@virtru/dsp-sdk 0.5.0 → 0.6.0

package/tests/dsp.test.ts

@@ -1,119 +0,0 @@
-/*
- * Copyright (c) Virtru Corporation.  All rights reserved.
- *
- * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
- */
-
-import { expect, test, vi, beforeEach } from 'vitest';
-import { DSP } from '../src';
-import { mockTaggingPDPResponse } from './mocks/tagging-pdp-tag';
-import { type AuthProvider, HttpRequest, withHeaders } from '@opentdf/sdk';
-import { mockWellKnownConfiguration } from './mocks/well-known-configuration';
-
-const platformUrl = 'https://dsp.example.com';
-
-// Mock fetch globally
-const mockFetch = vi.fn();
-global.fetch = mockFetch;
-
-const authProvider = <AuthProvider>{
-  updateClientPublicKey: async () => {},
-  withCreds: async (req: HttpRequest): Promise<HttpRequest> =>
-    withHeaders(req, {
-      Authorization: 'Bearer dummy auth token for testing purposes',
-    }),
-};
-
-beforeEach(() => {
-  mockFetch.mockReset();
-
-  // Setup default mock responses
-  mockFetch.mockImplementation(async (url: string) => {
-    if (url.includes('/tagging.pdp.v2.TaggingPDPService/Tag')) {
-      return {
-        ok: true,
-        status: 200,
-        json: async () => mockTaggingPDPResponse(),
-        headers: new Headers({
-          'Content-Type': 'application/json',
-        }),
-      };
-    }
-
-    if (
-      url.includes(
-        '/wellknownconfiguration.WellKnownService/GetWellKnownConfiguration'
-      )
-    ) {
-      return {
-        ok: true,
-        status: 200,
-        json: async () => mockWellKnownConfiguration(),
-        headers: new Headers({
-          'Content-Type': 'application/json',
-        }),
-      };
-    }
-
-    return {
-      ok: false,
-      status: 404,
-      json: async () => ({}),
-      headers: new Headers(),
-    };
-  });
-});
-
-test('should create a new DSP instance with platformUrl', () => {
-  const dsp = new DSP({ platformUrl, authProvider });
-  expect(dsp).toBeInstanceOf(DSP);
-});
-
-test('should throw an error if platformUrl is not provided', () => {
-  expect(() => new DSP({ authProvider } as never)).toThrowError(
-    'platformUrl is required for DSP client'
-  );
-});
-
-test('should create a new DSP instance with platformUrl and authProvider', () => {
-  const dsp = new DSP({ platformUrl, authProvider });
-  expect(dsp).toBeInstanceOf(DSP);
-});
-
-test('should perform RPC calls using the DSP client service', async () => {
-  const dsp = new DSP({ platformUrl, authProvider });
-  const result = await dsp.services.v2.taggingPDPService.tag({});
-  expect(result.$typeName).toBe('tagging.pdp.v2.TaggingPDPResponse');
-});
-
-test('should perform RPC calls via internal PlatformClient service', async () => {
-  const dsp = new DSP({ platformUrl, authProvider });
-  const result = await dsp.services.v1.wellknown.getWellKnownConfiguration({});
-  expect(result.$typeName).toBe(
-    'wellknownconfiguration.GetWellKnownConfigurationResponse'
-  );
-});
-
-test('should use provided interceptors when making RPC calls', async () => {
-  const mockInterceptor = vi.fn((next) => next);
-  const dsp = new DSP({
-    platformUrl,
-    authProvider,
-    interceptors: [mockInterceptor],
-  });
-  await dsp.services.v2.taggingPDPService.tag({});
-  expect(mockInterceptor).toHaveBeenCalled();
-});
-
-test('should expose expected service structure', () => {
-  const dsp = new DSP({ platformUrl, authProvider });
-  expect(dsp.services).toHaveProperty('v1');
-  expect(dsp.services.v2).toHaveProperty('taggingPDPService');
-  expect(dsp.services.v1).toHaveProperty('wellknown');
-});
-
-test('should throw if authProvider is missing', () => {
-  expect(() => new DSP({ platformUrl } as never)).toThrowError(
-    'Client ID or custom AuthProvider must be defined'
-  );
-});

