@virtru/dsp-sdk 0.5.0 → 0.7.0

package/src/gen/web-admin/v1/config_pb.ts

@@ -1,173 +0,0 @@
-/*
- * Copyright (c) Virtru Corporation.  All rights reserved.
- *
- * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
- */
-
-// @generated by protoc-gen-es v2.3.0 with parameter "target=ts"
-// @generated from file web-admin/v1/config.proto (package webadmin.v1, syntax proto3)
-/* eslint-disable */
-
-import type {
-  GenFile,
-  GenMessage,
-  GenService,
-} from '@bufbuild/protobuf/codegenv1';
-import {
-  fileDesc,
-  messageDesc,
-  serviceDesc,
-} from '@bufbuild/protobuf/codegenv1';
-import type { Timestamp } from '@bufbuild/protobuf/wkt';
-import { file_google_protobuf_timestamp } from '@bufbuild/protobuf/wkt';
-import type { Message } from '@bufbuild/protobuf';
-
-/**
- * Describes the file web-admin/v1/config.proto.
- */
-export const file_web_admin_v1_config: GenFile =
-  /*@__PURE__*/
-  fileDesc(
-    'Chl3ZWItYWRtaW4vdjEvY29uZmlnLnByb3RvEgt3ZWJhZG1pbi52MSInCgpDb25maWdJdGVtEgoKAmlkGAEgASgJEg0KBXZhbHVlGAIgASgMIhYKFExpc3RBbGxDb25maWdSZXF1ZXN0IkEKFUxpc3RBbGxDb25maWdSZXNwb25zZRIoCgdjb25maWdzGAEgAygLMhcud2ViYWRtaW4udjEuQ29uZmlnSXRlbSJNChdIYXNDb25maWdDaGFuZ2VzUmVxdWVzdBIyCg5sYXN0X2xvYWRlZF9hdBgBIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiLwoYSGFzQ29uZmlnQ2hhbmdlc1Jlc3BvbnNlEhMKC2hhc19jaGFuZ2VzGAEgASgIMswBCg1Db25maWdTZXJ2aWNlElgKDUxpc3RBbGxDb25maWcSIS53ZWJhZG1pbi52MS5MaXN0QWxsQ29uZmlnUmVxdWVzdBoiLndlYmFkbWluLnYxLkxpc3RBbGxDb25maWdSZXNwb25zZSIAEmEKEEhhc0NvbmZpZ0NoYW5nZXMSJC53ZWJhZG1pbi52MS5IYXNDb25maWdDaGFuZ2VzUmVxdWVzdBolLndlYmFkbWluLnYxLkhhc0NvbmZpZ0NoYW5nZXNSZXNwb25zZSIAQr0BCg9jb20ud2ViYWRtaW4udjFCC0NvbmZpZ1Byb3RvUAFaUGdpdGh1Yi5jb20vdmlydHJ1LWNvcnAvZGF0YS1zZWN1cml0eS1wbGF0Zm9ybS9zZGsvdjIvZ2VuL3dlYi1hZG1pbi92MTt3ZWJhZG1pbnYxogIDV1hYqgILV2ViYWRtaW4uVjHKAgtXZWJhZG1pblxWMeICF1dlYmFkbWluXFYxXEdQQk1ldGFkYXRh6gIMV2ViYWRtaW46OlYxYgZwcm90bzM',
-    [file_google_protobuf_timestamp]
-  );
-
-/**
- * A single configuration item.
- *
- * @generated from message webadmin.v1.ConfigItem
- */
-export type ConfigItem = Message<'webadmin.v1.ConfigItem'> & {
-  /**
-   * The dot-separated key for the config value (e.g. auth.enabled).
-   *
-   * @generated from field: string id = 1;
-   */
-  id: string;
-
-  /**
-   * JSONB representation of the configuration value, returned as bytes.
-   *
-   * @generated from field: bytes value = 2;
-   */
-  value: Uint8Array;
-};
-
-/**
- * Describes the message webadmin.v1.ConfigItem.
- * Use `create(ConfigItemSchema)` to create a new message.
- */
-export const ConfigItemSchema: GenMessage<ConfigItem> =
-  /*@__PURE__*/
-  messageDesc(file_web_admin_v1_config, 0);
-
-/**
- * Request for ListAllConfig.
- *
- * @generated from message webadmin.v1.ListAllConfigRequest
- */
-export type ListAllConfigRequest =
-  Message<'webadmin.v1.ListAllConfigRequest'> & {};
-
-/**
- * Describes the message webadmin.v1.ListAllConfigRequest.
- * Use `create(ListAllConfigRequestSchema)` to create a new message.
- */
-export const ListAllConfigRequestSchema: GenMessage<ListAllConfigRequest> =
