@xtr-dev/rondevu-server 0.5.11 → 0.5.13

package/README.md

@@ -4,7 +4,7 @@
 
 **WebRTC signaling server with tags-based discovery**
 
-HTTP signaling server with credential-based authentication, tag-based offer discovery, and JSON-RPC interface. Multiple storage backends supported.
+HTTP signaling server with stateless Ed25519 authentication, tag-based offer discovery, and JSON-RPC interface. Multiple storage backends supported.
 
 ## Quick Start
 
@@ -57,21 +57,10 @@ npm install pg      # for PostgreSQL
 
 All API calls go to `POST /rpc` with JSON-RPC format. Requests must be arrays.
 
-### Generate Credentials
-
-```json
-[{ "method": "generateCredentials", "params": { "name": "alice" } }]
-```
-
-Response:
-```json
-[{ "success": true, "result": { "name": "alice", "secret": "5a7f3e..." } }]
-```
-
 ### Publish Offer (authenticated)
 
 ```
-Headers: X-Name, X-Timestamp, X-Nonce, X-Signature
+Headers: X-PublicKey, X-Timestamp, X-Nonce, X-Signature
 ```
 
 ```json
@@ -81,7 +70,7 @@ Headers: X-Name, X-Timestamp, X-Nonce, X-Signature
 }]
 ```
 
-### Discover Offers
+### Discover Offers (unauthenticated)
 
 ```json
 [{ "method": "discover", "params": { "tags": ["chat"], "limit": 10 } }]
@@ -97,18 +86,20 @@ Headers: X-Name, X-Timestamp, X-Nonce, X-Signature
 
 - `addIceCandidates` - Add ICE candidates
 - `getIceCandidates` - Get ICE candidates
-- `poll` - Poll for answers
+- `poll` - Poll for answers and ICE candidates
 - `deleteOffer` - Delete an offer
 
 ## Authentication
 
-Authenticated methods require HMAC-SHA256 signatures:
+**Stateless Ed25519**: No registration required. Generate a keypair locally and sign requests.
 
