@tdxvolt/volt-client-grpc 0.16.0-beta.1 → 0.16.0-beta.12

package/src/volt-credential.js

@@ -1,16 +1,17 @@
 /* eslint-disable no-underscore-dangle */
 import debug from "debug";
 import fs from "fs";
-import forge from "node-forge";
-import jwt from "jsonwebtoken";
-import crypto from "crypto";
-import * as voltUtils from "./utils.js";
 import { constants } from "./constants.js";
+import {
+  createKey,
+  fingerprintFromPublicKey,
+  getIdentityToken,
+  keyFromPem,
+  privateKeyToPem,
+  publicKeyToPem
+} from "@tdxvolt/volt-client-web";
 
-const { pki } = forge;
 const log = debug("volt-client-grpc:volt-credential");
-const aesAlgorithm = "aes-256-cbc";
-const rs256Algorithm = "RS256";
 
 export class VoltCredential {
   constructor(config, configPath) {
@@ -34,14 +35,13 @@ export class VoltCredential {
       }
 
       // Need to unencrypt the private key.
-      const decrypted = pki.decryptRsaPrivateKey(
-        this._cryptoCache.key,
-        config.p
-      );
+      const decrypted = keyFromPem(this._cryptoCache.key, config.p);
+
       if (!decrypted) {
         throw new Error("failed to decrypt key - check passphrase");
       }
-      this._cryptoCache.key = pki.privateKeyToPem(decrypted);
+
+      this._cryptoCache.key = privateKeyToPem(decrypted);
     }
 
     if (this._voltConfig.ca_pem) {
@@ -50,14 +50,11 @@ export class VoltCredential {
         this._cryptoCache.ca = this._voltConfig.ca_pem;
       }
 
-      // Pre-cache the target Volt public key by extracting it from the signing certificate.
-      const voltCert = forge.pki.certificateFromPem(this._voltConfig.ca_pem);
-
       // Extract Volt public key (used for encrypting Relay payloads).
-      this._voltPublicKey = forge.pki.publicKeyToPem(voltCert.publicKey);
-      this._voltFingerprint = voltUtils.createPublicKeyFingerprint(
-        this._voltPublicKey
-      );
+      this._voltPublicKey = this._voltConfig.public_key;
+
+      const voltKey = keyFromPem(this._voltPublicKey).publicKey;
+      this._voltFingerprint = fingerprintFromPublicKey(voltKey);
     }
   }
 
@@ -69,8 +66,16 @@ export class VoltCredential {
     return this._cryptoCache;
   }
 
-  get clientId() {
-    return this._cryptoCache.client_id;
+  get certificate() {
+    return this._cryptoCache.cert;
+  }
+
+  get sessionId() {
+    return this._cryptoCache.session_id;
+  }
+
+  get identityId() {
+    return this._cryptoCache.identity_did;
   }
 
   get voltPublicKey() {
@@ -78,7 +83,7 @@ export class VoltCredential {
   }
 
   get publicKey() {
-    return pki.publicKeyToPem(this.getKey().publicKey);
+    return publicKeyToPem(this.getKey().publicKey);
   }
 
   get voltFingerprint() {
@@ -86,9 +91,8 @@ export class VoltCredential {
   }
 
   getKey() {
-    const privateKey = pki.privateKeyFromPem(this._cryptoCache.key);
-    const publicKey = pki.rsa.setPublicKey(privateKey.n, privateKey.e);
-    return { privateKey, publicKey };
+    const key = keyFromPem(this._cryptoCache.key);
+    return key;
   }
 
   /**
@@ -101,17 +105,10 @@ export class VoltCredential {
       return Promise.resolve(this.getKey());
     } else {
       log("creating key");
-      return voltUtils
-        .createRSAKey()
-        .then((keyInfo) => {
-          log("successfully created key");
-          this._cryptoCache.key = keyInfo.pem;
-          return keyInfo.keypair;
-        })
-        .catch((err) => {
-          log("failure creating key [%s]", err.message);
-          return Promise.reject(err);
-        });
+      this._cryptoCache.key = createKey();
+      const key = keyFromPem(this._cryptoCache.key);
+      log("successfully created key");
+      return Promise.resolve(key);
     }
   }
 
@@ -136,55 +133,6 @@ export class VoltCredential {
     return !!this._cryptoCache.cert;
   }
 
