feat: enforce device-bound connect challenge

2026-01-20 11:15:10 +00:00
parent 121ae6036b
commit dfbf6ac263
21 changed files with 953 additions and 129 deletions
--- a/src/gateway/test-helpers.server.ts
+++ b/src/gateway/test-helpers.server.ts
@@ -279,6 +279,7 @@ export async function connectReq(
      publicKey: string;
      signature: string;
      signedAt: number;
+      nonce?: string;
    };
  },
 ): Promise<ConnectResponse> {
@@ -310,6 +311,7 @@ export async function connectReq(
      publicKey: publicKeyRawBase64UrlFromPem(identity.publicKeyPem),
      signature: signDevicePayload(identity.privateKeyPem, payload),
      signedAt: signedAtMs,
+      nonce: opts?.device?.nonce,
    };
  })();
  ws.send(