@virtru/dsp-sdk 0.2.3 → 0.3.0

package/dist/src/gen/virtru/policy/objects_pb.js

@@ -0,0 +1,126 @@
+// @generated by protoc-gen-es v2.3.0 with parameter "target=ts"
+// @generated from file virtru/policy/objects.proto (package virtru.policy, syntax proto3)
+/* eslint-disable */
+import { enumDesc, fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_buf_validate_validate } from "../../buf/validate/validate_pb";
+import { file_virtru_common_common } from "../common/common_pb";
+/**
+ * Describes the file virtru/policy/objects.proto.
+ */
+export const file_virtru_policy_objects = /*@__PURE__*/ fileDesc("Cht2aXJ0cnUvcG9saWN5L29iamVjdHMucHJvdG8SDXZpcnRydS5wb2xpY3kinwIKC0NlcnRpZmljYXRlEgoKAmlkGAEgASgJEg4KBmtleV9pZBgCIAEoCRIvCg1rZXlfYWxnb3JpdGhtGAMgASgOMhgudmlydHJ1LnBvbGljeS5BbGdvcml0aG0SLAoKa2V5X3N0YXR1cxgEIAEoDjIYLnZpcnRydS5wb2xpY3kuS2V5U3RhdHVzEhQKA3BlbRgFIAEoCUIHukgEcgIQARIVCgRuYW1lGAYgASgJQge6SARyAhABEigKCGtleV9tb2RlGAcgASgOMhYudmlydHJ1LnBvbGljeS5LZXlNb2RlEhMKC2ZpbmdlcnByaW50GAggASgJEikKCG1ldGFkYXRhGGQgASgLMhcudmlydHJ1LmNvbW1vbi5NZXRhZGF0YSKXAQoSQ2VydGlmaWNhdGVNYXBwaW5nEhQKAmlkGAEgASgJQgi6SAVyA7ABARIgCg5jZXJ0aWZpY2F0ZV9pZBgCIAEoCUIIukgFcgOwAQESHgoMbmFtZXNwYWNlX2lkGAMgASgJQgi6SAVyA7ABARIpCghtZXRhZGF0YRhkIAEoCzIXLnZpcnRydS5jb21tb24uTWV0YWRhdGEqmwEKCUFsZ29yaXRobRIZChVBTEdPUklUSE1fVU5TUEVDSUZJRUQQABIWChJBTEdPUklUSE1fUlNBXzIwNDgQARIWChJBTEdPUklUSE1fUlNBXzQwOTYQAhIVChFBTEdPUklUSE1fRUNfUDI1NhADEhUKEUFMR09SSVRITV9FQ19QMzg0EAQSFQoRQUxHT1JJVEhNX0VDX1A1MjEQBSpWCglLZXlTdGF0dXMSGgoWS0VZX1NUQVRVU19VTlNQRUNJRklFRBAAEhUKEUtFWV9TVEFUVVNfQUNUSVZFEAESFgoSS0VZX1NUQVRVU19ST1RBVEVEEAIqlAEKB0tleU1vZGUSGAoUS0VZX01PREVfVU5TUEVDSUZJRUQQABIcChhLRVlfTU9ERV9DT05GSUdfUk9PVF9LRVkQARIeChpLRVlfTU9ERV9QUk9WSURFUl9ST09UX0tFWRACEhMKD0tFWV9NT0RFX1JFTU9URRADEhwKGEtFWV9NT0RFX1BVQkxJQ19LRVlfT05MWRAEQnYKEWNvbS52aXJ0cnUucG9saWN5QgxPYmplY3RzUHJvdG9QAaICA1ZQWKoCDVZpcnRydS5Qb2xpY3nKAg1WaXJ0cnVcUG9saWN54gIZVmlydHJ1XFBvbGljeVxHUEJNZXRhZGF0YeoCDlZpcnRydTo6UG9saWN5YgZwcm90bzM", [file_buf_validate_validate, file_virtru_common_common]);
+/**
+ * Describes the message virtru.policy.Certificate.
+ * Use `create(CertificateSchema)` to create a new message.
+ */
+export const CertificateSchema = /*@__PURE__*/ messageDesc(file_virtru_policy_objects, 0);
+/**
+ * Describes the message virtru.policy.CertificateMapping.
+ * Use `create(CertificateMappingSchema)` to create a new message.
+ */
+export const CertificateMappingSchema = /*@__PURE__*/ messageDesc(file_virtru_policy_objects, 1);
+/**
+ * @generated from enum virtru.policy.Algorithm
+ */
+export var Algorithm;
+(function (Algorithm) {
+    /**
+     * @generated from enum value: ALGORITHM_UNSPECIFIED = 0;
+     */
+    Algorithm[Algorithm["UNSPECIFIED"] = 0] = "UNSPECIFIED";
+    /**
+     * @generated from enum value: ALGORITHM_RSA_2048 = 1;
+     */
+    Algorithm[Algorithm["RSA_2048"] = 1] = "RSA_2048";
+    /**
+     * @generated from enum value: ALGORITHM_RSA_4096 = 2;
+     */
+    Algorithm[Algorithm["RSA_4096"] = 2] = "RSA_4096";
+    /**
+     * @generated from enum value: ALGORITHM_EC_P256 = 3;
+     */
+    Algorithm[Algorithm["EC_P256"] = 3] = "EC_P256";
+    /**
+     * @generated from enum value: ALGORITHM_EC_P384 = 4;
+     */
+    Algorithm[Algorithm["EC_P384"] = 4] = "EC_P384";
+    /**
+     * @generated from enum value: ALGORITHM_EC_P521 = 5;
