@tdxvolt/volt-client-grpc 0.16.0-beta.10 → 0.16.0-beta.12

package/src/volt-client-internal.js

@@ -2,7 +2,6 @@
 import debug from "debug";
 import ip from "ip";
 import bent from "bent";
-import forge from "node-forge";
 import lodash from "lodash";
 import VoltConnection from "./volt-connection.js";
 import { join } from "path";
@@ -17,8 +16,12 @@ import { constants } from "./constants.js";
 import GRPCCall from "./grpc-call.js";
 import RpcInvocation from "./rpc-invocation.js";
 import { v4 as generateId } from "uuid";
+import {
+  publicKeyToPem,
+  removeCarriageReturn,
+  signBase64
+} from "@tdxvolt/volt-client-web";
 
-const { pki } = forge;
 const { filter, pick } = lodash;
 
 const log = debug("volt-client-grpc:volt-client-internal");
@@ -54,9 +57,15 @@ function issueAuthenticate(authenticateRequest, ttl) {
             // This is the signing CA used by the volt.
             this._credential.cache.ca = authenticateResponse.chain;
 
-            // Identity resource id is assigned by the volt.
+            // The session id is assigned by the volt.
             this._credential.cache.session_id = authenticateResponse.session_id;
 
+            if (!this._credential.cache.identity_did) {
+              // Identity DID has been assigned by the volt.
+              this._credential.cache.identity_did =
+                authenticateResponse.identity_did;
+            }
+
             this._credential.saveCache();
             break;
           }
@@ -67,6 +76,20 @@ function issueAuthenticate(authenticateRequest, ttl) {
           case "POLICY_DECISION_PROMPT":
           case "POLICY_DECISION_PENDING": {
             log("access pending approval - waiting...");
+
+            // This is the signing CA used by the volt.
+            this._credential.cache.ca = authenticateResponse.chain;
+
+            // The session id is assigned by the volt.
+            this._credential.cache.session_id = authenticateResponse.session_id;
+
+            if (!this._credential.cache.identity_did) {
+              // Identity DID has been assigned by the volt.
+              this._credential.cache.identity_did =
+                authenticateResponse.identity_did;
+            }
+
+            this._credential.saveCache();
             break;
           }
           default:
@@ -91,7 +114,10 @@ function findDIDDocumentService(document, serviceType) {
   return matches;
 }
 
-export async function authenticateInternal(useDID = true) {
+export async function authenticateInternal(
+  sessionOnly = false,
+  ownDID = false
+) {
   try {
     // Check if we need to resolve a Relay volt.
     if (
@@ -103,7 +129,7 @@ export async function authenticateInternal(useDID = true) {
       log("attempting to retrieve Relay information from %s", relayURL);
       this._voltConfig.relay = await fetchVoltConfig.call(
         this,
-        `${relayURL}/discovery`
+        `${relayURL}/discover`
       );
 
       if (this._voltConfig.relay.ca_pem) {
@@ -128,8 +154,8 @@ export async function authenticateInternal(useDID = true) {
     }
 
     const keyPair = this._credential.getKey();
-    const publicKeyPem = voltUtils.removeCarriageReturn(
-      pki.publicKeyToPem(keyPair.publicKey)
+    const publicKeyPem = removeCarriageReturn(
+      publicKeyToPem(keyPair.publicKey)
     );
 
     if (!this._credential.cache.bindIp) {
@@ -142,12 +168,12 @@ export async function authenticateInternal(useDID = true) {
 
     // Form the request message.
     const authenticateRequest = {
-      binding_name: this._config.client_name,
+      client_name: this._config.client_name,
       host: this._credential.cache.bindIp
     };
 
     if (this._voltConfig.challenge_code) {
-      authenticateRequest.challenge = voltUtils.signBase64(
+      authenticateRequest.challenge = signBase64(
         keyPair.privateKey,
         this._voltConfig.challenge_code
       );
@@ -157,68 +183,58 @@ export async function authenticateInternal(useDID = true) {
       );
     }
 
