From 8b24695a7549cc2974e0ed7b4fb590baf01b43e5 Mon Sep 17 00:00:00 2001
From: NurAlan <wahyunuralan@gmail.com>
Date: Thu, 9 Oct 2025 09:50:35 +0700
Subject: [PATCH] deploy: testing mockup API

---
 src/helpers/signature.ts               | 17 ++++++++++++++
 src/middlewares/deviceGuard.ts         | 32 +++++++++++++-------------
 src/modules/device/commands/service.ts |  3 ---
 src/plugins/swagger.ts                 |  2 +-
 4 files changed, 34 insertions(+), 20 deletions(-)

diff --git a/src/helpers/signature.ts b/src/helpers/signature.ts
index ba5eb46..daec260 100644
--- a/src/helpers/signature.ts
+++ b/src/helpers/signature.ts
@@ -123,6 +123,23 @@ export function sign(data: unknown, secretKey?: string): string {
   return hmac.digest('hex')
 }
 
+console.log(sign({
+  merchantName: 'SAVY',
+  floorName: 'L2',
+  unitNumber: '01',
+  deviceName: 'AC',
+  roomName: 'KN',
+  deviceType: 'A',
+  commandType: 'C',
+  towerNumber: 'T1',
+  timestamp: '2025-10-01T14:30:12Z',
+  nonce: '9f2a6e7c8d3b',
+  payload: {
+    AC: 'On',
+    Temp: 25,
+  },
+}, 'savy_123123'))
+
 /**
  * Verifies the signature of the data using HMAC-SHA256 with constant-time comparison.
  * @param data The data to verify.
diff --git a/src/middlewares/deviceGuard.ts b/src/middlewares/deviceGuard.ts
index 01ad251..a060222 100644
--- a/src/middlewares/deviceGuard.ts
+++ b/src/middlewares/deviceGuard.ts
@@ -19,21 +19,21 @@ export const deviceGuard = () => ({
     }
 
     // Validate X-Timestamp
-    const timestampStr = headers['x-timestamp']
-    if (!timestampStr) {
-      set.status = 403
-      throw new Error('replay_attack_detected')
-    }
-    const timestamp = new Date(timestampStr)
-    if (isNaN(timestamp.getTime()) || timestampStr !== timestamp.toISOString()) {
-      set.status = 403
-      throw new Error('replay_attack_detected')
-    }
-    const now = new Date()
-    const diff = Math.abs(now.getTime() - timestamp.getTime())
-    if (diff > CLOCK_SKEW_MS) {
-      set.status = 403
-      throw new Error('replay_attack_detected')
-    }
+    // const timestampStr = headers['x-timestamp']
+    // if (!timestampStr) {
+    //   set.status = 403
+    //   throw new Error('replay_attack_detected')
+    // }
+    // const timestamp = new Date(timestampStr)
+    // if (isNaN(timestamp.getTime()) || timestampStr !== timestamp.toISOString()) {
+    //   set.status = 403
+    //   throw new Error('replay_attack_detected')
+    // }
+    // const now = new Date()
+    // const diff = Math.abs(now.getTime() - timestamp.getTime())
+    // if (diff > CLOCK_SKEW_MS) {
+    //   set.status = 403
+    //   throw new Error('replay_attack_detected')
+    // }
   },
 })
diff --git a/src/modules/device/commands/service.ts b/src/modules/device/commands/service.ts
index 2dae9e8..245479b 100644
--- a/src/modules/device/commands/service.ts
+++ b/src/modules/device/commands/service.ts
@@ -8,9 +8,6 @@ export default abstract class CommandService {
     receivedAt: string
   }> {
     const apiKey = headers['x-api-key']
-    if (!apiKey) {
-      throw new Error('invalid_api_key')
-    }
 
     // For now, use apiKey as secretKey since DB validation is skipped
     const secretKey = apiKey
diff --git a/src/plugins/swagger.ts b/src/plugins/swagger.ts
index 46f8c9d..2391298 100644
--- a/src/plugins/swagger.ts
+++ b/src/plugins/swagger.ts
@@ -7,7 +7,7 @@ type OpenApiDocumentation = Omit<Partial<OpenAPIV3.Document<OpenApiDocWithTagGro
 
 export const swaggerPlugin = openapi({
   path: '/swagger',
-  provider: 'swagger-ui',
+  provider: 'scalar',
   mapJsonSchema: {
     zod: z.toJSONSchema,
   },