@tdxvolt/volt-client-grpc 0.16.0-beta.12 → 0.16.0-beta.13

package/lib/index.cjs

@@ -4,10 +4,10 @@ Object.defineProperty(exports, '__esModule', { value: true });
 
 var lodash = require('lodash');
 var ip = require('ip');
+var voltClientWeb = require('@tdxvolt/volt-client-web');
 var debug = require('debug');
 var EventEmitter = require('events');
 var fs = require('fs');
-var voltClientWeb = require('@tdxvolt/volt-client-web');
 var path = require('path');
 var protoLoader = require('@grpc/proto-loader');
 var url = require('url');
@@ -17,8 +17,27 @@ var uuid = require('uuid');
 
 function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'default' in e ? e : { 'default': e }; }
 
+function _interopNamespace(e) {
+  if (e && e.__esModule) return e;
+  var n = Object.create(null);
+  if (e) {
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: function () { return e[k]; }
+        });
+      }
+    });
+  }
+  n["default"] = e;
+  return Object.freeze(n);
+}
+
 var lodash__default = /*#__PURE__*/_interopDefaultLegacy(lodash);
 var ip__default = /*#__PURE__*/_interopDefaultLegacy(ip);
+var voltClientWeb__namespace = /*#__PURE__*/_interopNamespace(voltClientWeb);
 var debug__default = /*#__PURE__*/_interopDefaultLegacy(debug);
 var EventEmitter__default = /*#__PURE__*/_interopDefaultLegacy(EventEmitter);
 var fs__default = /*#__PURE__*/_interopDefaultLegacy(fs);
@@ -152,7 +171,8 @@ var utils = /*#__PURE__*/Object.freeze({
   __proto__: null,
   createSecureContextOptions: createSecureContextOptions,
   getServiceAddress: getServiceAddress,
-  getDIDResolutionURL: getDIDResolutionURL
+  getDIDResolutionURL: getDIDResolutionURL,
+  crypto: voltClientWeb__namespace
 });
 
 /* eslint-disable no-underscore-dangle */
@@ -428,7 +448,7 @@ class VoltCredential {
         throw new Error("failed to decrypt key - check passphrase");
       }
 
-      this._cryptoCache.key = voltClientWeb.privateKeyToPem(decrypted);
+      this._cryptoCache.key = voltClientWeb.privateKeyToPem(decrypted.privateKey);
     }
 
     if (this._voltConfig.ca_pem) {

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.16.0-beta.12",
+  "version": "0.16.0-beta.13",
   "description": "tdx Volt library for nodejs clients",
   "type": "module",
   "exports": {

package/protobuf/tdx/volt_api/volt/v1/volt.proto

@@ -273,6 +273,9 @@ message VoltParameters {
 
   // If set, enables the terminal API.
   bool enable_terminal = 49;
+
+  // The time at which the Volt was started.
+  uint64 start_time = 50;
 }
 
 message VoltEndpoint {
@@ -548,37 +551,34 @@ message Access {
     string identity_did = 6;
 
     // The JSON path array for looking up verifiable credentials.
-    string credential_lookup = 9;
+    string credential_lookup = 7;
   }
 
   // A human-readable short identifier of the subject.
-  string identity_name = 7;
+  string identity_name = 8;
 
   // The kind of identity.
-  repeated string identity_kind = 8;
-
-  string issuer_id = 10;
-
-  string issuer_name = 11;
-
-  repeated string issuer_kind = 12;
+  repeated string identity_kind = 9;
 
   // Requested access.
-  string access = 13;
+  string access = 10;
+
+  // Optional extra data.
+  string extra = 11;
 
   // Assigned decision.
-  PolicyDecision decision = 14;
+  PolicyDecision decision = 12;
 
-  bool recursive = 15;
+  bool recursive = 13;
 
   // Time at which the request was made.
-  int64 request_time = 16;
+  int64 request_time = 14;
 
   // Time at which the decision was taken.
-  int64 decision_time = 17;
+  int64 decision_time = 15;
 
