@virtru/dsp-sdk 0.2.3 → 0.3.0

package/dist/src/lib/utils.js

@@ -3,6 +3,13 @@
  *
  * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
  */
+import { AuthProviders, OpenTDF, PermissionDeniedError } from '@opentdf/sdk';
+import { PlatformClient } from '@opentdf/sdk/platform';
+import { ActiveStateEnum } from '@opentdf/sdk/platform/common/common_pb.js';
+import * as asn1js from 'asn1js';
+import * as pkijs from 'pkijs';
+import { MAX_CERT_BYTES, MAX_CERTS } from "./consts";
+import { DSPClient } from './client';
 /**
  * Creates an interceptor that adds authentication headers to outgoing requests.
  *
@@ -15,7 +22,7 @@
  * @returns An `Interceptor` function that modifies requests to include authentication headers.
  */
 export function createAuthInterceptor(authProvider) {
-    const authInterceptor = (next) => async (req) => {
+    return (next) => async (req) => {
         const url = new URL(req.url);
         const pathOnly = url.pathname;
         // Signs only the path of the url in the request
@@ -31,5 +38,351 @@ export function createAuthInterceptor(authProvider) {
         });
         return await next(req);
     };
-    return authInterceptor;
+}
+/** Creates a new instance of an OIDC Auth Provider consumed by the TDF Clients */
+export async function createAuthProvider(options) {
+    const { oidc, refreshToken } = options;
+    return await AuthProviders.refreshAuthProvider({
+        clientId: oidc.clientId,
+        exchange: 'refresh',
+        refreshToken: refreshToken,
+        // TODO(DSPX-1559): Clean up these URLs.
+        oidcOrigin: 'https://only-required-for-back-compat.invalid',
+        oidcTokenEndpoint: oidc.tokenEndpoint,
+        oidcUserInfoEndpoint: oidc.userInfoEndpoint,
+    });
+}
+export async function createOpenTDFClient(options) {
+    const { platformEndpoint, obligations, ...authProviderOptions } = options;
+    return new OpenTDF({
+        authProvider: await createAuthProvider(authProviderOptions),
+        platformUrl: platformEndpoint,
+        policyEndpoint: platformEndpoint,
+        defaultCreateOptions: {
+            defaultKASEndpoint: `${platformEndpoint}/kas`,
+        },
+        defaultReadOptions: {
+            fulfillableObligationFQNs: obligations,
+            // NOTE(DSP-249): Disabling assertion verification until all generated assertions are supported.
+            noVerify: true,
+        },
+        disableDPoP: true,
+    });
+}
+export const getObligations = async (ciphertext, options) => {
+    const client = await createOpenTDFClient(options);
+    const source = {
+        type: 'buffer',
+        location: new Uint8Array(ciphertext),
+    };
+    const tdfReader = client.open({ source });
+    let obligations = [];
+    try {
+        obligations = (await tdfReader.obligations()).fqns;
+    }
+    catch (error) {
+        if (error instanceof PermissionDeniedError) {
+            obligations = error.requiredObligations || [];
+        }
+        // Swallow other errors and return empty obligations.
+    }
+    return obligations;
+};
+export async function getUserEntitlements(options) {
+    const authProvider = await createAuthProvider({
+        oidc: options.oidc,
+        refreshToken: options.refreshToken,
+    });
+    const accessToken = await authProvider.oidcAuth.get();
+    const userEntitlementsResponse = await fetch(`${options.platformEndpoint}/shared/entitlements`, {
+        body: JSON.stringify({}),
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+            'Content-Type': 'application/json',
+        },
+        method: 'POST',
+    });
+    return (await userEntitlementsResponse.json());
+}
+export const flattenObligations = (obligations) => Object.values(obligations).flatMap((feature) => feature?.fully_qualified_names || []);
+/**
+ * Helper function to retrieve certificates for a specific namespace with pagination handling.
+ *
+ * This function automatically handles pagination to retrieve all certificates for a namespace,
+ * making multiple requests if necessary.
+ *
+ * @param dspClient - The DSP client instance.
+ * @param namespaceId - The namespace UUID.
+ * @returns A promise that resolves to an array of certificates for the namespace.
+ * @throws If there is an error retrieving the certificates from the CertificateService.
