@tdxvolt/volt-client-grpc 0.18.0 → 0.18.1

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.18.0",
+  "version": "0.18.1",
   "description": "tdx Volt library for nodejs clients",
   "type": "module",
   "exports": {
@@ -37,7 +37,7 @@
   "license": "ISC",
   "dependencies": {
     "@grpc/proto-loader": "^0.6.4",
-    "@tdxvolt/volt-client-web": "^0.18.0",
+    "@tdxvolt/volt-client-web": "^0.18.1",
     "bent": "^7.3.12",
     "builtin-modules": "^3.3.0",
     "debug": "^4.1.1",

package/src/constants.js

@@ -1,6 +1,6 @@
 export const constants = {
   authTokenName: "volt-token",
-  defaultDIDHostName: "tdxvolt.com",
+  defaultDIDHostName: "coreid.com",
   didServiceType: {
     voltConfig: "volt-discovery"
   },

package/src/grpc-call.js

@@ -15,6 +15,8 @@ const {
   x25519
 } = voltClientUtils;
 
+const invokeMethod = "Invoke";
+
 const log = debug("volt-client-grpc:grpc-call");
 
 function _prepareInvokeRequest(
@@ -26,10 +28,10 @@ function _prepareInvokeRequest(
     this._service?.service_description.host_type ===
     "SERVICE_HOST_TYPE_RELAYED";
 
-  const relaying = this._voltClient.isVoltRelay || isServiceRelayed;
+  const relaying = this._voltClient.isRelayed || isServiceRelayed;
 
   let targetDID = [];
-  if (this._voltClient.isVoltRelay) {
+  if (this._voltClient.isRelayed) {
     targetDID.push(this._voltClient.voltConfig.id);
   }
 
@@ -54,20 +56,23 @@ function _prepareInvokeRequest(
   let invokeRequest;
   let callMethod = method;
 
+  const voltGrpcClient = this._voltClient.getVoltAPIClient();
+
   if (relaying) {
     //
     // If the volt connection is via a relay (or the target service is relayed),
     // we wrap the rpc in a RemoteRequest message and send it via a call to Invoke().
     //
+
     // Replace the target method with a call to Invoke on the relay Volt.
-    //
-    callMethod = "Invoke";
+    callMethod = invokeMethod;
 
     // But first we need to perform a key exchange with the target service.
-    //
     if (!this._encryptionKey) {
       // We haven't exchanged keys yet, so queue the payload.
-      this._pendingRequests.push(request);
+      if (request) {
+        this._pendingRequests.push(request);
+      }
 
       if (this._keyExchangePending) {
         // We've already sent the key exchange request, so do nothing.
@@ -86,6 +91,13 @@ function _prepareInvokeRequest(
           : undefined
       };
 
+      if (this._voltClient.isRelayed) {
+        // When tunnelling, we serialise the request using the original serialisation
+        // method for Invoke.
+        invokeRequest =
+          voltGrpcClient.Invoke.requestSerializeOriginal(invokeRequest);
+      }
+
       return {
         request: invokeRequest,
         method: callMethod,
@@ -96,41 +108,45 @@ function _prepareInvokeRequest(
 
     let requestPayload;
 
-    // Serialise the rpc request.
+    // Serialise the rpc request using the original serialisation method.
     if (request) {
-      requestPayload = this._grpcClient[method].requestSerialize(request);
+      if (this._voltClient.isRelayed) {
+        requestPayload =
+          this._grpcClient[method].requestSerializeOriginal(request);
+      } else {
+        requestPayload = this._grpcClient[method].requestSerialize(request);
+      }
     } else if (request !== null) {
       log("****************LOOKOUT****************** - empty request");
     } else {
       log("explicit empty request payload");
     }
 
-    // Use this placeholder to serialise the relay request wrapper.
-    const voltGrpcClient = this._voltClient.getVoltAPIClient();
-    const tunnelMethod = voltGrpcClient.Tunnel;
-
-    const tunnelResp = {
+    // Create a tunnel message containing the method call metadata and request payload.
+    const tunnelResp = voltGrpcClient.Tunnel.responseSerialize({
       method_invoke: {
         method_name: this._grpcClient[method].path,
         method_type: methodType,
         request: requestPayload
       }
-    };
-
-    let invokePayload;
-    const iv = aesCreateKey().iv;
+    });
 
