@tdxvolt/volt-client-grpc 0.20.4 → 0.20.8

package/lib/index.cjs

@@ -1088,8 +1088,14 @@ message GetFileDescendantsRequest {
   // Optional - only match descendants of the given kind.
   string extension = 3;
 
+  // Optional - restrict to folders only.bool
+  bool folders_only = 4;
+
   // Optional - can be used to determine if a resource is a descendant.
   string descendant_id = 5;
+
+  // Optional - include hidden files and directories.
+  bool include_hidden = 6;
 }
 
 message GetFileDescendantsResponse {
@@ -1420,10 +1426,13 @@ message DIDRegistryUpdate {
 }
 
 message VerifiablePresentation {
-  // The credential JSON.
+  // DEPRECATED - use 'credential'
   string credential_json = 1;
 
-  // A signature of the credential JSON. The signature should usually be that of the credential subject.
+  // Array of credential JSON.
+  repeated string credential = 3;
+
+  // A signature of the credential JSON. The signature should be that of the credential holder over the concatenation of the contents of the \`credential\` array.
   string signature = 2;
 }
 
@@ -1587,7 +1596,7 @@ message ParseCredentialResponse {
   tdx.volt_api.volt.v1.Status status = 1;
 
   // The parsed credential details.
-  VerifiableCredential verifiable_credential = 2;
+  repeated VerifiableCredential verifiable_credential = 2;
 }
 
 message ResolveDIDRequest {
@@ -2128,6 +2137,15 @@ message VoltParameters {
 
   // If set, enables the agent event pool.
   bool enable_agent_event_pool = 51;
+
+  // Optional owner email addresses.
+  repeated string owner_email = 52;
+
+  // Optional owner email identity providers.
+  repeated string identity_provider = 53;
+
+  // If set, exposes a resource that gives the Volt owner read-only access the file system.
+  bool enable_owner_file_system_access = 54;
 }
 
 message VoltEndpoint {
@@ -2492,6 +2510,9 @@ message SessionCredential {
 
   // More type-specific data stored with the credential.
   string extra_2 = 16;
+
+  // The verification status of the credential.
+  string status = 17;
 }
 
 message Session {
@@ -2515,7 +2536,6 @@ message Session {
 
   SessionStatus status = 10;
 }
-
 `;
 const volt_api = `syntax = "proto3";
 
@@ -2526,7 +2546,7 @@ import "tdx/volt_api/volt/v1/remote.proto";
 import "tdx/volt_api/volt/v1/ssi.proto";
 import "tdx/volt_api/volt/v1/volt.proto";
 
-// The top-level volt management service. 
+// The top-level volt management service.
 // With the exception of \`Authenticate\`, all RPCs on this service must submit either a valid client certificate signed by the volt CA, or a signed JWT.
 // A client certificate can be obtained from the \`Authenticate\` method.
 // All methods include a \`tdx.volt_api.volt.v1.Status\` in the response. If the status contains a non-OK error code the client should assume the remainder of the message is invalid, unless otherwise indicated in the response documentation.
@@ -2886,9 +2906,19 @@ message ConnectResource {
   Resource resource = 2;
 }
 
+enum ConnectAuthRequestType {
+    CONNECT_AUTH_REQUEST_TYPE_UNKNOWN = 0;
+    CONNECT_AUTH_REQUEST_TYPE_NEW_SESSION = 1;
+    CONNECT_AUTH_REQUEST_TYPE_UPDATE_SESSION = 2;
+    CONNECT_AUTH_REQUEST_TYPE_DELETE_SESSION = 3;
+    CONNECT_AUTH_REQUEST_TYPE_SIGN_REQUEST = 4;
+}
+
 message ConnectAuthRequest {
   Session session = 1;
 
+  ConnectAuthRequestType request_type = 2;
+
   string context = 5;
 
   string challenge = 6;
@@ -3298,6 +3328,8 @@ message GetSessionsRequest {
   string identity_name = 3;
 
   SessionStatus status = 4;
+
+  string identity_email_id = 5;
 }
 
 message GetSessionsResponse {
@@ -3538,6 +3570,11 @@ message SaveSessionResponse {
 }
 
 message SetPolicyRequest {
+  // The id of the policy to set.
+  // Should be either 00000000-0000-0000-0000-000000000000 or 00000000-0000-0000-0000-000000000001 for the first or last custom policy respectively.
+  string id = 2;
+
+  // The custom policy to set in JSON format.
   string custom_policy = 1;
 }
 
