@virtru/dsp-sdk 0.3.0 → 0.3.2

package/src/lib/utils.test.ts

@@ -9,14 +9,14 @@ import { describe, it, expect, beforeEach, vi } from 'vitest';
 // Mock all @opentdf imports BEFORE importing utils
 vi.mock('@opentdf/sdk', () => ({
   AuthProviders: {
-    refreshAuthProvider: vi.fn()
+    refreshAuthProvider: vi.fn(),
   },
   OpenTDF: vi.fn(),
-  PermissionDeniedError: class PermissionDeniedError extends Error {}
+  PermissionDeniedError: class PermissionDeniedError extends Error {},
 }));
 
 vi.mock('@opentdf/sdk/platform', () => ({
-  PlatformClient: vi.fn()
+  PlatformClient: vi.fn(),
 }));
 
 vi.mock('@opentdf/sdk/platform/policy/objects_pb.js', () => ({
@@ -25,18 +25,19 @@ vi.mock('@opentdf/sdk/platform/policy/objects_pb.js', () => ({
     constructor(data?: any) {
       if (data) Object.assign(this, data);
     }
-  }
+  },
 }));
 
 vi.mock('@opentdf/sdk/platform/common/common_pb.js', () => ({
   ActiveStateEnum: {
-    ACTIVE: 1
-  }
+    ACTIVE: 1,
+  },
 }));
 
 // Polyfill atob if needed
 if (typeof (globalThis as any).atob === 'undefined') {
-  (globalThis as any).atob = (b64: string) => Buffer.from(b64, 'base64').toString('binary');
+  (globalThis as any).atob = (b64: string) =>
+    Buffer.from(b64, 'base64').toString('binary');
 }
 
 // Mock pkijs/asn1js with a way to control them
@@ -48,7 +49,13 @@ const mockState = {
 vi.mock('asn1js', () => ({
   fromBER: vi.fn((_: ArrayBuffer) => {
     if (mockState.asn1Mode === 'bad-der') return { offset: -1 };
-    return { offset: 0, result: { subject: { typesAndValues: [] }, issuer: { typesAndValues: [] } } };
+    return {
+      offset: 0,
+      result: {
+        subject: { typesAndValues: [] },
+        issuer: { typesAndValues: [] },
+      },
+    };
   }),
 }));
 
@@ -65,13 +72,13 @@ vi.mock('pkijs', () => {
       async verify() {
         return mockState.verifyResult;
       }
-    }
+    },
   };
 });
 
 // Mock DSPClient
 vi.mock('./client', () => ({
-  DSPClient: vi.fn()
+  DSPClient: vi.fn(),
 }));
 
 // NOW import utils
@@ -87,30 +94,35 @@ describe('validateJWSCertificateChain', () => {
   });
 
   it('throws error when x5c is empty', async () => {
-    await expect(validateJWSCertificateChain([], [{ pem: '---' }] as any))
-      .rejects.toThrow(/No certificates provided in x5c array/);
+    await expect(
+      validateJWSCertificateChain([], [{ pem: '---' }] as any)
+    ).rejects.toThrow(/No certificates provided in x5c array/);
   });
 
   it('throws error when too many certificates in x5c', async () => {
     const tooMany = new Array(11).fill('AQI=');
-    await expect(validateJWSCertificateChain(tooMany, [{ pem: '---' }] as any))
-      .rejects.toThrow(/Too many certificates in x5c/);
+    await expect(
+      validateJWSCertificateChain(tooMany, [{ pem: '---' }] as any)
+    ).rejects.toThrow(/Too many certificates in x5c/);
   });
 
   it('throws error when no trusted roots provided', async () => {
-    await expect(validateJWSCertificateChain(['AQI='], [] as any))
-      .rejects.toThrow(/No trusted root certificates provided/);
+    await expect(
+      validateJWSCertificateChain(['AQI='], [] as any)
+    ).rejects.toThrow(/No trusted root certificates provided/);
   });
 
   it('fails on invalid base64 in x5c', async () => {
-    await expect(validateJWSCertificateChain(['***not-base64***'], [{ pem: '---' }] as any))
-      .rejects.toThrow(/Failed to parse certificate at x5c\[0]/);
+    await expect(
+      validateJWSCertificateChain(['***not-base64***'], [{ pem: '---' }] as any)
+    ).rejects.toThrow(/Failed to parse certificate at x5c\[0]/);
   });
 
