@tdxvolt/volt-client-grpc 0.15.1 → 0.16.0-beta.2

package/src/volt-client-internal.js

@@ -16,6 +16,7 @@ import * as voltUtils from "./utils.js";
 import { constants } from "./constants.js";
 import GRPCCall from "./grpc-call.js";
 import RpcInvocation from "./rpc-invocation.js";
+import { v4 as generateId } from "uuid";
 
 const { pki } = forge;
 const { filter, pick } = lodash;
@@ -31,30 +32,31 @@ const voltServices = [
   constants.serviceType.wireAPI
 ];
 
-function issueBind(bindRequest, ttl) {
+function issueAuthenticate(authenticateRequest, ttl) {
   // eslint-disable-next-line no-use-before-define
   return unaryCallInternal
-    .call(this, "Bind", bindRequest)
-    .then((bindResponse) => {
-      log("got binding request response %j", bindResponse);
-      if (bindResponse.status?.code) {
-        log("error in bind response: %s", bindResponse.status.message);
-        return Promise.reject(new Error(bindResponse.status.message));
+    .call(this, "Authenticate", authenticateRequest)
+    .then((authenticateResponse) => {
+      log("got authenticate response %j", authenticateResponse);
+      if (authenticateResponse.status?.code) {
+        log("error in bind response: %s", authenticateResponse.status.message);
+        return Promise.reject(new Error(authenticateResponse.status.message));
       } else {
-        switch (bindResponse.decision) {
+        switch (authenticateResponse.decision) {
           case "POLICY_DECISION_PERMIT": {
             //
             // The request status is permit => cache the bind response info.
             //
 
             // This is the certificate assigned to us by the volt.
-            this._credential.cache.cert = bindResponse.cert;
+            this._credential.cache.cert = authenticateResponse.cert;
 
             // This is the signing CA used by the volt.
-            this._credential.cache.ca = bindResponse.chain;
+            this._credential.cache.ca = authenticateResponse.chain;
 
             // Identity resource id is assigned by the volt.
-            this._credential.cache.client_id = bindResponse.identity_id;
+            this._credential.cache.session_id = authenticateResponse.session_id;
+
             this._credential.saveCache();
             break;
           }
@@ -68,12 +70,15 @@ function issueBind(bindRequest, ttl) {
             break;
           }
           default:
-            log("ignoring unknown bind descision %s", bindResponse.status);
+            log(
+              "ignoring unknown bind descision %s",
+              authenticateResponse.status
+            );
             break;
         }
       }
 
-      return bindResponse.decision;
+      return authenticateResponse.decision;
     });
 }
 
@@ -86,7 +91,7 @@ function findDIDDocumentService(document, serviceType) {
   return matches;
 }
 
-export async function bindInternal() {
+export async function authenticateInternal(createDID = true) {
   try {
     // Check if we need to resolve a Relay volt.
     if (
@@ -100,6 +105,7 @@ export async function bindInternal() {
         this,
         `${relayURL}/discovery`
       );
+
       if (this._voltConfig.relay.ca_pem) {
         log(
           "Auto-fetched Relay CA %s, remote address %s",
@@ -133,21 +139,13 @@ export async function bindInternal() {
     this._credential.saveCache();
 
     // Form the request message.
-    const bindRequest = {
+    const authenticateRequest = {
       binding_name: this._config.client_name,
-      public_key: publicKeyPem,
-      host: this._credential.cache.bindIp,
-      x509_credential: []
+      host: this._credential.cache.bindIp
     };
 
-    if (this._credential.cache.cert) {
-      bindRequest.x509_credential = [
-        this._credential.cache.cert + this._credential.cache.ca
-      ];
-    }
-
     if (this._voltConfig.challenge_code) {
-      bindRequest.challenge = voltUtils.signBase64(
+      authenticateRequest.challenge = voltUtils.signBase64(
         keyPair.privateKey,
         this._voltConfig.challenge_code
       );
@@ -157,15 +155,71 @@ export async function bindInternal() {
       );
     }
 
