@tdxvolt/volt-client-grpc 0.15.1 → 0.16.0-beta.2

package/lib/index.cjs

@@ -38,37 +38,37 @@ const constants = {
   collectionOperation: {
     add: "ADD",
     remove: "REMOVE",
-    update: "UPDATE",
+    update: "UPDATE"
   },
   crypto: {
     subjectDefaults: [
       {
         name: "countryName",
-        value: "GB",
+        value: "GB"
       },
       {
         name: "localityName",
-        value: "Southampton",
+        value: "Southampton"
       },
       {
         name: "organizationName",
-        value: "nquiringminds Ltd",
-      },
+        value: "nquiringminds Ltd"
+      }
     ],
-    userIdOID: "0.9.2342.19200300.100.1.1",
+    userIdOID: "0.9.2342.19200300.100.1.1"
   },
   defaultDIDHostName: "cloud.tdxvolt.com",
   didServiceType: {
-    voltConfig: "tdx-volt-config",
+    voltConfig: "tdx-volt-config"
   },
   identityType: {
     did: "did",
-    volt: "volt",
+    volt: "volt"
   },
   onlineStatus: {
     offline: "offline",
     online: "online",
-    unknown: "unknown",
+    unknown: "unknown"
   },
   publicKeyPrefix: "-----BEGIN PUBLIC KEY-----",
   privateKeyPrefix: "-----BEGIN RSA PRIVATE KEY-----",
@@ -79,14 +79,14 @@ const constants = {
     proxy: "proxy",
     proxyView: "proxy-view",
     vc: "vc",
-    vcView: "vc-view",
+    vcView: "vc-view"
   },
   voltStatus: {
     pending: "",
     online: "online",
     offline: "offline",
     deleted: "deleted",
-    revoked: "revoked",
+    revoked: "revoked"
   },
   /**
    * These top-level service types should map to a protobuf definition
@@ -96,16 +96,16 @@ const constants = {
     fileAPI: "tdx.volt_api.volt.v1.FileAPI",
     sqliteServerAPI: "tdx.volt_api.data.v1.SqliteServerAPI",
     sqliteDatabaseAPI: "tdx.volt_api.data.v1.SqliteDatabaseAPI",
-    ssiAPI: "tdx.volt_api.ssi.v1.SsiAPI",
+    ssiAPI: "tdx.volt_api.volt.v1.SsiAPI",
     relayAPI: "tdx.volt_api.relay.v1.RelayAPI",
     voltAPI: "tdx.volt_api.volt.v1.VoltAPI",
-    wireAPI: "tdx.volt_api.volt.v1.WireAPI",
+    wireAPI: "tdx.volt_api.volt.v1.WireAPI"
   },
   tunnelInvokeMethod: "/tdx.volt_api.volt.v1.VoltAPI/Invoke",
   tunnelPingInterval: 10000,
   tunnelPingTimeout: 2500,
   tunnelReconnectAfter: 30000,
-  tunnelTimeoutInterval: 10000 * 2, // This must always be greater than `tunnelPingInterval`.
+  tunnelTimeoutInterval: 10000 * 2 // This must always be greater than `tunnelPingInterval`.
 };
 
 const { pki: pki$2 } = forge__default["default"];
@@ -167,11 +167,16 @@ const createPublicKeyFingerprint = (key) => {
   return createBase58Hash(removeCarriageReturn(key));
 };
 
+const base64ToBase64Url = (base64) => {
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+
 const signBase64 = (key, msg) => {
   const md = forge__default["default"].md.sha256.create();
   md.update(msg);
   const signature = key.sign(md);
-  return forge__default["default"].util.encode64(signature);
+  const base64Standard = forge__default["default"].util.encode64(signature);
+  return base64ToBase64Url(base64Standard);
 };
 
 const verifyBase64 = (key, msg, signature) => {
@@ -240,7 +245,8 @@ const createRSAKey = (passphrase = "") => {
 const sha256Base64 = (msg) => {
   const md = forge__default["default"].md.sha256.create();
   md.update(msg);
-  return forge__default["default"].util.encode64(md.digest().bytes());
+  const base64Standard = forge__default["default"].util.encode64(md.digest().bytes());
+  return base64ToBase64Url(base64Standard);
 };
 
 const decryptPrivateKey = (pem, passphrase) => {
@@ -248,6 +254,20 @@ const decryptPrivateKey = (pem, passphrase) => {
   return forgePrivateKeyToPem(decryptedKey);
 };
 
