache.ca
-      ];
-    }
-
     if (this._voltConfig.challenge_code) {
-      bindRequest.challenge = signBase64(
+      authenticateRequest.challenge = signBase64(
         keyPair.privateKey,
         this._voltConfig.challenge_code
       );
@@ -1817,15 +1844,71 @@ async function bindInternal() {
       );
     }
 
-    // For remote connections, add our cloud-issued certificate as an additional credential.
-    if (this._voltConfig?.relay?.ca_pem && this._credential.cache.cloud_cert) {
-      bindRequest.x509_credential = bindRequest.x509_credential.concat(
-        this._credential.cache.cloud_cert + this._voltConfig.relay.ca_pem
+    if (!useDID) {
+      authenticateRequest.public_key = publicKeyPem;
+    } else if (!this._credential.cache.identity_id) {
+      // If we don't have an identity id, then we need to create a DID.
+      this._credential.cache.identity_id = `did:volt:${uuid.v4()}`;
+
+      const did = this._credential.cache.identity_id;
+
+      // Order of properties in the DID document is important,
+      // they must be in alphabetical order throughout the document.
+      // This is because the DID document is signed and the signature
+      // is over the entire document.
+      const didDocument = {
+        "@context": "https://www.w3.org/ns/did/v1",
+        authentication: [`${did}#key-1`],
+        description: this._config.client_name,
+        id: did,
+        verificationMethod: [
+          {
+            controller: did,
+            id: `${did}#key-1`,
+            publicKeyPem: publicKeyPem,
+            type: "RsaSignature2018"
+          }
+        ]
+      };
+
+      const signDocument = JSON.stringify(didDocument, null, 2);
+      log$1("signing did document");
+      log$1(signDocument);
+
+      // Sign the DID document.
+      const documentDigest = signBase64(
+        keyPair.privateKey,
+        signDocument
       );
+
+      const proofSignature = jwsSignature(documentDigest);
+
+      // Create the DID document proof.
+      didDocument.proof = {
+        created: new Date().toISOString(),
+        jws: proofSignature,
+        proofPurpose: "assertionMethod",
+        type: "RsaSignature2018",
+        verificationMethod: `${did}#key-1`
+      };
+
+      // Set the DID document with proof in the authenticate request.
+      authenticateRequest.did_document = JSON.stringify(didDocument, null, 2);
+
+      // Now sign the entire DID document, including the proof and set it in the
+      // bind request. This is required by the Volt to verify that we have the private key for the DID.
+      authenticateRequest.did_document_signature = signBase64(
+        keyPair.privateKey,
+        authenticateRequest.did_document
+      );
+
+      log$1("did document is %s", authenticateRequest.did_document);
+      log$1("did signature is %s", authenticateRequest.did_document_signature);
+    } else {
+      authenticateRequest.did = this._credential.cache.identity_id;
     }
 
-    log$1("sending %d x509 credentials", bindRequest.x509_credential.length);
-    log$1("bind TTL is ", this._config.bindRequestTTL);
+    log$1("authenticate TTL is ", this._config.bindRequestTTL);
 
     // This will block while the request is pending.
     const pollInterval = 10000;
@@ -1837,12 +1920,12 @@ async function bindInternal() {
         await new Promise((resolve) => setTimeout(resolve, pollInterval));
       }
       // eslint-disable-next-line no-await-in-loop
-      decision = await issueBind.call(
+      decision = await issueAuthenticate.call(
         this,
-        bindRequest,
+        authenticateRequest,
         this._voltConfig.bindRequestTTL
       );
-      log$1("binding decision: %s", decision);
+      log$1("authenticate decision: %s", decision);
     } while (
       decision === "POLICY_DECISION_PROMPT" ||
       decision === "POLICY_DECISION_PENDING"
@@ -1895,6 +1978,15 @@ function connectInternal(helloPayload) {
         onDisconnected();
         this.emit("connected", false);
       }
+
+      if (err.message.endsWith("session invalid")) {
+        log$1("Volt session invalid - clearing session");
+        delete this._credential.cache.session_id;
+        delete this._credential.cache.cert;
+        this._credential.saveCache();
+      }
+
+      this.emit("connectionError", err);
     });
 
     this._voltConnection.on("evt", (evt) => {
@@ -1964,8 +2056,6 @@ function getVoltAPIClientInternal() {
 
 function getAPIClientInternal(service) {
   if (!this._cachedService[service.id]) {
-    service.service_description.host_type === "SERVICE_HOST_TYPE_RELAYED";
-
     const serviceAddress = this.isRemote
       ? this._voltConfig.relay.address
       : service.service_description.host_address;
@@ -2013,9 +2103,8 @@ function getServiceClient(service) {
 }
 
 function unaryCallInternal(method, request, service) {
-  const grpcClient = getServiceClient.call(this, service);
-
   return new Promise((resolve, reject) => {
+    const grpcClient = getServiceClient.call(this, service);
     const call = new GRPCCall(this, method, "METHOD_TYPE_UNARY", service);
 
     let response = null;
@@ -2264,14 +2353,14 @@ class VoltClient extends EventEmitter__default["default"] {
       if (this._credential._cryptoCache.cert) {
         isBound = true;
       } else {
-        // No certificate present in the cache yet => we need to bind.
+        // No certificate present in the cache yet => we need to authenticate.
         try {
-          isBound = await bindInternal.call(this);
+          isBound = await authenticateInternal.call(this);
         } catch (bindErr) {
           if (bindErr.message === "invalid arguments") {
             // This is usually the result of a missing challenge signature or credential.
             log(
-              "failure binding to Volt - did you supply a challenge code or verified credential?"
+              "failure authenticating on Volt - did you supply a challenge code or verified credential?"
             );
             throw bindErr;
           }
@@ -2280,7 +2369,7 @@ class VoltClient extends EventEmitter__default["default"] {
 
       if (!isBound) {
         // This is usually because of request being denied.
-        throw new Error("Volt binding failed");
+        throw new Error("Volt authentication failed");
       }
 
       return Promise.resolve();
@@ -2506,6 +2595,10 @@ class VoltClient extends EventEmitter__default["default"] {
    * VoltAPI - volt management
    */
 
+  Authenticate(request) {
+    return unaryCallInternal.call(this, "Authenticate", request);
+  }
+
   Bind(request) {
     return unaryCallInternal.call(this, "Bind", request);
   }