@tdxvolt/volt-client-grpc 0.15.1 → 0.16.0-beta.2

package/protobuf/tdx/volt_api/volt/v1/file_api.proto

@@ -37,6 +37,8 @@ message DownloadFileRequest {
   string file_path = 2;
 }
 
+// The response stream will contain one or more of the following messages.
+// Each response message will contain one of the following fields.
 message DownloadFileResponse {
   oneof payload {
     // A chunk of file data.

package/protobuf/tdx/volt_api/volt/v1/ssi.proto

@@ -0,0 +1,40 @@
+syntax = "proto3";
+
+package tdx.volt_api.volt.v1;
+
+message DIDRegistryUpdate {
+  // The id of the update.
+  // This is populated and maintained by the Volt.
+  uint64 id = 1;
+
+  // The id of the identity.
+  string did = 2;
+
+  // The type of update.
+  string operation = 3;
+
+  // The DID document contained in the update.
+  string document = 4;
+
+  // The signature extracted from the DID document.
+  string signature = 5;
+
+  // The signature of the update.
+  string update_signature = 6;
+
+  uint64 timestamp = 7;
+
+  // The vector clocks for this DID.
+  // The vector clocks are a map of the peer ID to the id of the last update received for this DID.
+  map<string, uint64> vector_clock = 8;
+
+  string origin_volt = 9;
+
+  string description = 10;
+}
+
+message VerifiablePresentation {
+  string credential = 1;
+  string signature = 2;
+}
+

package/protobuf/tdx/volt_api/volt/v1/ssi_api.proto

@@ -0,0 +1,126 @@
+syntax = "proto3";
+
+package tdx.volt_api.volt.v1;
+
+import "tdx/volt_api/volt/v1/ssi.proto";
+import "tdx/volt_api/volt/v1/status.proto";
+
+service SsiAPI {
+  rpc DeleteDID(DeleteDIDRequest) returns (DeleteDIDResponse);
+  rpc GetDIDDocument(GetDIDDocumentRequest) returns (GetDIDDocumentResponse);
+  rpc GetDIDRegistryUpdates(GetDIDRegistryUpdatesRequest) returns (GetDIDRegistryUpdatesResponse);
+  rpc ParseCredential(ParseCredentialRequest) returns (ParseCredentialResponse);
+  rpc ResolveDID(ResolveDIDRequest) returns (ResolveDIDResponse);
+  rpc RegisterDIDDocument(RegisterDIDDocumentRequest) returns (RegisterDIDDocumentResponse);
+}
+
+message DeleteDIDRequest {
+  // The id of the identity to delete.
+  string did = 1;
+}
+
+message DeleteDIDResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+}
+
+message GetDIDDocumentRequest {
+  // The id of the identity to retrieve.
+  string did = 1;
+
+  // If set, the search is restricted to the local registry only, otherwise all configured registries are searched.
+  bool local_only = 2;
+}
+
+message GetDIDDocumentResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  DIDRegistryUpdate did_document = 2;
+}
+
+message GetDIDRegistryUpdatesRequest {
+  // The id of the last update received.
+  // All updates since this id will be returned, limited to the maximum number of updates specified in the request.
+  // To fully synchronise, clients should continue calling this method until the response contains no updates.
+  // If this is the first call, then this should be set to 0.
+  uint64 since_id = 1;
+
+  // The maximum number of updates to return, defaults to 1000.
+  uint32 max_updates = 2;
+
+  string origin_volt = 3;
+}
+
+message GetDIDRegistryUpdatesResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updates.
+  repeated DIDRegistryUpdate update = 2;
+}
+
+message ResolveDIDRequest {
+  // The DID to resolve.
+  string did = 1;
+
+  // Set to search all known registries rather than just the local registry.
+  bool include_registries = 2;
+}
+
+message ResolveDIDResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  // The JSON representation of the DID document.
+  string did_document = 2;
+
+  // The signature used to save this version of the DID document.
+  string update_signature = 3;
+
+  // The DID of the Volt that saved this version of the DID document.
+  string origin_volt = 4;
+}
+
+message RegisterDIDDocumentRequest {
+  bool create = 1;
+
+  // The DID document to save.
+  DIDRegistryUpdate did_update = 2;
+
+  // When updating an existing DID document, it is necessary to include a signature of the document JSON, signed by the DID document's current owner.
+  // This is different from the proof contained in the DID document itself.
+  string update_signature = 3;
+}
+
+message RegisterDIDDocumentResponse {
+  // Details of any error that occurred on the call.
+  tdx.volt_api.volt.v1.Status status = 1;
+
+  DIDRegistryUpdate did_document = 2;
+}
+
+
+// Empty ATM - a VC is issued for the authenticated identity.
+message TrustVerifiableCredentialRequest {
+}
+
+message TrustVerifiableCredentialResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  string verifiable_credential_json = 2;
+}
+
+message ParseCredentialRequest {
+  oneof credential {
+    VerifiablePresentation verifiable_presentation = 1;
+    string url = 2;
+  }
+  string public_key = 3;
+}
+
+message ParseCredentialResponse {
+  tdx.volt_api.volt.v1.Status status = 1;
+  string id = 2;
+  string issuer_id = 3;
+  string subject_id = 4;
+  string claim_json = 5;
+}

