pakstr 0.20.0 → 0.21.0

package/android-template/app/src/test/java/com/pakstr/app/signer/bunker/Nip46PairingClientTest.kt

@@ -0,0 +1,271 @@
+package com.pakstr.app.signer.bunker
+
+import com.pakstr.app.crypto.Bip340Hash
+import com.pakstr.app.crypto.Nip46ClientKey
+import com.pakstr.app.signer.NostrEventBuilder
+import kotlinx.coroutines.CoroutineStart
+import kotlinx.coroutines.async
+import kotlinx.coroutines.runBlocking
+import org.json.JSONArray
+import org.json.JSONObject
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Test
+
+class Nip46PairingClientTest {
+    private lateinit var clientKey: Nip46ClientKey
+    private lateinit var signerKey: Nip46ClientKey
+    private lateinit var factory: FakeConnectionFactory
+    private lateinit var client: Nip46PairingClient
+
+    @Before
+    fun setup() {
+        clientKey = Nip46ClientKey.fromPrivateKey(privateKey(1))
+        signerKey = Nip46ClientKey.fromPrivateKey(privateKey(2))
+        factory = FakeConnectionFactory()
+        client =
+            Nip46PairingClient(
+                relayUrls = listOf(RELAY_URL),
+                clientKey = clientKey,
+                pairingSecret = PAIRING_SECRET,
+                connectionFactory = factory
+            )
+        factory.connection.open()
+    }
+
+    @After
+    fun teardown() {
+        client.close()
+        clientKey.close()
+        signerKey.close()
+    }
+
+    @Test
+    fun pairing_uri_is_not_exposed_before_subscription_readiness() = runBlocking {
+        recreateClientWithoutOpeningRelay()
+        val exposedUri = async(start = CoroutineStart.UNDISPATCHED) {
+            check(client.awaitRelayReady(1_000))
+            PAIRING_URI
+        }
+
+        assertTrue(!exposedUri.isCompleted)
+
+        factory.connection.open()
+
+        assertEquals(PAIRING_URI, exposedUri.await())
+        val messages = factory.connection.messages
+        assertEquals(1, messages.size)
+        assertEquals("REQ", JSONArray(messages.single()).getString(0))
+    }
+
+    @Test
+    fun response_after_readiness_completes_pairing() = runBlocking {
+        assertTrue(client.awaitRelayReady(100))
+
+        factory.connection.receiveEvent(responseEvent(PAIRING_SECRET))
+
+        assertEquals(
+            signerKey.publicKeyHex,
+            requireNotNull(client.awaitConnection(100)).remoteSignerPubkey
+        )
+    }
+
+    @Test
+    fun response_cannot_precede_readiness_when_uri_exposure_is_blocked() = runBlocking {
+        recreateClientWithoutOpeningRelay()
+        val exposedUri = async(start = CoroutineStart.UNDISPATCHED) {
+            check(client.awaitRelayReady(1_000))
+            PAIRING_URI
+        }
+
+        assertTrue(!exposedUri.isCompleted)
+        factory.connection.open()
+        assertEquals(PAIRING_URI, exposedUri.await())
+        factory.connection.receiveEvent(responseEvent(PAIRING_SECRET))
+
+        assertEquals(
+            signerKey.publicKeyHex,
+            requireNotNull(client.awaitConnection(100)).remoteSignerPubkey
+        )
+    }
+
+    @Test
+    fun relay_failure_does_not_leave_readiness_waiting_indefinitely() = runBlocking {
+        recreateClientWithoutOpeningRelay()
+        factory.connection.fail()
+
+        assertTrue(!client.awaitRelayReady(25))
+    }
+
+    @Test
+    fun matching_secret_completes_pairing() = runBlocking {
+        factory.connection.receiveEvent(
+            responseEvent(PAIRING_SECRET)
+        )
+
+        val config = requireNotNull(client.awaitConnection(100))
+        assertEquals(signerKey.publicKeyHex, config.remoteSignerPubkey)
+        assertEquals(listOf(RELAY_URL), config.relayUrls)
+        assertNull(config.pairingSecret)
+    }
+
+    @Test
+    fun amber_connect_response_with_short_id_completes_pairing() = runBlocking {
+        factory.connection.receiveEvent(
+            responseEvent(
+                result = PAIRING_SECRET,
+                responseId = AMBER_RESPONSE_ID
+            )
+        )
+
+        val config = requireNotNull(client.awaitConnection(100))
+        assertEquals(signerKey.publicKeyHex, config.remoteSignerPubkey)
+    }
+
+    @Test
+    fun ack_wrong_secret_and_invalid_event_are_ignored() = runBlocking {
+        factory.connection.receiveEvent(responseEvent("ack"))
