trustbase-seller-backend 0.1.5

package/api/middleware/p2p-auth.d.ts

@@ -0,0 +1,140 @@
+/**
+ * Peer-to-Peer Auth Middleware (PRD-F Phase 2 §6)
+ *
+ * Four composable middlewares for protecting /api/p2p/mcp/* endpoints:
+ *
+ *   1. verifyPeerSignature
+ *      Pulls X-Node-ID, X-Signature, X-Nonce, X-Timestamp from the headers,
+ *      looks up the caller's public key on-chain (peer.discover by node_id),
+ *      rebuilds the canonical envelope, and verifies the secp256k1 signature.
+ *      On success, attaches `req.peer = { node_id, public_key }`.
+ *
+ *   2. requireTrustLevel(level)
+ *      Reads `peer_trust.trust_level` from the local SQLite whitelist. If the
+ *      caller's trust_level is < `level`, returns 403.
+ *
+ *   3. preventReplay
+ *      LRU+TTL cache of `(node_id, nonce)` pairs. Same nonce from the same
+ *      caller within the 5-minute window is rejected. Also enforces the
+ *      timestamp window (±5 minutes) before the nonce check.
+ *
+ *   4. rateLimitPerPeer
+ *      Per-peer token-bucket rate limiter (10 req/min, configurable). Pairs
+ *      with a global IP rate limiter mounted at the /api/p2p/ root.
+ *
+ * Design notes:
+ *   - All middlewares are pure factory functions that return an Express
+ *     RequestHandler. Easy to test in isolation with `supertest`.
+ *   - The chain RPC lookup is delegated to `discoverEndpoints` so tests can
+ *     inject a fake via `setChainClientFactory` (already exported from
+ *     peer-tools.ts).
+ *   - Nonce cache and rate limiter are module-level singletons. They grow
+ *     with traffic; the TTL on the nonce cache bounds memory to a few MB
+ *     even at 100k unique nonces/min.
+ *   - No new npm deps. LRU is a Map + lazy TTL eviction; rate limiter is a
+ *     Map + sliding window. Both are tested in __tests__/.
+ */
+import type { Request, RequestHandler } from 'express';
+import Database from 'better-sqlite3';
+import { discoverEndpoints } from '../../mcp/peer-tools';
+declare module 'express-serve-static-core' {
+    interface Request {
+        /** Populated by verifyPeerSignature once the signature passes. */
+        peer?: {
+            node_id: string;
+            public_key: Uint8Array;
+            /** Trust level from peer_trust table, if any. */
+            trust_level?: 'read' | 'write' | 'admin' | null;
+        };
+        /** Raw bytes of the request body, captured by express.json({ verify }). */
+        rawBody?: Buffer;
+    }
+}
+export type TrustLevel = 'read' | 'write' | 'admin';
+export interface VerifyPeerSignatureOptions {
+    /**
+     * How to obtain the SQLite db handle. Default: `(req) => req.app.locals.db`.
+     * Not used for the chain lookup, but kept for parity / future extension.
+     */
+    resolveDb?: (req: Request) => Database.Database | null;
+    /**
+     * How to obtain the chain RPC client. Default: use `discoverEndpoints` from
+     * peer-tools.ts (which itself is mockable via setChainClientFactory).
+     */
+    discover?: typeof discoverEndpoints;
+    /**
+     * Optional override for the canonical digest. The default rebuilds the
+     * same envelope shape used by sendRequest: method || path || body || nonce || ts.