   // Counter of number times this access was requested.
-  uint32 request_count = 18;
+  uint32 request_count = 16;
 }
 
 enum SessionStatus {

package/protobuf/tdx/volt_api/volt/v1/volt_api.proto

@@ -37,9 +37,6 @@ service VoltAPI {
   // n.b. Copy resources between Volts is not supported by this API. This is achieved by creating an API instance for the source and target Volts, getting the resource from the source and creating it on the target.
   rpc CopyResource(CopyResourceRequest) returns (CopyResourceResponse);
 
-  // This is a work in progress - do not use.
-  rpc CreateVerifiableCredentialSession(CreateVerifiableCredentialSessionRequest) returns (CreateVerifiableCredentialSessionResponse);
-
   // Remove a custom access rule, such as a file share.
   rpc DeleteAccess(DeleteAccessRequest) returns (DeleteAccessResponse);
 
@@ -63,9 +60,8 @@ service VoltAPI {
   // The identity will only be retrieved if the authenticated identity has read access to it.
   rpc GetIdentity(GetIdentityRequest) returns (GetIdentityResponse);
 
-  // NOT YET IMPLEMENTED.
-  // Gets a credential for the currently authenticated client, signed by the volt CA.
-  rpc GetIdentityToken(GetIdentityTokenRequest) returns (GetIdentityTokenResponse);
+  // Gets a one-time token that can be used as a temporary authentication token, for example create an file download link that expires after a certain time.
+  rpc GetOneTimeToken(GetOneTimeTokenRequest) returns (GetOneTimeTokenResponse);
 
   // Retrieve the Volt parameters.
   // This is a privileged API call and requires Volt root access.
@@ -104,9 +100,18 @@ service VoltAPI {
   // Create or update an access rule.
   rpc SaveAccess(SaveAccessRequest) returns (SaveAccessResponse);
 
+  // Create or update a static file HTTP server.
+  rpc SaveHttpFileServer(SaveResourceRequest) returns (SaveResourceResponse);
+
+  // Create or update an HTTP REST API server.
+  rpc SaveHttpApiServer(SaveResourceRequest) returns (SaveResourceResponse);
+
   // Create or update an identity.
   rpc SaveIdentity(SaveIdentityRequest) returns (SaveIdentityResponse);
 
+  // Create or update a mirrored link resource.
+  rpc SaveMirroredLink(SaveResourceRequest) returns (SaveResourceResponse);
+
   // Update Volt parameters.
   // This is a privileged call that requires Volt root access.
   rpc SaveParameters(SaveParametersRequest) returns (SaveParametersResponse);
@@ -114,6 +119,9 @@ service VoltAPI {
   // Create or update resource in this volt.
   rpc SaveResource(SaveResourceRequest) returns (SaveResourceResponse);
 
+  // Create or update a symbolic link resource.
+  rpc SaveSymbolicLink(SaveResourceRequest) returns (SaveResourceResponse);
+
   // Save a session.
   rpc SaveSession(SaveSessionRequest) returns (SaveSessionResponse);
 
@@ -231,9 +239,6 @@ message CanAccessResourceResponse {
   // The identity subject that the access relates to.
   string identity_did = 2;
 
-  // Optional identity that issued the access.
-  string issuer_id = 3;
-
   // The resource the access relates to.
   string resource_id = 4;
 
@@ -259,46 +264,48 @@ message CheckCompatibilityResponse {
 
 // All fields in this message are optional, send an empty message if necessary.
 message ConnectHello {
-  // Optionally specify the calling address of the peer.
-  // Not currently in use.
+  // Optionally specify the grpc server address of the client. Only used if the client is a Volt (or service).
   string address = 1;
 
   // Set to automatically make **all** services owned by the calling identity online.
-  bool online_services = 2;
+  bool online_services = 3;
 
   // Set to receive notification of resource events.
-  bool subscribe_resource_events = 3;
+  bool subscribe_resource_events = 4;
 