+ */
+async function getCertificatesForNamespace(dspClient, namespaceId) {
+    const certificates = [];
+    let offset = 0;
+    const limit = 100;
+    while (true) {
+        const response = await dspClient.v1.certificateService.listCertificatesByNamespace({
+            namespaceId,
+            pagination: { limit, offset },
+        });
+        if (response.certificates?.length > 0) {
+            certificates.push(...response.certificates);
+        }
+        // Check for more pages
+        if (response.pagination?.nextOffset && response.pagination.nextOffset > 0) {
+            offset = response.pagination.nextOffset;
+        }
+        else {
+            break;
+        }
+    }
+    return certificates;
+}
+/**
+ * Retrieves all trusted certificates from active namespaces in the platform.
+ *
+ * This function uses the new CertificateService API to retrieve certificates from all active
+ * namespaces. It automatically handles pagination to ensure all certificates are retrieved.
+ *
+ * The function performs the following steps:
+ * 1. Creates an authenticated auth provider with DPoP signing keys
+ * 2. Lists all active namespaces using the PlatformClient
+ * 3. For each namespace, retrieves all associated certificates using the CertificateService
+ * 4. Aggregates and returns all certificates from all namespaces
+ *
+ * @param options - The options object containing the platform endpoint, OIDC configuration, and refresh token.
+ * @param options.oidc - The OIDC configuration object.
+ * @param options.oidc.clientId - The OIDC client ID.
+ * @param options.oidc.tokenEndpoint - The OIDC token endpoint URL.
+ * @param options.oidc.userInfoEndpoint - The OIDC user info endpoint URL.
+ * @param options.platformEndpoint - The base URL of the platform.
+ * @param options.refreshToken - The refresh token for authentication.
+ * @returns A promise that resolves to an array of trusted certificates from all active namespaces.
+ * @throws If there is an error retrieving namespaces or certificates.
+ *
+ * @example
+ * ```typescript
+ * const certificates = await getTrustedCertificates({
+ *   oidc: {
+ *     clientId: 'my-client-id',
+ *     tokenEndpoint: 'https://auth.example.com/token',
+ *     userInfoEndpoint: 'https://auth.example.com/userinfo',
+ *   },
+ *   platformEndpoint: 'https://platform.example.com',
+ *   refreshToken: 'my-refresh-token',
+ * });
+ * ```
+ */
+export async function getTrustedCertificates(options) {
+    function generateSigningKeyPair() {
+        return crypto.subtle.generateKey({
+            name: 'ECDSA',
+            namedCurve: 'P-256',
+        }, true, ['sign', 'verify']);
+    }
+    const authProvider = await createAuthProvider({
+        oidc: options.oidc,
+        refreshToken: options.refreshToken,
+    });
+    await authProvider.updateClientPublicKey(await generateSigningKeyPair());
+    // Create both clients
+    const platform = new PlatformClient({
+        authProvider,
+        platformUrl: options.platformEndpoint,
+    });
+    const dspClient = new DSPClient({
+        platformUrl: options.platformEndpoint,
+        authProvider,
+    });
+    const certificates = [];
+    try {
+        // Get active namespaces (still using namespace API)
+        const namespaces = await platform.v1.namespace.listNamespaces({
+            state: ActiveStateEnum.ACTIVE,
+        });
+        // Get certificates using new CertificateService API
+        for (const namespace of namespaces.namespaces) {
+            const namespaceCerts = await getCertificatesForNamespace(dspClient, namespace.id);
+            certificates.push(...namespaceCerts);
+        }
+    }
+    catch (error) {
+        console.error('Error retrieving namespace certificates:', error);
+        throw error;
+    }
+    return certificates;
+}
+/**
+ * Helper to get a string representation of a pkijs Name.