package/tests/fips-crypto.unit.test.ts

@@ -1,412 +0,0 @@
-/*
- * Copyright (c) Virtru Corporation.  All rights reserved.
- *
- * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
- */
-
-import { expect, test, beforeAll, afterAll, describe } from 'vitest';
-import {
-  type KeyPair,
-  type PublicKey,
-  type PrivateKey,
-  Binary,
-} from '@opentdf/sdk/singlecontainer';
-import {
-  FipsCryptoService,
-  unwrapPublicKey,
-  unwrapPrivateKey,
-  importPrivateKey,
-  exportPrivateKeyPem,
-} from '../src/lib/fips-crypto-service';
-
-describe('FIPS CryptoService - Methods', () => {
-  // RSA key slots are finite in the WASM keystore. Each describe group that
-  // uses RSA keys creates ONE shared key pair in beforeAll and releases it in
-  // afterAll so slots are reclaimed before the next group starts.
-
-  describe('sign and verify (asymmetric)', () => {
-    let keyPair: KeyPair;
-    beforeAll(async () => {
-      keyPair = await FipsCryptoService.generateSigningKeyPair();
-    }, 60000);
-    afterAll(() => {
-      unwrapPublicKey(keyPair.publicKey).release();
-    });
-
-    test('should sign and verify with RS256', async () => {
-      const data = new Uint8Array([1, 2, 3, 4, 5]);
-      const signature = await FipsCryptoService.sign(
-        data,
-        keyPair.privateKey,
-        'RS256'
-      );
-      const isValid = await FipsCryptoService.verify(
-        data,
-        signature,
-        keyPair.publicKey,
-        'RS256'
-      );
-      expect(isValid).toBe(true);
-    });
-
-    test('should reject tampered data', async () => {
-      const data = new Uint8Array([1, 2, 3, 4, 5]);
-      const signature = await FipsCryptoService.sign(
-        data,
-        keyPair.privateKey,
-        'RS256'
-      );
-      const tamperedData = new Uint8Array([1, 2, 3, 4, 6]);
-      const isValid = await FipsCryptoService.verify(
-        tamperedData,
-        signature,
-        keyPair.publicKey,
-        'RS256'
-      );
-      expect(isValid).toBe(false);
-    });
-
-    test('should throw error for ES256 (EC not supported)', async () => {
-      await expect(
-        FipsCryptoService.sign(
-          new Uint8Array([1, 2, 3, 4]),
-          keyPair.privateKey,
-          'ES256'
-        )
-      ).rejects.toThrow('not supported in FIPS mode');
-    });
-
-    test('encryption key pair (RSA-OAEP) should not be usable for signing', async () => {
-      // Catches algorithm mismatch: if generateKeyPair() incorrectly used
-      // RSASSA-PKCS1-v1_5 params, signing would succeed here instead of throwing.
-      const encKeyPair = await FipsCryptoService.generateKeyPair();
-      await expect(
-        FipsCryptoService.sign(
-          new Uint8Array([1, 2, 3]),
-          encKeyPair.privateKey,
-          'RS256'
-        )
-      ).rejects.toThrow();
-      unwrapPublicKey(encKeyPair.publicKey).release();
-      unwrapPrivateKey(encKeyPair.privateKey).release();
-    });
-  });
-
-  describe('hmac and verifyHmac', () => {
-    test('should compute and verify HMAC-SHA256', async () => {
-      const crypto = FipsCryptoService;
-      const keyBytes = await crypto.randomBytes(32);
-      const symKey = await crypto.importSymmetricKey(keyBytes);
-      const data = new Uint8Array([1, 2, 3, 4, 5]);
-      const signature = await crypto.hmac(data, symKey);
-      const isValid = await crypto.verifyHmac(data, signature, symKey);
-      expect(isValid).toBe(true);
-    });
-
-    test('should reject invalid signature', async () => {
-      const crypto = FipsCryptoService;
-      const symKey = await crypto.generateKey(32);
-      const data = new Uint8Array([1, 2, 3, 4]);