+     */
+    buildDigest?: (req: Request) => Uint8Array;
+    /** Skip the chain lookup (useful for tests that inject req.peer directly). */
+    skipChainLookup?: boolean;
+}
+export declare function verifyPeerSignature(opts?: VerifyPeerSignatureOptions): RequestHandler;
+export interface RequireTrustLevelOptions {
+    /** Resolver for the SQLite db handle. Default: req.app.locals.db. */
+    resolveDb?: (req: Request) => Database.Database | null;
+}
+export declare function requireTrustLevel(level: TrustLevel, opts?: RequireTrustLevelOptions): RequestHandler;
+export interface PreventReplayOptions {
+    /** Allowed clock skew, in seconds. Default 300 (±5 min, matches PRD §6.2). */
+    windowSeconds?: number;
+    /** Max nonce cache size. Default 10000. */
+    maxNonces?: number;
+    /** TTL for nonces, ms. Default 10 minutes (matches ±5 min window). */
+    ttlMs?: number;
+    /** Test seam: provide a custom clock (ms). */
+    nowMs?: () => number;
+}
+declare class NonceCache {
+    private readonly maxSize;
+    private readonly ttlMs;
+    private readonly map;
+    constructor(maxSize: number, ttlMs: number);
+    /** Returns true if the nonce was fresh (i.e. not seen before, or was seen but expired). */
+    reserve(key: string, nowMs: number): boolean;
+    has(key: string): boolean;
+    size(): number;
+    clear(): void;
+    private sweep;
+}
+export declare function preventReplay(opts?: PreventReplayOptions): RequestHandler;
+/** Exposed for tests. */
+export declare const __testing__: {
+    NonceCache: typeof NonceCache;
+};
+export interface RateLimitPerPeerOptions {
+    /** Max requests per window. Default 10. */
+    points?: number;
+    /** Window length, seconds. Default 60. */
+    duration?: number;
+    /** Test seam: clock in ms. */
+    nowMs?: () => number;
+}
+declare class PerPeerLimiter {
+    private readonly points;
+    private readonly windowMs;
+    private readonly nowFn;
+    private readonly buckets;
+    constructor(points: number, windowMs: number, nowFn: () => number);
+    /** Returns ms until the next request would be allowed, or 0 if allowed. */
+    consume(key: string): {
+        allowed: boolean;
+        retryAfterMs: number;
+        remaining: number;
+    };
+    size(): number;
+    clear(): void;
+}
+export declare function rateLimitPerPeer(opts?: RateLimitPerPeerOptions): RequestHandler;
+/** Exposed for tests. */
+export declare const __testing2__: {
+    PerPeerLimiter: typeof PerPeerLimiter;
+};
+export interface IpRateLimitOptions extends RateLimitPerPeerOptions {
+    /** Key extractor — default uses req.ip with ::ffff: prefix stripped. */
+    keyFn?: (req: Request) => string;
+}
+export declare function ipRateLimit(opts?: IpRateLimitOptions): RequestHandler;
+export {};
+//# sourceMappingURL=p2p-auth.d.ts.map

package/api/middleware/p2p-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"p2p-auth.d.ts","sourceRoot":"","sources":["../../../src/api/middleware/p2p-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,OAAO,EAA0B,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAGtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAOzD,OAAO,QAAQ,2BAA2B,CAAC;IACzC,UAAU,OAAO;QACf,kEAAkE;QAClE,IAAI,CAAC,EAAE;YACL,OAAO,EAAE,MAAM,CAAC;YAChB,UAAU,EAAE,UAAU,CAAC;YACvB,iDAAiD;YACjD,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,IAAI,CAAC;SACjD,CAAC;QACF,2EAA2E;QAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB;CACF;AAED,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAYpD,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC;IAEvD;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,iBAAiB,CAAC;IAEpC;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,UAAU,CAAC;IAE3C,8EAA8E;IAC9E,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AA0BD,wBAAgB,mBAAmB,CACjC,IAAI,GAAE,0BAA+B,GACpC,cAAc,CAkOhB;AAMD,MAAM,WAAW,wBAAwB;IACvC,qEAAqE;IACrE,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC;CACxD;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,UAAU,EACjB,IAAI,GAAE,wBAA6B,GAClC,cAAc,CAyChB;AAMD,MAAM,WAAW,oBAAoB;IACnC,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CACtB;AAED,cAAM,UAAU;IAEF,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAU,OAAO,CAAC,QAAQ,CAAC,KAAK;IADpE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA6B;gBACpB,OAAO,EAAE,MAAM,EAAmB,KAAK,EAAE,MAAM;IAE5E,2FAA2F;IAC3F,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAe5C,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIzB,IAAI,IAAI,MAAM;IAId,KAAK,IAAI,IAAI;IAIb,OAAO,CAAC,KAAK;CAed;AAED,wBAAgB,aAAa,CAAC,IAAI,GAAE,oBAAyB,GAAG,cAAc,CAuC7E;AAED,yBAAyB;AACzB,eAAO,MAAM,WAAW;;CAAiB,CAAC;AAM1C,MAAM,WAAW,uBAAuB;IACtC,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CACtB;AAOD,cAAM,cAAc;IAGhB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAJxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;gBAElC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,MAAM;IAGtC,2EAA2E;IAC3E,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAenF,IAAI,IAAI,MAAM;IAId,KAAK,IAAI,IAAI;CAGd;AAED,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,uBAA4B,GAAG,cAAc,CA0BnF;AAED,yBAAyB;AACzB,eAAO,MAAM,YAAY;;CAAqB,CAAC;AAM/C,MAAM,WAAW,kBAAmB,SAAQ,uBAAuB;IACjE,wEAAwE;IACxE,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;CAClC;AAED,wBAAgB,WAAW,CAAC,IAAI,GAAE,kBAAuB,GAAG,cAAc,CAwBzE"}

package/api/middleware/p2p-auth.js

@@ -0,0 +1,510 @@
+"use strict";
+/**
+ * Peer-to-Peer Auth Middleware (PRD-F Phase 2 §6)
+ *
+ * Four composable middlewares for protecting /api/p2p/mcp/* endpoints:
+ *
+ *   1. verifyPeerSignature
+ *      Pulls X-Node-ID, X-Signature, X-Nonce, X-Timestamp from the headers,
+ *      looks up the caller's public key on-chain (peer.discover by node_id),
+ *      rebuilds the canonical envelope, and verifies the secp256k1 signature.
+ *      On success, attaches `req.peer = { node_id, public_key }`.
+ *
+ *   2. requireTrustLevel(level)
+ *      Reads `peer_trust.trust_level` from the local SQLite whitelist. If the
+ *      caller's trust_level is < `level`, returns 403.
+ *
+ *   3. preventReplay
+ *      LRU+TTL cache of `(node_id, nonce)` pairs. Same nonce from the same
+ *      caller within the 5-minute window is rejected. Also enforces the
+ *      timestamp window (±5 minutes) before the nonce check.
+ *
+ *   4. rateLimitPerPeer
+ *      Per-peer token-bucket rate limiter (10 req/min, configurable). Pairs
+ *      with a global IP rate limiter mounted at the /api/p2p/ root.
+ *
+ * Design notes:
+ *   - All middlewares are pure factory functions that return an Express
+ *     RequestHandler. Easy to test in isolation with `supertest`.
+ *   - The chain RPC lookup is delegated to `discoverEndpoints` so tests can
+ *     inject a fake via `setChainClientFactory` (already exported from
+ *     peer-tools.ts).
+ *   - Nonce cache and rate limiter are module-level singletons. They grow
+ *     with traffic; the TTL on the nonce cache bounds memory to a few MB
+ *     even at 100k unique nonces/min.
