|  | 
|  | 1 | +import { AuthProviders, OpenTDF, CreateZTDFOptions, DecoratedStream, ReadOptions } from '@opentdf/sdk'; | 
|  | 2 | +import * as fs from 'fs'; | 
|  | 3 | +import * as path from 'path'; | 
|  | 4 | +import * as os from 'os'; | 
|  | 5 | + | 
|  | 6 | +const clientId = "opentdf"; | 
|  | 7 | +const clientSecret = "secret"; | 
|  | 8 | +const oidcOrigin = "http://localhost:8888/auth/realms/opentdf"; | 
|  | 9 | +const kasEndpoint = "http://localhost:8080/kas"; | 
|  | 10 | +const platformEndpoint = "http://localhost:8080"; | 
|  | 11 | + | 
|  | 12 | +// Create the AuthProvider using client credentials | 
|  | 13 | +const authProvider = await AuthProviders.clientSecretAuthProvider({ | 
|  | 14 | +    clientId, | 
|  | 15 | +    clientSecret, | 
|  | 16 | +    oidcOrigin, | 
|  | 17 | +    exchange: 'client', | 
|  | 18 | +}); | 
|  | 19 | +console.log("✅ Authentication provider created"); | 
|  | 20 | + | 
|  | 21 | +// Create OpenTDF client | 
|  | 22 | +console.log("🔧 Creating OpenTDF client..."); | 
|  | 23 | +const client = new OpenTDF({ | 
|  | 24 | +    authProvider: authProvider, | 
|  | 25 | +    platformUrl: platformEndpoint, | 
|  | 26 | +}); | 
|  | 27 | +console.log("✅ Client created"); | 
|  | 28 | +// ABAC - Attribute-Based Access Control | 
|  | 29 | +// Option 1: No attributes (simplest for demonstration) | 
|  | 30 | +const attributes: string[] = [];  | 
|  | 31 | + | 
|  | 32 | +// Option 2: With attributes (requires proper attribute configuration on platform) | 
|  | 33 | +// const attributes = ["http://example.com/attr/classification/value/secret"]; | 
|  | 34 | + | 
|  | 35 | +// Create temporary files | 
|  | 36 | +const tempDir = os.tmpdir(); | 
|  | 37 | +const inputFile = path.join(tempDir, 'opentdf-input.txt'); | 
|  | 38 | +const encryptedFile = path.join(tempDir, 'opentdf-encrypted.tdf'); | 
|  | 39 | +const decryptedFile = path.join(tempDir, 'opentdf-decrypted.txt'); | 
|  | 40 | + | 
|  | 41 | +// client.dataAttributes = ["http://opentdf.io/attr/class/value/secret"]; | 
|  | 42 | +console.log(`📁 Using temp files:`); | 
|  | 43 | +console.log(`   Input: ${inputFile}`); | 
|  | 44 | +console.log(`   Encrypted: ${encryptedFile}`); | 
|  | 45 | +console.log(`   Decrypted: ${decryptedFile}`); | 
|  | 46 | + | 
|  | 47 | +// Write input data to temporary file | 
|  | 48 | +const inputData = "This is sensitive data that will be encrypted with OpenTDF!"; | 
|  | 49 | +console.log("📝 Preparing sensitive data for encryption..."); | 
|  | 50 | +fs.writeFileSync(inputFile, inputData, 'utf8'); | 
|  | 51 | +console.log(`✅ Input file written: ${inputData}`); | 
|  | 52 | + | 
|  | 53 | +// Encrypt using OpenTDF client | 
|  | 54 | +console.log("🔒 Starting encryption..."); | 
|  | 55 | +console.log("📖 Reading input file for encryption..."); | 
|  | 56 | + | 
|  | 57 | +// Read the file and create a Web ReadableStream | 
|  | 58 | +console.log("📡 Calling client.encrypt..."); | 
|  | 59 | +let opts: CreateZTDFOptions = { | 
|  | 60 | +    source: { type: 'buffer', location: new TextEncoder().encode(fs.readFileSync(inputFile).toString()) }, | 
|  | 61 | +} | 
|  | 62 | +let tdf = await client.createZTDF(opts); | 
|  | 63 | + | 
|  | 64 | +// Save encrypted stream to file | 
|  | 65 | +console.log(`💾 Saving encrypted data to temp file ${encryptedFile}`); | 
|  | 66 | + | 
|  | 67 | +const encrypted = await new Response(tdf).bytes() | 
|  | 68 | +fs.writeFileSync(encryptedFile, encrypted); | 
|  | 69 | + | 
|  | 70 | +console.log('✅ Data encrypted and saved to file!'); | 
|  | 71 | + | 
|  | 72 | + | 
|  | 73 | +// Decrypt ZTDF | 
|  | 74 | +console.log("🔓 Decrypting data..."); | 
|  | 75 | + | 
|  | 76 | +const fileBuffer: Buffer = fs.readFileSync(encryptedFile); | 
|  | 77 | +const byteArray: Uint8Array = new Uint8Array(fileBuffer); | 
|  | 78 | + | 
|  | 79 | +const decoratedStream: DecoratedStream = await client.read({ | 
|  | 80 | +    source: { type: 'buffer', location: byteArray }, | 
|  | 81 | +} as ReadOptions); | 
|  | 82 | + | 
|  | 83 | +const decrypted = await new Response(decoratedStream).text(); | 
|  | 84 | + | 
|  | 85 | +// Save decrypted stream to file | 
|  | 86 | +console.log("💾 Saving decrypted data to temp file..."); | 
|  | 87 | +fs.writeFileSync(decryptedFile, decrypted); | 
|  | 88 | + | 
|  | 89 | +// Read and display the decrypted content | 
|  | 90 | +const decryptedContent = fs.readFileSync(decryptedFile, 'utf8'); | 
|  | 91 | +console.log('✅ Data decrypted and saved to file!'); | 
|  | 92 | +console.log(`📤 Decrypted content: \n\n"${decryptedContent}"\n\n`); | 
|  | 93 | + | 
|  | 94 | +// Copy 'encryptedFile' to CWD | 
|  | 95 | +fs.copyFileSync(encryptedFile, path.join(process.cwd(), 'opentdf-encrypted.tdf')); | 
|  | 96 | + | 
|  | 97 | +process.exit(0); | 
0 commit comments