@tdxvolt/volt-client-grpc 0.15.1 → 0.16.0-beta.10

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.15.1",
+  "version": "0.16.0-beta.10",
   "description": "tdx Volt library for nodejs clients",
   "type": "module",
   "exports": {
@@ -45,7 +45,7 @@
     "jsonwebtoken": "^8.5.1",
     "lodash": "^4.17.15",
     "minimist": "^1.2.0",
-    "node-forge": "^0.9.0",
+    "node-forge": "^1.3.1",
     "uuid": "^8.1.0"
   }
-}
+}

package/protobuf/tdx/volt_api/data/v1/sqlite_database_api.proto

@@ -50,9 +50,9 @@ message SqlExecuteRequest {
   // This can be used to limit the number of rows returned by `SELECT` statements to avoid overloading a client. It is similar to using 'LIMIT/OFFSET' clauses on the 'SELECT' statement, but this method is easier to manage and the entire result set will be prepared on the Volt, and the client can then page through it by sending successive messages.
   uint32 page_size = 3;
 
-  // The list of values to set for each parameter defined in a database query.
+  // The values to set for each parameter defined in a database query.
   // This field is only relevant to 'query' databases, i.e. those with kind `tdx:sqlite-query`.
-  // The values in the list should be in the same order as the parameters defined by the query attributes.
+  // The values in the map should be keyed by parameter name.
   // A query may have no parameters defined, in which case leave this field empty.
   map<string, tdx.volt_api.volt.v1.AttributeValue> parameter = 4;
 }

package/protobuf/tdx/volt_api/volt/v1/file_api.proto

@@ -37,6 +37,8 @@ message DownloadFileRequest {
   string file_path = 2;
 }
 
+// The response stream will contain one or more of the following messages.
+// Each response message will contain one of the following fields.
 message DownloadFileResponse {
   oneof payload {
     // A chunk of file data.

package/protobuf/tdx/volt_api/volt/v1/ssi.proto

@@ -0,0 +1,40 @@
+syntax = "proto3";
+
+package tdx.volt_api.volt.v1;
+
+message DIDRegistryUpdate {
+  // The id of the update.
+  // This is populated and maintained by the Volt.
+  uint64 id = 1;
+
+  // The id of the identity.
+  string did = 2;
+
+  // The type of update.
+  string operation = 3;
+
+  // The DID document contained in the update.
+  string document = 4;
+
+  // The signature extracted from the DID document.
+  string signature = 5;
+
+  // The signature of the update.
+  string update_signature = 6;
+
+  uint64 timestamp = 7;
+
+  // The vector clocks for this DID.
+  // The vector clocks are a map of the peer ID to the id of the last update received for this DID.
+  map<string, uint64> vector_clock = 8;
+
+  string origin_volt = 9;
+
+  string description = 10;
+}
+
+message VerifiablePresentation {
+  string credential = 1;
+  string signature = 2;
+}
+

