elpaypg 0.0.0-stage → 2.0.0

package/src/routes/device.routes.js

@@ -0,0 +1,303 @@
+import { Router } from 'express';
+import {
+  generateFingerprintHash,
+  normalizeDeviceSignals,
+  verifyDeviceSignature,
+  createDeviceChallenge,
+  consumeDeviceChallenge
+} from '../vendor/core/index.js';
+
+/**
+ * Resolves a verified customer ID strictly from a valid customer session token.
+ */
+function resolveAuthenticatedCustomerId(req, body, ctx) {
+  if (!ctx.customerSessionRepo) return null;
+  let token = body?.token || req.headers['x-customer-token'] || null;
+  if (!token) {
+    const authHeader = req.headers['authorization'] || '';
+    if (authHeader.startsWith('Bearer ')) {
+      token = authHeader.slice(7).trim();
+    }
+  }
+  if (!token || typeof token !== 'string') return null;
+  const authCtx = ctx.customerSessionRepo.findByToken(token.trim());
+  return authCtx?.customer?.id || null;
+}
+
+/**
+ * Registers device identity and cryptographic binding routes.
+ * @param {HttpServer} server
+ * @param {{
+ *   deviceRepo: import('../vendor/db/index.js').DeviceRepository,
+ *   customerRepo: import('../vendor/db/index.js').CustomerRepository,
+ *   customerSessionRepo?: import('../vendor/db/index.js').CustomerSessionRepository,
+ *   auditRepo?: import('../vendor/db/index.js').AuditLogRepository
+ * }} ctx
+ */
+export function registerDeviceRoutes(router, ctx) {
+  // 0. POST /api/v1/devices/challenge
+  router.post('/api/v1/devices/challenge', async (req, res) => {
+    const body = req.body || {};
+    const { publicKey, deviceId } = body;
+
+    if (!publicKey && !deviceId) {
+      res.status(400).json({ error: 'publicKey or deviceId is required' });
+      return;
+    }
+
+    const existing = publicKey
+      ? ctx.deviceRepo.findByPublicKey(String(publicKey).trim())
+      : ctx.deviceRepo.findById(String(deviceId).trim());
+
+    if (!existing || existing.status !== 'ACTIVE') {
+      res.status(404).json({ error: 'Device not found or inactive' });
+      return;
+    }
+
+    const challenge = createDeviceChallenge(existing.id);
+    res.status(200).json({
+      success: true,
+      deviceId: existing.id,
+      challenge
+    });
+  });
+
+  // 1. POST /api/v1/devices/register
+  router.post('/api/v1/devices/register', async (req, res) => {
+    const body = req.body || {};
+    const { publicKey, signals, challenge, signature, payload } = body;
+
+    if (!publicKey || typeof publicKey !== 'string' || !publicKey.trim()) {
+      res.status(400).json({ error: 'Device public key is required for registration.' });
+      return;
+    }
+
+    const trimmedPublicKey = publicKey.trim();
+    if (trimmedPublicKey.startsWith('adhoc_')) {
+      res.status(400).json({ error: 'Invalid device public key format.' });
+      return;
+    }
+
+    // Resolve or generate fingerprint hash
+    const clientSignals = signals || {};
+    if (!clientSignals.userAgent && req.headers['user-agent']) {
+      clientSignals.userAgent = req.headers['user-agent'];
+    }
+    if (!clientSignals.language && req.headers['accept-language']) {
+      clientSignals.language = req.headers['accept-language'].split(',')[0];
+    }
+
+    const fingerprintHash = body.fingerprintHash || generateFingerprintHash(clientSignals);
+    const normalized = normalizeDeviceSignals(clientSignals);
+
+    // Optional customer association strictly from verified customer session token (never bare customerId)
+    const customerId = resolveAuthenticatedCustomerId(req, body, ctx);
+
+    // Check if device with this exact public key already exists
+    const existing = ctx.deviceRepo.findByPublicKey(trimmedPublicKey);
+    if (existing) {
+      if (existing.status !== 'ACTIVE') {
+        res.status(403).json({ error: 'DEVICE_REVOKED', message: 'Device has been revoked or deactivated.' });
+        return;
+      }
+
+      // Never return or rotate a deviceToken for an existing publicKey unless the caller
+      // proves possession of the private key by signing a valid server-issued challenge.
+      const hasChallengeProof =
+        typeof challenge === 'string' &&
+        challenge.trim().length > 0 &&
+        typeof signature === 'string' &&
+        signature.trim().length > 0 &&
+        payload !== undefined &&
+        payload !== null;
+
+      if (!hasChallengeProof) {
+        const freshChallenge = createDeviceChallenge(existing.id);
+        res.status(409).json({
+          error: 'DEVICE_ALREADY_REGISTERED',
+          code: 'CHALLENGE_REQUIRED',
+          message: 'This public key is already registered. Sign the server challenge with your private key to rotate credentials.',
+          deviceId: existing.id,
+          challenge: freshChallenge,
+          isExisting: true
+        });
+        return;
+      }
+
+      const challengeOk = consumeDeviceChallenge(challenge.trim(), existing.id);
+      const sigOk = challengeOk && verifyDeviceSignature(
+        existing.publicKey,
+        payload,
+        signature,
+        { expectedDeviceId: existing.id, expectedChallenge: challenge.trim() }
+      );
+
+      if (!sigOk) {
+        res.status(401).json({
+          error: 'DEVICE_CHALLENGE_FAILED',
+          message: 'Failed to verify private-key ownership for existing device public key.'
