WebSocket endpoint

// HmacChallengeVerifier + DevicePrincipal come from Elarion.Devices — pairing codes, key storage,
// and the constant-time verification are covered on the device identity page. The handler is a
// factory: it creates one session per upgrade request; per-connection state lives on the session.
public sealed class GatewaySocketHandler(IActorSystem actors, HmacChallengeVerifier verifier)
    : WebSocketConnectionHandler {
    public override ValueTask<WebSocketConnectionSession?> CreateSessionAsync(
        HttpContext context, CancellationToken ct) {
        return ValueTask.FromResult<WebSocketConnectionSession?>(new GatewaySession(actors, verifier));
    }
}

public sealed class GatewaySession(IActorSystem actors, HmacChallengeVerifier verifier)
    : WebSocketConnectionSession {

    // In-socket challenge/response (HTTP-level token auth works too — the HttpContext is available).
    public override async ValueTask<ClientConnectionTicket?> AuthenticateAsync(
        WebSocketHandshakeContext handshake, CancellationToken ct) {
        var nonce = HmacChallengeVerifier.CreateNonce();
        await handshake.SendTextAsync($"challenge:{Convert.ToBase64String(nonce)}", ct);
        var answer = await handshake.ReceiveTextAsync(ct);         // "deviceId:base64(mac)"
        if (answer?.Split(':', 2) is not [var deviceId, var mac]) {
            return null;                                   // → PolicyViolation close, nothing registered
        }

        var principal = await verifier.VerifyAsync(deviceId, nonce, Convert.FromBase64String(mac), ct);
        if (principal is null) {
            return null;
        }

        return new ClientConnectionTicket {
            Principal = principal,
            PrincipalId = deviceId,                        // the registry indexes by this
            Metadata = new Dictionary<string, string> { ["channel"] = "telemetry" },
        };
    }

    public override IClientConnectionProtocol CreateProtocol(WebSocketClientConnection connection) =>
        new GatewayCodec(connection, actors);
}

// The codec: parse the device's frames, route into the digital-twin actor, answer over raw sends.
internal sealed class GatewayCodec(WebSocketClientConnection connection, IActorSystem actors)
    : IClientConnectionProtocol {
    public async ValueTask OnTextAsync(string message, CancellationToken ct) {
        var frame = GatewayFrame.Parse(message);           // your wire format
        var twin = actors.Get<IDeviceTwin>(connection.Connection.PrincipalId!);
        await twin.ApplyAsync(frame);                      // the actor serializes all channels + UI actions
    }
}

builder.Services.AddSingleton<GatewaySocketHandler>();

var app = builder.Build();
app.UseWebSockets();
app.MapElarionConnectionSocket<GatewaySocketHandler>("/gateway/ws",
    o => o.MaxMessageBytes = 64 * 1024);