+ *   - No new npm deps. LRU is a Map + lazy TTL eviction; rate limiter is a
+ *     Map + sliding window. Both are tested in __tests__/.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.__testing2__ = exports.__testing__ = void 0;
+exports.verifyPeerSignature = verifyPeerSignature;
+exports.requireTrustLevel = requireTrustLevel;
+exports.preventReplay = preventReplay;
+exports.rateLimitPerPeer = rateLimitPerPeer;
+exports.ipRateLimit = ipRateLimit;
+const encoding_1 = require("@cosmjs/encoding");
+const signing_1 = require("../../p2p/signing");
+const peer_tools_1 = require("../../mcp/peer-tools");
+const peer_monitor_broadcaster_1 = require("../../ws/peer-monitor-broadcaster");
+const TRUST_RANK = {
+    read: 1,
+    write: 2,
+    admin: 3,
+};
+const DEFAULT_DIGEST = (req) => {
+    const ts = req.header('X-Timestamp') ?? '';
+    const nonce = req.header('X-Nonce') ?? '';
+    const sig = req.header('X-Signature') ?? '';
+    const nid = req.header('X-Node-ID') ?? '';
+    // Canonical envelope: { method, path, body, nonce, timestamp, node_id }
+    // signing.ts canonicalize() strips any `signature` field, so we can include
+    // a `signature: sig` here without poisoning the digest.
+    const envelope = {
+        method: req.method,
+        // 宝贝 2026-06-23: Express sub-router 下 req.path 会 strip 掉 mount path
+        // (如 "/api/p2p/tools/invoke" 会 变 "/tools/invoke")，但客户端签名时用
+        // 的是完整路径。不加 baseUrl 反面会导致 envelope canonicalize 两端不一致。
+        path: (req.baseUrl || '') + req.path,
+        body: req.body ?? null,
+        nonce,
+        timestamp: ts,
+        node_id: nid,
+        signature: sig,
+    };
+    const json = (0, signing_1.canonicalize)(envelope);
+    return new TextEncoder().encode(json);
+};
+function verifyPeerSignature(opts = {}) {
+    const discover = opts.discover ?? peer_tools_1.discoverEndpoints;
+    const buildDigest = opts.buildDigest ?? DEFAULT_DIGEST;
+    const skipChainLookup = opts.skipChainLookup ?? false;
+    return async (req, res, next) => {
+        // PRD-F Phase 2 §6 — inbound P2P call log埋点。req start + res.finish 写一条
+        // peer_call_log。失败路径（401/403/500）也必须记录，所以埋点放在最外层 try 之前。
+        const callStartMs = Date.now();
+        const remoteIp = (req.ip ?? req.socket.remoteAddress ?? '').toString().replace(/^::ffff:/, '');
+        const headerNodeId = req.header('X-Node-ID') || null;
+        const reqPath = (req.baseUrl || '') + req.path;
+        const reqMethod = req.method;
+        let toolName = null;
+        try {
+            // 仅对 /api/p2p/mcp/tools/invoke 解析 body.tool_name
+            if (reqPath.endsWith('/tools/invoke') && req.body && typeof req.body === 'object') {
+                const tn = req.body.tool_name;
+                if (typeof tn === 'string')
+                    toolName = tn;
+            }
+        }
+        catch { /* ignore body parse issues */ }
+        // PRD-F Phase 2 §6.1 (扩展): 捕获响应体存 peer_call_log，便于 Web 端展开查看。
+        // 包装 res.json / res.send 而不破坏原有行为，body 落入 res.locals._responseBody。
+        // 截断 10KB，防止大 payload 撑爆 SQLite。
+        const MAX_BODY_BYTES = 10 * 1024;
+        const originalJson = res.json.bind(res);
+        const originalSend = res.send.bind(res);
+        let capturedResponseBody = null;
+        res.json = ((body) => {
+            try {
+                capturedResponseBody = body;
+                res.locals._responseBody = body;
+            }
+            catch { /* swallow — capture is best-effort */ }
+            return originalJson(body);
+        });
+        res.send = ((body) => {
+            try {
+                if (capturedResponseBody === null) {
+                    capturedResponseBody = body;
+                    res.locals._responseBody = body;
+                }
+            }
+            catch { /* swallow */ }
+            return originalSend(body);
+        });
+        const truncateBody = (v) => {
+            try {
+                if (v === undefined || v === null)
+                    return null;
+                const json = typeof v === 'string' ? v : JSON.stringify(v);
+                if (json.length <= MAX_BODY_BYTES)
+                    return json;
+                return json.slice(0, MAX_BODY_BYTES);
+            }
+            catch {
+                return null;
+            }