-    if (!useDID) {
+    if (sessionOnly) {
+      // We want to create a session-based authentication based simply on our key, rather than a
+      // fully-blown DID-based authentication.
+      log("creating session-only request");
       authenticateRequest.public_key = publicKeyPem;
-    } else if (!this._credential.cache.identity_id) {
-      // If we don't have an identity id, then we need to create a DID.
-      this._credential.cache.identity_id = `did:volt:${generateId()}`;
-
-      const did = this._credential.cache.identity_id;
-
-      // Order of properties in the DID document is important,
-      // they must be in alphabetical order throughout the document.
-      // This is because the DID document is signed and the signature
-      // is over the entire document.
-      const didDocument = {
-        "@context": "https://www.w3.org/ns/did/v1",
-        authentication: [`${did}#key-1`],
-        description: this._config.client_name,
-        id: did,
-        verificationMethod: [
-          {
-            controller: did,
-            id: `${did}#key-1`,
-            publicKeyPem: publicKeyPem,
-            type: "RsaSignature2018"
-          }
-        ]
-      };
-
-      const signDocument = JSON.stringify(didDocument, null, 2);
-      log("signing did document");
-      log(signDocument);
-
-      // Sign the DID document.
-      const documentDigest = voltUtils.signBase64(
-        keyPair.privateKey,
-        signDocument
-      );
-
-      const proofSignature = voltUtils.jwsSignature(documentDigest);
-
-      // Create the DID document proof.
-      didDocument.proof = {
-        created: new Date().toISOString(),
-        jws: proofSignature,
-        proofPurpose: "assertionMethod",
-        type: "RsaSignature2018",
-        verificationMethod: `${did}#key-1`
-      };
-
-      // Set the DID document with proof in the authenticate request.
-      authenticateRequest.did_document = JSON.stringify(didDocument, null, 2);
-
-      // Now sign the entire DID document, including the proof and set it in the
-      // bind request. This is required by the Volt to verify that we have the private key for the DID.
-      authenticateRequest.did_document_signature = voltUtils.signBase64(
-        keyPair.privateKey,
-        authenticateRequest.did_document
-      );
+    } else if (!this._credential.cache.identity_did) {
+      if (!ownDID) {
+        // We don't want to have to manage our own DID, so we ask the Volt to do it for us.
+        // The Volt will create a new DID and return it to us in the response.
+        log("creating DID-based request");
+        authenticateRequest.did_public_key = publicKeyPem;
+      } else {
+        // We want to create and manage our own DID.
+        const did =
+          (this._credential.cache.identity_did = `did:volt:${generateId()}`);
+
+        // Order of properties in the DID document is important,
+        // they must be in alphabetical order throughout the document.
+        // This is because the DID document is signed and the signature
+        // is over the entire document.
+        const didDocument = {
+          "@context": "https://www.w3.org/ns/did/v1",
+          authentication: [`${did}#key-1`],
+          controller: did,
+          description: this._config.client_name,
+          id: did,
+          verificationMethod: [
+            {
+              id: `${did}#key-1`,
+              publicKeyPem: publicKeyPem,
+              type: "Ed25519VerificationKey2018"
+            }
+          ]
+        };
+
+        // Set the DID document with proof in the authenticate request.
+        authenticateRequest.did_document = JSON.stringify(didDocument, null, 2);
+
+        // Now sign the entire DID document, including the proof and set it in the
+        // bind request. This is required by the Volt to verify that we have the private key for the DID.
+        authenticateRequest.did_document_signature = signBase64(
+          keyPair.privateKey,
+          authenticateRequest.did_document
+        );
 