+     */
+    Algorithm[Algorithm["EC_P521"] = 5] = "EC_P521";
+})(Algorithm || (Algorithm = {}));
+/**
+ * Describes the enum virtru.policy.Algorithm.
+ */
+export const AlgorithmSchema = /*@__PURE__*/ enumDesc(file_virtru_policy_objects, 0);
+/**
+ * @generated from enum virtru.policy.KeyStatus
+ */
+export var KeyStatus;
+(function (KeyStatus) {
+    /**
+     * @generated from enum value: KEY_STATUS_UNSPECIFIED = 0;
+     */
+    KeyStatus[KeyStatus["UNSPECIFIED"] = 0] = "UNSPECIFIED";
+    /**
+     * @generated from enum value: KEY_STATUS_ACTIVE = 1;
+     */
+    KeyStatus[KeyStatus["ACTIVE"] = 1] = "ACTIVE";
+    /**
+     * @generated from enum value: KEY_STATUS_ROTATED = 2;
+     */
+    KeyStatus[KeyStatus["ROTATED"] = 2] = "ROTATED";
+})(KeyStatus || (KeyStatus = {}));
+/**
+ * Describes the enum virtru.policy.KeyStatus.
+ */
+export const KeyStatusSchema = /*@__PURE__*/ enumDesc(file_virtru_policy_objects, 1);
+/**
+ * Describes the management and operational mode of a cryptographic key.
+ *
+ * @generated from enum virtru.policy.KeyMode
+ */
+export var KeyMode;
+(function (KeyMode) {
+    /**
+     * KEY_MODE_UNSPECIFIED: Default, unspecified key mode. Indicates an uninitialized or error state.
+     *
+     * @generated from enum value: KEY_MODE_UNSPECIFIED = 0;
+     */
+    KeyMode[KeyMode["UNSPECIFIED"] = 0] = "UNSPECIFIED";
+    /**
+     * KEY_MODE_CONFIG_ROOT_KEY: Local key management where the private key is wrapped by a Key Encryption Key (KEK)
+     * sourced from local configuration. Unwrapping and all cryptographic operations are performed locally.
+     *
+     * @generated from enum value: KEY_MODE_CONFIG_ROOT_KEY = 1;
+     */
+    KeyMode[KeyMode["CONFIG_ROOT_KEY"] = 1] = "CONFIG_ROOT_KEY";
+    /**
+     * KEY_MODE_PROVIDER_ROOT_KEY: Local key management where the private key is wrapped by a Key Encryption Key (KEK)
+     * managed by an external provider (e.g., a Hardware Security Module or Cloud KMS).
+     * Key unwrapping is delegated to the external provider; subsequent cryptographic operations
+     * are performed locally using the unwrapped key.
+     *
+     * @generated from enum value: KEY_MODE_PROVIDER_ROOT_KEY = 2;
+     */
+    KeyMode[KeyMode["PROVIDER_ROOT_KEY"] = 2] = "PROVIDER_ROOT_KEY";
+    /**
+     * KEY_MODE_REMOTE: Remote key management where the private key is stored in, and all cryptographic
+     * operations are performed by, a remote Key Management Service (KMS) or HSM.
+     * The private key material never leaves the secure boundary of the remote system.
+     *
+     * @generated from enum value: KEY_MODE_REMOTE = 3;
+     */
+    KeyMode[KeyMode["REMOTE"] = 3] = "REMOTE";
+    /**
+     * KEY_MODE_PUBLIC_KEY_ONLY: Public key only mode. Used when only a public key is available or required,
+     * typically for wrapping operations (e.g., encrypting a Data Encryption Key (DEK) for an external KAS).
+     * The corresponding private key is not managed or accessible by this system.
+     *
+     * @generated from enum value: KEY_MODE_PUBLIC_KEY_ONLY = 4;
+     */
+    KeyMode[KeyMode["PUBLIC_KEY_ONLY"] = 4] = "PUBLIC_KEY_ONLY";
+})(KeyMode || (KeyMode = {}));
+/**
+ * Describes the enum virtru.policy.KeyMode.
+ */
+export const KeyModeSchema = /*@__PURE__*/ enumDesc(file_virtru_policy_objects, 2);

