rsksmart/rif-data-vault

RIF Data Vault

RIF Data Vault

A user centric cloud storage system

The Data Vault is a user-centric cloud service. Allows any user with a digital wallet to connect to their own storage cloud, encrypting their information on the client side.

Quick start

Connect to RIF Data Vault from your browser app!

import DataVaultWebClient, { AuthManager, AsymmetricEncryptionManager } from '@rsksmart/ipfs-cpinner-client'

const serviceUrl = 'https://data-vault.identity.rifos.org'

// using Metamask
const address = await window.ethereum.request({ method: 'eth_accounts' }).then(accounts => accounts[0])
const did = `did:ethr:rsk:${address}`

const dataVault = new DataVaultWebClient({
  serviceUrl,
  authManager: new AuthManager({ did, serviceUrl, personalSign: (data: string) => window.ethereum.request({ method: 'personal_sign', params: [data, address] }) }),
  encryptionManager: AsymmetricEncryptionManager.fromWeb3Provider(window.ethereum)
})

const key = 'MyKey'
const content = 'this is my content'

const id = await dataVault.create({ key, content })

await dataVault.get({ did, key })

Read the docs and find out more!

Modules

• @rsksmart/ipfs-cpinner-client - the web SDK. Enables users to log to their clouds with standard web3 wallets
• @rsksmart/ipfs-cpinner-provider - implements the storage layer: storing and pinning files on IPFS
• @rsksmart/ipfs-cpinner-service - API for the Data Vault. This abstraction allows to create different implementations for the storage layer
• @rsksmart/ipfs-cpinner-client-types - types for the SDK

Run for development

1. Install dependencies

   npm i
   npm run setup
   

2. Install IPFS CLI. Find your option: https://docs.ipfs.io/how-to/command-line-quick-start/.

Test

1. Init IPFS (once)

ipfs init

2. Start IPFS Daemon

ipfs daemon

3. Run tests

npm test

or watch mode with

test:watch

Lint

npm run lint

Branching model

• master has latest release. Do merge commits.
• develop has latest approved PR. PRs need to pass ci and LGTM. Do squash & merge.
• Use branches pointing to develop to add new PRs.
• Do external PRs against latest commit in develop.

Deploy your Data Vault instance

To run a productive instance of the Data Vault refer to Data Vault service configuration

rif-data-vault's Issues

Add health check endpoint

Make Data Vault client independent of storage module

In the future we can even move it out and configure it as a pluggable, making mobile apps and such not dependent on this

Originally posted by @ilanolkies in #11 (comment)

Enable max capacity in provider layer

The provider should have a configuration to set a max size limit for each user (each DID).

Discover all of your keys

Enable an authenticated user to fetch all of their keys

Fix service tsc dependency for Docker

This is to have tsc inside the service? Shouldn’t we add tsc as dev inside the module?

Originally posted by @ilanolkies in #9 (comment)

Prefix did in storage key

Prefix the DID in the storage key to enable multiple data vaults in same window.

Web build for client

Build the library for web browsers using webpack

Discussion: key name privacy on get method

Discussion: should this method encrypt the key or be authenticated?

Originally posted by @ilanolkies in #41 (comment)

DV Client should encrypt/decrypt data prior sending it to the service

It should also decrypt the retrieved data from the service.

Use lower cases to map DIDs

Some SSI libraries are using checksum, others not. Please ensure the DIDs are stored in lower case to prevent any invalid multiple identity store for one identity.

Ref: rsksmart/rif-identity-docs#12

Remove serviceDid parameter from client package

It is not longer used

Let's remove it if we are not going to use it, then we can add it back

Originally posted by @javiesses in #55 (comment)

Store and retrieve last update time of each file

UX - Add Newline and '*' to DV authentication message

Taking UX into account, it would be good to add some Newline (end of line) and some '*' in this message that is asked when authenticating to Data Vault:

The proposal is:

Are you sure you want to login to the RIF Data Vault? [Newline]

* URL: https://... [Newline]
* Verification code: ...

Note: if this issue should be created in rLogin instead of here, LMK and I move it.

Add factory methods

The method should automatically setup sign, decrypt and getEncryptionPublicKey.

In addition, public key returned by getEncryptionPublicKey should be memoized. See:

Originally posted by @ilanolkies in #41 (comment)

• AsymmetricEncryptionManager
• SignerEncryptionManager
• AuthManager
• DataVaultWebClient

Return file id on get by key

This will allow to delete the files after getting them by key.

Different names all over the repo

Not ready to merge. I found different names all over the repo:

• Folders have one name
• Packages have other name
• Readmes have another name

Let's unify before publishing...

Originally posted by @ilanolkies in #20 (comment)

Setup lint on CI

Rising an issue for this

Originally posted by @ilanolkies in #7 (comment)

Create DataVaultProvider Web Client SDK

• Receives:
  • web3Provider/signer function and a did. Will be used to authenticate
  • Optional: storage get and set functions. Will be used to save the access token so it can be reused. Default: window.localStorage. This is an option for other clients, like mobile applications.
• Implements @rsksmart/express-did-auth authentication protocol - RIFID-450
  • The login will be done in the first interaction with the DV API and the token will be saved in the provided storage so it can be reused
• Speaks with DV Service API
• Encrypts/decrypts content prior to put or after retrieving it from the DV Service
• WebJS compatible

type Key = string
type ContentIdentifier = string
type Content = string // if it is a JSON, must be stringified

type PutFilePayload = { key: Key, content: Content }
type PutFileResponse = { id: ContentIdentifier }
type GetFilePayload = { key: Key }
type GetFileResponse = { id: ContentIdentifier, content: Content }
type DeleteFilePayload = { key: Key, id: Identifier }
type DeleteFileResponse = {}
type SwapFilePayload = { key: Key, id: ContentIdentifier, content: Content }
type SwapFileResponse = { id: ContentIdentifier }

interface DataVaultWebClient {
  put(payload: PutFilePayload): PutFileResponse
  put(payload: PutFilePayload[]): PutFileResponse[]
  get(payload: GetFilePayload): GetFileResponse[]
  get(payload: GetFilePayload[]): GetFileResponse[]
  delete(payload: DeleteFilePayload): DeleteFileResponse
  delete(payload: DeleteFilePayload[]): DeleteFileResponse[]
  swap(payload: SwapFilePayload): SwapFileResponse
  swap(payload: SwapFilePayload[]): SwapFileResponse[]
}

Discussion: verify access token?

rif-data-vault/modules/ipfs-cpinner-client/src/auth-manager/index.ts

Line 70 in c861971

// TODO: should we verify?

Related to #56

Make the swap method more ACID compliant

Let's add it to the issues

Originally posted by @ilanolkies in #2 (comment)

Allow to perform bulk CRUD operations from the client

Should implement this interface

get (GetContentPayload): Promise<string[]>
create (CreateContentPayload): Promise<CreateContentResponse>
delete (DeleteTokenPayload): Promise<boolean[]>
swap (SwapContentPayload): Promise<SwapContentResponse[]>

Update the way the auth challenge is signed

This is what we need to change for new DI Auth integration. I identify it now to link it in an issue.

Originally posted by @ilanolkies in #11 (comment)

The new protocol implementation can be found here: rsksmart/rif-identity.js#72