-  /*@__PURE__*/
-  messageDesc(file_web_admin_v1_config, 1);
-
-/**
- * Response for ListAllConfig.
- *
- * @generated from message webadmin.v1.ListAllConfigResponse
- */
-export type ListAllConfigResponse =
-  Message<'webadmin.v1.ListAllConfigResponse'> & {
-    /**
-     * @generated from field: repeated webadmin.v1.ConfigItem configs = 1;
-     */
-    configs: ConfigItem[];
-  };
-
-/**
- * Describes the message webadmin.v1.ListAllConfigResponse.
- * Use `create(ListAllConfigResponseSchema)` to create a new message.
- */
-export const ListAllConfigResponseSchema: GenMessage<ListAllConfigResponse> =
-  /*@__PURE__*/
-  messageDesc(file_web_admin_v1_config, 2);
-
-/**
- * Request for HasConfigChanges.
- *
- * @generated from message webadmin.v1.HasConfigChangesRequest
- */
-export type HasConfigChangesRequest =
-  Message<'webadmin.v1.HasConfigChangesRequest'> & {
-    /**
-     * The timestamp to check against. The service will return true if any
-     * config has an `updated_at` value greater than this.
-     *
-     * @generated from field: google.protobuf.Timestamp last_loaded_at = 1;
-     */
-    lastLoadedAt?: Timestamp;
-  };
-
-/**
- * Describes the message webadmin.v1.HasConfigChangesRequest.
- * Use `create(HasConfigChangesRequestSchema)` to create a new message.
- */
-export const HasConfigChangesRequestSchema: GenMessage<HasConfigChangesRequest> =
-  /*@__PURE__*/
-  messageDesc(file_web_admin_v1_config, 3);
-
-/**
- * Response for HasConfigChanges.
- *
- * @generated from message webadmin.v1.HasConfigChangesResponse
- */
-export type HasConfigChangesResponse =
-  Message<'webadmin.v1.HasConfigChangesResponse'> & {
-    /**
-     * @generated from field: bool has_changes = 1;
-     */
-    hasChanges: boolean;
-  };
-
-/**
- * Describes the message webadmin.v1.HasConfigChangesResponse.
- * Use `create(HasConfigChangesResponseSchema)` to create a new message.
- */
-export const HasConfigChangesResponseSchema: GenMessage<HasConfigChangesResponse> =
-  /*@__PURE__*/
-  messageDesc(file_web_admin_v1_config, 4);
-
-/**
- * The ConfigService provides an interface for managing and retrieving
- * platform configuration values stored in the database.
- *
- * @generated from service webadmin.v1.ConfigService
- */
-export const ConfigService: GenService<{
-  /**
-   * ListAllConfig retrieves all configuration key-value pairs.
-   *
-   * @generated from rpc webadmin.v1.ConfigService.ListAllConfig
-   */
-  listAllConfig: {
-    methodKind: 'unary';
-    input: typeof ListAllConfigRequestSchema;
-    output: typeof ListAllConfigResponseSchema;
-  };
-  /**
-   * HasConfigChanges checks if any configuration was updated after a given timestamp.
-   *
-   * @generated from rpc webadmin.v1.ConfigService.HasConfigChanges
-   */
-  hasConfigChanges: {
-    methodKind: 'unary';
-    input: typeof HasConfigChangesRequestSchema;
-    output: typeof HasConfigChangesResponseSchema;
-  };
-}> = /*@__PURE__*/ serviceDesc(file_web_admin_v1_config, 0);

