Function seal_bundle

nodedb-cluster/src/auth/bundle.rs:59–73

Wrap `bundle_bytes` in an `AuthenticatedJoinBundle`.

(
    bundle_bytes: Vec<u8>,
    cluster_secret: &[u8; 32],
    token_hash: &[u8; 32],
)

/// Wrap `bundle_bytes` in an `AuthenticatedJoinBundle`.
pub fn seal_bundle(
    bundle_bytes: Vec<u8>,
    cluster_secret: &[u8; 32],
    token_hash: &[u8; 32],
) -> Result<AuthenticatedJoinBundle, BundleError> {
    let key = derive_mac_key(cluster_secret, token_hash);
    let mut mac = <Hmac<Sha256>>::new_from_slice(&key).map_err(|_| BundleError::HmacKeyLength)?;
    mac.update(&bundle_bytes);
    let tag: [u8; 32] = mac.finalize().into_bytes().into();
    Ok(AuthenticatedJoinBundle {
        version: WireVersion::CURRENT,
        bundle: bundle_bytes,
        mac: tag,
    })
}

/// Verify the MAC on `sealed` and return the inner bundle bytes.
///