+ */
+function getNameStringSafe(name) {
+    if (!name)
+        return '';
+    try {
+        // pkijs Name to string can be derived from typesAndValues
+        const parts = (name.typesAndValues || []).map((tv) => {
+            const type = tv?.type ?? 'unknownType';
+            // tv.value is an ASN.1 value; best-effort toString fallback
+            let value;
+            try {
+                const block = tv?.value?.valueBlock;
+                const v = block?.value;
+                value = typeof v === 'string' ? v : String(tv?.value);
+            }
+            catch {
+                value = '<?>';
+            }
+            return `${type}=${value}`;
+        });
+        return parts.join(', ');
+    }
+    catch {
+        return '';
+    }
+}
+function base64ToArrayBuffer(b64) {
+    const normalized = b64.replace(/\s+/g, '');
+    // Basic sanity check; allow trailing '=' padding
+    if (!/^[-A-Za-z0-9+/]*=*$/.test(normalized)) {
+        throw new Error('Invalid base64 characters');
+    }
+    // Optional size guard (approx: 3/4 of base64 length is bytes)
+    const approxBytes = Math.floor((normalized.length * 3) / 4);
+    if (approxBytes === 0) {
+        throw new Error('Empty base64 data');
+    }
+    if (approxBytes > MAX_CERT_BYTES) {
+        throw new Error(`Certificate exceeds maximum allowed size of ${MAX_CERT_BYTES} bytes`);
+    }
+    const binaryString = atob(normalized);
+    const bytes = new Uint8Array(binaryString.length);
+    for (let i = 0; i < binaryString.length; i++) {
+        bytes[i] = binaryString.charCodeAt(i);
+    }
+    return bytes.buffer; // bytes is freshly allocated; buffer is tightly packed
+}
+function pemToArrayBuffer(pem) {
+    const base64Der = pem
+        .replace(/-----BEGIN CERTIFICATE-----/g, '')
+        .replace(/-----END CERTIFICATE-----/g, '')
+        .replace(/\r?\n|\r|\s/g, '');
+    return base64ToArrayBuffer(base64Der);
+}
+/**
+ * Validate that a certificate chain from JWS x5c header chains to a trusted root.
+ *
+ * This function is designed to be portable and can be moved to another repository.
+ * It validates that the certificate chain presented in a JWS x5c header builds a
+ * valid chain to one of the provided trusted root certificates.
+ *
+ * Expectations and behavior:
+ * - `x5c` must be ordered leaf-first and contain base64-encoded DER certs.
+ * - `trustedRootCertificates` should contain PEM-encoded root certificates.
+ * - Performs basic input size checks and safe base64 decoding.
+ * - Uses PKI.js `CertificateChainValidationEngine` for comprehensive path validation
+ *   (validity dates, signatures, policies when present, etc.).
+ * - Returns detailed error messages including the leaf subject/issuer and parsing warnings.
+ *
+ * @param x5c - Array of base64-encoded DER certificates from JWS header (leaf first)
+ * @param trustedRootCertificates - Array of Certificate objects containing trusted roots in PEM format
+ * @returns Object with validation result and warnings
+ * @throws {Error} if validation fails
+ *
+ * @example
+ * ```typescript
+ * try {
+ *   const result = await validateJWSCertificateChain(
+ *     jwsHeader.x5c,
+ *     namespaceCertificates
+ *   );
+ *   console.log('Chain validates to trusted root', result.validationResult.warnings);
+ * } catch (error) {
+ *   console.error('Validation failed:', error.message);
+ * }
+ * ```
+ */
+export async function validateJWSCertificateChain(x5c, trustedRootCertificates) {
+    const warnings = [];
+    try {
+        // Validate inputs
+        if (!Array.isArray(x5c) || x5c.length === 0) {
+            throw new Error('No certificates provided in x5c array');
+        }
+        if (x5c.length > MAX_CERTS) {
+            throw new Error(`Too many certificates in x5c (max ${MAX_CERTS})`);
+        }
+        if (!Array.isArray(trustedRootCertificates) || trustedRootCertificates.length === 0) {
+            throw new Error('No trusted root certificates provided');
+        }
+        // Parse chain certs (base64 DER)
+        const chainCertificates = [];
+        for (let i = 0; i < x5c.length; i++) {
+            const certBase64 = x5c[i];
+            try {