-      log("did document is %s", authenticateRequest.did_document);
-      log("did signature is %s", authenticateRequest.did_document_signature);
+        log("did document is %s", authenticateRequest.did_document);
+        log("did signature is %s", authenticateRequest.did_document_signature);
+      }
     } else {
-      authenticateRequest.did = this._credential.cache.identity_id;
+      // We already have a DID cached, so re-use it.
+      log("using cached DID %s", this._credential.cache.identity_did);
+      authenticateRequest.did = this._credential.cache.identity_did;
     }
 
     log("authenticate TTL is ", this._config.bindRequestTTL);
@@ -312,10 +328,24 @@ export function connectInternal(helloPayload) {
 
     this._voltConnection.on("invoke_request", (invoke_request) => {
       const invokeId = invoke_request.invoke_id;
-      if (this._activeRPC[invokeId]) {
-        this._activeRPC[invokeId].parsePayload(invoke_request);
+
+      let rpcInvocation = this._activeRPC[invokeId];
+
+      if (rpcInvocation) {
+        if (rpcInvocation.started) {
+          rpcInvocation.parsePayload(invoke_request);
+        } else {
+          rpcInvocation
+            .initialise(invoke_request)
+            .then(() => {
+              this.emit("invoke_request", rpcInvocation);
+            })
+            .catch((err) => {
+              log("invoke_request - error [%s]", err.message);
+            });
+        }
       } else {
-        const rpcInvocation = new RpcInvocation(this, this._voltConnection);
+        rpcInvocation = new RpcInvocation(this, this._voltConnection);
 
         rpcInvocation.on("end", () => {
           log("removing active RPC [%s]", invokeId);
@@ -324,9 +354,11 @@ export function connectInternal(helloPayload) {
 
         rpcInvocation
           .initialise(invoke_request)
-          .then(() => {
+          .then((response) => {
             this._activeRPC[invokeId] = rpcInvocation;
-            this.emit("invoke_request", rpcInvocation);
+            if (!response.key_exchange) {
+              this.emit("invoke_request", rpcInvocation);
+            }
           })
           .catch((err) => {
             log("invoke_request - error [%s]", err.message);
@@ -472,6 +504,7 @@ export async function fetchVoltConfig(discovery_url) {
       "public_key",
       "fingerprint",
       "address",
+      "http_address",
       "ca_pem",
       "challenge_code",
       "cloud",

package/src/volt-client.js

@@ -59,6 +59,7 @@ export class VoltClient extends EventEmitter {
   /**
    * Initialises a binding and connection to the volt.
    * @param {string} [config] - the location of the Volt configuration file, or a configuration object
+   * @param {object} [extras] - additional configuration properties
    */
   async initialise(config, extras = {}) {
     try {
@@ -74,10 +75,15 @@ export class VoltClient extends EventEmitter {
         configPath = path.resolve(config);
         log("Attempt to load config from file %s", configPath);
         try {
-          const configContents = await readFile(
-            new URL(configPath, import.meta.url)
-          );
-          configJSON = JSON.parse(configContents);
+          if (fs.existsSync(configPath)) {
+            const configContents = await readFile(
+              new URL(configPath, import.meta.url)
+            );
+            configJSON = JSON.parse(configContents);
+          } else {
+            // There is currently no file at the given configuration path.
+            configJSON = {};
+          }
         } catch (err) {
           log("failure loading config file %s [%s]", configPath, err.message);
           throw new Error(
@@ -94,15 +100,15 @@ export class VoltClient extends EventEmitter {
         throw new Error("config argument is required to be an object");
       }
 
+      this._config = { ...extras, ...configJSON };
+
       if (
-        !configJSON.client_name ||
-        typeof configJSON.client_name !== "string"
+        !this._config.client_name ||
+        typeof this._config.client_name !== "string"
       ) {
         throw new Error("client_name property required in config");
       }
 
-      this._config = { ...configJSON, ...extras };
-
       let voltDID = "";
       let voltHttpAddress = "";
       if (typeof this._config.volt === "string") {
@@ -111,6 +117,7 @@ export class VoltClient extends EventEmitter {
         } else {
           voltHttpAddress = this._config.volt;
         }
+        delete this._config.volt;
       } else if (typeof this._config.volt !== "object") {
         throw new Error("configuration is missing the 'volt' object");
       } else {
@@ -125,7 +132,7 @@ export class VoltClient extends EventEmitter {
       } else if (voltHttpAddress && !this._config?.volt?.id) {
         const discoConfig = await fetchVoltConfig.call(
           this,
-          `${voltHttpAddress}/discovery`
+          `${voltHttpAddress}/discover`
         );
         this._config = {
           ...this._config,
@@ -134,8 +141,12 @@ export class VoltClient extends EventEmitter {
       }
 
