pakstr 0.19.3 → 0.21.0

package/android-template/app/src/test/java/com/pakstr/app/crypto/Nip46ClientKeyProtocolTest.kt

@@ -0,0 +1,82 @@
+package com.pakstr.app.crypto
+
+import org.junit.Assert.assertArrayEquals
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertThrows
+import org.junit.Test
+
+class Nip46ClientKeyProtocolTest {
+
+    @Test
+    fun client_keys_encrypt_and_decrypt_without_mutating_peer_input() {
+        val first =
+            Nip46ClientKey.fromPrivateKey(
+                privateKey(1)
+            )
+        val second =
+            Nip46ClientKey.fromPrivateKey(
+                privateKey(2)
+            )
+
+        first.use {
+            second.use {
+                val peerPublicKey = second.publicKey
+                val original = peerPublicKey.copyOf()
+                val payload =
+                    first.encryptNip44(
+                        "sensitive message",
+                        second.publicKeyHex
+                    )
+
+                assertEquals(
+                    "sensitive message",
+                    second.decryptNip44(
+                        payload,
+                        first.publicKeyHex
+                    )
+                )
+                assertArrayEquals(original, peerPublicKey)
+            }
+        }
+    }
+
+    @Test
+    fun closed_and_invalid_keys_fail_with_safe_errors() {
+        val key = Nip46ClientKey.generate()
+        key.close()
+
+        val closedError =
+            assertThrows(IllegalStateException::class.java) {
+                key.encryptNip44(
+                    "private plaintext",
+                    "f".repeat(64)
+                )
+            }
+        assertFalse(
+            closedError.message.orEmpty()
+                .contains("private plaintext")
+        )
+
+        val active = Nip46ClientKey.generate()
+        active.use {
+            val invalidError =
+                assertThrows(IllegalArgumentException::class.java) {
+                    active.encryptNip44(
+                        "private plaintext",
+                        "not-a-pubkey"
+                    )
+                }
+            assertFalse(
+                invalidError.message.orEmpty()
+                    .contains("private plaintext")
+            )
+        }
+    }
+
+    private fun privateKey(value: Int): ByteArray {
+        return ByteArray(32).also {
+            it[31] = value.toByte()
+        }
+    }
+}

package/android-template/app/src/test/java/com/pakstr/app/crypto/Nip46ClientKeyTest.kt

@@ -0,0 +1,52 @@
+package com.pakstr.app.crypto
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertThrows
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class Nip46ClientKeyTest {
+
+    @Test
+    fun generated_key_signs_with_its_public_identity() {
+        Nip46ClientKey.generate().use { key ->
+            val message = Bip340Hash.sha256("message".toByteArray())
+            val signature = key.sign(message)
+
+            assertEquals(32, key.publicKey.size)
+            assertTrue(key.publicKeyHex.matches(Regex("[0-9a-f]{64}")))
+            assertTrue(
+                Bip340Verifier.verify(
+                    key.publicKeyHex,
+                    Bip340Hash.bytesToHex(message),
+                    Bip340Hash.bytesToHex(signature)
+                )
+            )
+        }
+    }
+
+    @Test
+    fun closed_key_rejects_signing() {
+        val key = Nip46ClientKey.generate()
+        key.close()
+
+        assertThrows(IllegalStateException::class.java) {
+            key.sign(ByteArray(32))
+        }
+    }
+
+    @Test
+    fun diagnostics_do_not_expose_private_key() {
+        val privateKey =
+            Bip340Hash.hexToBytes(
+                "0000000000000000000000000000000000000000000000000000000000000003"
+            )
+        val privateKeyHex = Bip340Hash.bytesToHex(privateKey)
+        val key = Nip46ClientKey.fromPrivateKey(privateKey)
+
+        key.use {
+            assertFalse(key.toString().contains(privateKeyHex))
+        }
+    }
+}

package/android-template/app/src/test/java/com/pakstr/app/crypto/NostrEventSerializerTest.kt