package/src/index.ts

@@ -1,62 +0,0 @@
-/*
- * Copyright (c) Virtru Corporation.  All rights reserved.
- *
- * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
- */
-
-/**
- * Exports Connect RPC and Connect Web RPC
- */
-export {
-  platformConnect as dspConnect,
-  platformConnectWeb as dspConnectWeb,
-} from '@opentdf/sdk/platform';
-
-/**
- * Exports the platform client
- */
-export {
-  type DSPClientServicesV1 as DSPServicesV1,
-  type DSPClientServicesV2 as DSPServicesV2,
-  type DSPClientOptions,
-  DSPClient,
-} from './lib/client';
-export { PlatformClient } from '@opentdf/sdk/platform';
-export {
-  createAuthInterceptor,
-  type Interceptor,
-  createAuthProvider,
-  createOpenTDFClient,
-  getObligations,
-  getUserEntitlements,
-  flattenObligations,
-  getTrustedCertificates,
-  validateJWSCertificateChain,
-  type JWSValidationResult,
-  type ObligationFeatureMap,
-  type SupportedObligations,
-  type GetUserEntitlementsResponse,
-} from './lib/utils';
-
-/**
- * Exports the DSP wrapper of OpenTDF
- */
-export { DSP, createDSP } from './lib/dsp';
-
-/**
- * Exports components of OpenTDF
- */
-
-export {
-  version,
-  clientType,
-  tdfSpecVersion,
-  type DecoratedStream,
-  type CreateZTDFOptions,
-} from '@opentdf/sdk';
-
-// export AuthProvider during transition period
-// TODO: remove this export once the SDK is updated to deprecate the AuthProvider
-export { AuthProviders, type AuthProvider } from '@opentdf/sdk';
-
-export * as singlecontainer from '@opentdf/sdk/singlecontainer';

package/src/lib/client.ts

@@ -1,90 +0,0 @@
-/*
- * Copyright (c) Virtru Corporation.  All rights reserved.
- *
- * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
- */
-
-// export client service definitions
-
-// export Connect RPC framework
-import type { AuthProvider } from '@opentdf/sdk';
-import {
-  type Client,
-  createClient,
-  type Interceptor,
-} from '@connectrpc/connect';
-import { createConnectTransport } from '@connectrpc/connect-web';
-import { ConfigService } from '../gen/config/v1/config_pb';
-import { PolicyArtifactService } from '../gen/policyimportexport/v1/policy_import_export_pb';
-import { SharedService } from '../gen/shared/v1/shared_pb';
-import { TaggingPDPService } from '../gen/tagging/pdp/v2/tagging_pb';
-import { VersionService } from '../gen/version/v1/version_pb';
-import { CertificateService } from '../gen/virtru/policy/certificates/v1/certificates_pb';
-import { createAuthInterceptor } from './utils';
-
-export interface DSPClientServicesV1 {
-  configService: Client<typeof ConfigService>;
-  policyArtifactService: Client<typeof PolicyArtifactService>;
-  sharedService: Client<typeof SharedService>;
-  versionService: Client<typeof VersionService>;
-  certificateService: Client<typeof CertificateService>;
-}
-
-export interface DSPClientServicesV2 {
-  taggingPDPService: Client<typeof TaggingPDPService>;
-}
-
-export interface DSPClientOptions {
-  // Base URL of the DSP
-  platformUrl: string;
-  // List of interceptors to apply to rpc requests
-  interceptors?: Interceptor[];
-  // Auth provider for request signing
-  authProvider?: AuthProvider;
-}
-
-/**
- * A client for interacting with the DSP using the Connect RPC framework.
- *
- * This client supports custom interceptors, which can be used to add
- * authentication headers or other custom logic to outgoing requests.
- *
- */
-export class DSPClient {
-  readonly v1: DSPClientServicesV1;
-  readonly v2: DSPClientServicesV2;
-
-  constructor(options: DSPClientOptions) {
-    const interceptors: Interceptor[] = [];
-
-    if (!options.platformUrl) {
-      throw new Error('platformUrl is required for DSP client');
-    }
-
-    if (options.authProvider) {
-      const authInterceptor = createAuthInterceptor(options.authProvider);
-      interceptors.push(authInterceptor);
-    }
-
-    if (options.interceptors?.length) {
-      interceptors.push(...options.interceptors);
-    }
-
-    const transport = createConnectTransport({
-      baseUrl: options.platformUrl,
-      interceptors,
-    });
-
-    this.v1 = {
-      configService: createClient(ConfigService, transport),
-      policyArtifactService: createClient(PolicyArtifactService, transport),
-      sharedService: createClient(SharedService, transport),
-      versionService: createClient(VersionService, transport),
-      certificateService: createClient(CertificateService, transport),
-    };
-
-    this.v2 = {
-      taggingPDPService: createClient(TaggingPDPService, transport),
-    };
-  }
-}

package/src/lib/consts.ts

@@ -1,8 +0,0 @@
-/*
- * Copyright (c) Virtru Corporation.  All rights reserved.
- *
- * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
- */
-
-export const MAX_CERTS = 10; // reasonable upper bound for chain depth
-export const MAX_CERT_BYTES = 64 * 1024; // 64KB per certificate

