20 lines
1.6 KiB
JavaScript
20 lines
1.6 KiB
JavaScript
'use strict';
|
|
const channel=require('../../packages/core/policy-channel.cjs');
|
|
const fs=require('node:fs');
|
|
function deploymentPin(){if(process.env.SAFETYNET_REQUIRE_CHANNEL_PIN==='true'&&!process.env.SAFETYNET_CHANNEL_SIGNATURE_KEY_FILE)throw Error('Deployment requires a protected management signing pin');return process.env.SAFETYNET_CHANNEL_SIGNATURE_KEY_FILE?fs.readFileSync(process.env.SAFETYNET_CHANNEL_SIGNATURE_KEY_FILE,'utf8').trim():undefined;}
|
|
async function protectedPolicyRequest({device,request,save}){
|
|
const pin=deploymentPin();if(pin&&device.channelSignatureKey&&device.channelSignatureKey.trim()!==pin)throw Error('Protected management signing pin mismatch');
|
|
if(!device.channelSignatureKey){
|
|
// One-time legacy migration is authenticated by the enrollment signing pin and HTTPS.
|
|
const identity=await request(device.server,'/api/device/channel/identity',null,device.token);
|
|
channel.verifyIdentity(identity,device.publicKey);if(pin&&identity.signatureKey.trim()!==pin)throw Error('Protected management signing pin mismatch');
|
|
device.channelSignatureKey=identity.signatureKey;save(device);
|
|
}
|
|
const challenge=await request(device.server,'/api/device/channel/challenge',{},device.token);
|
|
channel.verifyChallenge(challenge,device.id,device.publicKey,device.channelSignatureKey);
|
|
const context=channel.prepare(challenge);
|
|
try{const response=await request(device.server,'/api/device/channel/policy',context.request,device.token);return channel.finish(response,challenge,context);}
|
|
finally{context.responseKey.fill(0);}
|
|
}
|
|
module.exports={protectedPolicyRequest,deploymentPin};
|