package/dist/src/index.d.ts

@@ -7,7 +7,7 @@ export { platformConnect as dspConnect, platformConnectWeb as dspConnectWeb, } f
  */
 export { type DSPClientServicesV1 as DSPServicesV1, type DSPClientServicesV2 as DSPServicesV2, type DSPClientOptions, DSPClient, } from './lib/client';
 export { PlatformClient } from '@opentdf/sdk/platform';
-export { createAuthInterceptor, type Interceptor } from './lib/utils';
+export { createAuthInterceptor, type Interceptor, createAuthProvider, createOpenTDFClient, getObligations, getUserEntitlements, flattenObligations, getTrustedCertificates, validateJWSCertificateChain, type JWSValidationResult, type ObligationFeatureMap, type SupportedObligations, type GetUserEntitlementsResponse, } from './lib/utils';
 /**
  * Exports the DSP wrapper of OpenTDF
  */

package/dist/src/index.js

@@ -12,7 +12,7 @@ export { platformConnect as dspConnect, platformConnectWeb as dspConnectWeb, } f
  */
 export { DSPClient, } from './lib/client';
 export { PlatformClient } from '@opentdf/sdk/platform';
-export { createAuthInterceptor } from './lib/utils';
+export { createAuthInterceptor, createAuthProvider, createOpenTDFClient, getObligations, getUserEntitlements, flattenObligations, getTrustedCertificates, validateJWSCertificateChain, } from './lib/utils';
 /**
  * Exports the DSP wrapper of OpenTDF
  */

package/dist/src/lib/client.d.ts

@@ -5,11 +5,13 @@ import { PolicyArtifactService } from '../gen/policyimportexport/v1/policy_impor
 import { SharedService } from '../gen/shared/v1/shared_pb';
 import { TaggingPDPService } from '../gen/tagging/pdp/v2/tagging_pb';
 import { VersionService } from '../gen/version/v1/version_pb';
+import { CertificateService } from '../gen/virtru/policy/certificates/v1/certificates_pb';
 export interface DSPClientServicesV1 {
     configService: Client<typeof ConfigService>;
     policyArtifactService: Client<typeof PolicyArtifactService>;
     sharedService: Client<typeof SharedService>;
     versionService: Client<typeof VersionService>;
+    certificateService: Client<typeof CertificateService>;
 }
 export interface DSPClientServicesV2 {
     taggingPDPService: Client<typeof TaggingPDPService>;