       this._voltConfig = this._config.volt;
-      this._voltConfig.did = voltDID;
-      this._voltConfig.http_address = voltHttpAddress;
+      if (voltDID) {
+        this._voltConfig.did = voltDID;
+      }
+      if (voltHttpAddress) {
+        this._voltConfig.http_address = voltHttpAddress;
+      }
 
       if (!this._voltConfig.id || typeof this._voltConfig.id !== "string") {
         throw new Error("'id' property is missing in Volt configuration");
@@ -183,9 +194,12 @@ export class VoltClient extends EventEmitter {
       if (!isBound) {
         // This is usually because of request being denied.
         throw new Error("Volt authentication failed");
+      } else {
+        // Perist the configuration.
+        this._config = this._credential.saveCache();
       }
 
-      return Promise.resolve();
+      return Promise.resolve(this._config);
     } catch (err) {
       log("Failure starting Volt client [%s]", err.message);
       throw err;
@@ -654,6 +668,13 @@ export class VoltClient extends EventEmitter {
     });
   }
 
+  SqlTransaction(request) {
+    const grpcClient = this.getVoltAPIClient();
+
+    const call = new GRPCCall(this, "Transaction", "METHOD_TYPE_BIDI");
+    return call.start(grpcClient, request);
+  }
+
   /**
    * WireAPI
    */

package/src/volt-connection.js

@@ -47,13 +47,18 @@ function _doConnect(connectHello) {
 
   const grpcClient = this._voltClient.getVoltAPIClient();
 
-  let helloPayload = connectHello;
-  if (!helloPayload) {
-    log("defaulting hello payload");
-    helloPayload = {
-      hello: {}
-    };
-  }
+  // Notify the Volt of our ping interval. If the Volt doesn't receive a ping from us
+  // within this time, it will assume the connection is dead.
+  const defaultHello = {
+    ping_interval: this._pingInterval,
+    timestamp: Date.now()
+  };
+
+  const helloPayload = { ...connectHello } || {};
+
+  helloPayload.hello = { ...defaultHello, ...connectHello?.hello };
+
+  log("hello is %j", helloPayload);
 
   this.call.on("error", (err) => {
     log("error on connection stream [%s]", err.message);
@@ -71,17 +76,22 @@ function _doConnect(connectHello) {
           clearTimeout(this._pingTimeoutTimer);
         }
 
-        // Schedule the next ping.
-        _startPingTimer.call(this);
-
         this.emit("ping", response.ping.timestamp);
         break;
       }
       case "acknowledge": {
         if (!this._connectionId) {
           this._connectionId = response.acknowledge.connection_id;
+
+          // Set the ping timeout interval to the value returned by the Volt. If we don't
+          // hear from the Volt in this time, we'll assume the connection is dead.
+          this._timeoutInterval = response.acknowledge.ping_interval;
+
           log("connection id is %s", this._connectionId);
           this.emit("connected", this._connectionId);
+
+          // Schedule the next ping.
+          _startPingTimer.call(this);
         }
         break;
       }
@@ -109,8 +119,6 @@ function _doConnect(connectHello) {
   });
 
   this.call.start(grpcClient, helloPayload);
-
-  _startPingTimer.call(this);
 }
 
 function _startPingTimer() {
@@ -137,6 +145,8 @@ function _startPingTimer() {
       _connectionTimeoutHandler.bind(this),
       this._timeoutInterval
     );
+
+    _startPingTimer.call(this);
   }, this._pingInterval);
 }
 

package/src/volt-credential.js

@@ -1,16 +1,17 @@
 /* eslint-disable no-underscore-dangle */
 import debug from "debug";
 import fs from "fs";
-import forge from "node-forge";
-import jwt from "jsonwebtoken";
-import crypto from "crypto";
-import * as voltUtils from "./utils.js";
 import { constants } from "./constants.js";
+import {
+  createKey,
+  fingerprintFromPublicKey,
+  getIdentityToken,
+  keyFromPem,
+  privateKeyToPem,
+  publicKeyToPem
+} from "@tdxvolt/volt-client-web";
 
