pakstr 0.20.0 → 0.21.1

package/README.md

@@ -12,7 +12,7 @@ The same `nsec` serves two core purposes:
 
 ## Status
 
-Pakstr is currently in **early development (0.x)**.  
+Pakstr is currently in **early development (0.x)**.
 The CLI API and configuration format may change before 1.0.0.
 
 ---

package/android-template/app/build.gradle.kts

@@ -132,6 +132,7 @@ dependencies {
     implementation(libs.androidx.compose.ui.tooling.preview)
     implementation(libs.androidx.compose.material3)
     testImplementation(libs.junit)
+    testImplementation(libs.json)
     androidTestImplementation(libs.androidx.junit)
     androidTestImplementation(libs.androidx.espresso.core)
     androidTestImplementation(platform(libs.androidx.compose.bom))
@@ -142,5 +143,8 @@ dependencies {
     implementation(libs.androidx.appcompat)
     implementation(libs.material)
     implementation(libs.androidx.core.splashscreen)
+    implementation(libs.okhttp)
+    implementation(libs.androidx.security.crypto)
+    implementation(libs.zxing.core)
     implementation("org.bouncycastle:bcprov-jdk18on:1.78.1")
 }

package/android-template/app/src/androidTest/java/com/pakstr/app/signer/SignerManagerTest.kt