   it('fails on ASN.1 parse error', async () => {
     mockState.asn1Mode = 'bad-der';
-    await expect(validateJWSCertificateChain(['AQI='], [{ pem: '---' }] as any))
-      .rejects.toThrow(/Invalid DER encoding/);
+    await expect(
+      validateJWSCertificateChain(['AQI='], [{ pem: '---' }] as any)
+    ).rejects.toThrow(/Invalid DER encoding/);
   });
 
   it('returns valid true on successful verification', async () => {
@@ -123,7 +135,10 @@ describe('validateJWSCertificateChain', () => {
 
   it('returns warnings when some trusted roots fail to parse', async () => {
     const pem = '-----BEGIN CERTIFICATE-----\nAQI=\n-----END CERTIFICATE-----';
-    const res = await validateJWSCertificateChain(['AQI='], [{ pem: '' }, { pem }] as any);
+    const res = await validateJWSCertificateChain(['AQI='], [
+      { pem: '' },
+      { pem },
+    ] as any);
     expect(res.valid).toBe(true);
     expect(res.validationResult.warnings).toHaveLength(1);
     expect(res.validationResult.warnings[0]).toMatch(/has no PEM data/);
@@ -166,7 +181,9 @@ describe('getTrustedCertificates', () => {
       updateClientPublicKey: vi.fn().mockResolvedValue(undefined),
     };
 
-    (AuthProviders.refreshAuthProvider as any).mockResolvedValue(mockAuthProvider);
+    (AuthProviders.refreshAuthProvider as any).mockResolvedValue(
+      mockAuthProvider
+    );
 
     // Mock certificate service
     mockCertificateService = {
@@ -211,9 +228,11 @@ describe('getTrustedCertificates', () => {
 
     expect(result).toHaveLength(2);
     expect(result).toEqual([mockCertificate1, mockCertificate2]);
-    expect(mockCertificateService.listCertificatesByNamespace).toHaveBeenCalledWith({
+    expect(
+      mockCertificateService.listCertificatesByNamespace
+    ).toHaveBeenCalledWith({
       namespaceId: 'namespace-1',
-      pagination: { limit: (100), offset: (0) },
+      pagination: { limit: 100, offset: 0 },
     });
   });
 
@@ -229,18 +248,20 @@ describe('getTrustedCertificates', () => {
     mockCertificateService.listCertificatesByNamespace
       .mockResolvedValueOnce({
         certificates: [mockCert1, mockCert2],
-        pagination: { nextOffset: (0) },
+        pagination: { nextOffset: 0 },
       })
       .mockResolvedValueOnce({
         certificates: [mockCert3],
-        pagination: { nextOffset: (0) },
+        pagination: { nextOffset: 0 },
       });
 
     const result = await getTrustedCertificates(mockOptions);
 
     expect(result).toHaveLength(3);
     expect(result).toEqual([mockCert1, mockCert2, mockCert3]);
-    expect(mockCertificateService.listCertificatesByNamespace).toHaveBeenCalledTimes(2);
+    expect(
+      mockCertificateService.listCertificatesByNamespace
+    ).toHaveBeenCalledTimes(2);
   });
 
   it('handles pagination correctly (multiple pages)', async () => {
@@ -256,26 +277,32 @@ describe('getTrustedCertificates', () => {
     mockCertificateService.listCertificatesByNamespace
       .mockResolvedValueOnce({
         certificates: [mockCert1, mockCert2],
-        pagination: { nextOffset: (100) },
+        pagination: { nextOffset: 100 },
       })
       // Second page
       .mockResolvedValueOnce({
         certificates: [mockCert3],
-        pagination: { nextOffset: (0) },
+        pagination: { nextOffset: 0 },
       });
 
     const result = await getTrustedCertificates(mockOptions);
 