@@ -4822,13 +4859,18 @@ function issueAuthenticate(authenticateRequest, ttl) {
         return Promise.reject(new Error(authenticateResponse.status.message));
       } else {
         switch (authenticateResponse.decision) {
-          case "POLICY_DECISION_PERMIT": {
+          case "POLICY_DECISION_PERMIT":
+          case "POLICY_DECISION_PROMPT":
+          case "POLICY_DECISION_PENDING": {
             //
-            // The request status is permit => cache the bind response info.
+            // The request status is not deny => cache the bind response info.
             //
+            log$2("decision is %s", authenticateResponse.decision);
 
             // This is the certificate assigned to us by the volt.
-            this._credential.cache.cert = authenticateResponse.cert;
+            if (authenticateResponse.cert) {
+              this._credential.cache.cert = authenticateResponse.cert;
+            }
 
             // This is the signing CA used by the volt.
             this._credential.cache.ca = authenticateResponse.chain;
@@ -4842,11 +4884,20 @@ function issueAuthenticate(authenticateRequest, ttl) {
                 authenticateResponse.identity_did;
             }
 
+            // Maintain a unique list of verifiable credentials.
+            const uniqueVCs = new Map();
             this._credential.cache.vc = this._credential.cache.vc || [];
+            for (const existingVC of this._credential.cache.vc) {
+              uniqueVCs.set(existingVC.id, existingVC);
+            }
+
             for (const credential of authenticateResponse.credential) {
-              this._credential.cache.vc.push(credential);
+              const vc = JSON.parse(credential);
+              uniqueVCs.set(vc.id, vc);
             }
 
+            this._credential.cache.vc = Array.from(uniqueVCs.values());
+
             this._credential.saveCache();
             break;
           }
@@ -4854,25 +4905,6 @@ function issueAuthenticate(authenticateRequest, ttl) {
             log$2(">>>>>>>>>>>>>>> access request is DENIED <<<<<<<<<<<<<<<<<<<");
             break;
           }
-          case "POLICY_DECISION_PROMPT":
-          case "POLICY_DECISION_PENDING": {
-            log$2("access pending approval - waiting...");
-
-            // This is the signing CA used by the volt.
-            this._credential.cache.ca = authenticateResponse.chain;
-
-            // The session id is assigned by the volt.
-            this._credential.cache.session_id = authenticateResponse.session_id;
-
-            if (!this._credential.cache.identity_did) {
-              // Identity DID has been assigned by the volt.
-              this._credential.cache.identity_did =
-                authenticateResponse.identity_did;
-            }
-
-            this._credential.saveCache();
-            break;
-          }
           default:
             log$2(
               "ignoring unknown bind descision %s",
@@ -4895,7 +4927,12 @@ function findDIDDocumentService(document, serviceType) {
   return matches;
 }
 
-async function authenticateInternal(noDID = false, ownDID = false, exchangeToken = "") {
+async function authenticateInternal(
+  noDID = false,
+  ownDID = false,
+  exchangeToken = "",
+  waitForPermit = true
+) {
   try {
     if (!this._credential.cache.ca) {
       this._credential.cache.ca = this._voltConfig.ca_pem;
@@ -4926,6 +4963,27 @@ async function authenticateInternal(noDID = false, ownDID = false, exchangeToken
       host: this._credential.cache.bindIp
     };
 
+    if (this._credential.cache.vc?.length > 0) {
+      const presentation = {
+        credential: []
+      };
+
+      let presentationData = "";
+      for (let credential of this._credential.cache.vc) {
+        const vc = JSON.stringify(credential, null, 2);
+        log$2(vc);
+        presentation.credential.push(vc);
+        presentationData += vc;
+      }
+
+      presentation.signature = signBase64(
+        this._credential.cache.key,
+        presentationData
+      );
+
+      authenticateRequest.verifiable_presentation = [presentation];
+    }
+
     if (exchangeToken) {
       log$2("setting request exchange token");
       authenticateRequest.exchange_token = exchangeToken;
@@ -4937,9 +4995,7 @@ async function authenticateInternal(noDID = false, ownDID = false, exchangeToken
       log$2("setting request challenge code");
       authenticateRequest.challenge = this._credential.cache.challenge_code;
     } else {
-      log$2(
-        "no challenge code in request"
-      );
+      log$2("no challenge code in request");
     }
 
     if (noDID) {
@@ -5017,8 +5073,8 @@ async function authenticateInternal(noDID = false, ownDID = false, exchangeToken
       );
       log$2("authenticate decision: %s", decision);
     } while (
-      decision === "POLICY_DECISION_PROMPT" ||
-      decision === "POLICY_DECISION_PENDING"
+      decision === "POLICY_DECISION_PENDING" ||
+      (waitForPermit && decision === "POLICY_DECISION_PROMPT")
     );
 