     // When sending via a relay we need to encrypt the payload.
-    invokePayload = aesEncrypt(
-      this._encryptionKey,
-      iv,
-      tunnelMethod.responseSerialize(tunnelResp)
-    );
+    const iv = aesCreateKey().iv;
+    const invokePayload = aesEncrypt(this._encryptionKey, iv, tunnelResp);
 
+    // Construct the Invoke request.
     invokeRequest = {
       iv,
       payload: invokePayload
     };
+
+    if (this._voltClient.isRelayed) {
+      // When tunnelling, we serialise the request using the original serialisation
+      // method for Invoke.
+      invokeRequest =
+        voltGrpcClient.Invoke.requestSerializeOriginal(invokeRequest);
+    }
   } else {
     invokeRequest = request;
   }
@@ -150,32 +166,45 @@ function _preparePayloadRequest(request, invokeInfo) {
     this._service?.service_description.host_type ===
     "SERVICE_HOST_TYPE_RELAYED";
 
-  let iv;
-  if (this._voltClient.isVoltRelay || isServiceRelayed) {
-    iv = aesCreateKey().iv;
-
-    const requestPayload =
-      this._grpcClient[invokeInfo.methodName].requestSerialize(request);
+  if (this._voltClient.isRelayed || isServiceRelayed) {
+    let requestPayload;
+    if (this._voltClient.isRelayed) {
+      // Serialise the rpc request using the original serialisation method.
+      requestPayload =
+        this._grpcClient[invokeInfo.methodName].requestSerializeOriginal(
+          request
+        );
+    } else {
+      requestPayload =
+        this._grpcClient[invokeInfo.methodName].requestSerialize(request);
+    }
 
+    // Use the Tunnel method to serialise the relay request wrapper, this
     const voltGrpcClient = this._voltClient.getVoltAPIClient();
-    const tunnelMethod = voltGrpcClient.Tunnel;
 
-    const tunnelResp = {
+    // Create a tunnel message containing the method call metadata and request payload.
+    const tunnelResp = voltGrpcClient.Tunnel.responseSerialize({
       method_payload: {
         payload: requestPayload
       }
-    };
+    });
 
-    const invokePayload = aesEncrypt(
-      this._encryptionKey,
-      iv,
-      tunnelMethod.responseSerialize(tunnelResp)
-    );
+    // Encrypt the payload using the shared key.
+    const iv = aesCreateKey().iv;
+    const invokePayload = aesEncrypt(this._encryptionKey, iv, tunnelResp);
 
+    // We then serialise the entire request using the original serialisation method for Invoke.
     payloadRequest = {
       iv,
       payload: invokePayload
     };
+
+    if (this._voltClient.isRelayed) {
+      // When tunnelling, we serialise the request using the original serialisation
+      // method for Invoke.
+      payloadRequest =
+        voltGrpcClient.Invoke.requestSerializeOriginal(payloadRequest);
+    }
   } else {
     payloadRequest = request;
   }
@@ -191,7 +220,14 @@ function _parseResponse(method, meta, response) {
     this._service?.service_description.host_type ===
     "SERVICE_HOST_TYPE_RELAYED";
 
-  if (this._voltClient.isVoltRelay || isServiceRelayed) {
+  const voltGrpcClient = this._voltClient.getVoltAPIClient();
+
+  if (this._voltClient.isRelayed || isServiceRelayed) {
+    if (this._voltClient.isRelayed) {
+      // Deserialise the incoming response using the original deserialisation method for Invoke.
+      response = voltGrpcClient.Invoke.responseDeserializeOriginal(response);
+    }
+
     if (response.key_exchange) {
       const encryptionKey = response.key_exchange.encryption_key;
       const nonce = response.key_exchange.nonce;
@@ -229,13 +265,24 @@ function _parseResponse(method, meta, response) {
         decryptedPayload = response.payload;
       }
 