+const jwsSignature = (signature) => {
+  //
+  // Use an unattached payload JWS signature for the DID document proof.
+  // This is a JWS with an empty payload and a detached payload digest.
+  //
+  // (https://tools.ietf.org/html/rfc7797#appendix-F) as used in the VC spec
+  // (https://www.w3.org/TR/vc-data-model/).
+  //
+  const jwsHeader = base64ToBase64Url(
+    forge__default["default"].util.encode64('{"alg":"RS256","b64": false}')
+  );
+  return jwsHeader + ".." + signature;
+};
+
 var utils = /*#__PURE__*/Object.freeze({
   __proto__: null,
   createSecureContextOptions: createSecureContextOptions,
@@ -258,12 +278,14 @@ var utils = /*#__PURE__*/Object.freeze({
   removeCarriageReturn: removeCarriageReturn,
   createBase58Hash: createBase58Hash,
   createPublicKeyFingerprint: createPublicKeyFingerprint,
+  base64ToBase64Url: base64ToBase64Url,
   signBase64: signBase64,
   verifyBase64: verifyBase64,
   getDIDResolutionURL: getDIDResolutionURL,
   createRSAKey: createRSAKey,
   sha256Base64: sha256Base64,
-  decryptPrivateKey: decryptPrivateKey
+  decryptPrivateKey: decryptPrivateKey,
+  jwsSignature: jwsSignature
 });
 
 /* eslint-disable no-underscore-dangle */
@@ -567,8 +589,12 @@ class VoltCredential {
     return this._cryptoCache;
   }
 
-  get clientId() {
-    return this._cryptoCache.client_id;
+  get sessionId() {
+    return this._cryptoCache.session_id;
+  }
+
+  get identityId() {
+    return this._cryptoCache.identity_id;
   }
 
   get voltPublicKey() {
@@ -656,7 +682,7 @@ class VoltCredential {
       aud: audience,
       iat: Math.floor(Date.now() / 1000) - ttl,
       exp: Math.floor(Date.now() / 1000) + ttl,
-      sub: this._cryptoCache.client_id
+      sub: this._cryptoCache.session_id
     };
 
     let sharedKey;
@@ -738,12 +764,13 @@ class VoltCredential {
   }
 
   static rsaEncrypt(key, buffer) {
-    return crypto__default["default"].publicEncrypt(key, buffer).toString("base64");
+    const cipher = crypto__default["default"].publicEncrypt(key, buffer);
+    return cipher.toString("base64url");
   }
 
   static rsaDecrypt(key, buffer) {
     const keyObj = crypto__default["default"].createPrivateKey(key);
-    const cipher = Buffer.from(buffer, "base64");
+    const cipher = Buffer.from(buffer, "base64url");
     return Buffer.from(crypto__default["default"].privateDecrypt(keyObj, cipher));
   }
 }
@@ -881,7 +908,7 @@ const log$4 = debug__default["default"]("volt-client-grpc:grpc-call");
 function _prepareInvokeRequest(
   request,
   method,
-  methodType = "METHOD_TYPE_UNARY",
+  methodType = "METHOD_TYPE_UNARY"
 ) {
   const isServiceRelayed =
     this._service?.service_description.host_type ===
@@ -894,7 +921,7 @@ function _prepareInvokeRequest(
       this._voltClient.voltConfig.id,
     this._service?.service_description.host_public_key ||
       this._voltClient.credential.voltPublicKey,
-    true,
+    true
   );
 
   let invokeRequest;
@@ -925,42 +952,40 @@ function _prepareInvokeRequest(
         method_name: this._grpcClient[method].path,
         method_type: methodType,
         token: methodToken.token,
-        request: requestPayload,
-      },
+        request: requestPayload
+      }
     };
 
