first commit

apps/browser/management-channel.cjs

@@ -0,0 +1,19 @@
+'use strict';
+const channel=require('../../packages/core/policy-channel.cjs');
+const fs=require('node:fs');
+function deploymentPin(){if(process.env.SAFETYNET_REQUIRE_CHANNEL_PIN==='true'&&!process.env.SAFETYNET_CHANNEL_SIGNATURE_KEY_FILE)throw Error('Deployment requires a protected management signing pin');return process.env.SAFETYNET_CHANNEL_SIGNATURE_KEY_FILE?fs.readFileSync(process.env.SAFETYNET_CHANNEL_SIGNATURE_KEY_FILE,'utf8').trim():undefined;}
+async function protectedPolicyRequest({device,request,save}){
+  const pin=deploymentPin();if(pin&&device.channelSignatureKey&&device.channelSignatureKey.trim()!==pin)throw Error('Protected management signing pin mismatch');
+  if(!device.channelSignatureKey){
+    // One-time legacy migration is authenticated by the enrollment signing pin and HTTPS.
+    const identity=await request(device.server,'/api/device/channel/identity',null,device.token);
+    channel.verifyIdentity(identity,device.publicKey);if(pin&&identity.signatureKey.trim()!==pin)throw Error('Protected management signing pin mismatch');
+    device.channelSignatureKey=identity.signatureKey;save(device);
+  }
+  const challenge=await request(device.server,'/api/device/channel/challenge',{},device.token);
+  channel.verifyChallenge(challenge,device.id,device.publicKey,device.channelSignatureKey);
+  const context=channel.prepare(challenge);
+  try{const response=await request(device.server,'/api/device/channel/policy',context.request,device.token);return channel.finish(response,challenge,context);}
+  finally{context.responseKey.fill(0);}
+}
+module.exports={protectedPolicyRequest,deploymentPin};