-      const tunnelMethod = this._voltClient.getVoltAPIClient().Tunnel;
-      const responsePayload = tunnelMethod.requestDeserialize(decryptedPayload);
+      // Deserialise the decrypted payload using the Tunnel deserialisation method.
+      const responsePayload =
+        voltGrpcClient.Tunnel.requestDeserialize(decryptedPayload);
       if (responsePayload.payload === "method_payload") {
         try {
-          invokeResponse.payload = this._grpcClient[method].responseDeserialize(
-            responsePayload.method_payload.payload
-          );
+          // Deserialise the method payload.
+          if (this._voltClient.isRelayed) {
+            // Use the original deserialisation method for the target method.
+            invokeResponse.payload = this._grpcClient[
+              method
+            ].responseDeserializeOriginal(
+              responsePayload.method_payload.payload
+            );
+          } else {
+            invokeResponse.payload = this._grpcClient[
+              method
+            ].responseDeserialize(responsePayload.method_payload.payload);
+          }
         } catch (err) {
           log("failure deserialising payload for %s", this._methodName);
           throw new Error(
@@ -263,16 +310,6 @@ function _parseResponse(method, meta, response) {
       invokeResponse.methodId = response.invoke_id;
       log("started method %d for %s", invokeResponse.methodId, method);
     }
-  } else if (this._voltClient.isRemote && this._encryptionKey) {
-    const decryptedPayload = aesDecrypt(
-      this._encryptionKey,
-      meta.sharedKey.iv,
-      response
-    );
-    invokeResponse = {
-      payload:
-        this._grpcClient[method].responseDeserializeOriginal(decryptedPayload)
-    };
   } else {
     invokeResponse = { payload: response };
   }
@@ -312,7 +349,7 @@ export default class GRPCCall extends EventEmitter {
       "SERVICE_HOST_TYPE_RELAYED";
 
     let callClient;
-    if (this._voltClient.isVoltRelay || isServiceRelayed) {
+    if (this._voltClient.isRelayed || isServiceRelayed) {
       callClient = this._voltClient.getVoltAPIClient();
     } else {
       callClient = this._grpcClient;
@@ -379,7 +416,11 @@ export default class GRPCCall extends EventEmitter {
     });
 
     this._call.on("error", (err) => {
-      log("ERROR - intercepted stream error %s", err.message);
+      log(
+        "ERROR - intercepted stream error on %s: %s",
+        this._methodName,
+        err.message
+      );
       this.emit("error", err);
     });
 
@@ -415,6 +456,16 @@ export default class GRPCCall extends EventEmitter {
     }
   }
 
+  pause() {
+    log("pausing call %s", this._methodName);
+    return this._call?.pause();
+  }
+
+  resume() {
+    log("resuming call %s", this._methodName);
+    return this._call?.resume();
+  }
+
   get writable() {
     return this._call?.writable;
   }

package/src/grpc-utils.js

@@ -20,7 +20,7 @@ export function createClient(
 ) {
   let grpcCredentials;
   if (credentials) {
-    const relaying = !!credentials.config?.volt?.relay;
+    const relaying = !!credentials.config?.volt?.relay && !Array.isArray(credentials.config?.volt?.relay);
     const ca = relaying
       ? credentials.config?.volt?.relay?.ca_pem
       : credentials.cache.ca;
@@ -28,8 +28,8 @@ export function createClient(
     const { key } = credentials.cache;
 
     if (key && cert) {
-      const cryyptoOptions = { ca, cert, key };
-      const tlsOptions = createSecureContextOptions(cryyptoOptions);
+      const cryptoOptions = { ca, cert, key };
+      const tlsOptions = createSecureContextOptions(cryptoOptions);
       grpcCredentials = grpc.credentials.createSsl(
         tlsOptions.ca,
         tlsOptions.key,

package/src/rpc-invocation.js

@@ -15,23 +15,26 @@ const {
   publicKeyToPem,
   randomBytes,
   signBase64,
-  stripPEMHeaders,
+  stripPemHeaders,
   x25519
 } = voltClientUtils;
 
-const log = debug("rpc-invocation");
+const log = debug("volt-client-grpc:rpc-invocation");
 
 class RpcInvocation extends EventEmitter {
   #voltClient = null;
   #voltConnection = null;
   #token = null;
+  #callerPublicKeyPem = null;
   #invokeId = null;
+  #serviceId = null;
   #payload = null;
   #isJSON = false;
   #methodDescriptor = null;
   #methodName = null;
   #derivedKey = null;
   #started = false;
+  #endEmitted = false;
 
   constructor(voltClient, voltConnection) {
     super();
@@ -43,6 +46,18 @@ class RpcInvocation extends EventEmitter {
     return this.#invokeId;
   }
 