 ```
-Message: timestamp:nonce:method:JSON.stringify(params)
-Headers: X-Name, X-Timestamp, X-Nonce, X-Signature (base64 HMAC)
+Message: timestamp:nonce:method:canonicalJSON(params)
+Headers: X-PublicKey, X-Timestamp, X-Nonce, X-Signature (base64 Ed25519)
 ```
 
+The server verifies signatures directly using the public key from the header - no identity table, no registration step. Your public key IS your identity.
+
 ## Configuration
 
 | Variable | Default | Description |
@@ -119,12 +110,9 @@ Headers: X-Name, X-Timestamp, X-Nonce, X-Signature (base64 HMAC)
 | `DATABASE_URL` | - | Connection string (for `mysql`/`postgres`) |
 | `DB_POOL_SIZE` | `10` | Connection pool size (for `mysql`/`postgres`) |
 | `CORS_ORIGINS` | `*` | Allowed origins |
-| `MASTER_ENCRYPTION_KEY` | - | 64-char hex for secret encryption |
 | `OFFER_DEFAULT_TTL` | `60000` | Default offer TTL (ms) |
 | `OFFER_MAX_TTL` | `86400000` | Max offer TTL (24h) |
 
-Generate encryption key: `openssl rand -hex 32`
-
 ## Tag Validation
 
 Tags: 1-64 chars, lowercase alphanumeric with dots/dashes.

package/dist/index.js

@@ -469,7 +469,7 @@ var init_memory = __esm({
         }
         return count;
       }
-      async answerOffer(offerId, answererUsername, answerSdp) {
+      async answerOffer(offerId, answererUsername, answerSdp, matchedTags) {
         const offer = await this.getOfferById(offerId);
         if (!offer) {
           return { success: false, error: "Offer not found or expired" };
@@ -481,6 +481,7 @@ var init_memory = __esm({
         offer.answererUsername = answererUsername;
         offer.answerSdp = answerSdp;
         offer.answeredAt = now;
+        offer.matchedTags = matchedTags;
         if (!this.offersByAnswerer.has(answererUsername)) {
           this.offersByAnswerer.set(answererUsername, /* @__PURE__ */ new Set());
         }
@@ -815,7 +816,8 @@ var init_sqlite = __esm({
         last_seen INTEGER NOT NULL,
         answerer_username TEXT,
         answer_sdp TEXT,
-        answered_at INTEGER
+        answered_at INTEGER,
+        matched_tags TEXT
       );
 
       CREATE INDEX IF NOT EXISTS idx_offers_username ON offers(username);
@@ -942,7 +944,7 @@ var init_sqlite = __esm({
         const result = stmt.run(now);
         return result.changes;
       }
-      async answerOffer(offerId, answererUsername, answerSdp) {
+      async answerOffer(offerId, answererUsername, answerSdp, matchedTags) {
         const offer = await this.getOfferById(offerId);
         if (!offer) {
           return {
@@ -958,10 +960,11 @@ var init_sqlite = __esm({
         }
         const stmt = this.db.prepare(`
       UPDATE offers
-      SET answerer_username = ?, answer_sdp = ?, answered_at = ?
+      SET answerer_username = ?, answer_sdp = ?, answered_at = ?, matched_tags = ?
       WHERE id = ? AND answerer_username IS NULL
     `);
-        const result = stmt.run(answererUsername, answerSdp, Date.now(), offerId);
+        const matchedTagsJson = matchedTags ? JSON.stringify(matchedTags) : null;
+        const result = stmt.run(answererUsername, answerSdp, Date.now(), matchedTagsJson, offerId);
         if (result.changes === 0) {
           return {
             success: false,
@@ -1288,7 +1291,8 @@ var init_sqlite = __esm({
           lastSeen: row.last_seen,
           answererUsername: row.answerer_username || void 0,
           answerSdp: row.answer_sdp || void 0,
-          answeredAt: row.answered_at || void 0
+          answeredAt: row.answered_at || void 0,
+          matchedTags: row.matched_tags ? JSON.parse(row.matched_tags) : void 0
         };
       }
     };
@@ -1346,6 +1350,7 @@ var init_mysql = __esm({
           answerer_username VARCHAR(32),
           answer_sdp MEDIUMTEXT,
           answered_at BIGINT,
+          matched_tags JSON,
           INDEX idx_offers_username (username),
           INDEX idx_offers_expires (expires_at),
           INDEX idx_offers_last_seen (last_seen),
@@ -1457,7 +1462,7 @@ var init_mysql = __esm({
         );
         return result.affectedRows;
       }
-      async answerOffer(offerId, answererUsername, answerSdp) {
+      async answerOffer(offerId, answererUsername, answerSdp, matchedTags) {
         const offer = await this.getOfferById(offerId);
         if (!offer) {
           return { success: false, error: "Offer not found or expired" };
@@ -1465,10 +1470,11 @@ var init_mysql = __esm({
         if (offer.answererUsername) {
           return { success: false, error: "Offer already answered" };
         }
+        const matchedTagsJson = matchedTags ? JSON.stringify(matchedTags) : null;
         const [result] = await this.pool.query(
-          `UPDATE offers SET answerer_username = ?, answer_sdp = ?, answered_at = ?
+          `UPDATE offers SET answerer_username = ?, answer_sdp = ?, answered_at = ?, matched_tags = ?