     expect(result).toHaveLength(3);
     expect(result).toEqual([mockCert1, mockCert2, mockCert3]);
-    expect(mockCertificateService.listCertificatesByNamespace).toHaveBeenCalledTimes(2);
-    expect(mockCertificateService.listCertificatesByNamespace).toHaveBeenNthCalledWith(1, {
+    expect(
+      mockCertificateService.listCertificatesByNamespace
+    ).toHaveBeenCalledTimes(2);
+    expect(
+      mockCertificateService.listCertificatesByNamespace
+    ).toHaveBeenNthCalledWith(1, {
       namespaceId: 'namespace-1',
-      pagination: { limit: (100), offset: (0) },
+      pagination: { limit: 100, offset: 0 },
     });
-    expect(mockCertificateService.listCertificatesByNamespace).toHaveBeenNthCalledWith(2, {
+    expect(
+      mockCertificateService.listCertificatesByNamespace
+    ).toHaveBeenNthCalledWith(2, {
       namespaceId: 'namespace-1',
-      pagination: { limit: (100), offset: (100) },
+      pagination: { limit: 100, offset: 100 },
     });
   });
 
@@ -286,7 +313,7 @@ describe('getTrustedCertificates', () => {
 
     mockCertificateService.listCertificatesByNamespace.mockResolvedValue({
       certificates: [],
-      pagination: { nextOffset: (0) },
+      pagination: { nextOffset: 0 },
     });
 
     const result = await getTrustedCertificates(mockOptions);
@@ -304,7 +331,9 @@ describe('getTrustedCertificates', () => {
       new Error('Certificate service error')
     );
 
-    await expect(getTrustedCertificates(mockOptions)).rejects.toThrow('Certificate service error');
+    await expect(getTrustedCertificates(mockOptions)).rejects.toThrow(
+      'Certificate service error'
+    );
   });
 
   it('handles errors from namespace listing', async () => {
@@ -312,7 +341,9 @@ describe('getTrustedCertificates', () => {
       new Error('Namespace listing error')
     );
 
-    await expect(getTrustedCertificates(mockOptions)).rejects.toThrow('Namespace listing error');
+    await expect(getTrustedCertificates(mockOptions)).rejects.toThrow(
+      'Namespace listing error'
+    );
   });
 
   it('initializes auth provider correctly', async () => {
@@ -353,7 +384,9 @@ describe('getTrustedCertificates', () => {
   });
 
   it('returns same Certificate type compatible with validateJWSCertificateChain', async () => {
-    const mockCert = { pem: '-----BEGIN CERTIFICATE-----\nAQI=\n-----END CERTIFICATE-----' };
+    const mockCert = {
+      pem: '-----BEGIN CERTIFICATE-----\nAQI=\n-----END CERTIFICATE-----',
+    };
 
     mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
       namespaces: [{ id: 'namespace-1' }],
@@ -361,7 +394,7 @@ describe('getTrustedCertificates', () => {
 
     mockCertificateService.listCertificatesByNamespace.mockResolvedValue({
       certificates: [mockCert],
-      pagination: { nextOffset: (0) },
+      pagination: { nextOffset: 0 },
     });
 
     const result = await getTrustedCertificates(mockOptions);
@@ -370,7 +403,10 @@ describe('getTrustedCertificates', () => {
     expect(result[0].pem).toBeDefined();
 
     // Integration test: verify compatibility with validateJWSCertificateChain
-    const validationResult = await validateJWSCertificateChain(['AQI='], result);
+    const validationResult = await validateJWSCertificateChain(
+      ['AQI='],
+      result
+    );
     expect(validationResult.valid).toBe(true);
   });
 });

package/src/lib/utils.ts

@@ -4,16 +4,21 @@
  * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
  */
 
-import type {AuthProvider} from '@opentdf/sdk';
-import {AuthProviders, OpenTDF, PermissionDeniedError, type Source} from '@opentdf/sdk';
-import {PlatformClient} from '@opentdf/sdk/platform';
-import {ActiveStateEnum} from '@opentdf/sdk/platform/common/common_pb.js';
-import type {Certificate} from '../gen/virtru/policy/objects_pb';
-import type {Interceptor as Inter} from '@connectrpc/connect';
+import type { AuthProvider } from '@opentdf/sdk';
+import {
+  AuthProviders,
+  OpenTDF,
+  PermissionDeniedError,
+  type Source,
+} from '@opentdf/sdk';
+import { PlatformClient } from '@opentdf/sdk/platform';
+import { ActiveStateEnum } from '@opentdf/sdk/platform/common/common_pb.js';
+import type { Certificate } from '../gen/virtru/policy/objects_pb';
+import type { Interceptor as Inter } from '@connectrpc/connect';
 import * as asn1js from 'asn1js';
 import * as pkijs from 'pkijs';
-import {MAX_CERT_BYTES, MAX_CERTS} from "./consts";
-import {DSPClient} from './client';
+import { MAX_CERT_BYTES, MAX_CERTS } from './consts';
+import { DSPClient } from './client';
 
 export type Interceptor = Inter;
 
