use otp for storm key

ui/storm/src/ctrl.ts

@@ -1,6 +1,7 @@
 import * as xhr from './xhr';
 import config from './config';
 import makePromotion from './promotion';
+import sign from './sign';
 import { Api as CgApi } from 'chessground/api';
 import { Chess } from 'chessops/chess';
 import { chessgroundDests } from 'chessops/compat';
@@ -38,11 +39,12 @@ export default class StormCtrl {
         moves: 0,
         errors: 0
       },
+      signed: prop(undefined)
     };
     this.promotion = makePromotion(this.withGround, this.makeCgOpts, redraw);
     this.checkDupTab();
     setTimeout(this.hotkeys, 1000);
-    if (this.data.key) setTimeout(this.signKey, 1000 * 60);
+    if (this.data.key) setTimeout(() => sign(this.data.key!).then(this.vm.signed), 1000 * 60);
   }
 
   clockMillis = (): number | undefined =>
@@ -220,7 +222,7 @@ export default class StormCtrl {
     combo: this.vm.comboBest,
     time: (this.vm.run.endAt! - this.vm.run.startAt) / 1000,
     highest: this.vm.history.reduce((h, r) => r.win && r.puzzle.rating > h ? r.puzzle.rating : h, 0),
-    signed: this.data.signed
+    signed: this.vm.signed()
   });
 
   private showGround = (g: CgApi): void => g.set(this.makeCgOpts());
@@ -254,11 +256,4 @@ export default class StormCtrl {
       .bind('space', () => location.reload())
       .bind('return', this.end);
   }
-
-  private signKey = () => {
-    lichess.socket.send('sk1', this.data.key!);
-    lichess.pubsub.on('socket.in.sk1', signed => {
-      this.data.signed = signed;
-    })
-  }
 }

ui/storm/src/interfaces.ts

@@ -1,4 +1,5 @@
 import { Role } from 'chessground/types';
+import {Prop} from 'common';
 import { VNode } from 'snabbdom/vnode'
 
 export type MaybeVNode = VNode | string | null | undefined;
@@ -44,6 +45,7 @@ export interface StormVm {
     response?: RunResponse;
   }
   dupTab?: boolean;
+  signed: Prop<string | undefined>;
 }
 
 export interface Round {

ui/storm/src/sign.ts

@@ -0,0 +1,24 @@
+export default function(serverKey: string): Promise<string> {
+  const otp = randomAscii(64);
+  lichess.socket.send('sk1', `${serverKey}:${otp}`);
+  return new Promise(solve =>
+    lichess.pubsub.on('socket.in.sk1', encrypted => solve(xor(encrypted, otp)))
+  );
+}
+
+function xor(a: string, b: string) {
+  const result = [];
+  for (let i = 0; i < a.length; i++)
+    result.push(String.fromCharCode(a.charCodeAt(i) ^ b.charCodeAt(i)));
+  return result.join('');
+}
+
+function randomAscii(length: number) {
+  let result = '';
+  const characters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
+  const charactersLength = characters.length;
+  for (let i = 0; i < length; i++)
+    result += characters.charAt(Math.floor(Math.random() * charactersLength));
+
+  return result;
+}