+        factory.connection.receiveEvent(responseEvent("wrong-secret"))
+        factory.connection.receiveEvent(
+            JSONObject(responseEvent(PAIRING_SECRET))
+                .put("sig", "0".repeat(128))
+                .toString()
+        )
+
+        assertNull(client.awaitConnection(25))
+    }
+
+    @Test
+    fun close_is_idempotent_and_unblocks_waiter() = runBlocking {
+        client.close()
+        client.close()
+
+        assertTrue(factory.connection.closed)
+        assertTrue(factory.closed)
+        assertNull(client.awaitConnection(25))
+    }
+
+    private fun recreateClientWithoutOpeningRelay() {
+        client.close()
+        factory = FakeConnectionFactory()
+        client =
+            Nip46PairingClient(
+                relayUrls = listOf(RELAY_URL),
+                clientKey = clientKey,
+                pairingSecret = PAIRING_SECRET,
+                connectionFactory = factory
+            )
+    }
+
+    private fun responseEvent(
+        result: String,
+        responseId: String = REQUEST_ID
+    ): String {
+        val response =
+            JSONObject()
+                .put("id", responseId)
+                .put("result", result)
+        val encrypted =
+            signerKey.encryptNip44(
+                response.toString(),
+                clientKey.publicKeyHex
+            )
+        val event =
+            JSONObject()
+                .put("pubkey", signerKey.publicKeyHex)
+                .put("created_at", CREATED_AT)
+                .put("kind", 24133)
+                .put(
+                    "tags",
+                    JSONArray().put(
+                        JSONArray()
+                            .put("p")
+                            .put(clientKey.publicKeyHex)
+                    )
+                )
+                .put("content", encrypted)
+        NostrEventBuilder.addId(event)
+        val eventId = Bip340Hash.hexToBytes(event.getString("id"))
+        val signature = signerKey.sign(eventId)
+        event.put("sig", Bip340Hash.bytesToHex(signature))
+        eventId.fill(0)
+        signature.fill(0)
+        return event.toString()
+    }
+
+    private fun privateKey(value: Int): ByteArray {
+        return ByteArray(32).also { it[31] = value.toByte() }
+    }
+
+    private class FakeConnectionFactory : Nip46RelayConnectionFactory {
+        lateinit var connection: FakeConnection
+            private set
+        var closed = false
+            private set
+
+        override fun connect(
+            relayUrl: String,
+            listener: Nip46RelayConnectionListener
+        ): Nip46RelayConnection {
+            return FakeConnection(listener).also {
+                connection = it
+            }
+        }
+
+        override fun close() {
+            closed = true
+        }
+    }
+
+    private class FakeConnection(
+        private val listener: Nip46RelayConnectionListener
+    ) : Nip46RelayConnection {
+        private lateinit var subscriptionId: String
+        val messages = mutableListOf<String>()
+        var closed = false
+            private set
+
+        override fun send(message: String): Boolean {
+            messages += message
+            val frame = JSONArray(message)
+            if (frame.getString(0) == "REQ") {
+                subscriptionId = frame.getString(1)
+            }
+            return !closed
+        }
+
+        override fun close() {
+            closed = true
+        }
+
+        fun open() {
+            listener.onOpen()
+        }
+
+        fun fail() {
+            listener.onFailure()
+        }
+
+        fun receiveEvent(eventJson: String) {
+            listener.onMessage(
+                JSONArray()
+                    .put("EVENT")
+                    .put(subscriptionId)
+                    .put(JSONObject(eventJson))
+                    .toString()
+            )
+        }
+    }
+
+    private companion object {
+        const val RELAY_URL = "wss://relay.example"
+        const val PAIRING_SECRET = "pairing-secret-value"
+        const val PAIRING_URI = "nostrconnect://not-exposed-until-ready"
+        const val CREATED_AT = 1_700_000_000L
+        const val AMBER_RESPONSE_ID = "a1b2c3"
+        val REQUEST_ID = "a".repeat(64)
+    }
+}

