@dooor-ai/trust/dist/core/services/tee-kms.service.js

TEE Attestation and Confidential Computing utilities for Dooor OS

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.TeeKmsService = void 0;
const crypto_1 = require("crypto");
const fs = require("fs");
const http = require("http");
const TOKEN_TYPE_OIDC = 'OIDC';
class TeeKmsService {
    constructor(kmsService) {
        this.kmsService = kmsService;
    }
    async getAttestedPublicKey() {
        try {
            console.log('[TeeKmsService] Request received for attested public key.');
            const publicKey = await this.kmsService.getPublicKey();
            console.log('[TeeKmsService] Public key retrieved from KMS service.');
            const pubHash = (0, crypto_1.createHash)('sha256').update(publicKey).digest('hex');
            console.log(`[TeeKmsService] Calculated public key hash: ${pubHash}`);
            const attestationJwt = await this.requestCustomTokenWithNonce(pubHash);
            console.log('[TeeKmsService] Custom attestation JWT with nonce retrieved.');
            return { publicKey, attestationJwt };
        }
        catch (error) {
            console.error(`[TeeKmsService] Failed to get attested public key: ${error.message}`, error);
            throw error;
        }
    }
    requestCustomTokenWithNonce(nonce) {
        const tokenRequest = {
            audience: 'tee-key-attestation',
            nonces: [nonce],
            token_type: TOKEN_TYPE_OIDC,
        };
        const customJSON = JSON.stringify(tokenRequest);
        console.log(`[TeeKmsService] Posting Custom Token Request: ${customJSON}`);
        const socketPath = '/run/container_launcher/teeserver.sock';
        if (!fs.existsSync(socketPath)) {
            const fallbackToken = `test-custom-token-for-nonce-${nonce}`;
            console.warn(`[TeeKmsService] TEE socket not found, using fallback: ${fallbackToken}`);
            return Promise.resolve(fallbackToken);
        }
        return new Promise((resolve, reject) => {
            const client = http.request({
                socketPath: socketPath,
                method: 'POST',
                path: '/v1/token',
                headers: {
                    'Content-Type': 'application/json',
                    'Content-Length': Buffer.byteLength(customJSON),
                },
            }, (res) => {
                let responseData = '';
                res.on('data', (chunk) => {
                    responseData += chunk;
                });
                res.on('end', () => {
                    if (res.statusCode === 200) {
                        console.log(`[TeeKmsService] Success: Received custom token.`);
                        resolve(responseData);
                    }
                    else {
                        const errorMsg = `Error creating custom token: Status ${res.statusCode} - ${responseData}`;
                        console.error(`[TeeKmsService] ${errorMsg}`);
                        reject(new Error(errorMsg));
                    }
                });
            });
            client.on('error', (error) => {
                console.error(`[TeeKmsService] Socket error: ${error.message}`);
                reject(error);
            });
            client.write(customJSON);
            client.end();
        });
    }
}
exports.TeeKmsService = TeeKmsService;
//# sourceMappingURL=tee-kms.service.js.map