pakstr 0.20.0 → 0.21.0

package/android-template/app/src/main/java/com/pakstr/app/signer/SignerManager.kt

@@ -4,246 +4,323 @@ import android.content.Context
 import android.content.Intent
 import androidx.activity.result.ActivityResult
 import androidx.activity.result.ActivityResultLauncher
-import com.pakstr.app.signer.interfaces.NostrSigner
 import androidx.core.content.edit
+import com.pakstr.app.crypto.Nip46ClientKey
 import com.pakstr.app.debug.AppDebugLogger
+import com.pakstr.app.signer.bunker.BunkerConfig
+import com.pakstr.app.signer.bunker.BunkerConnectionStore
+import com.pakstr.app.signer.bunker.Nip46PairingClient
+import com.pakstr.app.signer.bunker.Nip46PairingUri
+import com.pakstr.app.signer.bunker.RelayNip46Client
 import com.pakstr.app.signer.exceptions.SignerUnavailableException
+import com.pakstr.app.signer.interfaces.NostrSigner
+import org.json.JSONObject
 
-/**
- * Manages Nostr signer selection and lifecycle.
- *
- * Provides a single access point for obtaining the active NostrSigner
- * implementation used by the application.
- *
- * Supported signer types:
- *
- * - Amber
- *      External Android signer app using the nostrsigner URI scheme.
- *
- * - Fake
- *      Test signer used for development and testing.
- *
- * - Bunker
- *      Reserved for NIP-46 remote signer implementation.
- *
- * The selected signer type is persisted using SharedPreferences.
- * The signer instance is cached and recreated only when the user
- * changes the active signer.
- */
 class SignerManager(
     context: Context,
-    private val amberLauncher: ActivityResultLauncher<Intent>
+    private val amberLauncher: ActivityResultLauncher<Intent>,
+    private val bunkerAuthChallengeHandler: ((String) -> Unit)? = null
 ) {
-    private val context =
-        context.applicationContext
-
+    private val context = context.applicationContext
     private val prefs =
         this.context.getSharedPreferences(
             "signer",
             Context.MODE_PRIVATE
         )
+    private val bunkerStore by lazy {
+        BunkerConnectionStore(this.context)
+    }
 
     private var activeSigner: NostrSigner? = null
-
     private var currentUserPubkey: String? = null
+    private var pendingPairing: PendingPairing? = null
 
     init {
-
         AppDebugLogger.log(
-
             context,
-
             "SIGNER",
-
             "SignerManager initialized. Active type: ${getActiveType()}"
-
         )
-
     }
 
     fun getActiveType(): SignerType? {
-
-        val value =
-            prefs.getString(
-                "type",
-                SignerType.AMBER.name
-            )
-
+        val value = prefs.getString("type", SignerType.AMBER.name)
         return try {
             SignerType.valueOf(value.toString())
-
         } catch (_: IllegalArgumentException) {
             SignerType.AMBER
         }
     }
 
-    suspend fun getCurrentUserPubkey(): String {
-
-        currentUserPubkey?.let {
-
-            return it
-
+    fun hasBunkerSession(): Boolean {
+        return try {
+            val connection = bunkerStore.restore() ?: return false
+            connection.clientKey.close()
+            true
+        } catch (_: Exception) {
+            false
         }
+    }
 
-        val pk =
-
-            getSigner()
-
-                .getPublicKey()
-
-        currentUserPubkey = pk
-
+    suspend fun getCurrentUserPubkey(): String {
+        currentUserPubkey?.let { return it }
+        val publicKey = getSigner().getPublicKey()
+        currentUserPubkey = publicKey
         AppDebugLogger.log(
-
             context,
-
             "SIGNER",
+            "Public key received: ${publicKey.take(12)}..."
+        )
+        return publicKey
+    }
 
-            "Public key received: ${pk.take(12)}..."
+    suspend fun createBunkerPairingUri(
+        relayUrls: List<String>,
+        permissions: String? = null
+    ): String {
+        cancelBunkerPairing()
+        val clientKey = Nip46ClientKey.generate()
+        val secret = Nip46PairingClient.generateSecret()
+        var client: Nip46PairingClient? = null
+        var exposed = false
+        try {
+            val pairingUri =
+                Nip46PairingUri.create(
+                    clientKey.publicKeyHex,
+                    relayUrls,
+                    secret,
+                    permissions,
+                    context.getString(com.pakstr.app.R.string.app_name)
+                ).encode()
+            client =
+                Nip46PairingClient(
+                    context,
+                    relayUrls,
+                    clientKey,
+                    secret
+                )
+            if (!client.awaitRelayReady()) {
+                throw SignerUnavailableException(
+                    "Unable to subscribe for NIP-46 pairing responses"
+                )
+            }
+            synchronized(this) {
+                check(pendingPairing == null) {
+                    "Another NIP-46 pairing attempt is active"
+                }
+                pendingPairing = PendingPairing(clientKey, client)
+            }
+            exposed = true
+            return pairingUri
+        } finally {
+            if (!exposed) {
+                client?.close()
+                clientKey.close()
+            }
+        }
+    }
 