+        };
+        const captureRequestBody = () => {
+            try {
+                if (req.body === undefined || req.body === null)
+                    return null;
+                if (Buffer.isBuffer(req.body))
+                    return req.body.toString('utf8').slice(0, MAX_BODY_BYTES);
+                const json = typeof req.body === 'string' ? req.body : JSON.stringify(req.body);
+                if (json.length <= MAX_BODY_BYTES)
+                    return json;
+                return json.slice(0, MAX_BODY_BYTES);
+            }
+            catch {
+                return null;
+            }
+        };
+        const writeCallLog = (status, error, trustLevel) => {
+            try {
+                const db = req.app?.locals?.db ?? null;
+                if (!db)
+                    return; // 无 DB handle 时静默跳过，不影响主流程
+                const rtt = Date.now() - callStartMs;
+                const finalNodeId = req.peer?.node_id || headerNodeId;
+                const finalTrustLevel = trustLevel || req.peer?.trust_level || null;
+                // 捕获时尽量晚拿 —— res.finish 钩子里 res.locals 已有最终 body
+                const responseBodyStr = truncateBody(res.locals?._responseBody ?? capturedResponseBody);
+                const requestBodyStr = captureRequestBody();
+                const info = db.prepare(`INSERT INTO peer_call_log
+             (ts, direction, remote_node_id, remote_ip, method, path, tool_name,
+              status, error, rtt_ms, trust_level, request_body, response_body)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(callStartMs, 'inbound', finalNodeId, remoteIp, reqMethod, reqPath, toolName, status, error, rtt, finalTrustLevel, requestBodyStr, responseBodyStr);
+                // 实时推送给 /ws/peer-monitor 订阅者
+                const row = {
+                    id: Number(info.lastInsertRowid),
+                    ts: callStartMs,
+                    direction: 'inbound',
+                    remote_node_id: finalNodeId,
+                    remote_ip: remoteIp,
+                    method: reqMethod,
+                    path: reqPath,
+                    tool_name: toolName,
+                    status,
+                    error,
+                    rtt_ms: rtt,
+                    trust_level: finalTrustLevel,
+                    request_body: requestBodyStr,
+                    response_body: responseBodyStr,
+                };
+                try {
+                    peer_monitor_broadcaster_1.peerMonitorBroadcaster.broadcast({ type: 'peer-call', payload: row });
+                }
+                catch (e) {
+                    // 广播失败不应当影响主流程
+                    console.error('[p2p-auth] peer-monitor broadcast failed:', e?.message ?? e);
+                }
+            }
+            catch (e) {
+                // 写日志失败不应当阻塞响应；用 console.error 留痕
+                console.error('[p2p-auth] peer_call_log write failed:', e?.message ?? e);
+            }
+        };
+        // res.finish 钩子：响应真正写完后异步落库（覆盖成功 + 失败路径）
+        res.on('finish', () => {
+            // 此时 req.peer?.trust_level 可能已被 requireTrustLevel 写入
+            // 但 verifyPeerSignature 自身直接返回的错误（missing-headers / 401）也必须写
+            writeCallLog(res.statusCode, null, null);
+        });
+        try {
+            const nodeId = req.header('X-Node-ID');
+            const sigB64 = req.header('X-Signature');
+            const nonce = req.header('X-Nonce');
+            const ts = req.header('X-Timestamp');
+            if (!nodeId || !sigB64 || !nonce || !ts) {
+                return res.status(401).json({
+                    error: 'missing-headers',
+                    required: ['X-Node-ID', 'X-Signature', 'X-Nonce', 'X-Timestamp'],
+                });
+            }
+            let sigBytes;
+            try {
+                sigBytes = (0, encoding_1.fromBase64)(sigB64);
+            }
+            catch {
+                return res.status(401).json({ error: 'invalid-signature-encoding' });
+            }
+            if (sigBytes.length !== 64) {
+                return res.status(401).json({ error: 'invalid-signature-length', expected: 64, got: sigBytes.length });
+            }
+            let publicKey;
+            if (skipChainLookup) {
+                // Tests can pre-populate req.peer via a custom resolver.