+                const certBuffer = base64ToArrayBuffer(certBase64);
+                const asn1 = asn1js.fromBER(certBuffer);
+                if (asn1.offset === -1) {
+                    throw new Error(`Invalid DER encoding for certificate at x5c[${i}]`);
+                }
+                chainCertificates.push(new pkijs.Certificate({ schema: asn1.result }));
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : 'Unknown error';
+                throw new Error(`Failed to parse certificate at x5c[${i}]: ${msg}`);
+            }
+        }
+        // Parse trusted roots (PEM)
+        const trustedCerts = [];
+        for (let i = 0; i < trustedRootCertificates.length; i++) {
+            const rootCert = trustedRootCertificates[i];
+            try {
+                const pem = rootCert.pem;
+                if (!pem || pem.trim().length === 0) {
+                    warnings.push(`Trusted root at index ${i} has no PEM data; skipping`);
+                    continue;
+                }
+                const certBuffer = pemToArrayBuffer(pem);
+                const asn1 = asn1js.fromBER(certBuffer);
+                if (asn1.offset === -1) {
+                    warnings.push(`Trusted root at index ${i} has invalid DER; skipping`);
+                    continue;
+                }
+                trustedCerts.push(new pkijs.Certificate({ schema: asn1.result }));
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : 'Unknown error';
+                warnings.push(`Failed to parse trusted root at index ${i}: ${msg}`);
+            }
+        }
+        if (trustedCerts.length === 0) {
+            throw new Error('No valid trusted root certificates could be parsed');
+        }
+        // Build and verify certificate chain using PKI.js
+        const chainEngine = new pkijs.CertificateChainValidationEngine({
+            trustedCerts,
+            certs: chainCertificates,
+            checkDate: new Date(),
+        });
+        const verificationResult = await chainEngine.verify();
+        if (!verificationResult.result) {
+            // Compose detailed message
+            const leaf = chainCertificates[0];
+            const leafSubject = getNameStringSafe(leaf.subject);
+            const leafIssuer = getNameStringSafe(leaf.issuer);
+            const baseMsg = verificationResult.resultMessage || 'Certificate chain validation failed';
+            throw new Error(`${baseMsg} (leaf subject='${leafSubject}', issuer='${leafIssuer}')`);
+        }
+        return {
+            valid: true,
+            validationResult: {
+                warnings,
+                errors: [],
+            },
+        };
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : 'Unknown error';
+        const warnSuffix = warnings.length ? `; warnings: ${warnings.join(' | ')}` : '';
+        throw new Error(`Validation error: ${msg}${warnSuffix}`);
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@virtru/dsp-sdk",
-  "version": "0.2.3",
+  "version": "0.3.0",
   "license": "SEE LICENSE IN LICENSE",
   "main": "dist/src/index.js",
   "exports": {
@@ -25,7 +25,7 @@
     "jsdom": "^22.1.0",
     "msw": "^2.8.4",
     "playwright": "^1.52.0",
-    "vite": "^4.5.14",
+    "vite": "^5.4.21",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "~3.1.3",
     "typescript": "5.8.2"
@@ -35,7 +35,9 @@
     "@connectrpc/connect": "~2.0.2",
     "@connectrpc/connect-web": "~2.0.2",
     "@opentdf/sdk": "0.8.0-rc.73",
-    "@rushstack/heft": "^0.50.0"
+    "@rushstack/heft": "^0.50.0",
+    "asn1js": "^3.0.5",
+    "pkijs": "^3.0.19"
   },
   "scripts": {
     "build": "heft build --clean",

package/src/gen/virtru/common/common_pb.ts

@@ -0,0 +1,179 @@
+// @generated by protoc-gen-es v2.3.0 with parameter "target=ts"
+// @generated from file virtru/common/common.proto (package virtru.common, syntax proto3)
+/* eslint-disable */
+
+import type { GenEnum, GenFile, GenMessage } from "@bufbuild/protobuf/codegenv1";
+import { enumDesc, fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv1";
+import { file_buf_validate_validate } from "../../buf/validate/validate_pb";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file virtru/common/common.proto.