+  get serviceId() {
+    return this.#serviceId;
+  }
+
+  get token() {
+    return this.#token;
+  }
+
+  get callerPublicKeyPem() {
+    return this.#callerPublicKeyPem;
+  }
+
   get payload() {
     if (!this.#payload) {
       return null;
@@ -84,14 +99,23 @@ class RpcInvocation extends EventEmitter {
     // The rpc implementation should do the verification using the Volt API (e.g. CanAccessResource).
     this.#token = jwt.decode(token);
 
+    if (!this.#token) {
+      log("failed to decode token %s", token || "null");
+      return Promise.reject(new Error("failed to decode token"));
+    }
+
     // Store the JWT key id (kid) for use in the response.
-    const callerPublicKeyPem = formatPEM(this.#token.k, "PUBLIC KEY");
-    const callerKey = keyFromPem(callerPublicKeyPem, "", x25519).publicKey;
+    this.#callerPublicKeyPem = formatPEM(this.#token.k, "PUBLIC KEY");
+    const callerKey = keyFromPem(
+      this.#callerPublicKeyPem,
+      "",
+      x25519
+    ).publicKey;
 
     const ephemeralKeyPem = createEncryptionKey();
     const ephemeralKey = keyFromPem(ephemeralKeyPem, "", x25519);
     const ephemeralPublicKey = fromBase64(
-      stripPEMHeaders(publicKeyToPem(ephemeralKey.publicKey, x25519))
+      stripPemHeaders(publicKeyToPem(ephemeralKey.publicKey, x25519))
     );
 
     this.#derivedKey = deriveSharedKey(
@@ -108,7 +132,7 @@ class RpcInvocation extends EventEmitter {
     message.set(nonce, ephemeralPublicKey.length);
 
     const signature = signBase64(
-      this.#voltClient.credential.getKey().privateKey,
+      this.#voltClient.credential.cache.key,
       message
     );
 
@@ -129,7 +153,10 @@ class RpcInvocation extends EventEmitter {
   }
 
   initialise(invoke_request) {
-    this.#invokeId = invoke_request.invoke_id;
+    if (!this.#invokeId) {
+      this.#invokeId = invoke_request.invoke_id;
+      this.#serviceId = invoke_request.target_service_id;
+    }
 
     if (!this.#derivedKey) {
       // We don't have the derived key yet, so we need to perform the key exchange.
@@ -151,8 +178,7 @@ class RpcInvocation extends EventEmitter {
 
       if (invoke_request.payload) {
         let decryptedPayload;
-
-        if (encryptIV) {
+        if (encryptIV?.length) {
           // Decrypt the actual payload using the shared key and iv.
           decryptedPayload = aesDecrypt(
             this.#derivedKey,
@@ -220,8 +246,13 @@ class RpcInvocation extends EventEmitter {
             );
             this.emit("payload", this);
           } else if (wrappedPayload.method_end) {
-            // We don't need to do anything here, since we notify the client when we receive the client_end.
             log("method_end received");
+            if (!this.#endEmitted) {
+              this.#endEmitted = true;
+              this.emit("end", this);
+            } else {
+              log("method_end: end already emitted");
+            }
           }
         } catch (err) {
           log("JSON.parse failure parsing json_payload: %s", err.message);
@@ -230,7 +261,12 @@ class RpcInvocation extends EventEmitter {
 
         resolve();
       } else if (invoke_request.client_end) {
-        this.emit("end", this);
+        if (!this.#endEmitted) {
+          this.#endEmitted = true;
+          this.emit("end", this);
+        } else {
+          log("client_end: end already emitted");
+        }
       } else {
         // Do we need to support json_payload here?
         reject(new Error("No payload in invoke request"));

package/src/volt-client-internal.js

@@ -172,7 +172,7 @@ export async function authenticateInternal(
 
     if (this._voltConfig.challenge_code) {
       authenticateRequest.challenge = signBase64(
-        keyPair.privateKey,
+        this._credential.cache.key,
         this._voltConfig.challenge_code
       );
     } else {
@@ -202,16 +202,18 @@ export async function authenticateInternal(
         // This is because the DID document is signed and the signature
         // is over the entire document.
         const didDocument = {
-          "@context": "https://www.w3.org/ns/did/v1",
+          "@context": [
+            "https://www.w3.org/ns/did/v1",
+            "https://tdxvolt.com/ns/did/v1"
+          ],
           authentication: [`${did}#key-1`],
           controller: did,
-          description: this._config.client_name,
           id: did,
           verificationMethod: [
             {
               id: `${did}#key-1`,
               publicKeyPem: publicKeyPem,
-              type: "Ed25519VerificationKey2018"
+              type: "Ed25519Signature2018"
             }
           ]
         };
@@ -222,7 +224,7 @@ export async function authenticateInternal(
         // Now sign the entire DID document, including the proof and set it in the
         // bind request. This is required by the Volt to verify that we have the private key for the DID.
         authenticateRequest.did_document_signature = signBase64(
-          keyPair.privateKey,
+          this._credential.cache.key,
           authenticateRequest.did_document
         );
 