-    // For remote connections, add our cloud-issued certificate as an additional credential.
-    if (this._voltConfig?.relay?.ca_pem && this._credential.cache.cloud_cert) {
-      bindRequest.x509_credential = bindRequest.x509_credential.concat(
-        this._credential.cache.cloud_cert + this._voltConfig.relay.ca_pem
+    if (!createDID) {
+      authenticateRequest.public_key = publicKeyPem;
+    } else {
+      if (!this._credential.cache.identity_id) {
+        // If we don't have an identity id, then we need to create a DID.
+        this._credential.cache.identity_id = `did:volt:${generateId()}`;
+      }
+
+      const did = this._credential.cache.identity_id;
+
+      // Order of properties in the DID document is important,
+      // they must be in alphabetical order throughout the document.
+      // This is because the DID document is signed and the signature
+      // is over the entire document.
+      const didDocument = {
+        "@context": "https://www.w3.org/ns/did/v1",
+        authentication: [`${did}#key-1`],
+        description: this._config.client_name,
+        id: did,
+        verificationMethod: [
+          {
+            controller: did,
+            id: `${did}#key-1`,
+            publicKeyPem: publicKeyPem,
+            type: "RsaSignature2018"
+          }
+        ]
+      };
+
+      const signDocument = JSON.stringify(didDocument, null, 2);
+      log("signing did document");
+      log(signDocument);
+
+      // Sign the DID document.
+      const documentDigest = voltUtils.signBase64(
+        keyPair.privateKey,
+        signDocument
       );
+
+      const proofSignature = voltUtils.jwsSignature(documentDigest);
+
+      // Create the DID document proof.
+      didDocument.proof = {
+        created: new Date().toISOString(),
+        jws: proofSignature,
+        proofPurpose: "assertionMethod",
+        type: "RsaSignature2018",
+        verificationMethod: `${did}#key-1`
+      };
+
+      // Set the DID document with proof in the authenticate request.
+      authenticateRequest.did_document = JSON.stringify(didDocument, null, 2);
+
+      // Now sign the entire DID document, including the proof and set it in the
+      // bind request. This is required by the Volt to verify that we have the private key for the DID.
+      authenticateRequest.did_document_signature = voltUtils.signBase64(
+        keyPair.privateKey,
+        authenticateRequest.did_document
+      );
+
+      log("did document is %s", authenticateRequest.did_document);
+      log("did signature is %s", authenticateRequest.did_document_signature);
     }
 
-    log("sending %d x509 credentials", bindRequest.x509_credential.length);
-    log("bind TTL is ", this._config.bindRequestTTL);
+    log("authenticate TTL is ", this._config.bindRequestTTL);
 
     // This will block while the request is pending.
     const pollInterval = 10000;
@@ -177,12 +231,12 @@ export async function bindInternal() {
         await new Promise((resolve) => setTimeout(resolve, pollInterval));
       }
       // eslint-disable-next-line no-await-in-loop
-      decision = await issueBind.call(
+      decision = await issueAuthenticate.call(
         this,
-        bindRequest,
+        authenticateRequest,
         this._voltConfig.bindRequestTTL
       );
-      log("binding decision: %s", decision);
+      log("authenticate decision: %s", decision);
     } while (
       decision === "POLICY_DECISION_PROMPT" ||
       decision === "POLICY_DECISION_PENDING"
@@ -304,9 +358,6 @@ export function getVoltAPIClientInternal() {
 
 export function getAPIClientInternal(service) {
   if (!this._cachedService[service.id]) {
-    const isRelayedService =
-      service.service_description.host_type === "SERVICE_HOST_TYPE_RELAYED";
-
     const serviceAddress = this.isRemote
       ? this._voltConfig.relay.address
       : service.service_description.host_address;
@@ -354,9 +405,8 @@ export function getServiceClient(service) {
 }
 
 export function unaryCallInternal(method, request, service) {
-  const grpcClient = getServiceClient.call(this, service);
-
   return new Promise((resolve, reject) => {
+    const grpcClient = getServiceClient.call(this, service);
     const call = new GRPCCall(this, method, "METHOD_TYPE_UNARY", service);
 
     let response = null;