package/src/lib/dsp.ts

@@ -1,65 +0,0 @@
-/*
- * Copyright (c) Virtru Corporation.  All rights reserved.
- *
- * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
- */
-
-import { OpenTDF, type OpenTDFOptions } from '@opentdf/sdk';
-import { PlatformClient, type PlatformServices } from '@opentdf/sdk/platform';
-import {
-  DSPClient,
-  type DSPClientServicesV1,
-  type DSPClientServicesV2,
-} from './client';
-import type { Interceptor } from '@connectrpc/connect';
-
-export type DSPServicesV1 = DSPClientServicesV1 & PlatformServices;
-export type DSPServicesV2 = DSPClientServicesV2;
-
-export interface DSPOptions extends OpenTDFOptions {
-  // This is the URL of the DSP server that the client will connect to.
-  // PlatformUrl is required for DSP client
-  platformUrl: string;
-  // List interceptors to apply to rpc requests
-  interceptors?: Interceptor[];
-}
-
-export class DSP extends OpenTDF {
-  readonly services: {
-    v1: DSPServicesV1;
-    v2: DSPServicesV2;
-  };
-  constructor(options: DSPOptions) {
-    super(options);
-
-    if (!options.platformUrl) {
-      throw new Error('platformUrl is required for DSP client');
-    }
-
-    const dspClient = new DSPClient({
-      platformUrl: options.platformUrl,
-      interceptors: options.interceptors,
-      authProvider: options.authProvider,
-    });
-
-    const platformClient = new PlatformClient({
-      platformUrl: options.platformUrl,
-      interceptors: options.interceptors,
-      authProvider: options.authProvider,
-    });
-
-    this.services = {
-      v1: {
-        ...platformClient.v1,
-        ...dspClient.v1,
-      },
-      v2: {
-        ...dspClient.v2,
-      },
-    };
-  }
-}
-
-export function createDSP(options: DSPOptions): DSP {
-  return new DSP(options);
-}