@@ -0,0 +1,273 @@
+package com.pakstr.app.signer
+
+import android.content.Context
+import android.content.Intent
+import androidx.activity.result.ActivityResultLauncher
+import androidx.activity.result.contract.ActivityResultContract
+import androidx.core.app.ActivityOptionsCompat
+import androidx.test.core.app.ApplicationProvider
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import com.pakstr.app.crypto.Nip46ClientKey
+import com.pakstr.app.signer.bunker.BunkerConfig
+import com.pakstr.app.signer.bunker.BunkerConnectionStore
+import com.pakstr.app.signer.bunker.Nip46Client
+import com.pakstr.app.signer.interfaces.NostrSigner
+import kotlinx.coroutines.runBlocking
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Assert.fail
+import org.junit.Test
+import org.junit.runner.RunWith
+
+@RunWith(AndroidJUnit4::class)
+class SignerManagerTest {
+
+    @Test
+    fun signer_change_clears_cached_user_pubkey() = runBlocking {
+        val context =
+            ApplicationProvider.getApplicationContext<Context>()
+        val manager =
+            SignerManager(
+                context,
+                NoOpLauncher()
+            )
+        val amberSigner = CountingSigner("amber-pubkey")
+        val bunkerSigner = CountingSigner("bunker-pubkey")
+
+        manager.setActiveType(SignerType.AMBER)
+        setActiveSigner(manager, amberSigner)
+
+        assertEquals("amber-pubkey", manager.getCurrentUserPubkey())
+        assertEquals("amber-pubkey", manager.getCurrentUserPubkey())
+        assertEquals(1, amberSigner.publicKeyRequests)
+
+        manager.setActiveType(SignerType.BUNKER)
+        setActiveSigner(manager, bunkerSigner)
+
+        assertEquals("bunker-pubkey", manager.getCurrentUserPubkey())
+        assertEquals(1, bunkerSigner.publicKeyRequests)
+    }
+
+    @Test
+    fun invalid_pairing_relay_does_not_leave_pending_pairing() = runBlocking {
+        val context =
+            ApplicationProvider.getApplicationContext<Context>()
+        val manager =
+            SignerManager(
+                context,
+                NoOpLauncher()
+            )
+
+        try {
+            manager.createBunkerPairingUri(listOf("wss://"))
+            fail("Expected invalid relay URL")
+        } catch (_: IllegalArgumentException) {
+            assertNull(getPendingPairing(manager))
+        } finally {
+            manager.close()
+        }
+    }
+
+    @Test
+    fun established_bunker_session_survives_manager_recreation_and_logout() {
+        val context =
+            ApplicationProvider.getApplicationContext<Context>()
+        val store = BunkerConnectionStore(context)
+        val clientKey = Nip46ClientKey.generate()
+        val config =
+            BunkerConfig.parse(
+                "bunker://$VALID_PUBKEY?relay=wss://relay.example"
+            )
+        val first = SignerManager(context, NoOpLauncher())
+        val restored = SignerManager(context, NoOpLauncher())
+        store.clear()
+        try {
+            store.save(config, clientKey, VALID_PUBKEY)
+            first.setActiveType(SignerType.BUNKER)
+
+            assertTrue(restored.hasBunkerSession())
+            assertEquals(SignerType.BUNKER, restored.getActiveType())
+
+            restored.logoutBunker()
+
+            assertFalse(restored.hasBunkerSession())
+            assertEquals(SignerType.AMBER, restored.getActiveType())
+        } finally {
+            first.close()
+            restored.close()
+            clientKey.close()
+            store.clear()
+        }
+    }
+
+    @Test
+    fun switching_from_bunker_disconnects_and_closes_client() {
+        val context =
+            ApplicationProvider.getApplicationContext<Context>()
+        val manager = SignerManager(context, NoOpLauncher())
+        val client = RecordingNip46Client()
+        setActiveSigner(manager, BunkerSigner(context, client))
+
+        manager.logoutBunker()
+
+        assertTrue(client.disconnected)
+        assertTrue(client.closed)
+        assertEquals(SignerType.AMBER, manager.getActiveType())
+    }
+
+    @Test
+    fun pending_bunker_secret_is_removed_from_established_storage() {
+        val context =
+            ApplicationProvider.getApplicationContext<Context>()
+        val store = BunkerConnectionStore(context)
+        val clientKey = Nip46ClientKey.generate()
+        val config =
+            BunkerConfig.parse(
+                "bunker://$VALID_PUBKEY" +
+                        "?relay=wss://relay.example" +
+                        "&secret=$PAIRING_SECRET"
+            )
+        store.clear()
+        try {
+            store.savePending(config, clientKey)
+            val pending = requireNotNull(store.restore())
+            assertEquals(PAIRING_SECRET, pending.config.pairingSecret)
+            assertFalse(pending.connected)
+            pending.clientKey.close()
+
+            store.save(config, clientKey, VALID_PUBKEY)
+            val established = requireNotNull(store.restore())
+            assertNull(established.config.pairingSecret)
+            assertEquals(VALID_PUBKEY, established.userPubkey)
+            assertTrue(established.connected)
+            established.clientKey.close()
+        } finally {
+            clientKey.close()
+            store.clear()
+        }
+    }
+
+    private fun getPendingPairing(manager: SignerManager): Any? {
+        return SignerManager::class.java
+            .getDeclaredField("pendingPairing")
+            .apply {
+                isAccessible = true
+            }
+            .get(manager)
+    }
+
+    private fun setActiveSigner(
+        manager: SignerManager,
+        signer: NostrSigner
+    ) {
+        SignerManager::class.java
+            .getDeclaredField("activeSigner")
+            .apply {
+                isAccessible = true
+            }
+            .set(manager, signer)
+    }
+
+    private class RecordingNip46Client : Nip46Client {
+        var disconnected = false
+            private set
+        var closed = false
+            private set
+
+        override suspend fun getPublicKey(): String = VALID_PUBKEY
+
+        override suspend fun signEvent(eventJson: String): String = eventJson
+
+        override suspend fun nip04Encrypt(
+            pubkey: String,
+            plaintext: String
+        ): String = plaintext
+
+        override suspend fun nip04Decrypt(
+            pubkey: String,
+            ciphertext: String
+        ): String = ciphertext
+
+        override suspend fun nip44Encrypt(
+            pubkey: String,
+            plaintext: String
+        ): String = plaintext
+
+        override suspend fun nip44Decrypt(
+            pubkey: String,
+            ciphertext: String
+        ): String = ciphertext
+
+        override fun disconnect() {
+            disconnected = true
+        }
+
+        override fun close() {
+            closed = true
+        }
+    }
+
+    private class CountingSigner(
+        private val pubkey: String
+    ) : NostrSigner {
+        var publicKeyRequests = 0
+            private set
+
+        override suspend fun getPublicKey(): String {
+            publicKeyRequests++
+            return pubkey
+        }
+
+        override suspend fun signEvent(eventJson: String): String {
+            throw UnsupportedOperationException()
+        }
+
+        override suspend fun nip04Encrypt(
+            pubkey: String,
+            plaintext: String
+        ): String {
+            throw UnsupportedOperationException()
+        }
+
+        override suspend fun nip04Decrypt(
+            pubkey: String,
+            ciphertext: String
+        ): String {
+            throw UnsupportedOperationException()
+        }
+
+        override suspend fun nip44Encrypt(
+            pubkey: String,
+            plaintext: String
+        ): String {
+            throw UnsupportedOperationException()
+        }
+
+        override suspend fun nip44Decrypt(
+            pubkey: String,
+            ciphertext: String
+        ): String {
+            throw UnsupportedOperationException()
+        }
+    }
+
+    private companion object {
+        const val VALID_PUBKEY =
+            "cb227f60cb2a6d982ecbfc51b9199d340afc00b1ef81b67d8e3778e097e70d2c"
+        const val PAIRING_SECRET = "pending-pairing-secret"
+    }
+
+    private class NoOpLauncher : ActivityResultLauncher<Intent>() {
+        override fun launch(
+            input: Intent,
+            options: ActivityOptionsCompat?
+        ) = Unit
+
+        override fun unregister() = Unit
+
+        override val contract: ActivityResultContract<Intent, *>
+            get() = throw UnsupportedOperationException()
+    }
+}