package/dist/src/lib/client.js

@@ -10,6 +10,7 @@ import { PolicyArtifactService } from '../gen/policyimportexport/v1/policy_impor
 import { SharedService } from '../gen/shared/v1/shared_pb';
 import { TaggingPDPService } from '../gen/tagging/pdp/v2/tagging_pb';
 import { VersionService } from '../gen/version/v1/version_pb';
+import { CertificateService } from '../gen/virtru/policy/certificates/v1/certificates_pb';
 import { createAuthInterceptor } from './utils';
 /**
  * A client for interacting with the DSP using the Connect RPC framework.
@@ -52,6 +53,7 @@ export class DSPClient {
             policyArtifactService: createClient(PolicyArtifactService, transport),
             sharedService: createClient(SharedService, transport),
             versionService: createClient(VersionService, transport),
+            certificateService: createClient(CertificateService, transport),
         };
         this.v2 = {
             taggingPDPService: createClient(TaggingPDPService, transport),

package/dist/src/lib/consts.d.ts

@@ -0,0 +1,2 @@
+export declare const MAX_CERTS = 10;
+export declare const MAX_CERT_BYTES: number;

package/dist/src/lib/consts.js

@@ -0,0 +1,7 @@
+/*
+ * Copyright (c) Virtru Corporation.  All rights reserved.
+ *
+ * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
+ */
+export const MAX_CERTS = 10; // reasonable upper bound for chain depth
+export const MAX_CERT_BYTES = 64 * 1024; // 64KB per certificate