+ */
+export const file_virtru_common_common: GenFile = /*@__PURE__*/
+  fileDesc("Chp2aXJ0cnUvY29tbW9uL2NvbW1vbi5wcm90bxINdmlydHJ1LmNvbW1vbiLOAQoITWV0YWRhdGESLgoKY3JlYXRlZF9hdBgBIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLgoKdXBkYXRlZF9hdBgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASMwoGbGFiZWxzGAMgAygLMiMudmlydHJ1LmNvbW1vbi5NZXRhZGF0YS5MYWJlbHNFbnRyeRotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBInwKD01ldGFkYXRhTXV0YWJsZRI6CgZsYWJlbHMYAyADKAsyKi52aXJ0cnUuY29tbW9uLk1ldGFkYXRhTXV0YWJsZS5MYWJlbHNFbnRyeRotCgtMYWJlbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIlkKD0lkRnFuSWRlbnRpZmllchIWCgJpZBgBIAEoCUIIukgFcgOwAQFIABIZCgNmcW4YAiABKAlCCrpIB3IFEAGIAQFIAEITCgppZGVudGlmaWVyEgW6SAIIASIsCgtQYWdlUmVxdWVzdBINCgVsaW1pdBgBIAEoBRIOCgZvZmZzZXQYAiABKAUiSgoMUGFnZVJlc3BvbnNlEhYKDmN1cnJlbnRfb2Zmc2V0GAEgASgFEhMKC25leHRfb2Zmc2V0GAIgASgFEg0KBXRvdGFsGAMgASgFKn0KEk1ldGFkYXRhVXBkYXRlRW51bRIkCiBNRVRBREFUQV9VUERBVEVfRU5VTV9VTlNQRUNJRklFRBAAEh8KG01FVEFEQVRBX1VQREFURV9FTlVNX0VYVEVORBABEiAKHE1FVEFEQVRBX1VQREFURV9FTlVNX1JFUExBQ0UQAkJ1ChFjb20udmlydHJ1LmNvbW1vbkILQ29tbW9uUHJvdG9QAaICA1ZDWKoCDVZpcnRydS5Db21tb27KAg1WaXJ0cnVcQ29tbW9u4gIZVmlydHJ1XENvbW1vblxHUEJNZXRhZGF0YeoCDlZpcnRydTo6Q29tbW9uYgZwcm90bzM", [file_buf_validate_validate, file_google_protobuf_timestamp]);
+
+/**
+ * @generated from message virtru.common.Metadata
+ */
+export type Metadata = Message<"virtru.common.Metadata"> & {
+  /**
+   * @generated from field: google.protobuf.Timestamp created_at = 1;
+   */
+  createdAt?: Timestamp;
+
+  /**
+   * @generated from field: google.protobuf.Timestamp updated_at = 2;
+   */
+  updatedAt?: Timestamp;
+
+  /**
+   * @generated from field: map<string, string> labels = 3;
+   */
+  labels: { [key: string]: string };
+};
+
+/**
+ * Describes the message virtru.common.Metadata.
+ * Use `create(MetadataSchema)` to create a new message.
+ */
+export const MetadataSchema: GenMessage<Metadata> = /*@__PURE__*/
+  messageDesc(file_virtru_common_common, 0);
+
+/**
+ * @generated from message virtru.common.MetadataMutable
+ */
+export type MetadataMutable = Message<"virtru.common.MetadataMutable"> & {
+  /**
+   * @generated from field: map<string, string> labels = 3;
+   */
+  labels: { [key: string]: string };
+};
+
+/**
+ * Describes the message virtru.common.MetadataMutable.
+ * Use `create(MetadataMutableSchema)` to create a new message.
+ */
+export const MetadataMutableSchema: GenMessage<MetadataMutable> = /*@__PURE__*/
+  messageDesc(file_virtru_common_common, 1);
+
+/**
+ * @generated from message virtru.common.IdFqnIdentifier
+ */
+export type IdFqnIdentifier = Message<"virtru.common.IdFqnIdentifier"> & {
+  /**
+   * @generated from oneof virtru.common.IdFqnIdentifier.identifier
+   */
+  identifier: {
+    /**
+     * @generated from field: string id = 1;
+     */
+    value: string;
+    case: "id";
+  } | {
+    /**
+     * @generated from field: string fqn = 2;
+     */
+    value: string;
+    case: "fqn";
+  } | { case: undefined; value?: undefined };
+};
+
+/**
+ * Describes the message virtru.common.IdFqnIdentifier.
+ * Use `create(IdFqnIdentifierSchema)` to create a new message.
