@tdxvolt/volt-client-grpc 0.16.0-beta.1 → 0.16.0-beta.3

package/lib/index.cjs

@@ -589,8 +589,12 @@ class VoltCredential {
     return this._cryptoCache;
   }
 
-  get clientId() {
-    return this._cryptoCache.client_id;
+  get sessionId() {
+    return this._cryptoCache.session_id;
+  }
+
+  get identityId() {
+    return this._cryptoCache.identity_id;
   }
 
   get voltPublicKey() {
@@ -678,7 +682,7 @@ class VoltCredential {
       aud: audience,
       iat: Math.floor(Date.now() / 1000) - ttl,
       exp: Math.floor(Date.now() / 1000) + ttl,
-      sub: this._cryptoCache.client_id
+      sub: this._cryptoCache.session_id
     };
 
     let sharedKey;
@@ -1735,7 +1739,8 @@ function issueAuthenticate(authenticateRequest, ttl) {
             this._credential.cache.ca = authenticateResponse.chain;
 
             // Identity resource id is assigned by the volt.
-            this._credential.cache.client_id = authenticateResponse.session_id;
+            this._credential.cache.session_id = authenticateResponse.session_id;
+
             this._credential.saveCache();
             break;
           }
@@ -1770,8 +1775,7 @@ function findDIDDocumentService(document, serviceType) {
   return matches;
 }
 
-
-async function authenticateInternal() {
+async function authenticateInternal(createDID = true) {
   try {
     // Check if we need to resolve a Relay volt.
     if (
@@ -1808,7 +1812,9 @@ async function authenticateInternal() {
     }
 
     const keyPair = this._credential.getKey();
-    const publicKeyPem = pki.publicKeyToPem(keyPair.publicKey);
+    const publicKeyPem = removeCarriageReturn(
+      pki.publicKeyToPem(keyPair.publicKey)
+    );
 
     if (!this._credential.cache.bindIp) {
       // Default the IP address if none is specified. This is used to set the SAN in the
@@ -1821,8 +1827,7 @@ async function authenticateInternal() {
     // Form the request message.
     const authenticateRequest = {
       binding_name: this._config.client_name,
-      public_key: publicKeyPem,
-      host: this._credential.cache.bindIp,
+      host: this._credential.cache.bindIp
     };
 
     if (this._voltConfig.challenge_code) {
@@ -1836,6 +1841,70 @@ async function authenticateInternal() {
       );
     }
 
+    if (!createDID) {
+      authenticateRequest.public_key = publicKeyPem;
+    } else {
+      if (!this._credential.cache.identity_id) {
+        // If we don't have an identity id, then we need to create a DID.
+        this._credential.cache.identity_id = `did:volt:${uuid.v4()}`;
+      }
+
+      const did = this._credential.cache.identity_id;
+
+      // Order of properties in the DID document is important,
+      // they must be in alphabetical order throughout the document.
+      // This is because the DID document is signed and the signature
+      // is over the entire document.
+      const didDocument = {
+        "@context": "https://www.w3.org/ns/did/v1",
+        authentication: [`${did}#key-1`],
+        description: this._config.client_name,
+        id: did,
+        verificationMethod: [
+          {
+            controller: did,
+            id: `${did}#key-1`,
+            publicKeyPem: publicKeyPem,
+            type: "RsaSignature2018"
+          }
+        ]
+      };
+
+      const signDocument = JSON.stringify(didDocument, null, 2);
+      log$1("signing did document");
+      log$1(signDocument);
+
+      // Sign the DID document.
+      const documentDigest = signBase64(
+        keyPair.privateKey,
+        signDocument
+      );
+
+      const proofSignature = jwsSignature(documentDigest);
+
+      // Create the DID document proof.
+      didDocument.proof = {
+        created: new Date().toISOString(),
+        jws: proofSignature,
+        proofPurpose: "assertionMethod",
+        type: "RsaSignature2018",
+        verificationMethod: `${did}#key-1`
+      };
+
+      // Set the DID document with proof in the authenticate request.
+      authenticateRequest.did_document = JSON.stringify(didDocument, null, 2);
+
+      // Now sign the entire DID document, including the proof and set it in the
+      // bind request. This is required by the Volt to verify that we have the private key for the DID.
+      authenticateRequest.did_document_signature = signBase64(
+        keyPair.privateKey,
+        authenticateRequest.did_document
+      );
+
+      log$1("did document is %s", authenticateRequest.did_document);
+      log$1("did signature is %s", authenticateRequest.did_document_signature);
+    }
+
     log$1("authenticate TTL is ", this._config.bindRequestTTL);
 
     // This will block while the request is pending.

