// Verify incoming HMAC-signed peer requests (X-SS-* headers, see constants.js
// HEADERS) and sign the responses -- site-sync's binding of the shared inbound
// peer auth (lib/common/peerServer.js, which documents the protocol). Requests
// use Content-Type application/vnd.site-sync+json so Saltcorn's express.json()
// leaves the raw bytes for the HMAC.
//
// requirePeerAuth(req, res) returns the authenticated peer row (req.body = the
// signed JSON body, {} when empty) or null after sending a 4xx; handlers answer
// with sendSignedJson / sendSigned (transport.js refuses any response whose
// signature does not verify against its own nonce).

const { createPeerAuth }             = require("./common/peerServer");
const peers                          = require("./peers");
const { getEnv }                     = require("./env");
const { HEADERS, SEEN_NONCES_TABLE } = require("./constants");
const { PEER_LIMITS }                = require("./transport");


module.exports = createPeerAuth({
    headers:      HEADERS,
    nonceTable:   SEEN_NONCES_TABLE,
    maxBodyBytes: PEER_LIMITS.REQUEST_BODY_BYTES,
    peers:        peers,
    getEnv:       getEnv
});