From 9498d7f4046572e42d9af49e527405246b01eeb3 Mon Sep 17 00:00:00 2001
From: Maple Nebel <maple.neb@gmail.com>
Date: Sat, 20 Jun 2026 23:46:48 +0200
Subject: [PATCH] version bump, key derive and key length check

---
 Cargo.lock  | 11 ++++++++++-
 Cargo.toml  |  5 +++--
 src/lib.rs  | 18 ++++++++++++++++++
 src/main.rs |  5 +++++
 4 files changed, 36 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 5d2b1a6..4e7b9a7 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -175,6 +175,12 @@ dependencies = [
  "crossbeam-utils",
 ]
 
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -274,6 +280,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
  "block-buffer 0.12.1",
+ "const-oid",
  "crypto-common 0.2.2",
  "ctutils",
 ]
@@ -911,9 +918,11 @@ checksum = "1d87ecb2933e8aeadb3e3a02b828fed80a7528047e68b4f424523a0981a3a084"
 
 [[package]]
 name = "nex-account"
-version = "0.1.0"
+version = "0.1.1"
 dependencies = [
+ "hmac",
  "log",
+ "md-5",
  "prost",
  "simplelog",
  "sqlx",
diff --git a/Cargo.toml b/Cargo.toml
index 946a6af..1d7d56a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "nex-account"
-version = "0.1.0"
+version = "0.1.1"
 edition = "2024"
 publish = ["spbr"]
 
@@ -12,7 +12,8 @@ tokio = { version = "1.52.3", features = ["macros", "rt-multi-thread"] }
 sqlx = { version = "0.9.0", features = ["postgres", "runtime-tokio"] }
 log = "0.4.32"
 simplelog = "0.12.2"
+hmac = "0.13.0"
+md-5 = "0.11.0"
 
 [build-dependencies]
 tonic-prost-build = "0.14.6"
-
diff --git a/src/lib.rs b/src/lib.rs
index 773d491..c01f143 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -1 +1,19 @@
+use hmac::{Hmac, KeyInit, Mac};
+use md5::{
+    Md5,
+    digest::array::{Array, AsArrayRef},
+};
+
 pub mod grpc;
+
+pub type NEX_KEY = [u8; 16];
+
+type HmacMd5 = Hmac<Md5>;
+
+pub fn derive_pid_hmac(pid: u32, key: &NEX_KEY) -> [u8; 4] {
+    let mut hmac = HmacMd5::new_from_slice(&key[..]).expect("infallible");
+    hmac.update(&pid.to_be_bytes());
+    hmac.finalize().as_bytes().as_slice()[0..4]
+        .try_into()
+        .expect("infallible")
+}
diff --git a/src/main.rs b/src/main.rs
index c58e929..e0ad2e5 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -60,6 +60,11 @@ impl NexAccountService for NexAccountServer {
         let request = request.into_inner();
 
         let next_pid = next_pid(&self.pool).await;
+
+        if request.key.len() != 16 {
+            return Err(tonic::Status::invalid_argument("invalid key length"));
+        }
+
         query!(
             "insert into nex_accounts (
                 pid, principal_name, email, nex_key