-    let targetFingerprint = [];
+    let targetDID = [];
     let invokePayload;
     if (this._voltClient.isVoltRelay || isServiceRelayed) {
       // When sending via a relay we need to encrypt the payload.
       invokePayload = VoltCredential.aesEncrypt(
         tunnelMethod.responseSerialize(tunnelResp),
         methodToken.sharedKey.key,
-        methodToken.sharedKey.iv,
+        methodToken.sharedKey.iv
       );
     } else {
       invokePayload = tunnelMethod.responseSerialize(tunnelResp);
     }
 
     if (this._voltClient.isVoltRelay) {
-      targetFingerprint.push(this._voltClient.credential.voltFingerprint);
+      targetDID.push(this._voltClient.voltConfig.id);
     }
 
     if (isServiceRelayed) {
       // Add another relay hop if the target service is relayed.
       log$4("target service is relayed");
-      targetFingerprint.push(
-        this._service.service_description.host_fingerprint,
-      );
+      targetDID.push(this._service.service_description.host_client_id);
     }
 
-    log$4("target is %j", targetFingerprint);
+    log$4("target is %j", targetDID);
 
     invokeRequest = {
-      target_fingerprint: targetFingerprint,
+      target_did: targetDID,
       token: methodToken.token,
       payload: invokePayload,
-      target_service_id: isServiceRelayed ? this._service.id : undefined,
+      target_service_id: isServiceRelayed ? this._service.id : undefined
     };
 
     // Replace the target method with a call to Invoke on the relay Volt.
@@ -973,7 +998,7 @@ function _prepareInvokeRequest(
     meta: methodToken,
     method: callMethod,
     methodName: method,
-    request: invokeRequest,
+    request: invokeRequest
   };
 }
 
@@ -993,18 +1018,18 @@ function _preparePayloadRequest(request, invokeInfo) {
 
     const tunnelResp = {
       method_payload: {
-        payload: requestPayload,
-      },
+        payload: requestPayload
+      }
     };
 
     const invokePayload = VoltCredential.aesEncrypt(
       tunnelMethod.responseSerialize(tunnelResp),
       invokeInfo.meta.sharedKey.key,
-      invokeInfo.meta.sharedKey.iv,
+      invokeInfo.meta.sharedKey.iv
     );
 
     payloadRequest = {
-      payload: invokePayload,
+      payload: invokePayload
     };
   } else {
     payloadRequest = request;
@@ -1028,7 +1053,7 @@ function _parseResponse(method, meta, response) {
         decryptedPayload = VoltCredential.aesDecrypt(
           response.payload,
           meta.sharedKey.key,
-          meta.sharedKey.iv,
+          meta.sharedKey.iv
         );
       } else {
         decryptedPayload = response.payload;
@@ -1039,12 +1064,12 @@ function _parseResponse(method, meta, response) {
       if (responsePayload.payload === "method_payload") {
         try {
           invokeResponse.payload = this._grpcClient[method].responseDeserialize(
-            responsePayload.method_payload.payload,
+            responsePayload.method_payload.payload
           );
         } catch (err) {
           log$4("failure deserialising payload for %s", this._methodName);
           throw new Error(
-            "failure deserialising payload - check protobuf definition matches with data being sent",
+            "failure deserialising payload - check protobuf definition matches with data being sent"
           );
         }
       } else if (responsePayload.payload === "method_end") {
@@ -1058,11 +1083,11 @@ function _parseResponse(method, meta, response) {
         "Tunnel status received: %s, code %d, description: %s",
         response.status.message,
         response.status.code,
-        response.status.description || "n/a",
+        response.status.description || "n/a"
       );
       invokeResponse = {
         ended: true,
-        error: `Error in tunnel: ${response.status.message}`,
+        error: `Error in tunnel: ${response.status.message}`
       };
     } else {
       invokeResponse.methodId = response.invoke_id;
@@ -1072,11 +1097,11 @@ function _parseResponse(method, meta, response) {
     const decryptedPayload = VoltCredential.aesDecrypt(
       response,
       meta.sharedKey.key,
-      meta.sharedKey.iv,
+      meta.sharedKey.iv
     );
     invokeResponse = {
       payload:
-        this._grpcClient[method].responseDeserializeOriginal(decryptedPayload),
+        this._grpcClient[method].responseDeserializeOriginal(decryptedPayload)
     };
   } else {
     invokeResponse = { payload: response };
@@ -1106,7 +1131,7 @@ class GRPCCall extends EventEmitter__default["default"] {
       this,
       request,
       this._methodName,
-      this._methodType,
+      this._methodType
     );
 