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.16.0-beta.1",
+  "version": "0.16.0-beta.3",
   "description": "tdx Volt library for nodejs clients",
   "type": "module",
   "exports": {

package/src/volt-client-internal.js

@@ -55,7 +55,8 @@ function issueAuthenticate(authenticateRequest, ttl) {
             this._credential.cache.ca = authenticateResponse.chain;
 
             // Identity resource id is assigned by the volt.
-            this._credential.cache.client_id = authenticateResponse.session_id;
+            this._credential.cache.session_id = authenticateResponse.session_id;
+
             this._credential.saveCache();
             break;
           }
@@ -81,52 +82,6 @@ function issueAuthenticate(authenticateRequest, ttl) {
     });
 }
 
-function issueBind(bindRequest, ttl) {
-  // eslint-disable-next-line no-use-before-define
-  return unaryCallInternal
-    .call(this, "Bind", bindRequest)
-    .then((bindResponse) => {
-      log("got binding request response %j", bindResponse);
-      if (bindResponse.status?.code) {
-        log("error in bind response: %s", bindResponse.status.message);
-        return Promise.reject(new Error(bindResponse.status.message));
-      } else {
-        switch (bindResponse.decision) {
-          case "POLICY_DECISION_PERMIT": {
-            //
-            // The request status is permit => cache the bind response info.
-            //
-
-            // This is the certificate assigned to us by the volt.
-            this._credential.cache.cert = bindResponse.cert;
-
-            // This is the signing CA used by the volt.
-            this._credential.cache.ca = bindResponse.chain;
-
-            // Identity resource id is assigned by the volt.
-            this._credential.cache.client_id = bindResponse.identity_id;
-            this._credential.saveCache();
-            break;
-          }
-          case "POLICY_DECISION_DENY": {
-            log(">>>>>>>>>>>>>>> access request is DENIED <<<<<<<<<<<<<<<<<<<");
-            break;
-          }
-          case "POLICY_DECISION_PROMPT":
-          case "POLICY_DECISION_PENDING": {
-            log("access pending approval - waiting...");
-            break;
-          }
-          default:
-            log("ignoring unknown bind descision %s", bindResponse.status);
-            break;
-        }
-      }
-
-      return bindResponse.decision;
-    });
-}
-
 function findDIDDocumentService(document, serviceType) {
   if (!document.service) {
     return [];
@@ -136,8 +91,7 @@ function findDIDDocumentService(document, serviceType) {
   return matches;
 }
 
-
-export async function authenticateInternal() {
+export async function authenticateInternal(createDID = true) {
   try {
     // Check if we need to resolve a Relay volt.
     if (
@@ -174,7 +128,9 @@ export async function authenticateInternal() {
     }
 
     const keyPair = this._credential.getKey();
-    const publicKeyPem = pki.publicKeyToPem(keyPair.publicKey);
+    const publicKeyPem = voltUtils.removeCarriageReturn(
+      pki.publicKeyToPem(keyPair.publicKey)
+    );
 
     if (!this._credential.cache.bindIp) {
       // Default the IP address if none is specified. This is used to set the SAN in the
@@ -187,8 +143,7 @@ export async function authenticateInternal() {
     // Form the request message.
     const authenticateRequest = {
       binding_name: this._config.client_name,
-      public_key: publicKeyPem,
-      host: this._credential.cache.bindIp,
+      host: this._credential.cache.bindIp
     };
 
     if (this._voltConfig.challenge_code) {
@@ -202,161 +157,71 @@ export async function authenticateInternal() {
       );
     }
 
