full

models/DeviceLinkSessionModel.js

@@ -0,0 +1,40 @@
+const mongoose = require('mongoose')
+const timestamp = require('mongoose-timestamp')
+
+/**
+ * Short-lived handshake for linking a new browser/device to an account's existing
+ * E2EE identity key (QR-based, WhatsApp/Signal style) — see
+ * controllers/application/account/e2eeController.js. The server only ever relays
+ * `wrappedIdentityKey`: it's the private key encrypted client-side against the new
+ * device's ephemeral public key, so the server never sees plaintext key material.
+ */
+const deviceLinkSessionSchema = new mongoose.Schema({
+  user: {
+    type: mongoose.Schema.Types.ObjectId,
+    ref: 'User',
+    required: true,
+    index: true
+  },
+  ephemeralPublicKeyB64: {
+    type: String,
+    required: true
+  },
+  wrappedIdentityKey: {
+    type: String,
+    default: null
+  },
+  status: {
+    type: String,
+    enum: ['pending', 'fulfilled'],
+    default: 'pending'
+  },
+  expiresAt: {
+    type: Date,
+    required: true
+  }
+})
+
+deviceLinkSessionSchema.index({ expiresAt: 1 }, { expireAfterSeconds: 0 })
+deviceLinkSessionSchema.plugin(timestamp)
+
+module.exports = mongoose.model('DeviceLinkSession', deviceLinkSessionSchema)