+                publicKey = (req.peer?.public_key) ?? new Uint8Array(33);
+            }
+            else {
+                // Lesson #167: chain lookup 失败必须 fail-closed。
+                // discover() 抛错（本机 RPC 无 x/indexer 模块 / 节点不可达 / 查询超时）
+                // 时绝不能放行——显式 401 chain-lookup-failed，与签名错误区分开，
+                // 让运维一眼看出是"链查询挂了"而不是"签名不对"。
+                let discovered;
+                try {
+                    discovered = await discover({ by: 'node_id', value: nodeId });
+                }
+                catch (e) {
+                    return res.status(401).json({
+                        error: 'chain-lookup-failed',
+                        node_id: nodeId,
+                        hint: 'IndexerEndpoint query failed; check that the local chain node has x/indexer and is reachable',
+                    });
+                }
+                if (discovered.endpoints.length === 0) {
+                    return res.status(401).json({
+                        error: 'unknown-peer',
+                        node_id: nodeId,
+                        hint: 'no IndexerEndpoint on chain; caller must register first',
+                    });
+                }
+                publicKey = (0, encoding_1.fromBase64)(discovered.endpoints[0].public_key);
+            }
+            const digest = buildDigest(req);
+            const envelope = {
+                method: req.method,
+                // 宝贝 2026-06-23: 包含 mount path，否则与客户端签名时 path 不一致
+                path: (req.baseUrl || '') + req.path,
+                body: req.body ?? null,
+                nonce,
+                timestamp: ts,
+                node_id: nodeId,
+                signature: sigB64,
+            };
+            const ok = await (0, signing_1.verifySignature)(envelope, publicKey);
+            if (!ok) {
+                return res.status(401).json({
+                    error: 'signature-verification-failed',
+                    node_id: nodeId,
+                    hint: 'check that headers/body match what was signed',
+                });
+            }
+            // Surface for downstream middlewares / handlers.
+            req.peer = {
+                node_id: nodeId,
+                public_key: publicKey,
+                trust_level: null,
+            };
+            next();
+        }
+        catch (err) {
+            console.error('[p2p-auth] verifyPeerSignature error:', err?.message ?? err);
+            // Treat any unexpected failure as auth failure — never leak internal
+            // errors to the caller IN PRODUCTION. Dev mode surfaces a truncated hint.
+            const isProd = process.env.NODE_ENV === 'production';
+            const message = { error: 'signature-verification-error' };
+            if (!isProd) {
+                const hint = (err?.message ?? String(err)).slice(0, 240);
+                message.hint = `[dev] ${hint}`;
+            }
+            res.status(401).json(message);
+        }
+    };
+}
+function requireTrustLevel(level, opts = {}) {
+    const resolveDb = opts.resolveDb ?? ((req) => req.app.locals?.db ?? null);
+    return (req, res, next) => {
+        const peer = req.peer;
+        if (!peer) {
+            // Should be unreachable if verifyPeerSignature runs first, but guard
+            // anyway so a misconfigured chain fails closed.
+            return res.status(401).json({ error: 'no-peer-context' });
+        }
+        const db = resolveDb(req);
+        if (!db) {
+            return res.status(500).json({ error: 'no-database-handle' });
+        }
+        const row = db
+            .prepare('SELECT trust_level FROM peer_trust WHERE peer_node_id = ?')
