Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

draft #230

Draft
wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

draft #230

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c45b390
draft
ivanovSPvirtru Aug 7, 2023
0a27679
should work but it doesnt
ivanovSPvirtru Aug 7, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion lib/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@opentdf/client",
"version": "1.2.1",
"version": "1.2.7",
"description": "Access and generate tdf protected content",
"homepage": "https://github.com/opentdf/client-web",
"bugs": {
Expand All @@ -10,6 +10,8 @@
"dist/*/src/**",
"dist/*/tdf3/**",
"dist/*/*.json",
"src/**",
"tdf3/**",
"README.md"
],
"repository": {
Expand Down
5 changes: 4 additions & 1 deletion lib/src/nanotdf/Client.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -213,7 +213,10 @@ export default class Client {

const jwtPayload = { requestBody: requestBodyStr };
const requestBody = {
signedRequestToken: await reqSignature(jwtPayload, this.requestSignerKeyPair.privateKey, {
signedRequestToken: await reqSignature(
jwtPayload,
this.requestSignerKeyPair.privateKey,
{
alg: AlgorithmName.ES256,
}),
};
Expand Down
18 changes: 14 additions & 4 deletions lib/tdf3/src/client/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ import { OIDCRefreshTokenProvider } from '../../../src/auth/oidc-refreshtoken-pr
import { OIDCExternalJwtProvider } from '../../../src/auth/oidc-externaljwt-provider.js';
import { CryptoService, PemKeyPair } from '../crypto/declarations.js';
import { AuthProvider, AppIdAuthProvider, HttpRequest } from '../../../src/auth/auth.js';
import { generateKeyPair, enums as cryptoEnums, cryptoPublicToPem } from '../../../src/nanotdf-crypto/index.js';
import EAS from '../../../src/auth/Eas.js';

import { EncryptParams, DecryptParams, type Scope } from './builders.js';
Expand All @@ -28,7 +29,6 @@ import {
import * as defaultCryptoService from '../crypto/index.js';
import { Policy } from '../models/index.js';
import { TdfError } from '../errors.js';
import { rsaPkcs1Sha256 } from '../crypto/index.js';

const GLOBAL_BYTE_LIMIT = 64 * 1000 * 1000 * 1000; // 64 GB, see WS-9363.
const HTML_BYTE_LIMIT = 100 * 1000 * 1000; // 100 MB, see WS-9476.
Expand Down Expand Up @@ -137,16 +137,22 @@ export async function createSessionKeys({
let signingKeys;

if (dpopEnabled) {
signingKeys = await crypto.subtle.generateKey(rsaPkcs1Sha256(), true, ['sign']);
signingKeys = await generateKeyPair({
type: cryptoEnums.AlgorithmName.ECDSA,
curve: cryptoEnums.NamedCurve.P256,
keyUsages: [cryptoEnums.KeyUsageType.Sign, cryptoEnums.KeyUsageType.Verify],
isExtractable: true,
});
}

// This will contact the auth server and forcibly refresh the auth token claims,
// binding the token and the (new) pubkey together.
// Note that we base64 encode the PEM string here as a quick workaround, simply because
// a formatted raw PEM string isn't a valid header value and sending it raw makes keycloak's
// header parser barf. There are more subtle ways to solve this, but this works for now.
if (authProvider && !isAppIdProviderCheck(authProvider)) {
await authProvider?.updateClientPublicKey(base64.encode(k2.publicKey), signingKeys);
if (authProvider && !isAppIdProviderCheck(authProvider) && signingKeys) {
const signerPubKey = await cryptoPublicToPem(signingKeys.publicKey);
await authProvider?.updateClientPublicKey(base64.encode(signerPubKey), signingKeys);
}
return { keypair: k2, signingKeys };
}
Expand Down Expand Up @@ -370,6 +376,10 @@ export class Client {
if (eo) {
tdf.setEntity(eo);
}
tdf.dpopEnabled = this.dpopEnabled;
if (sessionKeys.signingKeys) {
tdf.requestSignerKeyPair = sessionKeys.signingKeys;
}
await tdf.addKeyAccess({
type: offline ? 'wrapped' : 'remote',
url: this.kasEndpoint,
Expand Down
26 changes: 22 additions & 4 deletions lib/tdf3/src/tdf.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,16 @@ import { EventEmitter } from 'events';
import axios from 'axios';
import crc32 from 'buffer-crc32';
import { v4 } from 'uuid';
import { exportSPKI, importPKCS8, importX509 } from 'jose';
import { exportSPKI, importPKCS8, importX509, KeyLike } from 'jose';
import { DecoratedReadableStream } from './client/DecoratedReadableStream.js';
import { EntityObject } from '../../src/tdf/EntityObject.js';
import DefaultParams from './../../src/nanotdf/models/DefaultParams.js';

import {
enums as cryptoEnums,
} from '../../src/nanotdf-crypto/index.js';

const { AlgorithmName } = cryptoEnums;

import {
AttributeSet,
Expand Down Expand Up @@ -127,6 +134,7 @@ export class TDF extends EventEmitter {
contentStream?: ReadableStream<Uint8Array>;
manifest?: Manifest;
entity?: EntityObject;
dpopEnabled?: Boolean;
encryptionInformation?: SplitKey;
htmlTransferUrl?: string;
authProvider?: AuthProvider | AppIdAuthProvider;
Expand All @@ -138,6 +146,7 @@ export class TDF extends EventEmitter {
segmentSizeDefault: number;
chunkMap: Map<string, Chunk>;
cryptoService: CryptoService;
requestSignerKeyPair?: Required<Readonly<CryptoKeyPair>>;

constructor(configuration: TDFConfiguration) {
super();
Expand Down Expand Up @@ -520,7 +529,8 @@ export class TDF extends EventEmitter {

//TODO I dont' think we need a body at all for KAS requests
// Do we need ANY of this if it's already embedded in the EO in the Bearer OIDC token?
const body: Record<string, unknown> = {
let body: Record<string, unknown> = {
algorithm: DefaultParams.defaultECAlgorithm,
keyAccess: keyAccessObject,
policy: unsavedManifest.encryptionInformation.policy,
entity: isAppIdProviderCheck(this.authProvider) ? this.entity : undefined,
Expand All @@ -532,7 +542,15 @@ export class TDF extends EventEmitter {
if (isAppIdProviderCheck(this.authProvider)) {
body.authToken = await reqSignature({}, pkKeyLike);
} else {
body.clientPayloadSignature = await reqSignature(body, pkKeyLike);
body.clientPublicKey = this.publicKey;
body = {
signedRequestToken: await reqSignature(
{ requestBody: JSON.stringify(body)},
(this.requestSignerKeyPair?.privateKey as KeyLike),
{ alg: AlgorithmName.ES256, }
)
}
// body.clientPayloadSignature = await reqSignature(body, pkKeyLike);
}
const httpReq = await this.authProvider.withCreds(this.buildRequest('POST', url, body));

Expand Down Expand Up @@ -847,7 +865,7 @@ export class TDF extends EventEmitter {
const url = `${keySplitInfo.url}/${isAppIdProvider ? '' : 'v2'}/rewrap`;

const requestBodyStr = JSON.stringify({
algorithm: 'RS256',
algorithm: DefaultParams.defaultECAlgorithm,
keyAccess: keySplitInfo,
policy: manifest.encryptionInformation.policy,
clientPublicKey: this.publicKey,
Expand Down