lightning 4.7.0 → 4.7.1

package/CHANGELOG.md

@@ -1,6 +1,6 @@
 # Versions
 
-## 4.7.0
+## 4.7.1
 
 - `getPayment`: Add `created_at` to indicate the creation date of the payment
 - `getPayment`: Add `request` to indicate serialized payment request

package/grpc/protos/lightning.proto

@@ -532,6 +532,14 @@ service Lightning {
     */
     rpc ListPermissions (ListPermissionsRequest)
         returns (ListPermissionsResponse);
+
+    /*
+    CheckMacaroonPermissions checks whether a request follows the constraints
+    imposed on the macaroon and that the macaroon is authorized to follow the
+    provided permissions.
+    */
+    rpc CheckMacaroonPermissions (CheckMacPermRequest)
+        returns (CheckMacPermResponse);
 }
 
 message Utxo {
@@ -4005,4 +4013,14 @@ message MacaroonId {
 message Op {
     string entity = 1;
     repeated string actions = 2;
-}
+}
+
+message CheckMacPermRequest {
+    bytes macaroon = 1;
+    repeated MacaroonPermission permissions = 2;
+    string fullMethod = 3;
+}
+
+message CheckMacPermResponse {
+    bool valid = 1;
+}

package/index.js

@@ -15,6 +15,7 @@ const {decodePaymentRequest} = require('./lnd_methods');
 const {deleteFailedPayAttempts} = require('./lnd_methods');
 const {deleteFailedPayments} = require('./lnd_methods');
 const {deleteForwardingReputations} = require('./lnd_methods');
+const {deletePayment} = require('./lnd_methods');
 const {deletePayments} = require('./lnd_methods');
 const {diffieHellmanComputeSecret} = require('./lnd_methods');
 const {disableChannel} = require('./lnd_methods');
@@ -145,6 +146,7 @@ module.exports = {
   deleteFailedPayAttempts,
   deleteFailedPayments,
   deleteForwardingReputations,
+  deletePayment,
   deletePayments,
   disableChannel,
   disconnectWatchtower,

package/lnd_methods/index.js

@@ -119,6 +119,7 @@ const {updateChainTransaction} = require('./onchain');
 const {updateConnectedWatchtower} = require('./offchain');
 const {updatePathfindingSettings} = require('./offchain');
 const {updateRoutingFees} = require('./offchain');
+const {verifyAccess} = require('./macaroon');
 const {verifyBackup} = require('./offchain');
 const {verifyBackups} = require('./offchain');
 const {verifyBytesSignature} = require('./signer');
@@ -246,6 +247,7 @@ module.exports = {
   updateConnectedWatchtower,
   updatePathfindingSettings,
   updateRoutingFees,
+  verifyAccess,
   verifyBackup,
   verifyBackups,
   verifyBytesSignature,

package/lnd_methods/macaroon/index.js

@@ -1,5 +1,6 @@
 const getAccessIds = require('./get_access_ids');
 const grantAccess = require('./grant_access');
 const revokeAccess = require('./revoke_access');
+const verifyAccess = require('./verify_access');
 
-module.exports = {getAccessIds, grantAccess, revokeAccess};
+module.exports = {getAccessIds, grantAccess, revokeAccess, verifyAccess};