package/android-template/app/src/main/assets/www/index.html

@@ -140,14 +140,8 @@ Waiting...
             }
 
 
-            const pubkey =
-                await window.nostr.getPublicKey();
-
-
             const event = {
 
-                pubkey,
-
                 kind: 1,
 
                 content:

package/android-template/app/src/main/java/com/pakstr/app/LocalServer.kt

@@ -63,6 +63,23 @@ internal fun shouldForwardProxyRequestHeader(
     "x-forwarded-proto"
 )
 
+internal fun currentRawQueryString(
+    session: NanoHTTPD.IHTTPSession?
+): String? {
+    val query = session?.queryParameterString
+    // NanoHTTPD resets parameters per request but can retain this raw value on keep-alive.
+    if (query.isNullOrEmpty() || session.parameters.isEmpty()) return null
+    return query
+}
+
+internal fun localRequestUrl(
+    uri: String,
+    query: String?
+): URL = URL(
+    "http://127.0.0.1:${Config.PORT}$uri" +
+            if (query.isNullOrEmpty()) "" else "?$query"
+)
+
 internal data class ProxyHttpResponse(
     val code: Int,
     val contentType: String?,
@@ -394,10 +411,9 @@ class LocalServer(
             val url = URL(finalUrl)
             val method = session?.method?.name ?: "GET"
             val requestHeaders = session?.headers ?: emptyMap()
-            val query = session?.queryParameterString
-            val localRequestUrl = URL(
-                "http://127.0.0.1:${Config.PORT}$uri" +
-                        if (query.isNullOrEmpty()) "" else "?$query"
+            val localRequestUrl = localRequestUrl(
+                uri,
+                currentRawQueryString(session)
             )
             val preparedHeaders = prepareProxyRequestHeaders(
                 headers = requestHeaders,