package/android-template/app/src/test/java/com/pakstr/app/signer/bunker/Nip46PairingQrCodeTest.kt

@@ -0,0 +1,54 @@
+package com.pakstr.app.signer.bunker
+
+import com.google.zxing.BinaryBitmap
+import com.google.zxing.RGBLuminanceSource
+import com.google.zxing.common.HybridBinarizer
+import com.google.zxing.qrcode.QRCodeReader
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertThrows
+import org.junit.Test
+
+class Nip46PairingQrCodeTest {
+
+    @Test
+    fun qr_code_decodes_to_exact_nostrconnect_uri() {
+        val uri =
+            "nostrconnect://${"a".repeat(64)}" +
+                    "?relay=wss%3A%2F%2Frelay.example" +
+                    "&perms=sign_event%2Cnip44_encrypt" +
+                    "&name=Pakstr" +
+                    "&secret=exact-pairing-secret"
+        val matrix = Nip46PairingQrCode.encode(uri, 512)
+        val pixels = IntArray(matrix.width * matrix.height) { index ->
+            val x = index % matrix.width
+            val y = index / matrix.width
+            if (matrix[x, y]) BLACK else WHITE
+        }
+        val bitmap = BinaryBitmap(
+            HybridBinarizer(
+                RGBLuminanceSource(
+                    matrix.width,
+                    matrix.height,
+                    pixels
+                )
+            )
+        )
+
+        assertEquals(uri, QRCodeReader().decode(bitmap).text)
+    }
+
+    @Test
+    fun rejects_blank_payload_and_invalid_size() {
+        assertThrows(IllegalArgumentException::class.java) {
+            Nip46PairingQrCode.encode("", 512)
+        }
+        assertThrows(IllegalArgumentException::class.java) {
+            Nip46PairingQrCode.encode("nostrconnect://pairing", 0)
+        }
+    }
+
+    private companion object {
+        const val BLACK = -0x1000000
+        const val WHITE = -0x1
+    }
+}

package/android-template/app/src/test/java/com/pakstr/app/signer/bunker/Nip46PairingUriTest.kt

@@ -0,0 +1,80 @@
+package com.pakstr.app.signer.bunker
+
+import com.pakstr.app.crypto.Nip46ClientKey
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import java.net.URI
+import java.net.URLDecoder
+
+class Nip46PairingUriTest {
+    @Test
+    fun generated_uri_is_canonical_and_contains_required_fields() {
+        val clientKey = Nip46ClientKey.fromPrivateKey(privateKey(1))
+        try {
+            val uri =
+                Nip46PairingUri.create(
+                    clientPubkey = clientKey.publicKeyHex,
+                    relayUrls = listOf(
+                        "wss://relay-one.example/path",
+                        "wss://relay-two.example"
+                    ),
+                    secret = "one-time-secret",
+                    permissions = "sign_event,nip44_encrypt",
+                    clientName = "Pakstr"
+                ).encode()
+            val parsed = URI(uri)
+            val parameters =
+                parsed.rawQuery.split("&").map { parameter ->
+                    val parts = parameter.split("=", limit = 2)
+                    URLDecoder.decode(parts[0], "UTF-8") to
+                            URLDecoder.decode(parts[1], "UTF-8")
+                }
+
+            assertEquals("nostrconnect", parsed.scheme)
+            assertEquals(clientKey.publicKeyHex, parsed.host)
+            assertEquals(
+                listOf(
+                    "wss://relay-one.example/path",
+                    "wss://relay-two.example"
+                ),
+                parameters.filter { it.first == "relay" }.map { it.second }
+            )
+            assertEquals(
+                "one-time-secret",
+                parameters.single { it.first == "secret" }.second
+            )
+            assertTrue(uri.contains("name=Pakstr"))
+            assertFalse(
+                Nip46PairingUri.create(
+                    clientKey.publicKeyHex,
+                    listOf("wss://relay.example"),
+                    "secret"
+                ).toString().contains("secret")
+            )
+        } finally {
+            clientKey.close()
+        }
+    }
+
+    @Test
+    fun generated_uri_rejects_insecure_relays() {
+        val clientKey = Nip46ClientKey.fromPrivateKey(privateKey(1))
+        try {
+            org.junit.Assert.assertThrows(IllegalArgumentException::class.java) {
+                Nip46PairingUri.create(
+                    clientKey.publicKeyHex,
+                    listOf("ws://relay.example"),
+                    "secret"
+                )
+            }
+        } finally {
+            clientKey.close()
+        }
+    }
+
+    private fun privateKey(value: Int): ByteArray {
+        return ByteArray(32).also { it[31] = value.toByte() }
+    }
+}