package/lnd_methods/macaroon/verify_access.js

@@ -0,0 +1,85 @@
+const asyncAuto = require('async/auto');
+const {returnResult} = require('asyncjs-util');
+
+const {isLnd} = require('./../../lnd_requests');
+
+const accessDeniedMessage = 'permission denied';
+const asPermission = n => ({action: n.split(':')[1], entity: n.split(':')[0]});
+const base64AsBuffer = base64 => Buffer.from(base64, 'base64');
+const {isArray} = Array;
+const isBoolean = n => n === false || n === true;
+const method = 'checkMacaroonPermissions';
+const notSupported = /unknown/;
+const type = 'default';
+
+/** Verify an access token has a given set of permissions
+
+  Note: this method is not supported in LND versions 0.13.1 and below
+
+  Requires `macaroon:read` permission
+
+  {
+    lnd: <Authenticated LND API Object>
+    macaroon: <Base64 Encoded Macaroon String>
+    permissions: [<Entity:Action String>]
+  }
+
+  @returns via cbk or Promise
+  {
+    is_valid: <Access Token is Valid For Described Permissions Bool>
+  }
+*/
+module.exports = ({lnd, macaroon, permissions}, cbk) => {
+  return new Promise((resolve, reject) => {
+    return asyncAuto({
+      // Check arguments
+      validate: cbk => {
+        if (!isLnd({lnd, method, type})) {
+          return cbk([400, 'ExpectedAuthenticatedLndApiObjectToVerifyAccess']);
+        }
+
+        if (!macaroon) {
+          return cbk([400, 'ExpectedMacaroonToVerifyAccess']);
+        }
+
+        if (!isArray(permissions)) {
+          return cbk([400, 'ExpectedPermissionsArrayToVerifyAccess']);
+        }
+
+        return cbk();
+      },
+
+      // Check macaroon access
+      check: ['validate', ({}, cbk) => {
+        return lnd[type][method]({
+          macaroon: base64AsBuffer(macaroon),
+          permissions: permissions.map(permission => asPermission(permission)),
+        },
+        (err, res) => {
+          if (!!err && notSupported.test(err.details)) {
+            return cbk([501, 'VerifyAccessMethodNotSupported']);
+          }
+
+          if (!!err && err.details === accessDeniedMessage) {
+            return cbk(null, {is_valid: false});
+          }
+
+          if (!!err) {
+            return cbk([503, 'UnexpectedErrorFromCheckMacaroonMethod', {err}]);
+          }
+
+          if (!res) {
+            return cbk([503, 'ExpectedResponseFromCheckMacaroonRequest']);
+          }
+
+          if (!isBoolean(res.valid)) {
+            return cbk([503, 'ExpectedValidIndicatorInCheckMacaroonResponse']);
+          }
+
+          return cbk(null, {is_valid: res.valid});
+        });
+      }],
+    },
+    returnResult({reject, resolve, of: 'check'}, cbk));
+  });
+};

package/lnd_methods/offchain/delete_payment.d.ts

@@ -0,0 +1,18 @@
+import {
+  AuthenticatedLightningArgs,
+  AuthenticatedLightningMethod,
+} from '../../typescript';
+
+export type DeletePaymentArgs = AuthenticatedLightningArgs<{
+  /** Payment Preimage Hash Hex String */
+  id: string;
+}>;
+
+/**
+ * Delete a payment record
+ *
+ * Requires `offchain:write` permission
+ *
+ * Note: this method is not supported on LND 0.13.1 and below
+ */
+export const deletePayment: AuthenticatedLightningMethod<DeletePaymentArgs>;

package/lnd_methods/offchain/index.d.ts

@@ -3,6 +3,7 @@ export * from './decode_payment_request';
 export * from './delete_failed_pay_attempts';
 export * from './delete_failed_payments';
 export * from './delete_forwarding_reputations';
+export * from './delete_payment';
 export * from './delete_payments';
 export * from './disable_channel';
 export * from './disconnect_watchtower';

package/package.json

@@ -10,7 +10,7 @@
     "@grpc/grpc-js": "1.3.7",
     "@grpc/proto-loader": "0.6.5",
     "@types/express": "4.17.13",
-    "@types/node": "16.9.1",
+    "@types/node": "16.9.6",
     "@types/request": "2.48.7",
     "@types/ws": "7.4.7",
     "async": "3.2.1",
@@ -19,7 +19,7 @@
     "bn.js": "5.2.0",
     "body-parser": "1.19.0",
     "bolt07": "1.7.3",
-    "bolt09": "0.1.5",
+    "bolt09": "0.2.0",
     "cbor": "8.0.0",
     "express": "4.17.1",
     "invoices": "2.0.0",
@@ -56,5 +56,5 @@
     "directory": "test/typescript"
   },
   "types": "index.d.ts",
-  "version": "4.7.0"
+  "version": "4.7.1"
 }