-  /**
-   * Signs the identity resource id using the private key.
-   * @param {*} audience the token audience (usually the target volt)
-   * @param {*} tunnelling flag indicating if the token is required for a tunnelled connection
-   * @param {*} ttl time to live in seconds (default to 1 minute)
-   */
-  getIdentityToken(audience, publicKey, tunnelling = false, ttl = 60) {
-    if (!this._cryptoCache.key) {
-      throw new Error("crypto cache invalid");
-    }
-
-    const keyPair = this.getKey();
-    const publicKeyPem = pki.publicKeyToPem(keyPair.publicKey);
-    const base58Key = voltUtils.createPublicKeyFingerprint(publicKeyPem);
-
-    log("base58 key is %s", base58Key);
-
-    // Allow TTL either side of the current time.
-    // @todo - fix with server time sync on volt connection.
-    const payload = {
-      aud: audience,
-      iat: Math.floor(Date.now() / 1000) - ttl,
-      exp: Math.floor(Date.now() / 1000) + ttl,
-      sub: this._cryptoCache.client_id
-    };
-
-    let sharedKey;
-    if (tunnelling) {
-      // Initialise the Relay encryption key.
-      sharedKey = VoltCredential.aesCreateKey();
-
-      // Encrypt the key details using the target Volt public key and include this in the JWT payload.
-      payload.sk = VoltCredential.rsaEncrypt(publicKey, sharedKey.key);
-      payload.iv = VoltCredential.rsaEncrypt(publicKey, sharedKey.iv);
-    }
-
-    // Sign synchronously.
-    const token = jwt.sign(payload, this._cryptoCache.key, {
-      algorithm: rs256Algorithm,
-      keyid: base58Key
-    });
-
-    // Return the token along with any encryption key details.
-    return {
-      token,
-      sharedKey
-    };
-  }
-
   /**
    * Creates the metadata required for a grpc call, including the Volt authentication token
    * and optionally tunnel encryption parameters.
@@ -195,9 +143,12 @@ export class VoltCredential {
    * @returns
    */
   getIdentityMetadata(grpc, audience, publicKey, tunnelling = false, ttl = 60) {
-    const identityToken = this.getIdentityToken(
+    const key = keyFromPem(this._cryptoCache.key);
+
+    const identityToken = getIdentityToken(
+      this.sessionId,
+      key,
       audience || this._voltConfig.id,
-      publicKey,
       tunnelling,
       ttl
     );
@@ -207,47 +158,17 @@ export class VoltCredential {
   }
 
   saveCache() {
+    const clone = { ...this._config, credential: { ...this._cryptoCache } };
+    if (this._config.p) {
+      // A passphrase option exists => encrypt the key before writing the cache file.
+      const key = keyFromPem(this._cryptoCache.key);
+      clone.credential.key = privateKeyToPem(key.privateKey, this._config.p);
+    }
+
     if (this._persistCache) {
-      const clone = { ...this._config, credential: { ...this._cryptoCache } };
-      if (this._config.p) {
-        // A passphrase option exists => encrypt the key before writing the cache file.
-        const privateKey = pki.privateKeyFromPem(this._cryptoCache.key);
-        clone.credential.key = pki.encryptRsaPrivateKey(
-          privateKey,
-          this._config.p
-        );
-      }
       fs.writeFileSync(this._configPath, JSON.stringify(clone, null, 2));
     }
-  }
-
-  static aesCreateKey() {
-    // Generate random key for the AES-256 algorithm (32 bytes = 256 bits).
-    const key = crypto.randomBytes(32);
-    const iv = crypto.randomBytes(16);
-    return { key, iv };
-  }
-
-  static aesEncrypt(buffer, key, iv) {
-    const cipher = crypto.createCipheriv(aesAlgorithm, key, iv);
-    const crypted = Buffer.concat([cipher.update(buffer), cipher.final()]);
-    return crypted;
-  }
-
-  static aesDecrypt(buffer, key, iv) {
-    const cipher = crypto.createDecipheriv(aesAlgorithm, key, iv);
-    const decrypted = Buffer.concat([cipher.update(buffer), cipher.final()]);
-    return decrypted;
-  }
-
-  static rsaEncrypt(key, buffer) {
-    const cipher = crypto.publicEncrypt(key, buffer);
-    return cipher.toString("base64url");
-  }
 
-  static rsaDecrypt(key, buffer) {
-    const keyObj = crypto.createPrivateKey(key);
-    const cipher = Buffer.from(buffer, "base64url");
-    return Buffer.from(crypto.privateDecrypt(keyObj, cipher));
+    return clone;
   }
 }