@@ -0,0 +1,42 @@
+package com.pakstr.app.crypto
+
+import org.json.JSONArray
+import org.json.JSONObject
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class NostrEventSerializerTest {
+
+    @Test
+    fun serializes_nip01_event_with_exact_required_escaping() {
+        val content =
+            "quote\" slash\\ backspace\b formfeed" +
+                    " newline\n return\r tab\t </ " +
+                    "

 café"
+        val tagValue = "tag\"\\</
"
+        val event =
+            JSONObject()
+                .put("pubkey", "a".repeat(64))
+                .put("created_at", 1L)
+                .put("kind", 24133)
+                .put(
+                    "tags",
+                    JSONArray()
+                        .put(
+                            JSONArray()
+                                .put("p")
+                                .put(tagValue)
+                        )
+                )
+                .put("content", content)
+
+        assertEquals(
+            "[0,\"${"a".repeat(64)}\",1,24133," +
+                    "[[\"p\",\"tag\\\"\\\\</
\"]]," +
+                    "\"quote\\\" slash\\\\ backspace\\b " +
+                    "formfeed\\f newline\\n return\\r tab\\t " +
+                    "</ 

 café\"]",
+            NostrEventSerializer.serialize(event)
+        )
+    }
+}

package/android-template/app/src/test/java/com/pakstr/app/signer/NostrBridgeErrorTest.kt

@@ -0,0 +1,32 @@
+package com.pakstr.app.signer
+
+import com.pakstr.app.signer.exceptions.SignerUnavailableException
+import org.json.JSONObject
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class NostrBridgeErrorTest {
+    @Test
+    fun signer_unavailable_uses_availability_error_code() {
+        val response =
+            NostrBridge.signerErrorResponse(
+                SignerUnavailableException("not connected")
+            )
+
+        val json = JSONObject(response)
+        assertEquals("SIGNER_UNAVAILABLE", json.getString("error"))
+        assertEquals("not connected", json.getString("message"))
+    }
+
+    @Test
+    fun other_failures_use_generic_signer_error_code() {
+        val response =
+            NostrBridge.signerErrorResponse(
+                IllegalStateException("failed")
+            )
+
+        val json = JSONObject(response)
+        assertEquals("SIGNER_ERROR", json.getString("error"))
+        assertEquals("failed", json.getString("message"))
+    }
+}

package/android-template/app/src/test/java/com/pakstr/app/signer/bunker/BunkerConfigTest.kt

@@ -0,0 +1,120 @@
+package com.pakstr.app.signer.bunker
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertThrows
+import org.junit.Test
+
+class BunkerConfigTest {
+
+    @Test
+    fun parses_valid_bunker_connection() {
+        val config =
+            BunkerConfig.parse(
+                "bunker://$VALID_PUBKEY" +
+                        "?relay=wss://relay.one" +
+                        "&relay=wss%3A%2F%2Frelay.two%2Fnostr" +
+                        "&secret=pairing%20secret"
+            )
+
+        assertEquals(VALID_PUBKEY, config.remoteSignerPubkey)
+        assertEquals(
+            listOf(
+                "wss://relay.one",
+                "wss://relay.two/nostr"
+            ),
+            config.relayUrls
+        )
+        assertEquals("pairing secret", config.pairingSecret)
+    }
+
+    @Test
+    fun accepts_connection_without_pairing_secret() {
+        val config =
+            BunkerConfig.parse(
+                "bunker://$VALID_PUBKEY?relay=wss://relay.example"
+            )
+
+        assertNull(config.pairingSecret)
+    }
+
+    @Test
+    fun rejects_non_secure_relay() {
+        assertThrows(IllegalArgumentException::class.java) {
+            BunkerConfig.parse(
+                "bunker://$VALID_PUBKEY?relay=ws://relay.example"
+            )
+        }
+    }
+
+    @Test
+    fun rejects_duplicate_secrets_and_unsafe_uri_components() {
+        listOf(
+            "bunker://$VALID_PUBKEY?relay=wss://relay.example&secret=one&secret=two",
+            "bunker://user@$VALID_PUBKEY?relay=wss://relay.example",
+            "bunker://$VALID_PUBKEY/path?relay=wss://relay.example",
+            "bunker://$VALID_PUBKEY?relay=wss://relay.example#fragment"
+        ).forEach { value ->
+            assertThrows(IllegalArgumentException::class.java) {
+                BunkerConfig.parse(value)
+            }
+        }
+    }
+
+    @Test
+    fun rejects_missing_relay() {
+        assertThrows(IllegalArgumentException::class.java) {
+            BunkerConfig.parse(
+                "bunker://$VALID_PUBKEY"
+            )
+        }
+    }
+
+    @Test
+    fun rejects_malformed_public_key() {
+        assertThrows(IllegalArgumentException::class.java) {
+            BunkerConfig.parse(
+                "bunker://not-a-pubkey?relay=wss://relay.example"
+            )
+        }
+    }
+
+    @Test
+    fun rejects_public_key_outside_curve_field() {
+        assertThrows(IllegalArgumentException::class.java) {
+            BunkerConfig.parse(
+                "bunker://${"f".repeat(64)}?relay=wss://relay.example"
+            )
+        }
+    }
+
+    @Test
+    fun pairing_secret_is_not_exposed_by_diagnostics_or_errors() {
+        val secret = "unique-pairing-secret"
+        val config =
+            BunkerConfig.parse(
+                "bunker://$VALID_PUBKEY" +
+                        "?relay=wss://relay.example" +
+                        "&secret=$secret"
+            )
+
+        assertFalse(config.toString().contains(secret))
+
+        val error =
+            assertThrows(IllegalArgumentException::class.java) {
+                BunkerConfig.parse(
+                    "bunker://$VALID_PUBKEY" +
+                            "?relay=ws://relay.example" +
+                            "&secret=$secret"
+                )
+            }
+
+        assertFalse(error.message.orEmpty().contains(secret))
+    }
+
+    companion object {
+        private const val VALID_PUBKEY =
+            "cb227f60cb2a6d982ecbfc51b9199d340afc00b1ef81b67d8e3778e097e70d2c"
+    }
+}

