feat(mobile): bind device identities and bound voice usage in 0.1.4 dev

apps/desktop/electron/mobile-host.mjs

@@ -4,6 +4,7 @@ import { BrowserWindow, ipcMain, safeStorage, shell } from 'electron'
 import { MobileVault, LiveTokenIssuer } from './mobile-secrets.mjs'
 import { DeliveryJournal, MobileGatewayClient } from './mobile-adapter.mjs'
 import { AccountClient } from '../../mobile/src/transport.mjs'
+import { normalizeFingerprint, parsePhoneIdentity, assertRemoteIdentity } from '../../mobile/src/peer-identity.mjs'
 
 export function createMobileWindow({ directory, assets, resolveBackend, show = true }) {
   const vault = new MobileVault(join(directory, 'mobile'), safeStorage)
@@ -23,7 +24,16 @@ export function createMobileWindow({ directory, assets, resolveBackend, show = t
     if (event.sender !== window.webContents || event.senderFrame !== window.webContents.mainFrame) throw new Error('Geçersiz mobil pencere.')
     if (action === 'setup') {
       const secrets = await vault.load()
-      return { paired: Boolean(secrets.deviceId), hasAccount: Boolean(secrets.accountToken), hasGoogle: Boolean(secrets.googleKey) }
+      return { paired: Boolean(secrets.deviceId), hasAccount: Boolean(secrets.accountToken), hasGoogle: Boolean(secrets.googleKey),
+        deviceId: secrets.deviceId, localFingerprint: secrets.localFingerprint }
+    }
+    if (action === 'identity.save') {
+      const previous = await vault.load(), fingerprint = normalizeFingerprint(params.fingerprint)
+      if (!previous.deviceId || previous.deviceId !== params.deviceId ||
+          (previous.localFingerprint && previous.localFingerprint !== fingerprint))
+        throw new Error('Cihaz kimliği sessizce değiştirilemez. Yeniden eşleştirin.')
+      await vault.save({ ...previous, localFingerprint: fingerprint })
+      return { saved: true }
     }
     if (action === 'account.save') {
       if (typeof params.token !== 'string' || params.token.length < 12 || params.token.length > 512) throw new Error('AITURK hesap anahtarı geçersiz.')
@@ -68,7 +78,15 @@ export function createMobileWindow({ directory, assets, resolveBackend, show = t
     }
     if (action === 'phone.approve') {
       if (!/^[0-9a-f-]{36}$/.test(params.pairingId) || !/^[A-Z2-9]{8}$/.test(params.code)) throw new Error('Telefondaki eşleştirme bilgileri geçersiz.')
-      return call(`/v1/aiturk/pairings/${params.pairingId}/approve`, { user_code: params.code })
+      const identity = parsePhoneIdentity(params.identity, params.pairingId)
+      const previous = await vault.load(), existing = previous.phoneFingerprints?.[identity.deviceId]
+      if (existing && existing !== identity.fingerprint) throw new Error('Kayıtlı telefon kimliği değiştirilemez. Cihazı iptal edip yeniden eşleştirin.')
+      const result = await call(`/v1/aiturk/pairings/${params.pairingId}/approve`, { user_code: params.code })
+      if (result.device_id !== identity.deviceId || result.status !== 'approved') throw new Error('Onaylanan telefon kimlik belgesiyle eşleşmiyor; bağlantı açılmadı.')
+      const current = await vault.load()
+      if (current.deviceId !== previous.deviceId || current.accountToken !== previous.accountToken) throw new Error('Onay sırasında hesap değişti; yeniden eşleştirin.')
+      await vault.save({ ...current, phoneFingerprints: { ...current.phoneFingerprints, [identity.deviceId]: identity.fingerprint } })
+      return result
     }
     if (action === 'devices') return call('/v1/aiturk/mobile/devices')
     if (action === 'invite.create') return call('/v1/aiturk/mobile/invites', {})
@@ -82,12 +100,20 @@ export function createMobileWindow({ directory, assets, resolveBackend, show = t
       if (result.self_revoked) await vault.save({})
       return result
     }
-    if (action === 'inbox') return call('/v1/aiturk/mobile/channels')
+    if (action === 'inbox') {
+      const data = await call('/v1/aiturk/mobile/channels'), secrets = await vault.load()
+      return { ...data, channels: data.channels.map(offer => {
+        const fingerprint = secrets.phoneFingerprints?.[offer.phone_id]
+        assertRemoteIdentity(offer.sdp, fingerprint)
+        return { ...offer, trustedPhoneFingerprint: fingerprint }
+      }) }
+    }
     if (action === 'ice') return call('/v1/aiturk/mobile/ice')
     if (action === 'channel.answer') {
       const inbox = await call('/v1/aiturk/mobile/channels')
       const offer = inbox.channels.find(row => row.id === params.channelId)
       if (!offer || clients.has(offer.id) || clients.size >= 4) throw new Error('Bağlantı isteği artık geçerli değil.')
+      assertRemoteIdentity(offer.sdp, (await vault.load()).phoneFingerprints?.[offer.phone_id])
       const authorize = () => call(`/v1/aiturk/mobile/channels/${offer.id}/heartbeat`, {})
       const client = new MobileGatewayClient(resolveBackend, frame => send({ channelId: offer.id, frame }),
         { deviceId: offer.phone_id, journal, authorize })