package/protobuf/tdx/volt_api/volt/v1/volt.proto

@@ -24,18 +24,6 @@ enum OnlineStatus {
   ONLINE_STATUS_OFFLINE = 2;
 }
 
-// @todo currently this must align with AuthorisationDecision enum in policy library, but some of the values are irrelevant outside of the public API so we need a public-facing enum and some translation.
-enum PolicyDecision {
-  POLICY_DECISION_UNKNOWN = 0;
-  POLICY_DECISION_PROMPT = 1;
-  POLICY_DECISION_PERMIT = 2;
-  POLICY_DECISION_DENY = 3;
-  POLICY_DECISION_INDETERMINATE = 4;
-  POLICY_DECISION_NOT_APPLICABLE = 5;
-  POLICY_DECISION_APPLICABLE = 6;
-  POLICY_DECISION_PENDING = 7;
-}
-
 // Not used ATM.
 enum ResourceStatus {
   RESOURCE_STATUS_UNKNOWN = 0;
@@ -51,6 +39,31 @@ enum ShareMode {
   SHARE_MODE_PUBLIC_READ = 2;
 }
 
+// @todo currently this must align with AuthorisationDecision enum in policy library, but some of the values are irrelevant outside of the public API so we need a public-facing enum and some translation.
+enum PolicyDecision {
+  POLICY_DECISION_UNKNOWN = 0;
+  POLICY_DECISION_PROMPT = 1;
+  POLICY_DECISION_PERMIT = 2;
+  POLICY_DECISION_DENY = 3;
+  POLICY_DECISION_INDETERMINATE = 4;
+  POLICY_DECISION_NOT_APPLICABLE = 5;
+  POLICY_DECISION_APPLICABLE = 6;
+  POLICY_DECISION_PENDING = 7;
+}
+
+// Attribute data types.
+enum AttributeDataType {
+  ATTRIBUTE_DATA_TYPE_UNKNOWN = 0;
+  ATTRIBUTE_DATA_TYPE_STRING = 1;
+  ATTRIBUTE_DATA_TYPE_INTEGER = 2;
+  ATTRIBUTE_DATA_TYPE_REAL = 3;
+  ATTRIBUTE_DATA_TYPE_BOOLEAN = 4;
+  ATTRIBUTE_DATA_TYPE_BYTES = 5;
+
+  ATTRIBUTE_DATA_TYPE_IDENTITY = 100;
+  ATTRIBUTE_DATA_TYPE_RESOURCE = 101;
+}
+
 // Represents an outbound connection from a Volt to a remote service that will act as a proxy for that Volt.
 // This enables Volts to bypass firewall and NATs.
 // Example - connection from a Volt to a Relay Volt running on the public internet, such as tdxvolt.com
@@ -81,6 +94,15 @@ message ProxyConnection {
 