+            .get(peer.node_id);
+        if (!row) {
+            return res.status(403).json({
+                error: 'peer-not-in-whitelist',
+                node_id: peer.node_id,
+            });
+        }
+        if (row.trust_level !== 'read' && row.trust_level !== 'write' && row.trust_level !== 'admin') {
+            return res.status(500).json({
+                error: 'corrupt-trust-level',
+                node_id: peer.node_id,
+                stored: row.trust_level,
+            });
+        }
+        peer.trust_level = row.trust_level;
+        if (TRUST_RANK[peer.trust_level] < TRUST_RANK[level]) {
+            return res.status(403).json({
+                error: 'insufficient-trust-level',
+                node_id: peer.node_id,
+                required: level,
+                actual: peer.trust_level,
+            });
+        }
+        next();
+    };
+}
+class NonceCache {
+    maxSize;
+    ttlMs;
+    map = new Map(); // key → expiryMs
+    constructor(maxSize, ttlMs) {
+        this.maxSize = maxSize;
+        this.ttlMs = ttlMs;
+    }
+    /** Returns true if the nonce was fresh (i.e. not seen before, or was seen but expired). */
+    reserve(key, nowMs) {
+        // Sweep expired entries when we approach capacity (cheap amortized).
+        if (this.map.size >= this.maxSize) {
+            this.sweep(nowMs);
+        }
+        const existing = this.map.get(key);
+        if (existing !== undefined && existing > nowMs) {
+            // Still within TTL — duplicate.
+            return false;
+        }
+        // Either never seen, or expired → treat as fresh.
+        this.map.set(key, nowMs + this.ttlMs);
+        return true;
+    }
+    has(key) {
+        return this.map.has(key);
+    }
+    size() {
+        return this.map.size;
+    }
+    clear() {
+        this.map.clear();
+    }
+    sweep(nowMs) {
+        for (const [k, exp] of this.map) {
+            if (exp <= nowMs)
+                this.map.delete(k);
+        }
+        // Hard cap as last resort if everything is fresh.
+        if (this.map.size >= this.maxSize) {
+            const drop = Math.floor(this.maxSize / 4);
+            const iter = this.map.keys();
+            for (let i = 0; i < drop; i++) {
+                const k = iter.next().value;
+                if (k === undefined)
+                    break;
+                this.map.delete(k);
+            }
+        }
+    }
+}
+function preventReplay(opts = {}) {
+    const windowSeconds = opts.windowSeconds ?? 300;
+    const maxNonces = opts.maxNonces ?? 10_000;
+    const ttlMs = opts.ttlMs ?? windowSeconds * 2 * 1000; // 2× window so the cache outlives any in-flight request
+    const nowMs = opts.nowMs ?? (() => Date.now());
+    const cache = new NonceCache(maxNonces, ttlMs);
+    return (req, res, next) => {
+        const nonce = req.header('X-Nonce');
+        const tsMs = parseInt(req.header('X-Timestamp') ?? '', 10);
+        if (!nonce || !Number.isFinite(tsMs)) {
+            return res.status(401).json({ error: 'missing-replay-headers' });
+        }
+        // 宝贝 2026-06-23: 客户端发 X-Timestamp 是毫秒（Date.now()），
+        // 但 windowSeconds 上下文是秒，这里必须换算为秒再比较，否则总是
+        // 报 timestamp-out-of-range (毫秒 vs 秒 差 1000× 超出任何合理窗口)
+        const ts = Math.floor(tsMs / 1000);
+        const now = Math.floor(nowMs() / 1000);
+        if (Math.abs(now - ts) > windowSeconds) {
+            return res.status(401).json({
+                error: 'timestamp-out-of-range',
+                now,
+                provided: ts,
+                window_seconds: windowSeconds,
+            });
+        }