-      const signature = await crypto.hmac(data, symKey);
-      signature[0] ^= 1; // Flip a bit
-      const isValid = await crypto.verifyHmac(data, signature, symKey);
-      expect(isValid).toBe(false);
-    });
-
-    test('should reject signature with wrong key', async () => {
-      const crypto = FipsCryptoService;
-      const symKey1 = await crypto.importSymmetricKey(
-        await crypto.randomBytes(32)
-      );
-      const symKey2 = await crypto.importSymmetricKey(
-        await crypto.randomBytes(32)
-      );
-      const data = new Uint8Array([1, 2, 3, 4]);
-      const signature = await crypto.hmac(data, symKey1);
-      const isValid = await crypto.verifyHmac(data, signature, symKey2);
-      expect(isValid).toBe(false);
-    });
-  });
-
-  describe('digest', () => {
-    test('should compute SHA-256 hash', async () => {
-      const data = new Uint8Array([1, 2, 3, 4]);
-      const hash = await FipsCryptoService.digest('SHA-256', data);
-      expect(hash).toBeInstanceOf(Uint8Array);
-      expect(hash.byteLength).toBe(32);
-    });
-
-    test('should produce consistent hashes', async () => {
-      const data = new Uint8Array([1, 2, 3, 4]);
-      const hash1 = await FipsCryptoService.digest('SHA-256', data);
-      const hash2 = await FipsCryptoService.digest('SHA-256', data);
-      expect(hash1).toEqual(hash2);
-    });
-
-    test('should throw error for SHA-384 (not supported)', async () => {
-      await expect(
-        FipsCryptoService.digest('SHA-384', new Uint8Array([1, 2, 3, 4]))
-      ).rejects.toThrow('not supported in FIPS mode');
-    });
-  });
-
-  describe('EC placeholder methods', () => {
-    test('should throw error for generateECKeyPair', async () => {
-      await expect(FipsCryptoService.generateECKeyPair()).rejects.toThrow(
-        'not supported in FIPS mode'
-      );
-    });
-
-    test('should throw error for deriveKeyFromECDH', async () => {
-      await expect(
-        FipsCryptoService.deriveKeyFromECDH({} as PrivateKey, {} as PublicKey, {
-          hash: 'SHA-256',
-          salt: new Uint8Array(),
-        })
-      ).rejects.toThrow('not supported in FIPS mode');
-    });
-  });
-
-  describe('exportPublicKeyPem', () => {
-    let keyPair: KeyPair;
-    beforeAll(async () => {
-      keyPair = await FipsCryptoService.generateKeyPair();
-    }, 60000);
-    afterAll(() => {
-      unwrapPublicKey(keyPair.publicKey).release();
-    });
-
-    test('should export generated public key to PEM', async () => {
-      const pem = await FipsCryptoService.exportPublicKeyPem(keyPair.publicKey);
-      expect(pem).toContain('-----BEGIN PUBLIC KEY-----');
-      expect(pem).toContain('-----END PUBLIC KEY-----');
-    });
-  });
-
-  describe('importPublicKey', () => {
-    let keyPair: KeyPair;
-    let importedKey: PublicKey;
-    beforeAll(async () => {
-      const crypto = FipsCryptoService;
-      keyPair = await crypto.generateKeyPair(2048);
-      const pem = await crypto.exportPublicKeyPem(keyPair.publicKey);
-      importedKey = await crypto.importPublicKey(pem, { usage: 'encrypt' });
-    }, 60000);
-    afterAll(() => {
-      unwrapPublicKey(keyPair.publicKey).release();
-      unwrapPublicKey(importedKey).release();
-    });
-
-    test('should import PEM and detect RSA-2048', () => {
-      expect(importedKey.algorithm).toBe('rsa:2048');
-    });
-  });
-
-  describe('exportPublicKeyJwk', () => {
-    let keyPair: KeyPair;
-    beforeAll(async () => {
-      keyPair = await FipsCryptoService.generateKeyPair(2048);
-    }, 60000);
-    afterAll(() => {
-      unwrapPublicKey(keyPair.publicKey).release();
-    });
-
-    test('should export public key to JWK', async () => {
