Updated with Antigravity.

Server/Security/PeerCache.cs

@@ -6,16 +6,19 @@ namespace SNote.Server.Security;
 
 public class PeerCache
 {
-    private readonly ConcurrentDictionary<string, byte> _downstreamPeers = new(StringComparer.OrdinalIgnoreCase);
+    // Mapping: PeerUrl (normalized) -> PeerDetails (SessionToken, PublicKeyPem)
+    private readonly ConcurrentDictionary<string, PeerDetails> _downstreamPeers = new(StringComparer.OrdinalIgnoreCase);
     private readonly ConcurrentDictionary<string, DateTime> _recentBroadcastIds = new(StringComparer.OrdinalIgnoreCase);
 
-    public void RegisterPeer(string peerUrl)
+    public void RegisterPeer(string peerUrl, string sessionToken, string publicKeyPem)
     {
-        if (string.IsNullOrWhiteSpace(peerUrl)) return;
+        if (string.IsNullOrWhiteSpace(peerUrl) || string.IsNullOrWhiteSpace(sessionToken)) return;
         
         var cleanUrl = peerUrl.Trim().TrimEnd('/');
-        _downstreamPeers.TryAdd(cleanUrl, 0);
-        Console.WriteLine($"[PeerCache] Registered downstream peer node: {cleanUrl}");
+        var details = new PeerDetails(sessionToken, publicKeyPem.Trim());
+        
+        _downstreamPeers[cleanUrl] = details;
+        Console.WriteLine($"[PeerCache] Registered downstream peer node: {cleanUrl} with secure session token.");
     }
 
     public void RemovePeer(string peerUrl)
@@ -34,6 +37,40 @@ public class PeerCache
         return new List<string>(_downstreamPeers.Keys);
     }
 
+    public string? GetToken(string peerUrl)
+    {
+        var cleanUrl = peerUrl.Trim().TrimEnd('/');
+        return _downstreamPeers.TryGetValue(cleanUrl, out var details) ? details.SessionToken : null;
+    }
+
+    public string? GetPublicKey(string peerUrl)
+    {
+        var cleanUrl = peerUrl.Trim().TrimEnd('/');
+        return _downstreamPeers.TryGetValue(cleanUrl, out var details) ? details.PublicKeyPem : null;
+    }
+
+    public bool VerifySessionToken(string peerUrl, string token)
+    {
+        if (string.IsNullOrEmpty(peerUrl) || string.IsNullOrEmpty(token)) return false;
+        
+        var cleanUrl = peerUrl.Trim().TrimEnd('/');
+        if (_downstreamPeers.TryGetValue(cleanUrl, out var details))
+        {
+            return string.Equals(details.SessionToken, token, StringComparison.Ordinal);
+        }
+        return false;
+    }
+
+    public List<(string Url, string Token)> GetActivePeers()
+    {
+        var list = new List<(string Url, string Token)>();
+        foreach (var kvp in _downstreamPeers)
+        {
+            list.Add((kvp.Key, kvp.Value.SessionToken));
+        }
+        return list;
+    }
+
     public bool TryProcessBroadcast(string broadcastId)
     {
         if (string.IsNullOrWhiteSpace(broadcastId)) return false;
@@ -51,3 +88,5 @@ public class PeerCache
         return _recentBroadcastIds.TryAdd(broadcastId, DateTime.UtcNow);
     }
 }
+
+public record PeerDetails(string SessionToken, string PublicKeyPem);