Key server

var fs=require("fs"),
    https=require("https"),
    crypto=require("crypto"),
    readline=require("readline");
const store="store.json";
const AllowManyRequests=true;
var options={
    key: fs.readFileSync("key.pem"),
    cert: fs.readFileSync("cert.pem")
};
const rl=readline.createInterface({input:process.stdin,output:process.stdout});
var enc;
rl.question("Encryption passphrase:",(r)=> {
var ehash=crypto.createHash("sha256");
ehash.update(Buffer.from(r));
enc=ehash.digest();
if(!enc) return;
var server=https.createServer(options,(req,res)=> {
    if(req.method=="POST") {
        var h=req.headers;
        console.log("---\nIncoming: ",req.url,"\n",h);
        var socket=req.socket; //socket.remoteAddress: IP
        var data,f="",st={}; //data: buffer
        if(fs.existsSync(store)) {
            f=fs.readFileSync("store.json");
            st=JSON.parse(f);
            if(!st) res.end(500);
        } else {
            console.log("store.json does not exist! Creating file.");
            fs.writeFileSync("store.json",JSON.stringify({}));
        }
        var key=-1,id=-1,paid=false,ip=socket.remoteAddress; //id=hash(key)
        var RC=400,RH={},RD=""; //return data
        if(!st.iplog) {
            st.iplog={};
            st.iplog[ip]=Date.now();
            fs.writeFileSync(store,JSON.stringify(st));
        }
        var tl=Date.now()-st.iplog[ip]; //time since last request
        if(tl<15000&&AllowManyRequests==false) {
            RC=429; //Too Many Requests
        } else {
            st.iplog[ip]=Date.now();
            fs.writeFileSync(store,JSON.stringify(st));
        }
        req.on("data",(chunk)=>{
            data=Buffer.from(chunk);
        });
        req.on("end",()=>{
        if(!data) RC=406;
        else {
            console.log("buf["+data.length+"] "+data.toString("hex"));
        }
        if(RC==429) { //prevent DDoS
            //console.log("delaying request");
        } else {
            if(req.url=="/key") {
                if(data.length!=32) { //AES key length
                    RC=406; //Not Acceptable
                } else {
                    key=data;
                    var hash=crypto.createHash("sha512");
                    hash.update(data);
                    id=hash.digest();
                    var aes=crypto.createCipheriv("aes256",enc,Buffer.alloc(16));
                    var key1=aes.update(data);
                    var key2=aes.final();
                    key=Buffer.concat([key1,key2]);
                    var obj={
                        "id": id.toString("hex"),
                        "key": key.toString("hex"),
                        "paid": false,
                        "ip": ip
                    };
                    if(!st[id]) {
                        console.log("-> Storing:\n",obj);
                        st[id]=obj;
                        fs.writeFileSync(store,JSON.stringify(st));
                    }
                    RC=201; //Created
                    RH["Content-Type"]="application/octet-stream";
                    RD=id; //give id
                } //end of else (key length valid)
            } else if(req.url=="/id") {
                if(data.length!=512/8) { //SHA512 hash length
                    RC=406;
                } else {
                    id=data;
                    if(st[id]) {
                        key=Buffer.from(st[id]["key"],"hex"); //build buffer from hex string
                        //check if hash(dec(key))=id
                        var aes=crypto.createDecipheriv("aes256",enc,Buffer.alloc(16));
                        var key1=aes.update(key);
                        var key2=aes.final();
                        key=Buffer.concat([key1,key2]);
                        var hash=crypto.createHash("sha512");
                        hash.update(key);
                        var rev=hash.digest();
                        console.log(id,rev,Buffer.compare(id,rev));
                        if(Buffer.compare(id,rev)!=0) {
                            RC=401; //Unauthorized
                            console.log("The decrpyted key hash is NOT equal to the given hash! Wrong passphrase used?");
                        } else {
                            console.log("-> paid: ",st[id]["paid"]);
                            if(st[id]["paid"]==true) {
                                RC=200;
                                RH["Content-Type"]="application/octet-stream";
                                RD=key;
                            } else {
                                RC=402; //Payment Required
                            }
                        }
                    } else {
                        RC=404; //Not Found
                    }
                }
            }
        } //end of else (not too many requests)
        res.writeHead(RC,RH);
        res.end(RD);
        console.log("Outgoing: ",RC,"\n",RD,"\n---\n");
        }); //end of req.on("end")
    } else {
        res.writeHead(405,"Method not allowed");
        res.end();
    }

}).listen(5500);
}); //end of rl.question