   // Optional challenge that can be presented in the bind phase when initialising the connection.
   string challenge = 10;
+
+  // Indicates that this connection hosts a DID registry that we should synchronise with.
+  bool sync_did_registry = 11;
+
+  // The id of the last DID registry operation that was synchronised.
+  uint64 did_registry_sync_id = 12;
+
+  // The id of the target Volt that this connection is bound to.
+  string target_id = 13;
 }
 
 enum SecureMode {
@@ -192,6 +214,13 @@ message VoltParameters {
   // The certificate authority of the Relay if this is a remote connection via a Relay.
   string relay_ca_pem = 33;
 
+  // Optional override of the http address, rather than using the default of fixed_host:http_port.
+  // This is useful if the Volt is behind a firewall or NAT, and the http server is listening on a different port
+  // from 80 or 443 but this is hidden by the proxy. For example, if the `fixed_host` is `coreid.com` and http server is
+  // listening on 2115, but the proxy is forwarding 443 to 2115, then the http_address_override would be set to
+  // `https://coreid.com`.
+  string http_address_override = 34;
+
   // An optional alias that can be used to refer to the Volt rather than the `id` field.
   // This alias must be unique within the scope of the Battery in which the Volt is stored.
   string alias = 35;
@@ -201,6 +230,12 @@ message VoltParameters {
 
   // If set, indicates that any client that provides the correct challenge in the bind phase will automatically be approved to access the Volt.
   bool approve_on_challenge = 37;
+
+  // Maintain and expose a database of DIDs.
+  bool enable_did_registry = 38;
+
+  // Zero or more URLs of trusted peer DID registries.
+  repeated string did_registry = 40;
 }
 
 message VoltEndpoint {
@@ -261,8 +296,11 @@ message ProtoFile {
 
 enum ServiceHostType {
   SERVICE_HOST_TYPE_UNKNOWN = 0;
+  // A built-in service hosted by the Volt.
   SERVICE_HOST_TYPE_BUILTIN = 1;
+  // A service hosted by a grpc server other than the Volt.
   SERVICE_HOST_TYPE_SERVER = 2;
+  // A service hosted by a Volt client via a relay connection, i.e. the service is not exposed by a server as such, rather a Volt client implements the service and a Volt acts as a proxy, calling back to the client to implement the methods.
   SERVICE_HOST_TYPE_RELAYED = 3;
 }
 
@@ -270,16 +308,19 @@ enum ServiceHostType {
 message ServiceDescription {
   ServiceHostType host_type = 1;
 
-  // The id of the server resource that is hosting this service.
-  // For built-in services, i.e. those hosted by the Volt, this will set to the Volt id.
-  string host_service_id = 2;
+  // The identity of the client that is exposing the service.
+  // For example, if a third party is exposing a database service via a Volt, it will first bind to the Volt and obtain a client DID and credentials in order to be able to create service resource(s).
+  // Any resources that are owned by this client will be marked as online if the client itself is online, i.e. has a live connection to the Volt.
+  // This will be empty if the service is a built-in Volt service.
+  string host_client_id = 2;
 
-  // The identity of the client that is exposing the service via a relay connection.
-  // This will be empty if the service is exposed via a grpc server.
-  string host_client_id = 3;
+  // The id of the resource that holds the protobuf definition for this resource.
+  // For example, if a third party is exposing a database service via a Volt, it will create a service resource that holds details of the protobuf methods exposed by the service.
+  // For built-in services, i.e. those hosted by the Volt, this will set to the Volt id.
+  string host_service_id = 3;
 
   // The address of the grpc server hosting this service.
-  // This will be empty if the service is hosted by a relay client (see `relay_public_key` below).
+  // Only relevant to grpc-hosted services.
   string host_address = 4;
 
   // The certificate authority (chain) that signed the service server certificate.
@@ -290,9 +331,6 @@ message ServiceDescription {
   // This may change as the service comes and goes online.
   string host_public_key = 6;
 
-  // The fingerprint derived from `host_public_key`, included for convenience.
-  string host_fingerprint = 7;
-
   // The connection id currently used to host this service.
   string host_connection_id = 8;
 
@@ -312,24 +350,11 @@ message ServiceDescription {
   repeated MethodDescription method = 100;
 }
 