@@ -260,7 +262,7 @@ export async function authenticateInternal(
 
     return decision === "POLICY_DECISION_PERMIT";
   } catch (err) {
-    log("failure binding to Volt [%s]", err.message);
+    log("failure authenticating with Volt [%s]", err.message);
     throw err;
   }
 }
@@ -276,15 +278,7 @@ export function connectInternal(helloPayload) {
       this._connected = false;
       this._session = null;
 
-      if (this._cachedClient) {
-        this._grpc.closeClient(this._cachedClient);
-        this._cachedClient = null;
-      }
-
-      if (this._cachedRemoteClient) {
-        this._grpc.closeClient(this._cachedRemoteClient);
-        this._cachedRemoteClient = null;
-      }
+      this.close();
     };
 
     this._voltConnection = new VoltConnection(this, this._grpc);
@@ -373,7 +367,7 @@ export function connectInternal(helloPayload) {
 
 export function getVoltAPIClientInternal() {
   if (!this._cachedClient) {
-    const serviceAddress = this.isRemote
+    const serviceAddress = this.isRelayed
       ? this._voltConfig.relay.address
       : this._voltConfig.address;
     log("creating cached VoltAPI service client on %s", serviceAddress);
@@ -388,7 +382,7 @@ export function getVoltAPIClientInternal() {
       serviceDescriptors,
       serviceAddress,
       this._credential,
-      this.isRemote && !this.isVoltRelay,
+      this.isRelayed,
       this._voltConfig?.relay?.cloud ? this._voltConfig.id : "",
       this._voltConfig?.relay?.cloud ? this._voltConfig.id : ""
     );
@@ -399,7 +393,7 @@ export function getVoltAPIClientInternal() {
 
 export function getAPIClientInternal(service) {
   if (!this._cachedService[service.id]) {
-    const serviceAddress = this.isRemote
+    const serviceAddress = this.isRelayed
       ? this._voltConfig.relay.address
       : service.service_description.host_address;
 
@@ -422,7 +416,7 @@ export function getAPIClientInternal(service) {
       serviceDescriptors,
       serviceAddress,
       this._credential,
-      this.isRemote && !this.isVoltRelay,
+      this.isRelayed,
       this._voltConfig?.relay?.cloud ? this._voltConfig.id : "",
       this._voltConfig?.relay?.cloud ? this._voltConfig.id : ""
     );
@@ -517,9 +511,9 @@ export async function fetchVoltConfig(discovery_url) {
   }
 }
 
-export async function fetchVoltConfigFromDID(volt_did) {
+async function fetchVoltConfigFromDIDInternal(volt_did, registryUrl) {
   try {
-    const didResolution = voltUtils.getDIDResolutionURL(volt_did);
+    const didResolution = voltUtils.getDIDResolutionURL(volt_did, registryUrl);
     if (!didResolution) {
       throw new Error(`Invalid Volt DID: ${volt_did}`);
     }
@@ -538,6 +532,8 @@ export async function fetchVoltConfigFromDID(volt_did) {
       );
     }
 
+    log("resolved DID from %s", didResolution);
+
     const serviceEndpoint = voltConfigServices[0].serviceEndpoint;
     return await fetchVoltConfig.call(this, serviceEndpoint);
   } catch (err) {
@@ -546,3 +542,22 @@ export async function fetchVoltConfigFromDID(volt_did) {
     );
   }
 }
+
+export async function fetchVoltConfigFromDID(
+  volt_did,
+  registryList = [constants.defaultDIDHostName]
+) {
+  for (let registryUrl of registryList) {
+    try {
+      return await fetchVoltConfigFromDIDInternal.call(
+        this,
+        volt_did,
+        registryUrl
+      );
+    } catch (err) {
+      log("Failed to fetch Volt config from %s: %s", registryUrl, err.message);
+    }
+  }
+
+  throw new Error("Failed to fetch Volt config from any registry");
+}