     const isServiceRelayed =
@@ -1121,7 +1146,7 @@ class GRPCCall extends EventEmitter__default["default"] {
     }
 
     this._call = callClient[this._initialRequest.method](
-      this._initialRequest.meta.metadata,
+      this._initialRequest.meta.metadata
     );
 
     this._call.on("data", (streamResponse) => {
@@ -1130,14 +1155,14 @@ class GRPCCall extends EventEmitter__default["default"] {
           this,
           this._methodName,
           this._initialRequest.meta,
-          streamResponse,
+          streamResponse
         );
         if (parsedResponse.payload) {
           // Interpret a non-empty status message as an error.
           if (parsedResponse.payload?.status?.message) {
             this.emit(
               "error",
-              new Error(parsedResponse.payload.status.message),
+              new Error(parsedResponse.payload.status.message)
             );
           } else {
             this.emit("data", parsedResponse.payload);
@@ -1156,7 +1181,7 @@ class GRPCCall extends EventEmitter__default["default"] {
         log$4(
           "failure processing %s call response: %s",
           this._methodName,
-          err.message,
+          err.message
         );
         this.emit("error", err);
       }
@@ -1178,7 +1203,7 @@ class GRPCCall extends EventEmitter__default["default"] {
       log$4(
         "ended call %s, method id: %s",
         this._methodName,
-        this._initialRequest.methodId || "n/a - not tunnelling",
+        this._initialRequest.methodId || "n/a - not tunnelling"
       );
       this.emit("end");
     });
@@ -1211,7 +1236,7 @@ class GRPCCall extends EventEmitter__default["default"] {
       const payloadRequest = _preparePayloadRequest.call(
         this,
         request,
-        this._initialRequest,
+        this._initialRequest
       );
       return this._call.write(payloadRequest);
     } else {
@@ -1219,7 +1244,7 @@ class GRPCCall extends EventEmitter__default["default"] {
         this,
         request,
         this._methodName,
-        this._methodType,
+        this._methodType
       );
 
       return this._call.write(this._initialRequest.request);
@@ -1691,30 +1716,31 @@ const voltServices = [
   constants.serviceType.wireAPI
 ];
 
-function issueBind(bindRequest, ttl) {
+function issueAuthenticate(authenticateRequest, ttl) {
   // eslint-disable-next-line no-use-before-define
   return unaryCallInternal
-    .call(this, "Bind", bindRequest)
-    .then((bindResponse) => {
-      log$1("got binding request response %j", bindResponse);
-      if (bindResponse.status?.code) {
-        log$1("error in bind response: %s", bindResponse.status.message);
-        return Promise.reject(new Error(bindResponse.status.message));
+    .call(this, "Authenticate", authenticateRequest)
+    .then((authenticateResponse) => {
+      log$1("got authenticate response %j", authenticateResponse);
+      if (authenticateResponse.status?.code) {
+        log$1("error in bind response: %s", authenticateResponse.status.message);
+        return Promise.reject(new Error(authenticateResponse.status.message));
       } else {
-        switch (bindResponse.decision) {
+        switch (authenticateResponse.decision) {
           case "POLICY_DECISION_PERMIT": {
             //
             // The request status is permit => cache the bind response info.
             //
 
             // This is the certificate assigned to us by the volt.
-            this._credential.cache.cert = bindResponse.cert;
+            this._credential.cache.cert = authenticateResponse.cert;
 
             // This is the signing CA used by the volt.
-            this._credential.cache.ca = bindResponse.chain;
+            this._credential.cache.ca = authenticateResponse.chain;
 
             // Identity resource id is assigned by the volt.
-            this._credential.cache.client_id = bindResponse.identity_id;
+            this._credential.cache.session_id = authenticateResponse.session_id;
+
             this._credential.saveCache();
             break;
           }
@@ -1728,12 +1754,15 @@ function issueBind(bindRequest, ttl) {
             break;
           }
           default:
-            log$1("ignoring unknown bind descision %s", bindResponse.status);
+            log$1(
+              "ignoring unknown bind descision %s",
+              authenticateResponse.status
+            );
             break;
         }
       }
 