@@ -160,20 +165,27 @@ export async function getUserEntitlements(options: {
     refreshToken: options.refreshToken,
   });
   const accessToken = await authProvider.oidcAuth.get();
-  const userEntitlementsResponse = await fetch(`${options.platformEndpoint}/shared/entitlements`, {
-    body: JSON.stringify({}),
-    headers: {
-      Authorization: `Bearer ${accessToken}`,
-      'Content-Type': 'application/json',
-    },
-    method: 'POST',
-  });
+  const userEntitlementsResponse = await fetch(
+    `${options.platformEndpoint}/shared/entitlements`,
+    {
+      body: JSON.stringify({}),
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        'Content-Type': 'application/json',
+      },
+      method: 'POST',
+    }
+  );
 
   return (await userEntitlementsResponse.json()) as GetUserEntitlementsResponse;
 }
 
-export const flattenObligations = (obligations: SupportedObligations): string[] =>
-  Object.values(obligations).flatMap((feature: ObligationFeatureMap) => feature?.fully_qualified_names || []);
+export const flattenObligations = (
+  obligations: SupportedObligations
+): string[] =>
+  Object.values(obligations).flatMap(
+    (feature: ObligationFeatureMap) => feature?.fully_qualified_names || []
+  );
 
 /**
  * Helper function to retrieve certificates for a specific namespace with pagination handling.
@@ -195,10 +207,11 @@ async function getCertificatesForNamespace(
   const limit = 100;
 
   while (true) {
-    const response = await dspClient.v1.certificateService.listCertificatesByNamespace({
-      namespaceId,
-      pagination: { limit, offset },
-    });
+    const response =
+      await dspClient.v1.certificateService.listCertificatesByNamespace({
+        namespaceId,
+        pagination: { limit, offset },
+      });
 
     if (response.certificates?.length > 0) {
       certificates.push(...response.certificates);
@@ -304,7 +317,6 @@ export async function getTrustedCertificates(options: {
       certificates.push(...namespaceCerts);
     }
   } catch (error) {
-    console.error('Error retrieving namespace certificates:', error);
     throw error;
   }
 
@@ -314,7 +326,9 @@ export async function getTrustedCertificates(options: {
 /**
  * Helper to get a string representation of a pkijs Name.
  */
-function getNameStringSafe(name: pkijs.RelativeDistinguishedNames | undefined): string {
+function getNameStringSafe(
+  name: pkijs.RelativeDistinguishedNames | undefined
+): string {
   if (!name) return '';
   try {
     // pkijs Name to string can be derived from typesAndValues
@@ -354,7 +368,9 @@ function base64ToArrayBuffer(b64: string): ArrayBuffer {
     throw new Error('Empty base64 data');
   }
   if (approxBytes > MAX_CERT_BYTES) {
-    throw new Error(`Certificate exceeds maximum allowed size of ${MAX_CERT_BYTES} bytes`);
+    throw new Error(
+      `Certificate exceeds maximum allowed size of ${MAX_CERT_BYTES} bytes`
+    );
   }
   const binaryString = atob(normalized);
   const bytes = new Uint8Array(binaryString.length);
@@ -419,7 +435,10 @@ export async function validateJWSCertificateChain(
     if (x5c.length > MAX_CERTS) {
       throw new Error(`Too many certificates in x5c (max ${MAX_CERTS})`);
     }
-    if (!Array.isArray(trustedRootCertificates) || trustedRootCertificates.length === 0) {
+    if (
+      !Array.isArray(trustedRootCertificates) ||
+      trustedRootCertificates.length === 0
+    ) {
       throw new Error('No trusted root certificates provided');
     }
 