-        )
+    suspend fun finishBunkerPairing(): Boolean {
+        val pairing = pendingPairing ?: return false
+        try {
+            val config = pairing.client.awaitConnection()
+                ?: return false
+            bunkerStore.save(config, pairing.clientKey, null)
+            closeActiveSigner()
+            setActiveTypeWithoutClosing(SignerType.BUNKER)
+            return true
+        } finally {
+            pendingPairing = null
+            pairing.client.close()
+            pairing.clientKey.close()
+        }
+    }
 
-        return pk
+    fun cancelBunkerPairing() {
+        val pairing = pendingPairing ?: return
+        pendingPairing = null
+        pairing.client.close()
+        pairing.clientKey.close()
+    }
 
+    fun connectBunker(connectionUri: String) {
+        val config = BunkerConfig.parse(connectionUri)
+        val clientKey = Nip46ClientKey.generate()
+        try {
+            bunkerStore.savePending(config, clientKey)
+        } catch (_: Exception) {
+            throw SignerUnavailableException(
+                "Unable to store bunker connection securely"
+            )
+        } finally {
+            clientKey.close()
+        }
+        closeActiveSigner()
+        setActiveTypeWithoutClosing(SignerType.BUNKER)
     }
 
-    fun setActiveType(
-        type: SignerType
-    ) {
+    fun setActiveType(type: SignerType) {
         AppDebugLogger.log(
-
             context,
-
             "SIGNER",
-
             "Changing active signer to: ${type.name}"
-
         )
-        prefs.edit {
-            putString(
-                "type",
-                type.name
-            )
-        }
-
-        activeSigner = null
+        closeActiveSigner()
+        setActiveTypeWithoutClosing(type)
     }
 
-    /**
-     * Returns the currently selected signer implementation.
-     *
-     * Creates the signer lazily on first request and reuses the same
-     * instance until the signer type changes.
-     */
-    fun getSigner(): NostrSigner {
-
-        activeSigner?.let {
-            return it
+    fun logoutBunker() {
+        try {
+            (activeSigner as? BunkerSigner)?.disconnect()
+        } finally {
+            closeActiveSigner()
         }
+        try {
+            bunkerStore.clear()
+        } finally {
+            setActiveTypeWithoutClosing(SignerType.AMBER)
+        }
+    }
 
+    fun getSigner(): NostrSigner {
+        activeSigner?.let { return it }
         val activeType = getActiveType()
-
         AppDebugLogger.log(
-
             context,
-
             "SIGNER",
-
             "Creating signer instance: $activeType"
-
         )
 
         val signer =
-            when (getActiveType()) {
-
-                SignerType.AMBER -> {
-                    AppDebugLogger.log(
-
-                        context,
-
-                        "AMBER",
-
-                        "Creating Amber signer"
-
-                    )
-                    if (!isAmberInstalled()) {
-                        AppDebugLogger.error(
+            when (activeType) {
+                SignerType.AMBER -> createAmberSigner()
+                SignerType.BUNKER -> createBunkerSigner()
+                SignerType.FAKE -> FakeSigner()
+                null -> throw IllegalStateException("No signer selected")
+            }
+        activeSigner = signer
+        return signer
+    }
 
-                            context,
+    fun close() {
+        cancelBunkerPairing()
+        closeActiveSigner()
+    }
 
-                            "AMBER",
+    fun handleAmberResult(result: ActivityResult) {
+        AppDebugLogger.log(
+            context,
+            "AMBER",
+            "Activity result received: ${result.resultCode}"
+        )
+        (activeSigner as? AmberSigner)?.onResult(result)
+    }
 
-                            "Amber signer app is not installed"
+    private fun createAmberSigner(): AmberSigner {
+        AppDebugLogger.log(
+            context,
+            "AMBER",
+            "Creating Amber signer"
+        )
+        if (!isAmberInstalled()) {
+            AppDebugLogger.error(
+                context,
+                "AMBER",
+                "Amber signer app is not installed"
+            )
+            throw SignerUnavailableException(
+                "Amber signer application is not installed"
+            )
+        }
+        return AmberSigner(amberLauncher)
+    }
 