     return decision === "POLICY_DECISION_PERMIT";
@@ -5689,9 +5745,14 @@ class VoltClient extends EventEmitter__default["default"] {
    * @param {boolean} [options.noDID] - whether to create a key-based authentication session
    * instead of a DID-based authentication session.
    * @param {string} [options.exchangeToken] - optional token to exchange in return for an authenticated session.
+   * @param {boolean} [options.waitForAuth] - whether to block and poll on 'prompt' authenticate decisions. Default is true.
    */
   async initialise(config, options = {}) {
-    const { ownDID, noDID, didRegistryList, exchangeToken, extraConfig } = options;
+    const { ownDID, noDID, didRegistryList, exchangeToken, extraConfig } =
+      options;
+    const waitForAuth =
+      options.waitForAuth === undefined ? true : !!options.waitForAuth;
+
     try {
       if (!config) {
         throw new Error(
@@ -5777,7 +5838,13 @@ class VoltClient extends EventEmitter__default["default"] {
       } else {
         // No certificate present in the cache yet => we need to authenticate.
         try {
-          isBound = await authenticateInternal.call(this, noDID, ownDID, exchangeToken);
+          isBound = await authenticateInternal.call(
+            this,
+            noDID,
+            ownDID,
+            exchangeToken,
+            waitForAuth
+          );
         } catch (bindErr) {
           if (bindErr.message === "invalid arguments") {
             // This is usually the result of a missing challenge signature or credential.
@@ -6214,6 +6281,21 @@ class VoltClient extends EventEmitter__default["default"] {
     return call.start(grpcClient, request);
   }
 
+  /**
+   * TerminalAPI
+   */
+  CommandStream(request, service) {
+    const grpcClient = this.getVoltAPIClient();
+
+    const commandStreamCall = new GRPCCall(
+      this,
+      "CommandStream",
+      "METHOD_TYPE_BIDI",
+      service
+    );
+    return commandStreamCall.start(grpcClient, request);
+  }
+
   /**
    * WireAPI
    */

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.20.4",
+  "version": "0.20.8",
   "description": "tdx Volt library for nodejs clients",
   "type": "module",
   "exports": {
@@ -33,7 +33,7 @@
   "author": "toby.ealden@gmail.com",
   "license": "ISC",
   "dependencies": {
-    "@tdxvolt/volt-client-web": "^0.20.4",
+    "@tdxvolt/volt-client-web": "^0.20.8",
     "debug": "^4.1.1",
     "ip": "^1.1.5",
     "jsonwebtoken": "^8.5.1",

package/src/volt-client-internal.js

@@ -32,13 +32,18 @@ function issueAuthenticate(authenticateRequest, ttl) {
         return Promise.reject(new Error(authenticateResponse.status.message));
       } else {
         switch (authenticateResponse.decision) {
-          case "POLICY_DECISION_PERMIT": {
+          case "POLICY_DECISION_PERMIT":
+          case "POLICY_DECISION_PROMPT":
+          case "POLICY_DECISION_PENDING": {
             //
-            // The request status is permit => cache the bind response info.
+            // The request status is not deny => cache the bind response info.
             //
+            log("decision is %s", authenticateResponse.decision);
 
             // This is the certificate assigned to us by the volt.
-            this._credential.cache.cert = authenticateResponse.cert;
+            if (authenticateResponse.cert) {
+              this._credential.cache.cert = authenticateResponse.cert;
+            }
 
             // This is the signing CA used by the volt.
             this._credential.cache.ca = authenticateResponse.chain;
@@ -52,11 +57,20 @@ function issueAuthenticate(authenticateRequest, ttl) {
                 authenticateResponse.identity_did;
             }
 
+            // Maintain a unique list of verifiable credentials.
+            const uniqueVCs = new Map();
             this._credential.cache.vc = this._credential.cache.vc || [];
+            for (const existingVC of this._credential.cache.vc) {
+              uniqueVCs.set(existingVC.id, existingVC);
+            }
+
             for (const credential of authenticateResponse.credential) {
-              this._credential.cache.vc.push(credential);
+              const vc = JSON.parse(credential);
+              uniqueVCs.set(vc.id, vc);
             }
 