-    log("authenticate TTL is ", this._config.bindRequestTTL);
-
-    // This will block while the request is pending.
-    const pollInterval = 10000;
-    let decision = "";
-    do {
-      if (decision) {
-        // Wait a while before retrying.
-        // eslint-disable-next-line no-await-in-loop
-        await new Promise((resolve) => setTimeout(resolve, pollInterval));
+    if (!createDID) {
+      authenticateRequest.public_key = publicKeyPem;
+    } else {
+      if (!this._credential.cache.identity_id) {
+        // If we don't have an identity id, then we need to create a DID.
+        this._credential.cache.identity_id = `did:volt:${generateId()}`;
       }
-      // eslint-disable-next-line no-await-in-loop
-      decision = await issueAuthenticate.call(
-        this,
-        authenticateRequest,
-        this._voltConfig.bindRequestTTL
-      );
-      log("authenticate decision: %s", decision);
-    } while (
-      decision === "POLICY_DECISION_PROMPT" ||
-      decision === "POLICY_DECISION_PENDING"
-    );
 
-    return decision === "POLICY_DECISION_PERMIT";
-  } catch (err) {
-    log("failure binding to Volt [%s]", err.message);
-    throw err;
-  }
-}
-
-export async function bindInternal() {
-  try {
-    // Check if we need to resolve a Relay volt.
-    if (
-      typeof this._voltConfig?.relay === "string" ||
-      this._voltConfig?.relay?.http_address
-    ) {
-      const relayURL =
-        this._voltConfig.relay?.http_address || this._voltConfig.relay;
-      log("attempting to retrieve Relay information from %s", relayURL);
-      this._voltConfig.relay = await fetchVoltConfig.call(
-        this,
-        `${relayURL}/discovery`
-      );
-      if (this._voltConfig.relay.ca_pem) {
-        log(
-          "Auto-fetched Relay CA %s, remote address %s",
-          this._voltConfig.relay.ca_pem,
-          this._voltConfig.relay.address
-        );
-      } else {
-        throw new Error("Unable to fetch Relay CA - cannot securely connect.");
-      }
-    }
+      const did = this._credential.cache.identity_id;
+
+      // Order of properties in the DID document is important,
+      // they must be in alphabetical order throughout the document.
+      // This is because the DID document is signed and the signature
+      // is over the entire document.
+      const didDocument = {
+        "@context": "https://www.w3.org/ns/did/v1",
+        authentication: [`${did}#key-1`],
+        description: this._config.client_name,
+        id: did,
+        verificationMethod: [
+          {
+            controller: did,
+            id: `${did}#key-1`,
+            publicKeyPem: publicKeyPem,
+            type: "RsaSignature2018"
+          }
+        ]
+      };
 
-    if (!this._credential.cache.ca) {
-      this._credential.cache.ca = this._voltConfig.ca_pem;
-    }
+      const signDocument = JSON.stringify(didDocument, null, 2);
+      log("signing did document");
+      log(signDocument);
 
-    if (!this._credential.cache.ca) {
-      throw new Error(
-        "No certificate authority found in configuration for target Volt - check configuration"
+      // Sign the DID document.
+      const documentDigest = voltUtils.signBase64(
+        keyPair.privateKey,
+        signDocument
       );
-    }
 
-    const keyPair = this._credential.getKey();
-    const publicKeyPem = voltUtils.removeCarriageReturn(
-      pki.publicKeyToPem(keyPair.publicKey)
-    );
+      const proofSignature = voltUtils.jwsSignature(documentDigest);
 
-    if (!this._credential.cache.bindIp) {
-      // Default the IP address if none is specified. This is used to set the SAN in the
-      // certificate issued by the Volt.
-      this._credential.cache.bindIp = ip.address();
-    }
+      // Create the DID document proof.
+      didDocument.proof = {
+        created: new Date().toISOString(),
+        jws: proofSignature,
+        proofPurpose: "assertionMethod",
+        type: "RsaSignature2018",
+        verificationMethod: `${did}#key-1`
+      };
 
-    this._credential.saveCache();
+      // Set the DID document with proof in the authenticate request.
+      authenticateRequest.did_document = JSON.stringify(didDocument, null, 2);
 
-    // Form the request message.
-    const bindRequest = {
-      binding_name: this._config.client_name,
-      host: this._credential.cache.bindIp
-    };
-
-    if (this._voltConfig.challenge_code) {
-      bindRequest.challenge = voltUtils.signBase64(
+      // Now sign the entire DID document, including the proof and set it in the
+      // bind request. This is required by the Volt to verify that we have the private key for the DID.
+      authenticateRequest.did_document_signature = voltUtils.signBase64(
         keyPair.privateKey,
-        this._voltConfig.challenge_code
-      );
-    } else {
-      log(
-        "****no Volt challenge code available**** => not sending challenge signature"
+        authenticateRequest.did_document
       );
-    }
 
