Raven Scott
c818edac9d
Release rolling / release (push) Successful in 12m24s
Default peers are read-only; admin requires seed proof and operators redeem AutoPass packages with signed grants. ACL UI and docs match the new trust model.
48 lines
1.4 KiB
JavaScript
48 lines
1.4 KiB
JavaScript
/**
|
|
* Server-side MAC key for capability + admin proof verification.
|
|
* Derived once from SERVER_SEED after keys are loaded.
|
|
*/
|
|
import { deriveMacKey } from '../../shared/crypto-auth.js'
|
|
|
|
/** @type {Buffer|null} */
|
|
let macKey = null
|
|
/** @type {string|null} */
|
|
let seedHex = null
|
|
/** @type {string|null} */
|
|
let publicKeyHex = null
|
|
|
|
/**
|
|
* @param {{ seedHex: string, publicKeyHex: string }} opts
|
|
*/
|
|
export function initAuthKeys({ seedHex: seed, publicKeyHex: pub }) {
|
|
if (!seed || !/^[0-9a-fA-F]{64}$/.test(seed)) {
|
|
throw new Error('initAuthKeys requires 64-hex seedHex')
|
|
}
|
|
seedHex = seed.toLowerCase()
|
|
publicKeyHex = String(pub || '').toLowerCase()
|
|
macKey = deriveMacKey(seedHex)
|
|
}
|
|
|
|
export function getMacKey() {
|
|
if (!macKey) {
|
|
// Lazy init from env (tests / late import)
|
|
const seed = process.env.SERVER_SEED || process.env.SERVER_KEY
|
|
if (seed && /^[0-9a-fA-F]{64}$/.test(seed)) {
|
|
seedHex = seed.toLowerCase()
|
|
macKey = deriveMacKey(seedHex)
|
|
publicKeyHex = (process.env.SERVER_PUBLIC_KEY || '').toLowerCase() || null
|
|
}
|
|
}
|
|
if (!macKey) throw new Error('Auth keys not initialized (SERVER_SEED missing)')
|
|
return macKey
|
|
}
|
|
|
|
export function getSeedHex() {
|
|
if (!seedHex) getMacKey()
|
|
return seedHex
|
|
}
|
|
|
|
export function getServerPublicKeyHex() {
|
|
return publicKeyHex || (process.env.SERVER_PUBLIC_KEY || '').toLowerCase() || null
|
|
}
|