+            this._credential.cache.vc = Array.from(uniqueVCs.values());
+
             this._credential.saveCache();
             break;
           }
@@ -64,25 +78,6 @@ function issueAuthenticate(authenticateRequest, ttl) {
             log(">>>>>>>>>>>>>>> access request is DENIED <<<<<<<<<<<<<<<<<<<");
             break;
           }
-          case "POLICY_DECISION_PROMPT":
-          case "POLICY_DECISION_PENDING": {
-            log("access pending approval - waiting...");
-
-            // This is the signing CA used by the volt.
-            this._credential.cache.ca = authenticateResponse.chain;
-
-            // The session id is assigned by the volt.
-            this._credential.cache.session_id = authenticateResponse.session_id;
-
-            if (!this._credential.cache.identity_did) {
-              // Identity DID has been assigned by the volt.
-              this._credential.cache.identity_did =
-                authenticateResponse.identity_did;
-            }
-
-            this._credential.saveCache();
-            break;
-          }
           default:
             log(
               "ignoring unknown bind descision %s",
@@ -105,7 +100,12 @@ function findDIDDocumentService(document, serviceType) {
   return matches;
 }
 
-export async function authenticateInternal(noDID = false, ownDID = false, exchangeToken = "") {
+export async function authenticateInternal(
+  noDID = false,
+  ownDID = false,
+  exchangeToken = "",
+  waitForPermit = true
+) {
   try {
     if (!this._credential.cache.ca) {
       this._credential.cache.ca = this._voltConfig.ca_pem;
@@ -136,6 +136,27 @@ export async function authenticateInternal(noDID = false, ownDID = false, exchan
       host: this._credential.cache.bindIp
     };
 
+    if (this._credential.cache.vc?.length > 0) {
+      const presentation = {
+        credential: []
+      };
+
+      let presentationData = "";
+      for (let credential of this._credential.cache.vc) {
+        const vc = JSON.stringify(credential, null, 2);
+        log(vc);
+        presentation.credential.push(vc);
+        presentationData += vc;
+      }
+
+      presentation.signature = signBase64(
+        this._credential.cache.key,
+        presentationData
+      );
+
+      authenticateRequest.verifiable_presentation = [presentation];
+    }
+
     if (exchangeToken) {
       log("setting request exchange token");
       authenticateRequest.exchange_token = exchangeToken;
@@ -147,9 +168,7 @@ export async function authenticateInternal(noDID = false, ownDID = false, exchan
       log("setting request challenge code");
       authenticateRequest.challenge = this._credential.cache.challenge_code;
     } else {
-      log(
-        "no challenge code in request"
-      );
+      log("no challenge code in request");
     }
 
     if (noDID) {
@@ -227,8 +246,8 @@ export async function authenticateInternal(noDID = false, ownDID = false, exchan
       );
       log("authenticate decision: %s", decision);
     } while (
-      decision === "POLICY_DECISION_PROMPT" ||
-      decision === "POLICY_DECISION_PENDING"
+      decision === "POLICY_DECISION_PENDING" ||
+      (waitForPermit && decision === "POLICY_DECISION_PROMPT")
     );
 
     return decision === "POLICY_DECISION_PERMIT";

package/src/volt-client.js

@@ -85,9 +85,14 @@ export class VoltClient extends EventEmitter {
    * @param {boolean} [options.noDID] - whether to create a key-based authentication session
    * instead of a DID-based authentication session.
    * @param {string} [options.exchangeToken] - optional token to exchange in return for an authenticated session.
+   * @param {boolean} [options.waitForAuth] - whether to block and poll on 'prompt' authenticate decisions. Default is true.
    */
   async initialise(config, options = {}) {
-    const { ownDID, noDID, didRegistryList, exchangeToken, extraConfig } = options;
+    const { ownDID, noDID, didRegistryList, exchangeToken, extraConfig } =
+      options;
+    const waitForAuth =
+      options.waitForAuth === undefined ? true : !!options.waitForAuth;
+
     try {
       if (!config) {
         throw new Error(
@@ -173,7 +178,13 @@ export class VoltClient extends EventEmitter {
       } else {
         // No certificate present in the cache yet => we need to authenticate.
         try {
-          isBound = await authenticateInternal.call(this, noDID, ownDID, exchangeToken);
+          isBound = await authenticateInternal.call(
+            this,
+            noDID,
+            ownDID,
+            exchangeToken,
+            waitForAuth
+          );
         } catch (bindErr) {
           if (bindErr.message === "invalid arguments") {
             // This is usually the result of a missing challenge signature or credential.
@@ -612,6 +623,21 @@ export class VoltClient extends EventEmitter {
     return call.start(grpcClient, request);
   }
 