-      const jwk = await FipsCryptoService.exportPublicKeyJwk(keyPair.publicKey);
-      expect(jwk.kty).toBe('RSA');
-      expect(jwk.n).toBeDefined();
-      expect(jwk.e).toBeDefined();
-      expect(typeof jwk.n).toBe('string');
-      expect(typeof jwk.e).toBe('string');
-    });
-
-    test('should produce a JWK that round-trips back to SPKI', async () => {
-      const jwk = await FipsCryptoService.exportPublicKeyJwk(keyPair.publicKey);
-      const webKey = await globalThis.crypto.subtle.importKey(
-        'jwk',
-        jwk,
-        { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },
-        true,
-        ['verify']
-      );
-      const spki = await globalThis.crypto.subtle.exportKey('spki', webKey);
-      expect(spki.byteLength).toBeGreaterThan(0);
-    });
-  });
-
-  describe('encrypt and decrypt (symmetric AES-GCM)', () => {
-    test('should round-trip encrypt/decrypt', async () => {
-      const key = await FipsCryptoService.generateKey();
-      const iv = Binary.fromArrayBuffer(
-        (await FipsCryptoService.randomBytes(12)).buffer as ArrayBuffer
-      );
-      const plaintext = new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8]);
-      const { payload: cipher, authTag } = await FipsCryptoService.encrypt(
-        Binary.fromArrayBuffer(plaintext.buffer as ArrayBuffer),
-        key,
-        iv
-      );
-      const { payload: recovered } = await FipsCryptoService.decrypt(
-        cipher,
-        key,
-        iv,
-        undefined,
-        authTag
-      );
-      expect(new Uint8Array(recovered.asArrayBuffer())).toEqual(plaintext);
-    });
-
-    test('should produce different ciphertext for different IVs', async () => {
-      const key = await FipsCryptoService.generateKey();
-      const plaintext = Binary.fromArrayBuffer(
-        new Uint8Array([1, 2, 3, 4]).buffer as ArrayBuffer
-      );
-      const iv1 = Binary.fromArrayBuffer(
-        (await FipsCryptoService.randomBytes(12)).buffer as ArrayBuffer
-      );
-      const iv2 = Binary.fromArrayBuffer(
-        (await FipsCryptoService.randomBytes(12)).buffer as ArrayBuffer
-      );
-      const { payload: cipher1 } = await FipsCryptoService.encrypt(
-        plaintext,
-        key,
-        iv1
-      );
-      const { payload: cipher2 } = await FipsCryptoService.encrypt(
-        plaintext,
-        key,
-        iv2
-      );
-      expect(new Uint8Array(cipher1.asArrayBuffer())).not.toEqual(
-        new Uint8Array(cipher2.asArrayBuffer())
-      );
-    });
-  });
-
-  describe('encryptWithPublicKey and decryptWithPrivateKey (RSA-OAEP)', () => {
-    let keyPair: KeyPair;
-    beforeAll(async () => {
-      keyPair = await FipsCryptoService.generateKeyPair();
-    }, 60000);
-    afterAll(() => {
-      unwrapPublicKey(keyPair.publicKey).release();
-    });
-
-    test('should round-trip RSA encrypt/decrypt', async () => {
-      const plaintext = new Uint8Array([10, 20, 30, 40, 50]);
-      const encrypted = await FipsCryptoService.encryptWithPublicKey(
-        Binary.fromArrayBuffer(plaintext.buffer as ArrayBuffer),
-        keyPair.publicKey
-      );
-      const decrypted = await FipsCryptoService.decryptWithPrivateKey(
-        encrypted,
-        keyPair.privateKey
-      );
-      expect(new Uint8Array(decrypted.asArrayBuffer())).toEqual(plaintext);
-    });
-
-    test('should produce different ciphertext each call (RSA-OAEP is randomized)', async () => {
-      const payload = Binary.fromArrayBuffer(
-        new Uint8Array([1, 2, 3]).buffer as ArrayBuffer
-      );
-      const enc1 = await FipsCryptoService.encryptWithPublicKey(
-        payload,