package/protobuf/tdx/volt_api/volt/v1/ssi_api.proto

@@ -0,0 +1,126 @@
+syntax = "proto3";
+
+package tdx.volt_api.volt.v1;
+
+import "tdx/volt_api/volt/v1/ssi.proto";
+import "tdx/volt_api/volt/v1/status.proto";
+
+service SsiAPI {
+  rpc DeleteDID(DeleteDIDRequest) returns (DeleteDIDResponse);
+  rpc GetDIDDocument(GetDIDDocumentRequest) returns (GetDIDDocumentResponse);
+  rpc GetDIDRegistryUpdates(GetDIDRegistryUpdatesRequest) returns (GetDIDRegistryUpdatesResponse);
+  rpc ParseCredential(ParseCredentialRequest) returns (ParseCredentialResponse);
+  rpc ResolveDID(ResolveDIDRequest) returns (ResolveDIDResponse);
+  rpc RegisterDIDDocument(RegisterDIDDocumentRequest) returns (RegisterDIDDocumentResponse);
+}
+
+message DeleteDIDRequest {
+  // The id of the identity to delete.
+  string did = 1;
+}
+
+message DeleteDIDResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+message GetDIDDocumentRequest {
+  // The id of the identity to retrieve.
+  string did = 1;
+
+  // If set, the search is restricted to the local registry only, otherwise all configured registries are searched.
+  bool local_only = 2;
+}
+
+message GetDIDDocumentResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  DIDRegistryUpdate did_document = 2;
+}
+
+message GetDIDRegistryUpdatesRequest {
+  // The id of the last update received.
+  // All updates since this id will be returned, limited to the maximum number of updates specified in the request.
+  // To fully synchronise, clients should continue calling this method until the response contains no updates.
+  // If this is the first call, then this should be set to 0.
+  uint64 since_id = 1;
+
+  // The maximum number of updates to return, defaults to 1000.
+  uint32 max_updates = 2;
+
+  string origin_volt = 3;
+}
+
+message GetDIDRegistryUpdatesResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updates.
+  repeated DIDRegistryUpdate update = 2;
+}
+
+message ResolveDIDRequest {
+  // The DID to resolve.
+  string did = 1;
+
+  // Set to search all known registries rather than just the local registry.
+  bool include_registries = 2;
+}
+
+message ResolveDIDResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The JSON representation of the DID document.
+  string did_document = 2;
+
+  // The signature used to save this version of the DID document.
+  string update_signature = 3;
+
+  // The DID of the Volt that saved this version of the DID document.
+  string origin_volt = 4;
+}
+
+message RegisterDIDDocumentRequest {
+  bool create = 1;
+
+  // The DID document to save.
+  DIDRegistryUpdate did_update = 2;
+
+  // When updating an existing DID document, it is necessary to include a signature of the document JSON, signed by the DID document's current owner.
+  // This is different from the proof contained in the DID document itself.
+  string update_signature = 3;
+}
+
+message RegisterDIDDocumentResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  DIDRegistryUpdate did_document = 2;
+}
+
+
+// Empty ATM - a VC is issued for the authenticated identity.
+message TrustVerifiableCredentialRequest {
+}
+
+message TrustVerifiableCredentialResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  string verifiable_credential_json = 2;
+}
+
+message ParseCredentialRequest {
+  oneof credential {
+    VerifiablePresentation verifiable_presentation = 1;
+    string url = 2;
+  }
+  string public_key = 3;
+}
+
+message ParseCredentialResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  string id = 2;
+  string issuer_id = 3;
+  string subject_id = 4;
+  string claim_json = 5;
+}

package/protobuf/tdx/volt_api/volt/v1/volt.proto

@@ -24,18 +24,6 @@ enum OnlineStatus {
   ONLINE_STATUS_OFFLINE = 2;
 }
 
-// @todo currently this must align with AuthorisationDecision enum in policy library, but some of the values are irrelevant outside of the public API so we need a public-facing enum and some translation.
-enum PolicyDecision {
-  POLICY_DECISION_UNKNOWN = 0;
-  POLICY_DECISION_PROMPT = 1;
-  POLICY_DECISION_PERMIT = 2;
-  POLICY_DECISION_DENY = 3;
-  POLICY_DECISION_INDETERMINATE = 4;
-  POLICY_DECISION_NOT_APPLICABLE = 5;
-  POLICY_DECISION_APPLICABLE = 6;
-  POLICY_DECISION_PENDING = 7;
-}
-
 // Not used ATM.
 enum ResourceStatus {
   RESOURCE_STATUS_UNKNOWN = 0;
@@ -51,6 +39,31 @@ enum ShareMode {
   SHARE_MODE_PUBLIC_READ = 2;
 }
 
+// @todo currently this must align with AuthorisationDecision enum in policy library, but some of the values are irrelevant outside of the public API so we need a public-facing enum and some translation.
+enum PolicyDecision {
+  POLICY_DECISION_UNKNOWN = 0;
+  POLICY_DECISION_PROMPT = 1;
+  POLICY_DECISION_PERMIT = 2;
+  POLICY_DECISION_DENY = 3;
+  POLICY_DECISION_INDETERMINATE = 4;
+  POLICY_DECISION_NOT_APPLICABLE = 5;
+  POLICY_DECISION_APPLICABLE = 6;
+  POLICY_DECISION_PENDING = 7;
+}
+
+// Attribute data types.
+enum AttributeDataType {
+  ATTRIBUTE_DATA_TYPE_UNKNOWN = 0;
+  ATTRIBUTE_DATA_TYPE_STRING = 1;
+  ATTRIBUTE_DATA_TYPE_INTEGER = 2;
+  ATTRIBUTE_DATA_TYPE_REAL = 3;
+  ATTRIBUTE_DATA_TYPE_BOOLEAN = 4;
+  ATTRIBUTE_DATA_TYPE_BYTES = 5;
+
+  ATTRIBUTE_DATA_TYPE_IDENTITY = 100;
+  ATTRIBUTE_DATA_TYPE_RESOURCE = 101;
+}
+
 // Represents an outbound connection from a Volt to a remote service that will act as a proxy for that Volt.
 // This enables Volts to bypass firewall and NATs.
 // Example - connection from a Volt to a Relay Volt running on the public internet, such as tdxvolt.com
@@ -81,6 +94,15 @@ message ProxyConnection {
 
