24 lines
1.5 KiB
JavaScript
24 lines
1.5 KiB
JavaScript
import {managementIdentity} from './channel-identity.mjs';
|
|
import channel from '../../packages/core/policy-channel.cjs';
|
|
|
|
export function installPolicyChannel(app,store,device){
|
|
const shared=managementIdentity(store),keys={privateKey:shared.pqPrivate,publicKey:shared.publicKey};
|
|
const ed=shared.edPrivate,identity=shared.identity,pending=new Map();
|
|
app.get('/api/device/channel/identity',device,(_req,res)=>res.json(identity));
|
|
app.post('/api/device/channel/challenge',device,(req,res)=>{
|
|
for(const [id,item] of pending)if(item.bundle.expiresAt<=Date.now()||item.bundle.deviceId===req.device.id)pending.delete(id);
|
|
if(pending.size>=10000)return res.status(503).json({error:'Protected management channel unavailable'});
|
|
const item=channel.challenge(req.device.id,ed,keys.privateKey);pending.set(item.bundle.id,item);res.json(item.bundle);
|
|
});
|
|
app.post('/api/device/channel/policy',device,(req,res)=>{
|
|
const item=pending.get(req.body?.id);
|
|
if(!item||item.bundle.deviceId!==req.device.id)return res.status(403).json({error:'Protected management channel refused'});
|
|
// Consume before processing: every challenge is one use, including failed ciphertext.
|
|
pending.delete(item.bundle.id);let context;
|
|
try{context=channel.receive(req.body,item.bundle,item.privateKey);res.json(channel.response(store.envelope(req.device.id),item.bundle,context));}
|
|
catch{return res.status(403).json({error:'Protected management channel refused'});}
|
|
finally{context?.responseKey.fill(0);}
|
|
});
|
|
return identity;
|
|
}
|