package/test/lnd_methods/macaroon/test_verify_access.js

@@ -0,0 +1,101 @@
+const {test} = require('@alexbosworth/tap');
+
+const {verifyAccess} = require('./../../../lnd_methods');
+
+const makeArgs = overrides => {
+  const args = {
+    lnd: {
+      default: {
+        checkMacaroonPermissions: ({}, cbk) => cbk(null, {valid: true}),
+      },
+    },
+    macaroon: Buffer.from('macaroon').toString('base64'),
+    permissions: ['entity:action'],
+  };
+
+  Object.keys(overrides).forEach(k => args[k] = overrides[k]);
+
+  return args;
+};
+
+const tests = [
+  {
+    args: makeArgs({lnd: undefined}),
+    description: 'LND is required to verify access',
+    error: [400, 'ExpectedAuthenticatedLndApiObjectToVerifyAccess'],
+  },
+  {
+    args: makeArgs({macaroon: undefined}),
+    description: 'A macaroon is required',
+    error: [400, 'ExpectedMacaroonToVerifyAccess'],
+  },
+  {
+    args: makeArgs({permissions: undefined}),
+    description: 'Permissions to check are required',
+    error: [400, 'ExpectedPermissionsArrayToVerifyAccess'],
+  },
+  {
+    args: makeArgs({
+      lnd: {
+        default: {
+          checkMacaroonPermissions: ({}, cbk) => cbk({details: 'unknown ser'}),
+        },
+      },
+    }),
+    description: 'Method not supported error returned',
+    error: [501, 'VerifyAccessMethodNotSupported'],
+  },
+  {
+    args: makeArgs({
+      lnd: {
+        default: {
+          checkMacaroonPermissions: ({}, cbk) => cbk({
+            details: 'permission denied',
+          }),
+        },
+      },
+    }),
+    description: 'Method not supported error returned',
+    expected: {is_valid: false},
+  },
+  {
+    args: makeArgs({
+      lnd: {default: {checkMacaroonPermissions: ({}, cbk) => cbk('err')}},
+    }),
+    description: 'Errors are passed back',
+    error: [503, 'UnexpectedErrorFromCheckMacaroonMethod', {err: 'err'}],
+  },
+  {
+    args: makeArgs({
+      lnd: {default: {checkMacaroonPermissions: ({}, cbk) => cbk()}},
+    }),
+    description: 'A response is expected',
+    error: [503, 'ExpectedResponseFromCheckMacaroonRequest'],
+  },
+  {
+    args: makeArgs({
+      lnd: {default: {checkMacaroonPermissions: ({}, cbk) => cbk(null, {})}},
+    }),
+    description: 'A valid attribute is expected',
+    error: [503, 'ExpectedValidIndicatorInCheckMacaroonResponse'],
+  },
+  {
+    args: makeArgs({}),
+    description: 'Validity is returned',
+    expected: {is_valid: true},
+  },
+];
+
+tests.forEach(({args, description, error, expected}) => {
+  return test(description, async ({end, rejects, strictSame}) => {
+    if (!!error) {
+      await rejects(() => verifyAccess(args), error, 'Got expected error');
+    } else {
+      const res = await verifyAccess(args);
+
+      strictSame(res, expected, 'Got expected result');
+    }
+
+    return end();
+  });
+});

package/test/typescript/delete_payment.test-d.ts

@@ -0,0 +1,15 @@
+import {expectError, expectType} from 'tsd';
+import {AuthenticatedLnd} from '../../lnd_grpc';
+import {deletePayment} from '../../lnd_methods';
+
+const lnd = {} as AuthenticatedLnd;
+const id = '0';
+
+expectError(deletePayment());
+expectError(deletePayment({}));
+expectError(deletePayment({lnd}));
+expectError(deletePayment({id}));
+
+expectType<void>(await deletePayment({lnd, id}));
+
+expectType<void>(deletePayment({lnd, id}, () => {}));