package/android-template/app/src/main/java/com/pakstr/app/MainActivity.kt

@@ -1,7 +1,9 @@
 package com.pakstr.app
 
 import android.Manifest
+import android.content.ActivityNotFoundException
 import android.content.Intent
+import android.net.Uri
 import android.os.Bundle
 import android.os.Handler
 import android.os.Looper
@@ -15,8 +17,10 @@ import androidx.activity.OnBackPressedCallback
 import androidx.activity.enableEdgeToEdge
 import androidx.activity.result.ActivityResultLauncher
 import androidx.activity.result.contract.ActivityResultContracts
+import androidx.appcompat.app.AlertDialog
 import androidx.appcompat.app.AppCompatActivity
 import androidx.core.splashscreen.SplashScreen.Companion.installSplashScreen
+import androidx.lifecycle.lifecycleScope
 import androidx.core.view.ViewCompat
 import androidx.core.view.WindowInsetsCompat
 import androidx.core.view.updatePadding
@@ -37,7 +41,10 @@ import com.pakstr.app.permissions.interfaces.PermissionHandler
 
 import com.pakstr.app.signer.SignerManager
 import com.pakstr.app.signer.SignerType
+import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.launch
 import com.pakstr.app.utils.AppPreferences
+import com.pakstr.app.utils.BunkerPairingDialog
 import com.pakstr.app.utils.SignerPickerBottomSheet
 
 class MainActivity : AppCompatActivity(), PermissionHandler {
@@ -53,6 +60,7 @@ class MainActivity : AppCompatActivity(), PermissionHandler {
 
     private lateinit var fab: FloatingActionButton
     private lateinit var supportUnlockGestureLayout: SupportUnlockGestureLayout
+    private var bunkerPairingDialog: AlertDialog? = null
 
     private val diagnosticsHandler = Handler(Looper.getMainLooper())
     private val diagnosticsExpiryCheck = Runnable {
@@ -120,12 +128,12 @@ class MainActivity : AppCompatActivity(), PermissionHandler {
             }
 
         initSigner()
-
-        signerManager.setActiveType(
-
-            SignerType.AMBER
-
-        )
+        if (
+            savedInstanceState == null &&
+            AppPreferences.getBoolean("isFirstRun", true)
+        ) {
+            container.post(::showSignerPicker)
+        }
 
         ViewCompat.setOnApplyWindowInsetsListener(
 
@@ -260,10 +268,34 @@ class MainActivity : AppCompatActivity(), PermissionHandler {
         signerManager =
             SignerManager(
                 this,
-                amberLauncher
+                amberLauncher,
+                bunkerAuthChallengeHandler = ::openBunkerAuthChallenge
             )
     }
 
+    private fun openBunkerAuthChallenge(value: String) {
+        runOnUiThread {
+            val uri = Uri.parse(value)
+            if (
+                uri.scheme != "https" ||
+                uri.host.isNullOrBlank()
+            ) {
+                return@runOnUiThread
+            }
+            try {
+                startActivity(
+                    Intent(Intent.ACTION_VIEW, uri)
+                )
+            } catch (_: ActivityNotFoundException) {
+                Toast.makeText(
+                    this,
+                    R.string.signer_auth_browser_unavailable,
+                    Toast.LENGTH_LONG
+                ).show()
+            }
+        }
+    }
+
     private fun initViews() {
 
         container =
@@ -326,6 +358,13 @@ class MainActivity : AppCompatActivity(), PermissionHandler {
 
         }
 
+        bunkerPairingDialog?.dismiss()
+        bunkerPairingDialog = null
+
+        if (::signerManager.isInitialized) {
+            signerManager.close()
+        }
+
         super.onDestroy()
 
     }
@@ -369,16 +408,95 @@ class MainActivity : AppCompatActivity(), PermissionHandler {
     }
 
     private fun showSignerPicker() {
-
-        SignerPickerBottomSheet { selectedType ->
-            signerManager.setActiveType(selectedType)
-            handleSignerSetup()
-        }.show(
+        SignerPickerBottomSheet(
+            hasBunkerSession = signerManager.hasBunkerSession(),
+            onAmberSelected = {
+                signerManager.setActiveType(SignerType.AMBER)
+                handleSignerSetup()
+            },
+            onBunkerSelected = { value ->
+                try {
+                    signerManager.connectBunker(value)
+                    handleSignerSetup()
+                    true
+                } catch (_: Exception) {
+                    false
+                }
+            },
+            onSharePairing = ::shareBunkerPairing,
+            onBunkerLogout = {
+                signerManager.logoutBunker()
+                Toast.makeText(
+                    this,
+                    R.string.signer_picker_disconnected,
+                    Toast.LENGTH_SHORT
+                ).show()
+            }
+        ).show(
             supportFragmentManager,
             "SignerPicker"
         )
     }
 
