Create index.js

index.js

@@ -0,0 +1,91 @@
+// The entire server-side API.
+const express = require('express');
+const multer = require('multer');
+const cors = require('cors');
+const sharp = require('sharp');
+const { webcrypto } = require('crypto');
+
+const app = express();
+const PORT = process.env.PORT || 7860; // HF Spaces uses port 7860
+
+// Allow requests from any origin. For production, you should restrict this
+// to the specific domain of your client application.
+app.use(cors());
+
+// --- Full Decoder Logic ---
+function pemToDer(pem) {
+    const b64 = pem.replace(/-----BEGIN PRIVATE KEY-----/, '').replace(/-----END PRIVATE KEY-----/, '').replace(/\\n/g, '').replace(/\s/g, '');
+    const binaryDer = atob(b64);
+    const buffer = new ArrayBuffer(binaryDer.length);
+    const bytes = new Uint8Array(buffer);
+    for (let i = 0; i < binaryDer.length; i++) { bytes[i] = binaryDer.charCodeAt(i); }
+    return buffer;
+}
+
+async function decodeFromImageBuffer(imageBuffer, privateKeyPem) {
+    // 1. Extract data from image using Sharp
+    const { data: pixelData } = await sharp(imageBuffer).raw().toBuffer({ resolveWithObject: true });
+    const HEADER_BITS = 32;
+    let headerBinaryString = '';
+    for (let i = 0; headerBinaryString.length < HEADER_BITS; i++) {
+        const pixelIndex = i * 4;
+        if(pixelData.length < pixelIndex + 3) throw new Error("Image too small for header.");
+        headerBinaryString += pixelData[pixelIndex] & 1;
+        if (headerBinaryString.length < HEADER_BITS) headerBinaryString += pixelData[pixelIndex + 1] & 1;
+        if (headerBinaryString.length < HEADER_BITS) headerBinaryString += pixelData[pixelIndex + 2] & 1;
+    }
+    const headerBytes = new Uint8Array(HEADER_BITS / 8);
+    for (let i = 0; i < HEADER_BITS / 8; i++) { headerBytes[i] = parseInt(headerBinaryString.substring(i * 8, (i + 1) * 8), 2); }
+    const dataLengthInBytes = new DataView(headerBytes.buffer).getUint32(0, false);
+    if (dataLengthInBytes === 0) return {};
+
+    const dataLengthInBits = dataLengthInBytes * 8;
+    const bitOffset = HEADER_BITS;
+    let dataBinaryString = '';
+    for (let i = 0; dataBinaryString.length < dataLengthInBits; i++) {
+        const bitPosition = bitOffset + i;
+        const pixelIndex = Math.floor(bitPosition / 3) * 4;
+        const channelOffset = bitPosition % 3;
+        if(pixelData.length < pixelIndex + channelOffset) throw new Error("Image data is corrupt or truncated.");
+        dataBinaryString += pixelData[pixelIndex + channelOffset] & 1;
+    }
+    const cryptoPayload = new Uint8Array(dataLengthInBytes);
+    for (let i = 0; i < dataLengthInBytes; i++) { cryptoPayload[i] = parseInt(dataBinaryString.substring(i * 8, (i + 1) * 8), 2); }
+
+    // 2. Decrypt payload using Web Crypto API
+    const privateKey = await webcrypto.subtle.importKey('pkcs8', pemToDer(privateKeyPem), { name: 'RSA-OAEP', hash: 'SHA-256' }, true, ['decrypt']);
+    const encryptedAesKeyLen = new DataView(cryptoPayload.buffer, 0, 4).getUint32(0, false);
+    let offset = 4;
+    const encryptedAesKey = cryptoPayload.slice(offset, offset + encryptedAesKeyLen);
+    offset += encryptedAesKeyLen;
+    const nonce = cryptoPayload.slice(offset, offset + 12);
+    offset += 12;
+    const ciphertextWithTag = cryptoPayload.slice(offset);
+    const decryptedAesKeyBytes = await webcrypto.subtle.decrypt({ name: 'RSA-OAEP' }, privateKey, encryptedAesKey);
+    const aesKey = await webcrypto.subtle.importKey('raw', decryptedAesKeyBytes, { name: 'AES-GCM', length: 256 }, true, ['decrypt']);
+    const decryptedDataBuffer = await webcrypto.subtle.decrypt({ name: 'AES-GCM', iv: nonce }, aesKey, ciphertextWithTag);
+    return JSON.parse(new TextDecoder().decode(decryptedDataBuffer));
+}
+
+// --- API Endpoint ---
+const upload = multer({ storage: multer.memoryStorage(), limits: { fileSize: 5 * 1024 * 1024 } });
+app.post('/api/decode', upload.single('authImage'), async (req, res) => {
+    const privateKey = process.env.PLUGIN_PRIVATE_KEY;
+    if (!privateKey) {
+        console.error("FATAL: PLUGIN_PRIVATE_KEY secret is not set in the Space settings.");
+        return res.status(500).json({ error: 'Server is not configured with a private key.' });
+    }
+    if (!req.file) {
+        return res.status(400).json({ error: 'No image file provided. Please upload a file with the key "authImage".' });
+    }
+    try {
+        const credentials = await decodeFromImageBuffer(req.file.buffer, privateKey);
+        res.json({ success: true, data: credentials });
+    } catch (error) {
+        res.status(400).json({ success: false, error: 'Decryption failed. The image may be corrupt or was not encrypted with the correct public key.' });
+    }
+});
+
+app.listen(PORT, () => {
+    console.log(`Secure decoder API listening on port ${PORT}`);
+});