+  /**
+   * TerminalAPI
+   */
+  CommandStream(request, service) {
+    const grpcClient = this.getVoltAPIClient();
+
+    const commandStreamCall = new GRPCCall(
+      this,
+      "CommandStream",
+      "METHOD_TYPE_BIDI",
+      service
+    );
+    return commandStreamCall.start(grpcClient, request);
+  }
+
   /**
    * WireAPI
    */

package/src/volt-proto-literals.js

@@ -543,8 +543,14 @@ message GetFileDescendantsRequest {
   // Optional - only match descendants of the given kind.
   string extension = 3;
 
+  // Optional - restrict to folders only.bool
+  bool folders_only = 4;
+
   // Optional - can be used to determine if a resource is a descendant.
   string descendant_id = 5;
+
+  // Optional - include hidden files and directories.
+  bool include_hidden = 6;
 }
 
 message GetFileDescendantsResponse {
@@ -875,10 +881,13 @@ message DIDRegistryUpdate {
 }
 
 message VerifiablePresentation {
-  // The credential JSON.
+  // DEPRECATED - use 'credential'
   string credential_json = 1;
 
-  // A signature of the credential JSON. The signature should usually be that of the credential subject.
+  // Array of credential JSON.
+  repeated string credential = 3;
+
+  // A signature of the credential JSON. The signature should be that of the credential holder over the concatenation of the contents of the \`credential\` array.
   string signature = 2;
 }
 
@@ -1042,7 +1051,7 @@ message ParseCredentialResponse {
   tdx.volt_api.volt.v1.Status status = 1;
 
   // The parsed credential details.
-  VerifiableCredential verifiable_credential = 2;
+  repeated VerifiableCredential verifiable_credential = 2;
 }
 
 message ResolveDIDRequest {
@@ -1583,6 +1592,15 @@ message VoltParameters {
 
   // If set, enables the agent event pool.
   bool enable_agent_event_pool = 51;
+
+  // Optional owner email addresses.
+  repeated string owner_email = 52;
+
+  // Optional owner email identity providers.
+  repeated string identity_provider = 53;
+
+  // If set, exposes a resource that gives the Volt owner read-only access the file system.
+  bool enable_owner_file_system_access = 54;
 }
 
 message VoltEndpoint {
@@ -1947,6 +1965,9 @@ message SessionCredential {
 
   // More type-specific data stored with the credential.
   string extra_2 = 16;
+
+  // The verification status of the credential.
+  string status = 17;
 }
 
 message Session {
@@ -1970,7 +1991,6 @@ message Session {
 
   SessionStatus status = 10;
 }
-
 `;
 export const volt_api = `syntax = "proto3";
 
@@ -1981,7 +2001,7 @@ import "tdx/volt_api/volt/v1/remote.proto";
 import "tdx/volt_api/volt/v1/ssi.proto";
 import "tdx/volt_api/volt/v1/volt.proto";
 
-// The top-level volt management service. 
+// The top-level volt management service.
 // With the exception of \`Authenticate\`, all RPCs on this service must submit either a valid client certificate signed by the volt CA, or a signed JWT.
 // A client certificate can be obtained from the \`Authenticate\` method.
 // All methods include a \`tdx.volt_api.volt.v1.Status\` in the response. If the status contains a non-OK error code the client should assume the remainder of the message is invalid, unless otherwise indicated in the response documentation.
@@ -2341,9 +2361,19 @@ message ConnectResource {
   Resource resource = 2;
 }
 
+enum ConnectAuthRequestType {
+    CONNECT_AUTH_REQUEST_TYPE_UNKNOWN = 0;
+    CONNECT_AUTH_REQUEST_TYPE_NEW_SESSION = 1;
+    CONNECT_AUTH_REQUEST_TYPE_UPDATE_SESSION = 2;
+    CONNECT_AUTH_REQUEST_TYPE_DELETE_SESSION = 3;
+    CONNECT_AUTH_REQUEST_TYPE_SIGN_REQUEST = 4;
+}
+
 message ConnectAuthRequest {
   Session session = 1;
 
+  ConnectAuthRequestType request_type = 2;
+
   string context = 5;
 
   string challenge = 6;
@@ -2753,6 +2783,8 @@ message GetSessionsRequest {
   string identity_name = 3;
 
   SessionStatus status = 4;
+
+  string identity_email_id = 5;
 }
 
 message GetSessionsResponse {
@@ -2993,6 +3025,11 @@ message SaveSessionResponse {
 }
 
 message SetPolicyRequest {
+  // The id of the policy to set.
+  // Should be either 00000000-0000-0000-0000-000000000000 or 00000000-0000-0000-0000-000000000001 for the first or last custom policy respectively.
+  string id = 2;
+
+  // The custom policy to set in JSON format.
   string custom_policy = 1;
 }