-        keyPair.publicKey
-      );
-      const enc2 = await FipsCryptoService.encryptWithPublicKey(
-        payload,
-        keyPair.publicKey
-      );
-      expect(new Uint8Array(enc1.asArrayBuffer())).not.toEqual(
-        new Uint8Array(enc2.asArrayBuffer())
-      );
-    });
-
-    test('signing key pair (RSASSA-PKCS1-v1_5) should not be usable for encryption', async () => {
-      // Catches algorithm mismatch: if generateSigningKeyPair() incorrectly used
-      // RSA-OAEP params, encryption would succeed here instead of throwing.
-      const signingKp = await FipsCryptoService.generateSigningKeyPair();
-      await expect(
-        FipsCryptoService.encryptWithPublicKey(
-          Binary.fromArrayBuffer(
-            new Uint8Array([1, 2, 3]).buffer as ArrayBuffer
-          ),
-          signingKp.publicKey
-        )
-      ).rejects.toThrow();
-      unwrapPublicKey(signingKp.publicKey).release();
-      unwrapPrivateKey(signingKp.privateKey).release();
-    });
-  });
-
-  describe('importPrivateKey and exportPrivateKeyPem', () => {
-    let privKey: PrivateKey;
-    beforeAll(async () => {
-      const kp = await globalThis.crypto.subtle.generateKey(
-        {
-          name: 'RSASSA-PKCS1-v1_5',
-          modulusLength: 2048,
-          publicExponent: new Uint8Array([1, 0, 1]),
-          hash: 'SHA-256',
-        },
-        true,
-        ['sign', 'verify']
-      );
-      const pkcs8 = await globalThis.crypto.subtle.exportKey(
-        'pkcs8',
-        kp.privateKey
-      );
-      const b64 = btoa(String.fromCharCode(...new Uint8Array(pkcs8)));
-      const pem = `-----BEGIN PRIVATE KEY-----\n${b64
-        .match(/.{1,64}/g)!
-        .join('\n')}\n-----END PRIVATE KEY-----`;
-      privKey = await importPrivateKey(pem, {
-        usage: 'sign',
-        extractable: true,
-      });
-    }, 60000);
-    afterAll(() => {
-      unwrapPrivateKey(privKey).release();
-    });
-
-    test('should import PKCS#8 PEM private key', () => {
-      expect(privKey.algorithm).toBe('rsa:2048');
-    });
-
-    test('should export imported private key back to PEM', async () => {
-      const exported = await exportPrivateKeyPem(privKey);
-      expect(exported).toContain('-----BEGIN PRIVATE KEY-----');
-      expect(exported).toContain('-----END PRIVATE KEY-----');
-    });
-  });
-
-  describe('splitSymmetricKey and mergeSymmetricKeys', () => {
-    test('splitSymmetricKey with 1 share returns the same key (single-KAS identity)', async () => {
-      const key = await FipsCryptoService.generateKey();
-      const shares = await FipsCryptoService.splitSymmetricKey(key, 1);
-      expect(shares).toHaveLength(1);
-      expect(shares[0]).toBe(key);
-    });
-
-    test('mergeSymmetricKeys with 1 share returns the same key (single-KAS identity)', async () => {
-      const key = await FipsCryptoService.generateKey();
-      const merged = await FipsCryptoService.mergeSymmetricKeys([key]);
-      expect(merged).toBe(key);
-    });
-
-    test('splitSymmetricKey with 2 shares throws (multi-KAS not yet supported)', async () => {
-      const key = await FipsCryptoService.generateKey();
-      await expect(FipsCryptoService.splitSymmetricKey(key, 2)).rejects.toThrow(
-        'not yet supported in FIPS mode'
-      );
-    });
-
-    test('mergeSymmetricKeys with 2 shares throws (multi-KAS not yet supported)', async () => {
-      const key1 = await FipsCryptoService.generateKey();
-      const key2 = await FipsCryptoService.generateKey();
-      await expect(
-        FipsCryptoService.mergeSymmetricKeys([key1, key2])
-      ).rejects.toThrow('not yet supported in FIPS mode');
-    });
-  });
-});