package/src/lib/fips-crypto/asymmetric.ts

@@ -1,162 +0,0 @@
-/*
- * Copyright (c) Virtru Corporation.  All rights reserved.
- *
- * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
- */
-
-import { Binary } from '@opentdf/sdk/singlecontainer';
-import {
-  type AsymmetricSigningAlgorithm,
-  type ECCurve,
-  type HkdfParams,
-  type KeyPair,
-  type PrivateKey,
-  type PublicKey,
-  type SymmetricKey,
-} from '@opentdf/sdk/singlecontainer';
-import { ConfigurationError } from '@opentdf/sdk';
-import { getVirtruCrypto } from './primitives';
-import { isSymmetricKey, wrapKeyPair, unwrapPublicKey, unwrapPrivateKey, unwrapSymmetricKey } from './keys';
-
-// ─── Key Generation ───────────────────────────────────────────────────────────
-
-const ENC_DEC_METHODS = ['encrypt', 'decrypt'] as const;
-const SIGN_VERIFY_METHODS = ['sign', 'verify'] as const;
-
-const RSA_OAEP_PARAMS = {
-  name: 'RSA-OAEP' as const,
-  modulusLength: 2048,
-  publicExponent: [1, 0, 1],
-  hash: 'SHA-256' as const,
-};
-
-const RS256_PARAMS = {
-  name: 'RSASSA-PKCS1-v1_5' as const,
-  modulusLength: 2048,
-  publicExponent: [1, 0, 1],
-  hash: 'SHA-256' as const,
-};
-
-/**
- * Generate an RSA key pair for encryption/decryption (RSA-OAEP).
- *
- * VirtruCrypto generates a single combined keypair handle. Both the PublicKey
- * and PrivateKey opaque wrappers reference the same VirtruCryptoKey — the
- * handle already carries all necessary usages. No export/re-import needed.
- */
-export async function generateKeyPair(_size?: number): Promise<KeyPair> {
-  const crypto = await getVirtruCrypto();
-  const combined = await crypto.generateKey(RSA_OAEP_PARAMS, true, ENC_DEC_METHODS);
-  return wrapKeyPair(combined, combined, 'rsa:2048');
-}
-
-/**
- * Generate an RSA key pair for signing/verification (RSASSA-PKCS1-v1_5).
- */
-export async function generateSigningKeyPair(): Promise<KeyPair> {
-  const crypto = await getVirtruCrypto();
-  const combined = await crypto.generateKey(RS256_PARAMS, true, SIGN_VERIFY_METHODS);
-  return wrapKeyPair(combined, combined, 'rsa:2048');
-}
-
-// ─── RSA Encrypt / Decrypt ────────────────────────────────────────────────────
-
-/**
- * Encrypt with RSA-OAEP public key.
- * Accepts Binary payload or a SymmetricKey for key-wrapping.
- */
-export async function encryptWithPublicKey(
-  payload: Binary | SymmetricKey,
-  publicKey: PublicKey
-): Promise<Binary> {
-  const crypto = await getVirtruCrypto();
-
-  let payloadBytes: Uint8Array;
-  if (isSymmetricKey(payload)) {
-    payloadBytes = await crypto.exportKey('raw', unwrapSymmetricKey(payload));
-  } else {
-    payloadBytes = new Uint8Array(payload.asArrayBuffer());
-  }
-
-  const vKey = unwrapPublicKey(publicKey);
-  const encrypted = await crypto.encrypt(RSA_OAEP_PARAMS as any, vKey, payloadBytes);
-  return Binary.fromArrayBuffer((encrypted as Uint8Array).buffer as ArrayBuffer);
-}
-
-/**
- * Decrypt with RSA-OAEP private key.
- */
-export async function decryptWithPrivateKey(
-  encryptedPayload: Binary,
-  privateKey: PrivateKey
-): Promise<Binary> {
-  const crypto = await getVirtruCrypto();
-  const vKey = unwrapPrivateKey(privateKey);
-  const payloadBytes = new Uint8Array(encryptedPayload.asArrayBuffer());
-  const decrypted = await crypto.decrypt(RSA_OAEP_PARAMS as any, vKey, payloadBytes);
-  return Binary.fromArrayBuffer((decrypted as Uint8Array).buffer as ArrayBuffer);
-}
-
-// ─── Sign / Verify ────────────────────────────────────────────────────────────
-
-/**
- * Sign data with an RSA private key (RS256 only).
- * VirtruCrypto requires pre-hashed data, so the data is SHA-256 hashed first.
- */
-export async function sign(
-  data: Uint8Array,
-  privateKey: PrivateKey,
-  algorithm: AsymmetricSigningAlgorithm
-): Promise<Uint8Array> {
-  if (algorithm !== 'RS256') {
-    throw new ConfigurationError(
-      `Signing algorithm '${algorithm}' not supported in FIPS mode. Only RS256 is supported.`
-    );
-  }
-  const crypto = await getVirtruCrypto();
-  const vKey = unwrapPrivateKey(privateKey);
-  // VirtruCrypto signs a pre-computed hash, not raw data
-  const hash = await crypto.digest({ name: 'SHA-256' }, data);
-  const sig = await crypto.sign(RS256_PARAMS, vKey, new Uint8Array(hash));
-  return new Uint8Array(sig);
-}
-
-/**
- * Verify an RS256 signature.
- * VirtruCrypto requires pre-hashed data.
- */
-export async function verify(
-  data: Uint8Array,
-  signature: Uint8Array,
-  publicKey: PublicKey,
-  algorithm: AsymmetricSigningAlgorithm
-): Promise<boolean> {
-  if (algorithm !== 'RS256') {
-    throw new ConfigurationError(
-      `Verification algorithm '${algorithm}' not supported in FIPS mode. Only RS256 is supported.`
-    );
-  }
-  const crypto = await getVirtruCrypto();
-  const vKey = unwrapPublicKey(publicKey);
-  const hash = await crypto.digest({ name: 'SHA-256' }, data);
-  try {
-    return await crypto.verify(RS256_PARAMS, vKey, signature, new Uint8Array(hash));
-  } catch (e) {
-    if (e === 'Signature verification error') return false;
-    throw e;
-  }
-}
-
-// ─── EC Stubs (unsupported in FIPS mode) ─────────────────────────────────────
-
-export async function generateECKeyPair(_curve?: ECCurve): Promise<KeyPair> {
-  throw new ConfigurationError('EC key generation is not supported in FIPS mode.');
-}
-
-export async function deriveKeyFromECDH(
-  _privateKey: PrivateKey,
-  _publicKey: PublicKey,
-  _hkdfParams: HkdfParams
-): Promise<SymmetricKey> {
-  throw new ConfigurationError('ECDH key derivation is not supported in FIPS mode.');
-}