package/android-template/app/src/test/java/com/pakstr/app/signer/bunker/Nip46ModelsTest.kt

@@ -0,0 +1,111 @@
+package com.pakstr.app.signer.bunker
+
+import org.json.JSONArray
+import org.json.JSONObject
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertThrows
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class Nip46ModelsTest {
+
+    @Test
+    fun request_round_trip_preserves_method_and_string_params() {
+        val request =
+            Nip46Request(
+                REQUEST_ID,
+                Nip46Method.NIP44_ENCRYPT,
+                listOf(PUBKEY, "private plaintext")
+            )
+
+        val parsed = Nip46Request.parse(request.toJson())
+
+        assertEquals(REQUEST_ID, parsed.id)
+        assertEquals(Nip46Method.NIP44_ENCRYPT, parsed.method)
+        assertEquals(2, parsed.params.size)
+        assertFalse(request.toString().contains("private plaintext"))
+    }
+
+    @Test
+    fun empty_params_are_serialized_as_array() {
+        val encoded =
+            JSONObject(
+                Nip46Request(
+                    REQUEST_ID,
+                    Nip46Method.GET_PUBLIC_KEY,
+                    emptyList()
+                ).toJson()
+            )
+
+        assertEquals(0, encoded.getJSONArray("params").length())
+    }
+
+    @Test
+    fun response_parsing_is_strict_and_safe() {
+        val secretResult = "sensitive result"
+        val response =
+            Nip46Response.parse(
+                JSONObject()
+                    .put("id", REQUEST_ID)
+                    .put("result", secretResult)
+                    .toString()
+            )
+
+        assertEquals(secretResult, response.result)
+        assertFalse(response.toString().contains(secretResult))
+
+        assertThrows(Nip46ProtocolException::class.java) {
+            Nip46Response.parse(
+                JSONObject()
+                    .put("id", REQUEST_ID)
+                    .put("result", 42)
+                    .toString()
+            )
+        }
+    }
+
+    @Test
+    fun malformed_json_unknown_methods_and_invalid_ids_are_rejected() {
+        assertThrows(Nip46ProtocolException::class.java) {
+            Nip46Request.parse("not-json")
+        }
+        assertThrows(Nip46ProtocolException::class.java) {
+            Nip46Request.parse(
+                JSONObject()
+                    .put("id", REQUEST_ID)
+                    .put("method", "unknown")
+                    .put("params", JSONArray())
+                    .toString()
+            )
+        }
+        assertThrows(Nip46ProtocolException::class.java) {
+            Nip46Request(
+                "predictable",
+                Nip46Method.CONNECT,
+                emptyList()
+            ).toJson()
+        }
+    }
+
+    @Test
+    fun secure_request_ids_are_canonical_and_unique() {
+        val ids =
+            (0 until 256)
+                .map {
+                    SecureNip46RequestIdGenerator.nextId()
+                }
+
+        assertTrue(
+            ids.all { it.matches(Regex("[0-9a-f]{64}")) }
+        )
+        assertEquals(ids.size, ids.toSet().size)
+    }
+
+    companion object {
+        private const val REQUEST_ID =
+            "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        private const val PUBKEY =
+            "cb227f60cb2a6d982ecbfc51b9199d340afc00b1ef81b67d8e3778e097e70d2c"
+    }
+}