@@ -480,8 +499,12 @@ export async function validateJWSCertificateChain(
       const leaf = chainCertificates[0];
       const leafSubject = getNameStringSafe(leaf.subject);
       const leafIssuer = getNameStringSafe(leaf.issuer);
-      const baseMsg = verificationResult.resultMessage || 'Certificate chain validation failed';
-      throw new Error(`${baseMsg} (leaf subject='${leafSubject}', issuer='${leafIssuer}')`);
+      const baseMsg =
+        verificationResult.resultMessage ||
+        'Certificate chain validation failed';
+      throw new Error(
+        `${baseMsg} (leaf subject='${leafSubject}', issuer='${leafIssuer}')`
+      );
     }
 
     return {
@@ -493,7 +516,9 @@ export async function validateJWSCertificateChain(
     };
   } catch (error) {
     const msg = error instanceof Error ? error.message : 'Unknown error';
-    const warnSuffix = warnings.length ? `; warnings: ${warnings.join(' | ')}` : '';
+    const warnSuffix = warnings.length
+      ? `; warnings: ${warnings.join(' | ')}`
+      : '';
     throw new Error(`Validation error: ${msg}${warnSuffix}`);
   }
 }

package/tests/dsp.test.ts

@@ -70,8 +70,8 @@ test('should create a new DSP instance with platformUrl', () => {
 });
 
 test('should throw an error if platformUrl is not provided', () => {
-  expect(() => new DSP({} as never)).toThrowError(
-    'Client ID or custom AuthProvider must be defined'
+  expect(() => new DSP({ authProvider } as never)).toThrowError(
+    'platformUrl is required for DSP client'
   );
 });
 
@@ -117,7 +117,3 @@ test('should throw if authProvider is missing', () => {
     'Client ID or custom AuthProvider must be defined'
   );
 });
-
-test('should throw an error if platformUrl is not provided', async () => {
-  expect(() => new DSP({} as never)).toThrowError();
-});

package/update-protos.sh

@@ -0,0 +1,63 @@
+#!/bin/bash
+
+set -e
+
+REPO_URL="git@github.com:virtru-corp/data-security-platform.git"
+CLONE_DIR=".dsp"
+DEST_DIR="src/gen/"
+FILES_TO_COPY="sdk_web/src/gen/"
+
+echo "Cloning repository..."
+if test -d "$CLONE_DIR"; then
+  echo "Repo exists? Try: rm -rf '$CLONE_DIR'"
+  exit 1
+fi
+git clone --depth=1 "$REPO_URL" "$CLONE_DIR"
+
+echo "Updating repo buf.gen.yaml to generate for dsp-sdk..."
+echo >>"$CLONE_DIR/buf.gen.yaml"
+# Copy buf.gen.yaml over to our cloned reposiroty, modifying it to output to our src/gen/ directory
+sed '1,/plugins:/d' buf.gen.yaml | sed 's# src/gen# ../src/gen#' >>"$CLONE_DIR/buf.gen.yaml"
+
+pushd "$CLONE_DIR"
+
+echo "Generating protos..."
+make proto-generate
+
+popd
+
+echo "Removing repo..."
+rm -rf "$CLONE_DIR"
+
+
+echo "Prepending copyright headers to TypeScript files..."
+VIRTRU_LICENSE=$(cat <<EOF
+/*
+ * Copyright (c) Virtru Corporation.  All rights reserved.
+ *
+ * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
+ */
+EOF
+)
+
+# Find all .ts files and loop through them
+git status --porcelain | grep -E '(M|A)' | cut -b 4- | sed "s#^#$(git rev-parse --show-toplevel)/#" | sed "s#^$(pwd)/##" | sort | uniq | grep "$DEST_DIR" | while read -r ts_file; do
+    echo "Processing $ts_file..."
+    TMPFILE="${ts_file}.tmp"
+
+    # Prepend header: Concatenate header + original file -> temp file, then move back
+    rm -f "$TMPFILE"
+    touch "$TMPFILE"
+    echo "$VIRTRU_LICENSE" >$TMPFILE
+    echo >>$TMPFILE
+    cat "$ts_file" >>"$TMPFILE"
+    mv "$TMPFILE" "$ts_file"
+done
+
+echo "Re-adding to stage, for prettier..."
+git add src/gen
+
+echo "Running prettier..."
+rush prettier
+
+echo "Protos updated successfully!"