+    private fun shareBunkerPairing(relayUrls: List<String>) {
+        lifecycleScope.launch {
+            val pairingUri =
+                try {
+                    signerManager.createBunkerPairingUri(relayUrls)
+                } catch (cancelled: CancellationException) {
+                    throw cancelled
+                } catch (_: Exception) {
+                    Toast.makeText(
+                        this@MainActivity,
+                        R.string.signer_picker_connection_failed,
+                        Toast.LENGTH_LONG
+                    ).show()
+                    return@launch
+                }
+            val pairingDialog = BunkerPairingDialog.show(
+                activity = this@MainActivity,
+                pairingUri = pairingUri,
+                onShare = ::shareBunkerPairingUri
+            )
+            bunkerPairingDialog = pairingDialog
+            pairingDialog.setOnDismissListener {
+                if (bunkerPairingDialog === pairingDialog) {
+                    bunkerPairingDialog = null
+                }
+            }
+            Toast.makeText(
+                this@MainActivity,
+                R.string.signer_picker_pairing_waiting,
+                Toast.LENGTH_LONG
+            ).show()
+            val connected = signerManager.finishBunkerPairing()
+            if (pairingDialog.isShowing) {
+                pairingDialog.dismiss()
+            }
+            Toast.makeText(
+                this@MainActivity,
+                if (connected) {
+                    handleSignerSetup()
+                    R.string.signer_picker_pairing_connected
+                } else {
+                    R.string.signer_picker_pairing_failed
+                },
+                Toast.LENGTH_LONG
+            ).show()
+        }
+    }
+
+    private fun shareBunkerPairingUri(pairingUri: String) {
+        startActivity(
+            Intent.createChooser(
+                Intent(Intent.ACTION_SEND)
+                    .setType("text/plain")
+                    .putExtra(Intent.EXTRA_TEXT, pairingUri),
+                getString(R.string.signer_picker_pairing_share_title)
+            )
+        )
+    }
+
     private fun showLoader(
         show: Boolean
     ) {

package/android-template/app/src/main/java/com/pakstr/app/crypto/Bip340Hash.kt

@@ -0,0 +1,56 @@
+package com.pakstr.app.crypto
+
+import java.security.MessageDigest
+
+internal object Bip340Hash {
+    fun sha256(data: ByteArray): ByteArray {
+        return MessageDigest
+            .getInstance("SHA-256")
+            .digest(data)
+    }
+
+    fun taggedHash(
+        tag: String,
+        vararg parts: ByteArray
+    ): ByteArray {
+        val tagHash =
+            sha256(
+                tag.toByteArray(Charsets.UTF_8)
+            )
+
+        return try {
+            MessageDigest
+                .getInstance("SHA-256")
+                .apply {
+                    update(tagHash)
+                    update(tagHash)
+                    parts.forEach(::update)
+                }
+                .digest()
+        } finally {
+            tagHash.fill(0)
+        }
+    }
+
+    fun hexToBytes(value: String): ByteArray {
+        require(value.length % 2 == 0) {
+            "Hex value must have an even length"
+        }
+        require(value.matches(Regex("[0-9a-fA-F]*"))) {
+            "Invalid hexadecimal value"
+        }
+
+        return ByteArray(value.length / 2) { index ->
+            value.substring(
+                index * 2,
+                index * 2 + 2
+            ).toInt(16).toByte()
+        }
+    }
+
+    fun bytesToHex(value: ByteArray): String {
+        return value.joinToString("") { byte ->
+            "%02x".format(byte.toInt() and 0xff)
+        }
+    }
+}