-const { pki } = forge;
 const log = debug("volt-client-grpc:volt-credential");
-const aesAlgorithm = "aes-256-cbc";
-const rs256Algorithm = "RS256";
 
 export class VoltCredential {
   constructor(config, configPath) {
@@ -34,14 +35,13 @@ export class VoltCredential {
       }
 
       // Need to unencrypt the private key.
-      const decrypted = pki.decryptRsaPrivateKey(
-        this._cryptoCache.key,
-        config.p
-      );
+      const decrypted = keyFromPem(this._cryptoCache.key, config.p);
+
       if (!decrypted) {
         throw new Error("failed to decrypt key - check passphrase");
       }
-      this._cryptoCache.key = pki.privateKeyToPem(decrypted);
+
+      this._cryptoCache.key = privateKeyToPem(decrypted);
     }
 
     if (this._voltConfig.ca_pem) {
@@ -50,14 +50,11 @@ export class VoltCredential {
         this._cryptoCache.ca = this._voltConfig.ca_pem;
       }
 
-      // Pre-cache the target Volt public key by extracting it from the signing certificate.
-      const voltCert = forge.pki.certificateFromPem(this._voltConfig.ca_pem);
-
       // Extract Volt public key (used for encrypting Relay payloads).
-      this._voltPublicKey = forge.pki.publicKeyToPem(voltCert.publicKey);
-      this._voltFingerprint = voltUtils.createPublicKeyFingerprint(
-        this._voltPublicKey
-      );
+      this._voltPublicKey = this._voltConfig.public_key;
+
+      const voltKey = keyFromPem(this._voltPublicKey).publicKey;
+      this._voltFingerprint = fingerprintFromPublicKey(voltKey);
     }
   }
 
@@ -78,7 +75,7 @@ export class VoltCredential {
   }
 
   get identityId() {
-    return this._cryptoCache.identity_id;
+    return this._cryptoCache.identity_did;
   }
 
   get voltPublicKey() {
@@ -86,7 +83,7 @@ export class VoltCredential {
   }
 
   get publicKey() {
-    return pki.publicKeyToPem(this.getKey().publicKey);
+    return publicKeyToPem(this.getKey().publicKey);
   }
 
   get voltFingerprint() {
@@ -94,9 +91,8 @@ export class VoltCredential {
   }
 
   getKey() {
-    const privateKey = pki.privateKeyFromPem(this._cryptoCache.key);
-    const publicKey = pki.rsa.setPublicKey(privateKey.n, privateKey.e);
-    return { privateKey, publicKey };
+    const key = keyFromPem(this._cryptoCache.key);
+    return key;
   }
 
   /**
@@ -109,17 +105,10 @@ export class VoltCredential {
       return Promise.resolve(this.getKey());
     } else {
       log("creating key");
-      return voltUtils
-        .createRSAKey()
-        .then((keyInfo) => {
-          log("successfully created key");
-          this._cryptoCache.key = keyInfo.pem;
-          return keyInfo.keypair;
-        })
-        .catch((err) => {
-          log("failure creating key [%s]", err.message);
-          return Promise.reject(err);
-        });
+      this._cryptoCache.key = createKey();
+      const key = keyFromPem(this._cryptoCache.key);
+      log("successfully created key");
+      return Promise.resolve(key);
     }
   }
 
@@ -144,55 +133,6 @@ export class VoltCredential {
     return !!this._cryptoCache.cert;
   }
 