-      return bindResponse.decision;
+      return authenticateResponse.decision;
     });
 }
 
@@ -1746,7 +1775,7 @@ function findDIDDocumentService(document, serviceType) {
   return matches;
 }
 
-async function bindInternal() {
+async function authenticateInternal(createDID = true) {
   try {
     // Check if we need to resolve a Relay volt.
     if (
@@ -1760,6 +1789,7 @@ async function bindInternal() {
         this,
         `${relayURL}/discovery`
       );
+
       if (this._voltConfig.relay.ca_pem) {
         log$1(
           "Auto-fetched Relay CA %s, remote address %s",
@@ -1793,21 +1823,13 @@ async function bindInternal() {
     this._credential.saveCache();
 
     // Form the request message.
-    const bindRequest = {
+    const authenticateRequest = {
       binding_name: this._config.client_name,
-      public_key: publicKeyPem,
-      host: this._credential.cache.bindIp,
-      x509_credential: []
+      host: this._credential.cache.bindIp
     };
 
-    if (this._credential.cache.cert) {
-      bindRequest.x509_credential = [
-        this._credential.cache.cert + this._credential.cache.ca
-      ];
-    }
-
     if (this._voltConfig.challenge_code) {
-      bindRequest.challenge = signBase64(
+      authenticateRequest.challenge = signBase64(
         keyPair.privateKey,
         this._voltConfig.challenge_code
       );
@@ -1817,15 +1839,71 @@ async function bindInternal() {
       );
     }
 
-    // For remote connections, add our cloud-issued certificate as an additional credential.
-    if (this._voltConfig?.relay?.ca_pem && this._credential.cache.cloud_cert) {
-      bindRequest.x509_credential = bindRequest.x509_credential.concat(
-        this._credential.cache.cloud_cert + this._voltConfig.relay.ca_pem
+    if (!createDID) {
+      authenticateRequest.public_key = publicKeyPem;
+    } else {
+      if (!this._credential.cache.identity_id) {
+        // If we don't have an identity id, then we need to create a DID.
+        this._credential.cache.identity_id = `did:volt:${uuid.v4()}`;
+      }
+
+      const did = this._credential.cache.identity_id;
+
+      // Order of properties in the DID document is important,
+      // they must be in alphabetical order throughout the document.
+      // This is because the DID document is signed and the signature
+      // is over the entire document.
+      const didDocument = {
+        "@context": "https://www.w3.org/ns/did/v1",
+        authentication: [`${did}#key-1`],
+        description: this._config.client_name,
+        id: did,
+        verificationMethod: [
+          {
+            controller: did,
+            id: `${did}#key-1`,
+            publicKeyPem: publicKeyPem,
+            type: "RsaSignature2018"
+          }
+        ]
+      };
+
+      const signDocument = JSON.stringify(didDocument, null, 2);
+      log$1("signing did document");
+      log$1(signDocument);
+
+      // Sign the DID document.
+      const documentDigest = signBase64(
+        keyPair.privateKey,
+        signDocument
+      );
+
+      const proofSignature = jwsSignature(documentDigest);
+
+      // Create the DID document proof.
+      didDocument.proof = {
+        created: new Date().toISOString(),
+        jws: proofSignature,
+        proofPurpose: "assertionMethod",
+        type: "RsaSignature2018",
+        verificationMethod: `${did}#key-1`
+      };
+
+      // Set the DID document with proof in the authenticate request.
+      authenticateRequest.did_document = JSON.stringify(didDocument, null, 2);
+
+      // Now sign the entire DID document, including the proof and set it in the
+      // bind request. This is required by the Volt to verify that we have the private key for the DID.
+      authenticateRequest.did_document_signature = signBase64(
+        keyPair.privateKey,
+        authenticateRequest.did_document
       );
+
+      log$1("did document is %s", authenticateRequest.did_document);
+      log$1("did signature is %s", authenticateRequest.did_document_signature);
     }
 
-    log$1("sending %d x509 credentials", bindRequest.x509_credential.length);
-    log$1("bind TTL is ", this._config.bindRequestTTL);
+    log$1("authenticate TTL is ", this._config.bindRequestTTL);
 