+        const peer = req.peer;
+        if (!peer) {
+            return res.status(401).json({ error: 'no-peer-context' });
+        }
+        const key = `${peer.node_id}:${nonce}`;
+        if (!cache.reserve(key, nowMs())) {
+            return res.status(401).json({
+                error: 'nonce-already-used',
+                node_id: peer.node_id,
+            });
+        }
+        next();
+    };
+}
+/** Exposed for tests. */
+exports.__testing__ = { NonceCache };
+class PerPeerLimiter {
+    points;
+    windowMs;
+    nowFn;
+    buckets = new Map();
+    constructor(points, windowMs, nowFn) {
+        this.points = points;
+        this.windowMs = windowMs;
+        this.nowFn = nowFn;
+    }
+    /** Returns ms until the next request would be allowed, or 0 if allowed. */
+    consume(key) {
+        const now = this.nowFn();
+        let b = this.buckets.get(key);
+        if (!b || b.resetAtMs <= now) {
+            b = { count: 1, resetAtMs: now + this.windowMs };
+            this.buckets.set(key, b);
+            return { allowed: true, retryAfterMs: 0, remaining: this.points - 1 };
+        }
+        if (b.count >= this.points) {
+            return { allowed: false, retryAfterMs: b.resetAtMs - now, remaining: 0 };
+        }
+        b.count++;
+        return { allowed: true, retryAfterMs: 0, remaining: this.points - b.count };
+    }
+    size() {
+        return this.buckets.size;
+    }
+    clear() {
+        this.buckets.clear();
+    }
+}
+function rateLimitPerPeer(opts = {}) {
+    const points = opts.points ?? 10;
+    const duration = opts.duration ?? 60;
+    const windowMs = duration * 1000;
+    const nowFn = opts.nowMs ?? (() => Date.now());
+    const limiter = new PerPeerLimiter(points, windowMs, nowFn);
+    return (req, res, next) => {
+        const peer = req.peer;
+        if (!peer) {
+            return res.status(401).json({ error: 'no-peer-context' });
+        }
+        const verdict = limiter.consume(peer.node_id);
+        res.setHeader('X-RateLimit-Limit', String(points));
+        if (!verdict.allowed) {
+            const retrySec = Math.max(1, Math.ceil(verdict.retryAfterMs / 1000));
+            res.setHeader('Retry-After', String(retrySec));
+            return res.status(429).json({
+                error: 'rate-limit-exceeded',
+                retry_after_seconds: retrySec,
+                peer: peer.node_id,
+            });
+        }
+        res.setHeader('X-RateLimit-Remaining', String(verdict.remaining));
+        next();
+    };
+}
+/** Exposed for tests. */
+exports.__testing2__ = { PerPeerLimiter };
+function ipRateLimit(opts = {}) {
+    const points = opts.points ?? 100;
+    const duration = opts.duration ?? 60;
+    const windowMs = duration * 1000;
+    const nowFn = opts.nowMs ?? (() => Date.now());
+    const keyFn = opts.keyFn ??
+        ((req) => (req.ip ?? req.socket.remoteAddress ?? 'unknown').replace(/^::ffff:/, ''));
+    const limiter = new PerPeerLimiter(points, windowMs, nowFn);
+    return (req, res, next) => {
+        const verdict = limiter.consume(keyFn(req));
+        res.setHeader('X-RateLimit-Limit', String(points));
+        if (!verdict.allowed) {
+            const retrySec = Math.max(1, Math.ceil(verdict.retryAfterMs / 1000));
+            res.setHeader('Retry-After', String(retrySec));
+            return res.status(429).json({
+                error: 'ip-rate-limit-exceeded',
+                retry_after_seconds: retrySec,
+            });
+        }
+        res.setHeader('X-RateLimit-Remaining', String(verdict.remaining));
+        next();
+    };
+}
+//# sourceMappingURL=p2p-auth.js.map