package/tests/mocks/create-export-artifacts.ts

@@ -1,16 +0,0 @@
-/*
- * Copyright (c) Virtru Corporation.  All rights reserved.
- *
- * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
- */
-
-import { type CreateExportArtifactsResponse } from '@src/gen/policyimportexport/v1/policy_import_export_pb';
-
-export const mockCreateExportArtifactsResponse =
-  (): CreateExportArtifactsResponse => ({
-    $typeName: 'policyimportexport.v1.CreateExportArtifactsResponse',
-    artifact: {
-      case: undefined,
-      value: undefined,
-    },
-  });

package/tests/mocks/tagging-pdp-tag.ts

@@ -1,13 +0,0 @@
-/*
- * Copyright (c) Virtru Corporation.  All rights reserved.
- *
- * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
- */
-
-import { type TaggingPDPResponse } from '@src/gen/tagging/pdp/v2/tagging_pb';
-
-export const mockTaggingPDPResponse = (): TaggingPDPResponse => ({
-  $typeName: 'tagging.pdp.v2.TaggingPDPResponse',
-  events: [],
-  tags: [],
-});

package/tests/mocks/well-known-configuration.ts

@@ -1,15 +0,0 @@
-/*
- * Copyright (c) Virtru Corporation.  All rights reserved.
- *
- * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
- */
-
-import { type GetWellKnownConfigurationResponse } from '@opentdf/sdk/platform/wellknownconfiguration/wellknown_configuration_pb.js';
-
-export const mockWellKnownConfiguration =
-  (): GetWellKnownConfigurationResponse => ({
-    $typeName: 'wellknownconfiguration.GetWellKnownConfigurationResponse',
-    configuration: {
-      wellKnown: {},
-    },
-  });

package/tests/setup-msw.ts

@@ -1,35 +0,0 @@
-/*
- * Copyright (c) Virtru Corporation.  All rights reserved.
- *
- * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
- */
-
-import { type SetupWorker, setupWorker } from 'msw/browser';
-import { beforeAll, afterEach, afterAll } from 'vitest';
-import { HttpHandler } from 'msw';
-
-let worker: SetupWorker | undefined;
-
-/**
- * Sets up the MSW (Mock Service Worker) for testing.
- *
- * @param handlers - An array of HTTP handlers to be used with MSW.
- * @returns The MSW worker instance.
- */
-export function setupMSW(handlers: HttpHandler[]): SetupWorker | undefined {
-  if (!worker) {
-    worker = setupWorker(...handlers);
-
-    beforeAll(async () => {
-      await worker!.start();
-    });
-
-    afterEach(() => worker!.resetHandlers());
-    afterAll(() => worker!.stop());
-  } else {
-    // If worker already exists, just update handlers
-    worker.resetHandlers(...handlers);
-  }
-
-  return worker;
-}