-    if (!this._credential.cache.client_id) {
-      // If we don't have a client id, then we need to create a DID.
-      this._credential.cache.client_id = `did:volt:${generateId()}`;
+      log("did document is %s", authenticateRequest.did_document);
+      log("did signature is %s", authenticateRequest.did_document_signature);
     }
 
-    const did = this._credential.cache.client_id;
-
-    // Order of properties in the DID document is important,
-    // they must be in alphabetical order throughout the document.
-    // This is because the DID document is signed and the signature
-    // is over the entire document.
-    const didDocument = {
-      "@context": "https://www.w3.org/ns/did/v1",
-      authentication: [`${did}#key-1`],
-      description: this._config.client_name,
-      id: did,
-      verificationMethod: [
-        {
-          controller: did,
-          id: `${did}#key-1`,
-          publicKeyPem: publicKeyPem,
-          type: "RsaSignature2018"
-        }
-      ]
-    };
-
-    const signDocument = JSON.stringify(didDocument, null, 2);
-    log("signing did document");
-    log(signDocument);
-
-    // Sign the DID document.
-    const documentDigest = voltUtils.signBase64(
-      keyPair.privateKey,
-      signDocument
-    );
-
-    const proofSignature = voltUtils.jwsSignature(documentDigest);
-
-    // Create the DID document proof.
-    didDocument.proof = {
-      created: new Date().toISOString(),
-      jws: proofSignature,
-      proofPurpose: "assertionMethod",
-      type: "RsaSignature2018",
-      verificationMethod: `${did}#key-1`
-    };
-
-    // Set the DID document with proof in the bind request.
-    bindRequest.did_document = JSON.stringify(didDocument, null, 2);
-
-    // Now sign the entire DID document, including the proof and set it in the
-    // bind request. This is required by the Volt to verify that we have the private key for the DID.
-    bindRequest.did_document_signature = voltUtils.signBase64(
-      keyPair.privateKey,
-      bindRequest.did_document
-    );
-
-    log("did document is %s", bindRequest.did_document);
-    log("did signature is %s", bindRequest.did_document_signature);
-    log("bind TTL is ", this._config.bindRequestTTL);
+    log("authenticate TTL is ", this._config.bindRequestTTL);
 
     // This will block while the request is pending.
     const pollInterval = 10000;
@@ -368,12 +233,12 @@ export async function bindInternal() {
         await new Promise((resolve) => setTimeout(resolve, pollInterval));
       }
       // eslint-disable-next-line no-await-in-loop
-      decision = await issueBind.call(
+      decision = await issueAuthenticate.call(
         this,
-        bindRequest,
+        authenticateRequest,
         this._voltConfig.bindRequestTTL
       );
-      log("binding decision: %s", decision);
+      log("authenticate decision: %s", decision);
     } while (
       decision === "POLICY_DECISION_PROMPT" ||
       decision === "POLICY_DECISION_PENDING"

package/src/volt-client.js

@@ -6,7 +6,6 @@ import { getServiceDescriptors } from "./proto-utils.js";
 import { createClient as createGrpcClient } from "./grpc-utils.js";
 import {
   authenticateInternal,
-  bindInternal,
   connectInternal,
   fetchVoltConfig,
   fetchVoltConfigFromDID,

package/src/volt-credential.js

@@ -69,8 +69,12 @@ export class VoltCredential {
     return this._cryptoCache;
   }
 
-  get clientId() {
-    return this._cryptoCache.client_id;
+  get sessionId() {
+    return this._cryptoCache.session_id;
+  }
+
+  get identityId() {
+    return this._cryptoCache.identity_id;
   }
 
   get voltPublicKey() {
@@ -159,7 +163,7 @@ export class VoltCredential {
       aud: audience,
       iat: Math.floor(Date.now() / 1000) - ttl,
       exp: Math.floor(Date.now() / 1000) + ttl,
-      sub: this._cryptoCache.client_id
+      sub: this._cryptoCache.session_id
     };
 
     let sharedKey;