-  /**
-   * Signs the identity resource id using the private key.
-   * @param {*} audience the token audience (usually the target volt)
-   * @param {*} tunnelling flag indicating if the token is required for a tunnelled connection
-   * @param {*} ttl time to live in seconds (default to 1 minute)
-   */
-  getIdentityToken(audience, publicKey, tunnelling = false, ttl = 60) {
-    if (!this._cryptoCache.key) {
-      throw new Error("crypto cache invalid");
-    }
-
-    const keyPair = this.getKey();
-    const publicKeyPem = pki.publicKeyToPem(keyPair.publicKey);
-    const base58Key = voltUtils.createPublicKeyFingerprint(publicKeyPem);
-
-    log("base58 key is %s", base58Key);
-
-    // Allow TTL either side of the current time.
-    // @todo - fix with server time sync on volt connection.
-    const payload = {
-      aud: audience,
-      iat: Math.floor(Date.now() / 1000) - ttl,
-      exp: Math.floor(Date.now() / 1000) + ttl,
-      sub: this._cryptoCache.session_id
-    };
-
-    let sharedKey;
-    if (tunnelling) {
-      // Initialise the Relay encryption key.
-      sharedKey = VoltCredential.aesCreateKey();
-
-      // Encrypt the key details using the target Volt public key and include this in the JWT payload.
-      payload.sk = VoltCredential.rsaEncrypt(publicKey, sharedKey.key);
-      payload.iv = VoltCredential.rsaEncrypt(publicKey, sharedKey.iv);
-    }
-
-    // Sign synchronously.
-    const token = jwt.sign(payload, this._cryptoCache.key, {
-      algorithm: rs256Algorithm,
-      keyid: base58Key
-    });
-
-    // Return the token along with any encryption key details.
-    return {
-      token,
-      sharedKey
-    };
-  }
-
   /**
    * Creates the metadata required for a grpc call, including the Volt authentication token
    * and optionally tunnel encryption parameters.
@@ -203,9 +143,12 @@ export class VoltCredential {
    * @returns
    */
   getIdentityMetadata(grpc, audience, publicKey, tunnelling = false, ttl = 60) {
-    const identityToken = this.getIdentityToken(
+    const key = keyFromPem(this._cryptoCache.key);
+
+    const identityToken = getIdentityToken(
+      this.sessionId,
+      key,
       audience || this._voltConfig.id,
-      publicKey,
       tunnelling,
       ttl
     );
@@ -215,47 +158,17 @@ export class VoltCredential {
   }
 
   saveCache() {
+    const clone = { ...this._config, credential: { ...this._cryptoCache } };
+    if (this._config.p) {
+      // A passphrase option exists => encrypt the key before writing the cache file.
+      const key = keyFromPem(this._cryptoCache.key);
+      clone.credential.key = privateKeyToPem(key.privateKey, this._config.p);
+    }
+
     if (this._persistCache) {
-      const clone = { ...this._config, credential: { ...this._cryptoCache } };
-      if (this._config.p) {
-        // A passphrase option exists => encrypt the key before writing the cache file.
-        const privateKey = pki.privateKeyFromPem(this._cryptoCache.key);
-        clone.credential.key = pki.encryptRsaPrivateKey(
-          privateKey,
-          this._config.p
-        );
-      }
       fs.writeFileSync(this._configPath, JSON.stringify(clone, null, 2));
     }
-  }
-
-  static aesCreateKey() {
-    // Generate random key for the AES-256 algorithm (32 bytes = 256 bits).
-    const key = crypto.randomBytes(32);
-    const iv = crypto.randomBytes(16);
-    return { key, iv };
-  }
-
-  static aesEncrypt(buffer, key, iv) {
-    const cipher = crypto.createCipheriv(aesAlgorithm, key, iv);
-    const crypted = Buffer.concat([cipher.update(buffer), cipher.final()]);
-    return crypted;
-  }
-
-  static aesDecrypt(buffer, key, iv) {
-    const cipher = crypto.createDecipheriv(aesAlgorithm, key, iv);
-    const decrypted = Buffer.concat([cipher.update(buffer), cipher.final()]);
-    return decrypted;
-  }
-
-  static rsaEncrypt(key, buffer) {
-    const cipher = crypto.publicEncrypt(key, buffer);
-    return cipher.toString("base64url");
-  }
 
-  static rsaDecrypt(key, buffer) {
-    const keyObj = crypto.createPrivateKey(key);
-    const cipher = Buffer.from(buffer, "base64url");
-    return Buffer.from(crypto.privateDecrypt(keyObj, cipher));
+    return clone;
   }
 }