package/src/volt-client.js

@@ -5,7 +5,7 @@ import path from "path";
 import { getServiceDescriptors } from "./proto-utils.js";
 import { createClient as createGrpcClient } from "./grpc-utils.js";
 import {
-  bindInternal,
+  authenticateInternal,
   connectInternal,
   fetchVoltConfig,
   fetchVoltConfigFromDID,
@@ -166,14 +166,14 @@ export class VoltClient extends EventEmitter {
       if (this._credential._cryptoCache.cert) {
         isBound = true;
       } else {
-        // No certificate present in the cache yet => we need to bind.
+        // No certificate present in the cache yet => we need to authenticate.
         try {
-          isBound = await bindInternal.call(this);
+          isBound = await authenticateInternal.call(this);
         } catch (bindErr) {
           if (bindErr.message === "invalid arguments") {
             // This is usually the result of a missing challenge signature or credential.
             log(
-              "failure binding to Volt - did you supply a challenge code or verified credential?"
+              "failure authenticating on Volt - did you supply a challenge code or verified credential?"
             );
             throw bindErr;
           }
@@ -182,7 +182,7 @@ export class VoltClient extends EventEmitter {
 
       if (!isBound) {
         // This is usually because of request being denied.
-        throw new Error("Volt binding failed");
+        throw new Error("Volt authentication failed");
       }
 
       return Promise.resolve();
@@ -408,6 +408,10 @@ export class VoltClient extends EventEmitter {
    * VoltAPI - volt management
    */
 
+  Authenticate(request) {
+    return unaryCallInternal.call(this, "Authenticate", request);
+  }
+
   Bind(request) {
     return unaryCallInternal.call(this, "Bind", request);
   }

package/src/volt-credential.js

@@ -69,8 +69,12 @@ export class VoltCredential {
     return this._cryptoCache;
   }
 
-  get clientId() {
-    return this._cryptoCache.client_id;
+  get sessionId() {
+    return this._cryptoCache.session_id;
+  }
+
+  get identityId() {
+    return this._cryptoCache.identity_id;
   }
 
   get voltPublicKey() {
@@ -159,7 +163,7 @@ export class VoltCredential {
       aud: audience,
       iat: Math.floor(Date.now() / 1000) - ttl,
       exp: Math.floor(Date.now() / 1000) + ttl,
-      sub: this._cryptoCache.client_id
+      sub: this._cryptoCache.session_id
     };
 
     let sharedKey;
@@ -241,12 +245,13 @@ export class VoltCredential {
   }
 
   static rsaEncrypt(key, buffer) {
-    return crypto.publicEncrypt(key, buffer).toString("base64");
+    const cipher = crypto.publicEncrypt(key, buffer);
+    return cipher.toString("base64url");
   }
 
   static rsaDecrypt(key, buffer) {
     const keyObj = crypto.createPrivateKey(key);
-    const cipher = Buffer.from(buffer, "base64");
+    const cipher = Buffer.from(buffer, "base64url");
     return Buffer.from(crypto.privateDecrypt(keyObj, cipher));
   }
 }

package/protobuf/tdx/volt_api/ssi/v1/ssi_api.proto

@@ -1,37 +0,0 @@
-syntax = "proto3";
-
-package tdx.volt_api.ssi.v1;
-
-import "tdx/volt_api/volt/v1/status.proto";
-
-// Volt DIDs are essentially 'peer DIDs', i.e. they are not globally resolvable.
-// TDX DIDs are globally resolvable.
-
-service SsiAPI {
-  rpc ResolveDID(ResolveDIDRequest) returns (ResolveDIDResponse);
-  rpc TrustVerifiableCredential(TrustVerifiableCredentialRequest) returns (TrustVerifiableCredentialResponse);
-}
-
-//
-// Do we need to support/differentiate between plain DIDs and DID urls here?
-// Where a DID url is a DID followed by some additional lookup info,
-// e.g. did:tdx:volt:92181ffa-072a-452a-ae79-a243ab2812fc;service=/some/service?query#fragment
-//
-message ResolveDIDRequest {
-  string did_url = 1;
-}
-
-message ResolveDIDResponse {
-  tdx.volt_api.volt.v1.Status status = 1;
-  string did_document_json = 2;
-}
-
-// Empty ATM - a VC is issued for the authenticated identity.
-message TrustVerifiableCredentialRequest {
-}
-
-message TrustVerifiableCredentialResponse {
-  tdx.volt_api.volt.v1.Status status = 1;
-  string verifiable_credential_json = 2;
-}
-