Draft: Resolve "Object / Person identification using SDM NFC cards"

Closes #15

aleksis/apps/kort/models/sdm.py

@@ -46,6 +46,11 @@ class NfcSdmAuthenticator(ObjectAuthenticator):
         if card.person != obj:
             raise BadRequest("Card is not linked to identified object")
 
+        if card.last_read_counter <= res["read_ctr"]:
+            raise BadRequest("Read counter went backwards, possible replay attack")
+        card.last_read_counter = res["read_ctr"]
+        card.save()
+
         return True