+    private fun createBunkerSigner(): BunkerSigner {
+        val connection =
+            try {
+                bunkerStore.restore()
+            } catch (_: Exception) {
+                null
+            } ?: throw SignerUnavailableException(
+                "Bunker connection is not configured"
+            )
+        currentUserPubkey = connection.userPubkey
+
+        val client =
+            try {
+                RelayNip46Client(
+                    config = connection.config,
+                    clientKey = connection.clientKey,
+                    authChallengeHandler = bunkerAuthChallengeHandler,
+                    initialUserPubkey = connection.userPubkey,
+                    activationHandler = {
+                        bunkerStore.save(
+                            connection.config.withoutPairingSecret(),
+                            connection.clientKey,
+                            connection.userPubkey
                         )
-                        throw SignerUnavailableException(
-                            "Amber signer application is not installed"
+                    },
+                    userPubkeyHandler = { userPubkey ->
+                        bunkerStore.save(
+                            connection.config.withoutPairingSecret(),
+                            connection.clientKey,
+                            userPubkey
                         )
-                    }
-
-                    AmberSigner(
-                        amberLauncher
-                    )
-                }
-
-                SignerType.BUNKER -> {
-                    throw SignerUnavailableException(
-                        "Bunker signer is not implemented"
-                    )
-                }
-
-                SignerType.FAKE -> {
-                    FakeSigner()
-                }
-
-                null -> {
-
-                    throw IllegalStateException(
-                        "No signer selected"
-                    )
-                }
+                        currentUserPubkey = userPubkey
+                    },
+                    requestedPermissions = BUNKER_PERMISSIONS,
+                    clientMetadataJson =
+                        JSONObject()
+                            .put(
+                                "name",
+                                context.getString(
+                                    com.pakstr.app.R.string.app_name
+                                )
+                            )
+                            .toString(),
+                    connected = connection.connected
+                )
+            } catch (_: Exception) {
+                connection.clientKey.close()
+                throw SignerUnavailableException(
+                    "Unable to restore bunker connection"
+                )
             }
+        return BunkerSigner(context, client)
+    }
 
-        activeSigner = signer
+    private fun setActiveTypeWithoutClosing(type: SignerType) {
+        prefs.edit {
+            putString("type", type.name)
+        }
+    }
 
-        return signer
+    private fun closeActiveSigner() {
+        (activeSigner as? BunkerSigner)?.close()
+        activeSigner = null
+        currentUserPubkey = null
     }
 
-    private fun isAmberInstalled(): Boolean {
+    private class PendingPairing(
+        val clientKey: Nip46ClientKey,
+        val client: Nip46PairingClient
+    )
 
+    private fun isAmberInstalled(): Boolean {
         return try {
-
-            context.packageManager
-                .getPackageInfo(
-                    "com.greenart7c3.nostrsigner",
-                    0
-                )
-
+            context.packageManager.getPackageInfo(
+                "com.greenart7c3.nostrsigner",
+                0
+            )
             true
-
         } catch (_: Exception) {
-
             false
         }
     }
 
-    /**
-     * Forwards Android Activity results back to the active Amber signer.
-     *
-     * Required because Amber communication is based on the Android
-     * Activity Result API.
-     */
-    fun handleAmberResult(result: ActivityResult) {
-        AppDebugLogger.log(
-
-            context,
-
-            "AMBER",
-
-            "Activity result received: ${result.resultCode}"
-
-        )
-        (activeSigner as? AmberSigner)
-            ?.onResult(result)
+    private companion object {
+        const val BUNKER_PERMISSIONS =
+            "sign_event,nip04_encrypt,nip04_decrypt," +
+                    "nip44_encrypt,nip44_decrypt"
     }
-}
+}

package/android-template/app/src/main/java/com/pakstr/app/signer/bunker/BunkerConfig.kt