-// Resource attribute data types.
-enum AttributeDataType {
-  ATTRIBUTE_DATA_TYPE_UNKNOWN = 0;
-  ATTRIBUTE_DATA_TYPE_STRING = 1;
-  ATTRIBUTE_DATA_TYPE_INTEGER = 2;
-  ATTRIBUTE_DATA_TYPE_REAL = 3;
-  ATTRIBUTE_DATA_TYPE_BOOLEAN = 4;
-  ATTRIBUTE_DATA_TYPE_BYTES = 5;
-
-  ATTRIBUTE_DATA_TYPE_IDENTITY = 100;
-  ATTRIBUTE_DATA_TYPE_RESOURCE = 101;
-}
-
-// Resource attribute value will be one of the following fields, depending on the data type.
+// Attribute value will be one of the following fields, depending on the data type.
 message AttributeValue {
   oneof value {
     string string = 1;
-    int32 integer = 2;
+    int64 integer = 2;
     double real = 3;
     bool boolean = 4;
     bytes bytes = 5;
@@ -429,32 +454,38 @@ enum IdentityType {
 }
 
 message IdentityAlias {
+  // The alias id.
+  uint32 id = 1;
+
   // The corresponding identity id.
-  string identity_id = 1;
+  string identity_id = 2;
 
   // The actual alias, e.g. a common name or key fingerprint.
-  string alias = 2;
-
-  // This will only be populated if alias_type == tdx:public-key
-  string public_key = 3;
+  string alias = 3;
 
   // This will only be populated if alias_type == tdx:public-key
-  string private_key = 4;
+  string public_key = 4;
 
-  string alias_type = 5;
+  // This will only be populated if alias_type == tdx:public-key, and the key is stored in the Volt.
+  string private_key = 5;
 
-  string issuer_id = 6;
+  // The alias type, for example public key, email, phone number etc.
+  string alias_type = 6;
 
-  // Indicates if this alias has an 'authenticate' policy decision assigned.
-  PolicyDecision authenticate = 7;
+  // The identity that issued this alias.
+  string issuer_id = 7;
 
   // Indicates if this alias has an 'bind' policy decision assigned.
   PolicyDecision bind = 8;
+
+  // Optional description of this alias.
+  string description = 9;
 }
 
 // A Volt identity encompasses a Resource and a set of identity aliases.
 message Identity {
   Resource resource = 1;
+
   repeated IdentityAlias alias = 2;
 }
 
@@ -514,6 +545,10 @@ message Binding {
 
   // Set if the bind request presented a valid challenge code.
   bool volt_challenge = 15;
+
+  string did_document = 16;
+
+  string did_document_signature = 17;
 }
 
 message Access {
@@ -571,27 +606,49 @@ enum SessionStatus {
   SESSION_STATUS_REJECTED = 3;
 }
 
+message SessionCredential {
+  // The alias id.
+  uint32 id = 1;
+
+  // The corresponding session id.
+  string session_id = 2;
+
+  // The actual credential, e.g. a key fingerprint or VC.
+  string credential = 3;
+
+  // The credential type, for example public key, email, phone number etc.
+  string credential_type = 4;
+
+  // The identity that issued this alias.
+  string issuer_id = 5;
+
+  // Optional description of this alias.
+  string description = 6;
+
+  // Type-specific extra data stored with the credential.
+  string extra = 7;
+
+  // More type-specific data stored with the credential.
+  string extra_2 = 8;
+}
+
 message Session {
   string id = 1;
 
-  string identity_id = 2;
+  //  string public_key = 2;
 
-  string identity_name = 3;
+  string identity_id = 3;
 
-  string ip = 4;
+  string identity_name = 4;
 
-  uint64 created = 5;
+  string ip = 5;
 
-  uint64 modified = 6;
+  repeated SessionCredential credential = 6;
 
-  SessionStatus status = 7;
-}
+  uint64 created = 7;
 
-message VerifiableCredential {
-  string encoded = 1;
-}
+  uint64 modified = 8;
 
-message VerifiablePresentation {
-  VerifiableCredential credential = 1;
-  string signature = 2;
+  SessionStatus status = 9;
 }
+