   // Optional challenge that can be presented in the bind phase when initialising the connection.
   string challenge = 10;
+
+  // Indicates that this connection hosts a DID registry that we should synchronise with.
+  bool sync_did_registry = 11;
+
+  // The id of the last DID registry operation that was synchronised.
+  uint64 did_registry_sync_id = 12;
+
+  // The id of the target Volt that this connection is bound to.
+  string target_id = 13;
 }
 
 enum SecureMode {
@@ -192,6 +214,13 @@ message VoltParameters {
   // The certificate authority of the Relay if this is a remote connection via a Relay.
   string relay_ca_pem = 33;
 
+  // Optional override of the http address, rather than using the default of fixed_host:http_port.
+  // This is useful if the Volt is behind a firewall or NAT, and the http server is listening on a different port
+  // from 80 or 443 but this is hidden by the proxy. For example, if the `fixed_host` is `coreid.com` and http server is
+  // listening on 2115, but the proxy is forwarding 443 to 2115, then the http_address_override would be set to
+  // `https://coreid.com`.
+  string http_address_override = 34;
+
   // An optional alias that can be used to refer to the Volt rather than the `id` field.
   // This alias must be unique within the scope of the Battery in which the Volt is stored.
   string alias = 35;
@@ -201,6 +230,12 @@ message VoltParameters {
 
   // If set, indicates that any client that provides the correct challenge in the bind phase will automatically be approved to access the Volt.
   bool approve_on_challenge = 37;
+
+  // Maintain and expose a database of DIDs.
+  bool enable_did_registry = 38;
+
+  // Zero or more URLs of trusted peer DID registries.
+  repeated string did_registry = 40;
 }
 
 message VoltEndpoint {
@@ -261,8 +296,11 @@ message ProtoFile {
 
 enum ServiceHostType {
   SERVICE_HOST_TYPE_UNKNOWN = 0;
+  // A built-in service hosted by the Volt.
   SERVICE_HOST_TYPE_BUILTIN = 1;
+  // A service hosted by a grpc server other than the Volt.
   SERVICE_HOST_TYPE_SERVER = 2;
+  // A service hosted by a Volt client via a relay connection, i.e. the service is not exposed by a server as such, rather a Volt client implements the service and a Volt acts as a proxy, calling back to the client to implement the methods.
   SERVICE_HOST_TYPE_RELAYED = 3;
 }
 
@@ -270,16 +308,19 @@ enum ServiceHostType {
 message ServiceDescription {
   ServiceHostType host_type = 1;
 
-  // The id of the server resource that is hosting this service.
-  // For built-in services, i.e. those hosted by the Volt, this will set to the Volt id.
-  string host_service_id = 2;
+  // The identity of the client that is exposing the service.
+  // For example, if a third party is exposing a database service via a Volt, it will first bind to the Volt and obtain a client DID and credentials in order to be able to create service resource(s).
+  // Any resources that are owned by this client will be marked as online if the client itself is online, i.e. has a live connection to the Volt.
+  // This will be empty if the service is a built-in Volt service.
+  string host_client_id = 2;
 
-  // The identity of the client that is exposing the service via a relay connection.
-  // This will be empty if the service is exposed via a grpc server.
-  string host_client_id = 3;
+  // The id of the resource that holds the protobuf definition for this resource.
+  // For example, if a third party is exposing a database service via a Volt, it will create a service resource that holds details of the protobuf methods exposed by the service.
+  // For built-in services, i.e. those hosted by the Volt, this will set to the Volt id.
+  string host_service_id = 3;
 
   // The address of the grpc server hosting this service.
-  // This will be empty if the service is hosted by a relay client (see `relay_public_key` below).
+  // Only relevant to grpc-hosted services.
   string host_address = 4;
 
   // The certificate authority (chain) that signed the service server certificate.
@@ -290,9 +331,6 @@ message ServiceDescription {
   // This may change as the service comes and goes online.
   string host_public_key = 6;
 