        WHERE id = ? AND answerer_username IS NULL`,
-          [answererUsername, answerSdp, Date.now(), offerId]
+          [answererUsername, answerSdp, Date.now(), matchedTagsJson, offerId]
         );
         if (result.affectedRows === 0) {
           return { success: false, error: "Offer already answered (race condition)" };
@@ -1758,7 +1764,8 @@ var init_mysql = __esm({
           lastSeen: Number(row.last_seen),
           answererUsername: row.answerer_username || void 0,
           answerSdp: row.answer_sdp || void 0,
-          answeredAt: row.answered_at ? Number(row.answered_at) : void 0
+          answeredAt: row.answered_at ? Number(row.answered_at) : void 0,
+          matchedTags: row.matched_tags ? typeof row.matched_tags === "string" ? JSON.parse(row.matched_tags) : row.matched_tags : void 0
         };
       }
       rowToIceCandidate(row) {
@@ -1823,7 +1830,8 @@ var init_postgres = __esm({
           last_seen BIGINT NOT NULL,
           answerer_username VARCHAR(32),
           answer_sdp TEXT,
-          answered_at BIGINT
+          answered_at BIGINT,
+          matched_tags JSONB
         )
       `);
           await client.query(`CREATE INDEX IF NOT EXISTS idx_offers_username ON offers(username)`);
@@ -1935,7 +1943,7 @@ var init_postgres = __esm({
         );
         return result.rowCount ?? 0;
       }
-      async answerOffer(offerId, answererUsername, answerSdp) {
+      async answerOffer(offerId, answererUsername, answerSdp, matchedTags) {
         const offer = await this.getOfferById(offerId);
         if (!offer) {
           return { success: false, error: "Offer not found or expired" };
@@ -1943,10 +1951,11 @@ var init_postgres = __esm({
         if (offer.answererUsername) {
           return { success: false, error: "Offer already answered" };
         }
+        const matchedTagsJson = matchedTags ? JSON.stringify(matchedTags) : null;
         const result = await this.pool.query(
-          `UPDATE offers SET answerer_username = $1, answer_sdp = $2, answered_at = $3
-       WHERE id = $4 AND answerer_username IS NULL`,
-          [answererUsername, answerSdp, Date.now(), offerId]
+          `UPDATE offers SET answerer_username = $1, answer_sdp = $2, answered_at = $3, matched_tags = $4
+       WHERE id = $5 AND answerer_username IS NULL`,
+          [answererUsername, answerSdp, Date.now(), matchedTagsJson, offerId]
         );
         if ((result.rowCount ?? 0) === 0) {
           return { success: false, error: "Offer already answered (race condition)" };
@@ -2244,7 +2253,8 @@ var init_postgres = __esm({
           lastSeen: Number(row.last_seen),
           answererUsername: row.answerer_username || void 0,
           answerSdp: row.answer_sdp || void 0,
-          answeredAt: row.answered_at ? Number(row.answered_at) : void 0
+          answeredAt: row.answered_at ? Number(row.answered_at) : void 0,
+          matchedTags: row.matched_tags || void 0
         };
       }
       rowToIceCandidate(row) {
@@ -2593,7 +2603,7 @@ var handlers = {
    * Answer an offer
    */
   async answerOffer(params, name, timestamp, signature, storage, config, request) {
-    const { offerId, sdp } = params;
+    const { offerId, sdp, matchedTags } = params;
     validateStringParam(offerId, "offerId");
     if (!name) {
       throw new RpcError(ErrorCodes.AUTH_REQUIRED, "Name required");
@@ -2604,6 +2614,9 @@ var handlers = {
     if (sdp.length > config.maxSdpSize) {
       throw new RpcError(ErrorCodes.SDP_TOO_LARGE, `SDP too large (max ${config.maxSdpSize} bytes)`);
     }
+    if (matchedTags !== void 0 && !Array.isArray(matchedTags)) {
+      throw new RpcError(ErrorCodes.INVALID_PARAMS, "matchedTags must be an array");
+    }
     const offer = await storage.getOfferById(offerId);
     if (!offer) {
       throw new RpcError(ErrorCodes.OFFER_NOT_FOUND, "Offer not found");
@@ -2611,7 +2624,14 @@ var handlers = {
     if (offer.answererUsername) {
       throw new RpcError(ErrorCodes.OFFER_ALREADY_ANSWERED, "Offer already answered");
     }
-    await storage.answerOffer(offerId, name, sdp);
+    if (matchedTags && matchedTags.length > 0) {
+      const offerTagSet = new Set(offer.tags);
+      const invalidTags = matchedTags.filter((tag) => !offerTagSet.has(tag));
+      if (invalidTags.length > 0) {
+        throw new RpcError(ErrorCodes.INVALID_PARAMS, `matchedTags contains tags not on offer: ${invalidTags.join(", ")}`);
+      }
+    }
+    await storage.answerOffer(offerId, name, sdp, matchedTags);
     return { success: true, offerId };
   },
   /**
@@ -3018,7 +3038,7 @@ function createApp(storage, config) {
 }
 
 // src/config.ts
-var BUILD_VERSION = true ? "0.5.11" : "unknown";
+var BUILD_VERSION = true ? "0.5.12" : "unknown";
 function loadConfig() {
   let masterEncryptionKey = process.env.MASTER_ENCRYPTION_KEY;
   if (!masterEncryptionKey) {