package/dist/src/lib/utils.d.ts

@@ -1,6 +1,21 @@
 import type { AuthProvider } from '@opentdf/sdk';
+import { AuthProviders, OpenTDF } from '@opentdf/sdk';
+import type { Certificate } from '../gen/virtru/policy/objects_pb';
 import type { Interceptor as Inter } from '@connectrpc/connect';
 export type Interceptor = Inter;
+export type ObligationFeatureMap = {
+    fully_qualified_names: string[];
+};
+export type SupportedObligations = {
+    watermark?: ObligationFeatureMap;
+    prevent_download?: ObligationFeatureMap;
+};
+export type GetUserEntitlementsResponse = {
+    entitlements: {
+        entityId: string;
+        attributeValueFqns: string[];
+    }[];
+};
 /**
  * Creates an interceptor that adds authentication headers to outgoing requests.
  *
@@ -13,3 +28,124 @@ export type Interceptor = Inter;
  * @returns An `Interceptor` function that modifies requests to include authentication headers.
  */
 export declare function createAuthInterceptor(authProvider: AuthProvider): Interceptor;
+/** Creates a new instance of an OIDC Auth Provider consumed by the TDF Clients */
+export declare function createAuthProvider(options: {
+    oidc: {
+        clientId: string;
+        tokenEndpoint: string;
+        userInfoEndpoint: string;
+    };
+    refreshToken: string;
+}): Promise<AuthProviders.OIDCRefreshTokenProvider>;
+export declare function createOpenTDFClient(options: {
+    oidc: {
+        clientId: string;
+        tokenEndpoint: string;
+        userInfoEndpoint: string;
+    };
+    platformEndpoint: string;
+    refreshToken: string;
+    obligations: string[];
+}): Promise<OpenTDF>;
+export declare const getObligations: (ciphertext: ArrayBuffer, options: {
+    oidc: {
+        clientId: string;
+        tokenEndpoint: string;
+        userInfoEndpoint: string;
+    };
+    platformEndpoint: string;
+    refreshToken: string;
+    obligations: string[];
+}) => Promise<string[]>;
+export declare function getUserEntitlements(options: {
+    oidc: {
+        clientId: string;
+        tokenEndpoint: string;
+        userInfoEndpoint: string;
+    };
+    platformEndpoint: string;
+    refreshToken: string;
+}): Promise<GetUserEntitlementsResponse>;
+export declare const flattenObligations: (obligations: SupportedObligations) => string[];
+/**
+ * Retrieves all trusted certificates from active namespaces in the platform.
+ *
+ * This function uses the new CertificateService API to retrieve certificates from all active
+ * namespaces. It automatically handles pagination to ensure all certificates are retrieved.
+ *
+ * The function performs the following steps:
+ * 1. Creates an authenticated auth provider with DPoP signing keys
+ * 2. Lists all active namespaces using the PlatformClient
+ * 3. For each namespace, retrieves all associated certificates using the CertificateService
+ * 4. Aggregates and returns all certificates from all namespaces
+ *
+ * @param options - The options object containing the platform endpoint, OIDC configuration, and refresh token.
+ * @param options.oidc - The OIDC configuration object.
+ * @param options.oidc.clientId - The OIDC client ID.
+ * @param options.oidc.tokenEndpoint - The OIDC token endpoint URL.
+ * @param options.oidc.userInfoEndpoint - The OIDC user info endpoint URL.
+ * @param options.platformEndpoint - The base URL of the platform.
+ * @param options.refreshToken - The refresh token for authentication.
+ * @returns A promise that resolves to an array of trusted certificates from all active namespaces.
+ * @throws If there is an error retrieving namespaces or certificates.
+ *
+ * @example
+ * ```typescript
+ * const certificates = await getTrustedCertificates({
+ *   oidc: {
+ *     clientId: 'my-client-id',
+ *     tokenEndpoint: 'https://auth.example.com/token',
+ *     userInfoEndpoint: 'https://auth.example.com/userinfo',
+ *   },
+ *   platformEndpoint: 'https://platform.example.com',
+ *   refreshToken: 'my-refresh-token',
+ * });
+ * ```
+ */
+export declare function getTrustedCertificates(options: {
+    oidc: {
+        clientId: string;
+        tokenEndpoint: string;
+        userInfoEndpoint: string;
+    };
+    platformEndpoint: string;
+    refreshToken: string;
+}): Promise<Certificate[]>;
+export type JWSValidationResult = {
+    valid: boolean;
+    validationResult: Record<string, string[]>;
+};
+/**
+ * Validate that a certificate chain from JWS x5c header chains to a trusted root.
+ *
+ * This function is designed to be portable and can be moved to another repository.
+ * It validates that the certificate chain presented in a JWS x5c header builds a
+ * valid chain to one of the provided trusted root certificates.
+ *
+ * Expectations and behavior:
+ * - `x5c` must be ordered leaf-first and contain base64-encoded DER certs.
+ * - `trustedRootCertificates` should contain PEM-encoded root certificates.
+ * - Performs basic input size checks and safe base64 decoding.
+ * - Uses PKI.js `CertificateChainValidationEngine` for comprehensive path validation
+ *   (validity dates, signatures, policies when present, etc.).
+ * - Returns detailed error messages including the leaf subject/issuer and parsing warnings.
+ *
+ * @param x5c - Array of base64-encoded DER certificates from JWS header (leaf first)
+ * @param trustedRootCertificates - Array of Certificate objects containing trusted roots in PEM format
+ * @returns Object with validation result and warnings
+ * @throws {Error} if validation fails
+ *
+ * @example
+ * ```typescript
+ * try {
+ *   const result = await validateJWSCertificateChain(
+ *     jwsHeader.x5c,
+ *     namespaceCertificates
+ *   );
+ *   console.log('Chain validates to trusted root', result.validationResult.warnings);
+ * } catch (error) {
+ *   console.error('Validation failed:', error.message);
+ * }
+ * ```
+ */
+export declare function validateJWSCertificateChain(x5c: string[], trustedRootCertificates: Certificate[]): Promise<JWSValidationResult>;