+ */
+export const IdFqnIdentifierSchema: GenMessage<IdFqnIdentifier> = /*@__PURE__*/
+  messageDesc(file_virtru_common_common, 2);
+
+/**
+ * @generated from message virtru.common.PageRequest
+ */
+export type PageRequest = Message<"virtru.common.PageRequest"> & {
+  /**
+   * Optional
+   * Set to configured default limit if not provided
+   * Maximum limit set in platform config and enforced by services
+   *
+   * @generated from field: int32 limit = 1;
+   */
+  limit: number;
+
+  /**
+   * Optional
+   * Defaulted if not provided
+   *
+   * @generated from field: int32 offset = 2;
+   */
+  offset: number;
+};
+
+/**
+ * Describes the message virtru.common.PageRequest.
+ * Use `create(PageRequestSchema)` to create a new message.
+ */
+export const PageRequestSchema: GenMessage<PageRequest> = /*@__PURE__*/
+  messageDesc(file_virtru_common_common, 3);
+
+/**
+ * @generated from message virtru.common.PageResponse
+ */
+export type PageResponse = Message<"virtru.common.PageResponse"> & {
+  /**
+   * Requested pagination offset
+   *
+   * @generated from field: int32 current_offset = 1;
+   */
+  currentOffset: number;
+
+  /**
+   * Calculated with request limit + offset or defaults
+   * Empty when none remain after current page
+   *
+   * @generated from field: int32 next_offset = 2;
+   */
+  nextOffset: number;
+
+  /**
+   * Total count of entire list
+   *
+   * @generated from field: int32 total = 3;
+   */
+  total: number;
+};
+
+/**
+ * Describes the message virtru.common.PageResponse.
+ * Use `create(PageResponseSchema)` to create a new message.
+ */
+export const PageResponseSchema: GenMessage<PageResponse> = /*@__PURE__*/
+  messageDesc(file_virtru_common_common, 4);
+
+/**
+ * @generated from enum virtru.common.MetadataUpdateEnum
+ */
+export enum MetadataUpdateEnum {
+  /**
+   * @generated from enum value: METADATA_UPDATE_ENUM_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * @generated from enum value: METADATA_UPDATE_ENUM_EXTEND = 1;
+   */
+  EXTEND = 1,
+
+  /**
+   * @generated from enum value: METADATA_UPDATE_ENUM_REPLACE = 2;
+   */
+  REPLACE = 2,
+}
+
+/**
+ * Describes the enum virtru.common.MetadataUpdateEnum.
+ */
+export const MetadataUpdateEnumSchema: GenEnum<MetadataUpdateEnum> = /*@__PURE__*/
+  enumDesc(file_virtru_common_common, 0);
+

package/src/gen/virtru/policy/certificates/v1/certificates_connect.ts

@@ -0,0 +1,44 @@
+// @generated by protoc-gen-connect-es v1.6.1 with parameter "target=ts"
+// @generated from file virtru/policy/certificates/v1/certificates.proto (package virtru.policy.certificates.v1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import { AssignCertificateToNamespaceRequest, AssignCertificateToNamespaceResponse, ListCertificatesByNamespaceRequest, ListCertificatesByNamespaceResponse, RemoveCertificateFromNamespaceRequest, RemoveCertificateFromNamespaceResponse } from "./certificates_pb.js";
+import { MethodKind } from "@bufbuild/protobuf";
+
+/**
+ * @generated from service virtru.policy.certificates.v1.CertificateService
+ */
+export const CertificateService = {
+  typeName: "virtru.policy.certificates.v1.CertificateService",
+  methods: {
+    /**
+     * @generated from rpc virtru.policy.certificates.v1.CertificateService.ListCertificatesByNamespace
+     */
+    listCertificatesByNamespace: {
+      name: "ListCertificatesByNamespace",
+      I: ListCertificatesByNamespaceRequest,
+      O: ListCertificatesByNamespaceResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc virtru.policy.certificates.v1.CertificateService.AssignCertificateToNamespace
+     */
+    assignCertificateToNamespace: {
+      name: "AssignCertificateToNamespace",
+      I: AssignCertificateToNamespaceRequest,
+      O: AssignCertificateToNamespaceResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc virtru.policy.certificates.v1.CertificateService.RemoveCertificateFromNamespace
+     */
+    removeCertificateFromNamespace: {
+      name: "RemoveCertificateFromNamespace",
+      I: RemoveCertificateFromNamespaceRequest,
+      O: RemoveCertificateFromNamespaceResponse,
+      kind: MethodKind.Unary,
+    },
+  }
+} as const;
+