   // Set this if you are connecting to a relay, i.e. the Volt you are sending to this message is a relay.
   // This indicates that you are happy to receive method invocations from clients of the Relay.
   // This will usually be set to the `id` of your Volt, but in theory any client could receive remote invocation requests in this way.
-  string relay_id = 4;
+  string relay_id = 5;
 
   // A friendly name to present to Relay clients.
-  string relay_name = 5;
+  string relay_name = 6;
 
-  string relay_description = 6;
+  string relay_description = 7;
 
   // The certificate authority to present to Relay clients.
-  string relay_ca_pem = 7;
+  string relay_ca_pem = 8;
 
   // Set to indicate the connection is discoverable to other Relay clients.
-  bool relay_discoverable = 8;
+  bool relay_discoverable = 9;
+
+  // Optionally specify the address of the HTTP server to use for HTTP proxying. If set, a relay will forward HTTP requests to this address from the subdomain that matches the client's DID.
+  string relay_http_address = 10;
 
   // Set to receive notification of authentication requests.
-  bool subscribe_auth_requests = 9;
+  bool subscribe_auth_requests = 11;
 
   // Set to indicate the connection will accept method invocation requests.
-  bool accept_invocation = 10;
+  bool accept_invocation = 12;
 
   // Set to subscribe to DID registry updates from the peer.
-  bool subscribe_did_registry_updates = 11;
+  bool subscribe_did_registry_updates = 13;
 
   // The interval at which the client will send ping requests to the target.
-  uint32 ping_interval = 12;
+  uint32 ping_interval = 14;
 
   // The current time on the client.
-  uint64 timestamp = 13;
+  uint64 timestamp = 15;
 }
 
 message ConnectAcknowledge {
@@ -452,15 +459,6 @@ message CopyResourceResponse {
   tdx.volt_api.volt.v1.Status status = 1;
 }
 
-message CreateVerifiableCredentialSessionRequest {
-  string presentation = 1;
-}
-
-message CreateVerifiableCredentialSessionResponse {
-  tdx.volt_api.volt.v1.Status status = 1;
-  string session_id = 2;
-}
-
 message DeleteAccessRequest {
   // The id of the access rule to delete.
   string id = 1;
@@ -521,9 +519,6 @@ message GetAccessRequest {
   // The identity id that is the subject of the access rule. If omitted, all identities will be considered.
   string identity_did = 2;
 
-  // The issuer of the access rule. If omitted, all issuers will be considered.
-  string issuer_id = 3;
-
   // The type of access to retrieve, if omitted all access will be considered.
   string access = 4;
 
@@ -575,17 +570,16 @@ message GetIdentityResponse {
   Identity identity = 2;
 }
 
-message GetIdentityTokenRequest {
-  // The token TTL, in seconds.
+message GetOneTimeTokenRequest {
+  // Optional token TTL, in seconds. Default is 10 seconds.
   int32 ttl = 1;
-
-  // The intended token audience - usually the common name of the target volt
-  // CA.
-  string audience = 2;
 }
 
-message GetIdentityTokenResponse {
+message GetOneTimeTokenResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The one-time token.
   string token = 2;
 }
 
@@ -878,9 +872,6 @@ message RequestAccessResponse {
   // The identity attempting access.
   string identity_did = 3;
 
-  // The identity of the issuer of the access.
-  string issuer_id = 4;
-
   // Requested access.
   string access = 5;
 

package/src/utils.js

@@ -1,5 +1,6 @@
 import ip from "ip";
 import _ from "lodash";
+export * as crypto from "@tdxvolt/volt-client-web";
 
 import { constants } from "./constants.js";
 

package/src/volt-credential.js

@@ -41,7 +41,7 @@ export class VoltCredential {
         throw new Error("failed to decrypt key - check passphrase");
       }
 
-      this._cryptoCache.key = privateKeyToPem(decrypted);
+      this._cryptoCache.key = privateKeyToPem(decrypted.privateKey);
     }
 
     if (this._voltConfig.ca_pem) {