+        });
+        return;
+      }
+
+      if (customerId && !existing.customerId) {
+        ctx.deviceRepo.associateCustomer(existing.id, customerId);
+      }
+      ctx.deviceRepo.touch(existing.id);
+      const rotatedToken = ctx.deviceRepo.rotateToken(existing.id);
+
+      res.status(200).json({
+        success: true,
+        deviceId: existing.id,
+        deviceToken: rotatedToken,
+        fingerprintHash: existing.fingerprintHash,
+        status: existing.status,
+        isExisting: true
+      });
+      return;
+    }
+
+    // Register new device
+    const device = ctx.deviceRepo.create({
+      customerId,
+      publicKey: trimmedPublicKey,
+      fingerprintHash,
+      userAgent: normalized.userAgent,
+      platform: normalized.platform,
+      browser: normalized.webglRenderer ? 'WebBrowser' : null,
+      timezone: normalized.timezone,
+      language: normalized.language,
+      screenSignature: normalized.screenSignature
+    });
+
+    if (ctx.auditRepo) {
+      ctx.auditRepo.log({
+        entityType: 'DEVICE',
+        entityId: device.id,
+        action: 'DEVICE_REGISTERED',
+        actorType: customerId ? 'CUSTOMER' : 'SYSTEM',
+        actorId: customerId || 'ANONYMOUS',
+        details: {
+          fingerprintHash: device.fingerprintHash,
+          platform: normalized.platform,
+          screenSignature: normalized.screenSignature
+        }
+      });
+    }
+
+    res.status(201).json({
+      success: true,
+      deviceId: device.id,
+      deviceToken: device.deviceToken,
+      fingerprintHash: device.fingerprintHash,
+      status: device.status,
+      isExisting: false
+    });
+  });
+
+  // 2. POST /api/v1/devices/verify
+  router.post('/api/v1/devices/verify', async (req, res) => {
+    const body = req.body || {};
+    const { deviceId, payload, signature, deviceToken } = body;
+
+    if (!deviceId || typeof deviceId !== 'string') {
+      res.status(400).json({ valid: false, error: 'deviceId is required' });
+      return;
+    }
+
+    const device = ctx.deviceRepo.findById(deviceId);
+    if (!device || device.status !== 'ACTIVE' || (typeof device.publicKey === 'string' && device.publicKey.startsWith('adhoc_'))) {
+      res.status(404).json({ valid: false, error: 'Device not found or inactive' });
+      return;
+    }
+
+    const hasToken = typeof deviceToken === 'string' && deviceToken.trim().length > 0;
+    const hasSig = typeof signature === 'string' && signature.trim().length > 0;
+    const hasPayload = payload !== undefined && payload !== null && String(payload).trim().length > 0;
+
+    // Require at least one cryptographic credential; never default to valid: true!
+    if (!hasToken && !hasSig) {
+      res.status(401).json({
+        valid: false,
+        error: 'DEVICE_CREDENTIALS_REQUIRED',
+        message: 'A deviceToken or cryptographic signature with payload is required.',
+        deviceId: device.id,
+        tokenValid: false,
+        signatureValid: false
+      });
+      return;
+    }
+
+    if ((hasSig && !hasPayload) || (!hasSig && hasPayload)) {
+      res.status(401).json({
+        valid: false,
+        error: 'DEVICE_SIGNATURE_INVALID',
+        message: 'Both signature and payload are required for signature verification.',
+        deviceId: device.id,
+        tokenValid: false,
+        signatureValid: false
+      });
+      return;
+    }
+
+    const tokenValid = hasToken ? ctx.deviceRepo.verifyToken(device.id, deviceToken.trim()) : true;
+    const signatureValid = hasSig
+      ? verifyDeviceSignature(device.publicKey, payload, signature, { expectedDeviceId: device.id })
+      : true;
+
+    const isValid = tokenValid && signatureValid;
+
+    res.status(isValid ? 200 : 401).json({
+      valid: isValid,
+      deviceId: device.id,
+      customerId: device.customerId,
+      tokenValid: hasToken ? tokenValid : false,
+      signatureValid: hasSig ? signatureValid : false
+    });
+  });
+
+  // 3. GET /api/v1/devices/:id
+  router.get('/api/v1/devices/:id', async (req, res) => {
+    const device = ctx.deviceRepo.findById(req.params.id);
+    if (!device) {
+      res.status(404).json({ error: 'Device not found' });
+      return;
+    }
+
+    res.status(200).json({
+      id: device.id,
+      customerId: device.customerId,
+      fingerprintHash: device.fingerprintHash,
+      platform: device.platform,
+      timezone: device.timezone,
+      language: device.language,
+      status: device.status,
+      createdAt: device.createdAt,
+      lastSeenAt: device.lastSeenAt
+    });
+  });
+
+  // 4. GET /api/v1/devices/customer/:customerId
+  router.get('/api/v1/devices/customer/:customerId', async (req, res) => {
+    const devices = ctx.deviceRepo.findByCustomerId(req.params.customerId);
+    res.status(200).json({
+      customerId: req.params.customerId,
+      count: devices.length,
+      devices: devices.map(d => ({
+        id: d.id,
+        fingerprintHash: d.fingerprintHash,
+        platform: d.platform,
+        timezone: d.timezone,
+        status: d.status,
+        createdAt: d.createdAt,
+        lastSeenAt: d.lastSeenAt
+      }))
+    });
+  });
+}
+
+
+
+
+
+