// sframe_transform_worker.ts
// RFC 9605 Secure Frame (SFrame) RTCRtpScriptTransform Web Worker
// 100% Native WebCrypto AES-GCM Pipeline with MLS Epoch Key Rotation

interface SFrameConfig {
  cipherSuite: 'AES_128_GCM' | 'AES_256_GCM';
  keyId: number;
  metadataLength: number; // e.g., VP9 Payload Descriptor size
}

class SFrameEncryptor {
  private frameCounter: bigint = 0n;
  private key: CryptoKey | null = null;
  private salt: Uint8Array = new Uint8Array(12);

  async setEpochSecret(epochSecret: Uint8Array, keyId: number): Promise<void> {
    const hkdfKey = await crypto.subtle.importKey('raw', epochSecret, 'HKDF', false, ['deriveKey', 'deriveBits']);
    
    // Derive SFrame Encryption Key
    this.key = await crypto.subtle.deriveKey(
      { name: 'HKDF', hash: 'SHA-256', salt: new Uint8Array(), info: new TextEncoder().encode('sframe key') },
      hkdfKey,
      { name: 'AES-GCM', length: 128 },
      false,
      ['encrypt']
    );

    // Derive SFrame 96-bit Salt
    const saltBits = await crypto.subtle.deriveBits(
      { name: 'HKDF', hash: 'SHA-256', salt: new Uint8Array(), info: new TextEncoder().encode('sframe salt') },
      hkdfKey,
      96
    );
    this.salt = new Uint8Array(saltBits);
  }

  encodeHeader(keyId: number, counter: bigint): Uint8Array {
    const ctrBytes: number[] = [];
    let tempCtr = counter;
    while (tempCtr > 0n || ctrBytes.length === 0) {
      ctrBytes.unshift(Number(tempCtr & 0xffn));
      tempCtr >>= 8n;
    }

    if (keyId < 8) {
      // Compact Header: [0 | LEN (3) | KeyID (4)]
      const firstByte = (ctrBytes.length << 4) | (keyId & 0x0f);
      return new Uint8Array([firstByte, ...ctrBytes]);
    } else {
      // Extended Header: [1 | LEN (3) | KeyID_LEN (4)]
      const keyBytes: number[] = [];
      let tempK = keyId;
      while (tempK > 0) { keyBytes.unshift(tempK & 0xff); tempK >>= 8; }
      const firstByte = 0x80 | (ctrBytes.length << 4) | ((keyBytes.length - 1) & 0x0f);
      return new Uint8Array([firstByte, ...keyBytes, ...ctrBytes]);
    }
  }

  async transform(frame: RTCEncodedVideoFrame, controller: TransformStreamDefaultController): Promise<void> {
    if (!this.key) return;

    const data = new Uint8Array(frame.data);
    const metadataLength = 12; // Unencrypted VP9 descriptor
    const metadata = data.subarray(0, metadataLength);
    const plaintextPayload = data.subarray(metadataLength);

    const sframeHeader = this.encodeHeader(3, this.frameCounter);

    // Compute Nonce: IV = salt XOR CTR (padded to 12 bytes)
    const iv = new Uint8Array(this.salt);
    let c = this.frameCounter;
    for (let i = 11; i >= 4; i--) {
      iv[i] ^= Number(c & 0xffn);
      c >>= 8n;
    }

    // AAD binds SFrame Header + Unencrypted Metadata
    const aad = new Uint8Array(sframeHeader.length + metadata.length);
    aad.set(sframeHeader, 0);
    aad.set(metadata, sframeHeader.length);

    const ciphertext = await crypto.subtle.encrypt(
      { name: 'AES-GCM', iv, additionalData: aad, tagLength: 128 },
      this.key,
      plaintextPayload
    );

    // Assemble final frame: [Metadata] + [SFrame Header] + [Ciphertext + Tag]
    const encryptedFrame = new Uint8Array(metadata.length + sframeHeader.length + ciphertext.byteLength);
    encryptedFrame.set(metadata, 0);
    encryptedFrame.set(sframeHeader, metadata.length);
    encryptedFrame.set(new Uint8Array(ciphertext), metadata.length + sframeHeader.length);

    frame.data = encryptedFrame.buffer;
    this.frameCounter++;
    controller.enqueue(frame);
  }
}

// sfu_blind_forwarder.mjs
// Lightweight Selective Forwarding Unit (SFU) in Node.js
// Demonstrates RFC 9605 zero-trust blind routing: SFU forwards encrypted packets without key access

import dgram from 'node:dgram';

const server = dgram.createSocket('udp4');
const SUBSCRIBERS = new Set(['192.168.1.50:5004', '192.168.1.51:5004']);

server.on('message', (msg, rinfo) => {
  // Parse Standard RTP Header (12 Bytes)
  if (msg.length < 12) return;
  const version = (msg[0] >> 6) & 0x03;
  const payloadType = msg[1] & 0x7f;
  const seqNum = msg.readUInt16BE(2);
  const timestamp = msg.readUInt32BE(4);
  const ssrc = msg.readUInt32BE(8);

  // Inspect unencrypted VP9 descriptor for temporal layer routing (SVC)
  const rtpPayload = msg.subarray(12);
  const vp9Desc = rtpPayload[0];
  const isKeyframe = (vp9Desc & 0x08) !== 0; // Layer sync bit

  console.log(`[SFU Relay] SSRC:${ssrc} Seq:${seqNum} Keyframe:${isKeyframe} - Forwarding blind ciphertext (${msg.length} B)`);

  // Forward raw RTP packet to all subscribers - SFU has ZERO decryption capability
  for (const sub of SUBSCRIBERS) {
    const [ip, port] = sub.split(':');
    server.send(msg, Number(port), ip);
  }
});

server.bind(5004, () => console.log('SFU blind forwarder listening on UDP 5004'));

RFC 9605: Secure Frame (SFrame) Media Encryption Architecture

1. Header Bitfield Layout:
   Compact Format (KID < 8):
    0 1 2 3 4 5 6 7
   +-+-+-+-+-+-+-+-+
   |0|  LEN  | KID |  + CTR (LEN octets, 1..8)
   +-+-+-+-+-+-+-+-+

   Extended Format (KID >= 8):
    0 1 2 3 4 5 6 7
   +-+-+-+-+-+-+-+-+
   |1|  LEN  |KLEN |  + KID (KLEN+1 octets) + CTR (LEN octets)
   +-+-+-+-+-+-+-+-+

2. Nonce Construction (96 bits):
   nonce = sframe_salt XOR (CTR << (96 - 8 * LEN))

3. Authenticated Additional Data (AAD):
   AAD = SFrame_Header || Unencrypted_Metadata

4. Packet Structure:
   [Unencrypted Metadata] || [SFrame Header] || [Encrypted Payload] || [Auth Tag]