-  // The fingerprint derived from `host_public_key`, included for convenience.
-  string host_fingerprint = 7;
-
   // The connection id currently used to host this service.
   string host_connection_id = 8;
 
@@ -312,24 +350,11 @@ message ServiceDescription {
   repeated MethodDescription method = 100;
 }
 
-// Resource attribute data types.
-enum AttributeDataType {
-  ATTRIBUTE_DATA_TYPE_UNKNOWN = 0;
-  ATTRIBUTE_DATA_TYPE_STRING = 1;
-  ATTRIBUTE_DATA_TYPE_INTEGER = 2;
-  ATTRIBUTE_DATA_TYPE_REAL = 3;
-  ATTRIBUTE_DATA_TYPE_BOOLEAN = 4;
-  ATTRIBUTE_DATA_TYPE_BYTES = 5;
-
-  ATTRIBUTE_DATA_TYPE_IDENTITY = 100;
-  ATTRIBUTE_DATA_TYPE_RESOURCE = 101;
-}
-
-// Resource attribute value will be one of the following fields, depending on the data type.
+// Attribute value will be one of the following fields, depending on the data type.
 message AttributeValue {
   oneof value {
     string string = 1;
-    int32 integer = 2;
+    int64 integer = 2;
     double real = 3;
     bool boolean = 4;
     bytes bytes = 5;
@@ -429,32 +454,38 @@ enum IdentityType {
 }
 
 message IdentityAlias {
+  // The alias id.
+  uint32 id = 1;
+
   // The corresponding identity id.
-  string identity_id = 1;
+  string identity_id = 2;
 
   // The actual alias, e.g. a common name or key fingerprint.
-  string alias = 2;
-
-  // This will only be populated if alias_type == tdx:public-key
-  string public_key = 3;
+  string alias = 3;
 
   // This will only be populated if alias_type == tdx:public-key
-  string private_key = 4;
+  string public_key = 4;
 
-  string alias_type = 5;
+  // This will only be populated if alias_type == tdx:public-key, and the key is stored in the Volt.
+  string private_key = 5;
 
-  string issuer_id = 6;
+  // The alias type, for example public key, email, phone number etc.
+  string alias_type = 6;
 
-  // Indicates if this alias has an 'authenticate' policy decision assigned.
-  PolicyDecision authenticate = 7;
+  // The identity that issued this alias.
+  string issuer_id = 7;
 
   // Indicates if this alias has an 'bind' policy decision assigned.
   PolicyDecision bind = 8;
+
+  // Optional description of this alias.
+  string description = 9;
 }
 
 // A Volt identity encompasses a Resource and a set of identity aliases.
 message Identity {
   Resource resource = 1;
+
   repeated IdentityAlias alias = 2;
 }
 
@@ -514,6 +545,10 @@ message Binding {
 
   // Set if the bind request presented a valid challenge code.
   bool volt_challenge = 15;
+
+  string did_document = 16;
+
+  string did_document_signature = 17;
 }
 
 message Access {
@@ -571,27 +606,49 @@ enum SessionStatus {
   SESSION_STATUS_REJECTED = 3;
 }
 
+message SessionCredential {
+  // The alias id.
+  uint32 id = 1;
+
+  // The corresponding session id.
+  string session_id = 2;
+
+  // The actual credential, e.g. a key fingerprint or VC.
+  string credential = 3;
+
+  // The credential type, for example public key, email, phone number etc.
+  string credential_type = 4;
+
+  // The identity that issued this alias.
+  string issuer_id = 5;
+
+  // Optional description of this alias.
+  string description = 6;
+
+  // Type-specific extra data stored with the credential.
+  string extra = 7;
+
+  // More type-specific data stored with the credential.
+  string extra_2 = 8;
+}
+
 message Session {
   string id = 1;
 
-  string identity_id = 2;
+  //  string public_key = 2;
 
-  string identity_name = 3;
+  string identity_id = 3;
 
-  string ip = 4;
+  string identity_name = 4;
 
-  uint64 created = 5;
+  string ip = 5;
 
-  uint64 modified = 6;
+  repeated SessionCredential credential = 6;
 
-  SessionStatus status = 7;
-}
+  uint64 created = 7;
 
-message VerifiableCredential {
-  string encoded = 1;
-}
+  uint64 modified = 8;
 
-message VerifiablePresentation {
-  VerifiableCredential credential = 1;
-  string signature = 2;
+  SessionStatus status = 9;
 }
+