     // This will block while the request is pending.
     const pollInterval = 10000;
@@ -1837,12 +1915,12 @@ async function bindInternal() {
         await new Promise((resolve) => setTimeout(resolve, pollInterval));
       }
       // eslint-disable-next-line no-await-in-loop
-      decision = await issueBind.call(
+      decision = await issueAuthenticate.call(
         this,
-        bindRequest,
+        authenticateRequest,
         this._voltConfig.bindRequestTTL
       );
-      log$1("binding decision: %s", decision);
+      log$1("authenticate decision: %s", decision);
     } while (
       decision === "POLICY_DECISION_PROMPT" ||
       decision === "POLICY_DECISION_PENDING"
@@ -1964,8 +2042,6 @@ function getVoltAPIClientInternal() {
 
 function getAPIClientInternal(service) {
   if (!this._cachedService[service.id]) {
-    service.service_description.host_type === "SERVICE_HOST_TYPE_RELAYED";
-
     const serviceAddress = this.isRemote
       ? this._voltConfig.relay.address
       : service.service_description.host_address;
@@ -2013,9 +2089,8 @@ function getServiceClient(service) {
 }
 
 function unaryCallInternal(method, request, service) {
-  const grpcClient = getServiceClient.call(this, service);
-
   return new Promise((resolve, reject) => {
+    const grpcClient = getServiceClient.call(this, service);
     const call = new GRPCCall(this, method, "METHOD_TYPE_UNARY", service);
 
     let response = null;
@@ -2264,14 +2339,14 @@ class VoltClient extends EventEmitter__default["default"] {
       if (this._credential._cryptoCache.cert) {
         isBound = true;
       } else {
-        // No certificate present in the cache yet => we need to bind.
+        // No certificate present in the cache yet => we need to authenticate.
         try {
-          isBound = await bindInternal.call(this);
+          isBound = await authenticateInternal.call(this);
         } catch (bindErr) {
           if (bindErr.message === "invalid arguments") {
             // This is usually the result of a missing challenge signature or credential.
             log(
-              "failure binding to Volt - did you supply a challenge code or verified credential?"
+              "failure authenticating on Volt - did you supply a challenge code or verified credential?"
             );
             throw bindErr;
           }
@@ -2280,7 +2355,7 @@ class VoltClient extends EventEmitter__default["default"] {
 
       if (!isBound) {
         // This is usually because of request being denied.
-        throw new Error("Volt binding failed");
+        throw new Error("Volt authentication failed");
       }
 
       return Promise.resolve();
@@ -2506,6 +2581,10 @@ class VoltClient extends EventEmitter__default["default"] {
    * VoltAPI - volt management
    */
 
+  Authenticate(request) {
+    return unaryCallInternal.call(this, "Authenticate", request);
+  }
+
   Bind(request) {
     return unaryCallInternal.call(this, "Bind", request);
   }

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.15.1",
+  "version": "0.16.0-beta.2",
   "description": "tdx Volt library for nodejs clients",
   "type": "module",
   "exports": {
@@ -45,7 +45,7 @@
     "jsonwebtoken": "^8.5.1",
     "lodash": "^4.17.15",
     "minimist": "^1.2.0",
-    "node-forge": "^0.9.0",
+    "node-forge": "^1.3.1",
     "uuid": "^8.1.0"
   }
-}
+}

package/protobuf/tdx/volt_api/data/v1/sqlite_database_api.proto

@@ -50,9 +50,9 @@ message SqlExecuteRequest {
   // This can be used to limit the number of rows returned by `SELECT` statements to avoid overloading a client. It is similar to using 'LIMIT/OFFSET' clauses on the 'SELECT' statement, but this method is easier to manage and the entire result set will be prepared on the Volt, and the client can then page through it by sending successive messages.
   uint32 page_size = 3;
 
-  // The list of values to set for each parameter defined in a database query.
+  // The values to set for each parameter defined in a database query.
   // This field is only relevant to 'query' databases, i.e. those with kind `tdx:sqlite-query`.
-  // The values in the list should be in the same order as the parameters defined by the query attributes.
+  // The values in the map should be keyed by parameter name.
   // A query may have no parameters defined, in which case leave this field empty.
   map<string, tdx.volt_api.volt.v1.AttributeValue> parameter = 4;
 }