@@ -0,0 +1,175 @@
+package com.pakstr.app.signer.bunker
+
+import com.pakstr.app.crypto.Bip340Verifier
+import java.net.URI
+import java.net.URLDecoder
+import java.net.URLEncoder
+import java.nio.charset.StandardCharsets
+
+class BunkerConfig private constructor(
+    val remoteSignerPubkey: String,
+    relayUrls: List<String>,
+    pairingSecret: String?
+) {
+    val relayUrls: List<String> = relayUrls.toList()
+    private var pairingSecretValue: String? = pairingSecret
+    val pairingSecret: String?
+        get() = pairingSecretValue
+
+    internal fun clearPairingSecret() {
+        pairingSecretValue = null
+    }
+
+    internal fun withoutPairingSecret(): BunkerConfig {
+        return BunkerConfig(
+            remoteSignerPubkey,
+            relayUrls,
+            null
+        )
+    }
+
+    internal fun encode(): String {
+        val parameters = relayUrls.map { "relay" to it }.toMutableList()
+        pairingSecret?.let { parameters += "secret" to it }
+        return "bunker://$remoteSignerPubkey?" +
+                parameters.joinToString("&") { (name, value) ->
+                    "${encodeParameter(name)}=${encodeParameter(value)}"
+                }
+    }
+
+    override fun toString(): String {
+        return "BunkerConfig(" +
+                "remoteSignerPubkey=${remoteSignerPubkey.take(12)}..., " +
+                "relayCount=${relayUrls.size}, " +
+                "hasPairingSecret=${pairingSecret != null}" +
+                ")"
+    }
+
+    companion object {
+        fun parse(value: String): BunkerConfig {
+            val uri = parseUri(value)
+
+            require(uri.scheme == "bunker") {
+                "Invalid bunker connection scheme"
+            }
+            require(uri.rawAuthority != null && uri.rawUserInfo == null) {
+                "Invalid bunker connection authority"
+            }
+            require(uri.rawPath.isNullOrEmpty()) {
+                "Invalid bunker connection path"
+            }
+            require(uri.rawFragment == null) {
+                "Invalid bunker connection fragment"
+            }
+
+            val remoteSignerPubkey = uri.host
+            require(
+                remoteSignerPubkey != null &&
+                        remoteSignerPubkey.matches(Regex("[0-9a-f]{64}")) &&
+                        Bip340Verifier.isValidXOnlyPubkey(remoteSignerPubkey)
+            ) {
+                "Invalid remote signer public key"
+            }
+
+            val parameters = parseQuery(uri.rawQuery)
+            val relayUrls =
+                parameters
+                    .filter { it.first == "relay" }
+                    .map { validateRelay(it.second) }
+
+            require(relayUrls.isNotEmpty()) {
+                "At least one relay is required"
+            }
+
+            val secrets =
+                parameters
+                    .filter { it.first == "secret" }
+                    .map { it.second }
+
+            require(secrets.size <= 1) {
+                "Multiple pairing secrets are not supported"
+            }
+
+            return BunkerConfig(
+                remoteSignerPubkey = remoteSignerPubkey,
+                relayUrls = relayUrls,
+                pairingSecret = secrets.singleOrNull()
+            )
+        }
+
+        private fun parseUri(value: String): URI {
+            require(value.isNotBlank() && value == value.trim()) {
+                "Invalid bunker connection"
+            }
+
+            return try {
+                URI(value)
+            } catch (_: Exception) {
+                throw IllegalArgumentException(
+                    "Invalid bunker connection"
+                )
+            }
+        }
+
+        private fun parseQuery(
+            rawQuery: String?
+        ): List<Pair<String, String>> {
+            if (rawQuery.isNullOrEmpty()) {
+                return emptyList()
+            }
+
+            return rawQuery
+                .split("&")
+                .map { parameter ->
+                    val parts = parameter.split("=", limit = 2)
+                    require(parts.size == 2) {
+                        "Invalid bunker connection parameter"
+                    }
+
+                    decode(parts[0]) to decode(parts[1])
+                }
+        }
+
+        private fun validateRelay(value: String): String {
+            val relay =
+                try {
+                    URI(value)
+                } catch (_: Exception) {
+                    throw IllegalArgumentException(
+                        "Invalid relay URL"
+                    )
+                }
+
+            require(
+                relay.scheme == "wss" &&
+                        !relay.host.isNullOrBlank() &&
+                        relay.rawUserInfo == null &&
+                        relay.rawFragment == null
+            ) {
+                "Invalid relay URL"
+            }
+
+            return relay.toASCIIString()
+        }
+
+        private fun encodeParameter(value: String): String {
+            return URLEncoder.encode(
+                value,
+                StandardCharsets.UTF_8.name()
+            )
+        }
+
+        private fun decode(value: String): String {
+            return try {
+                URLDecoder.decode(
+                    value,
+                    StandardCharsets.UTF_8.name()
+                )
+            } catch (_: Exception) {
+                throw IllegalArgumentException(
+                    "Invalid bunker connection parameter"
+                )
+            }
+        }
+    }
+}