pakstr 0.21.1 → 0.23.0

package/android-template/app/src/test/java/com/pakstr/app/Nip55SignEventDispatchTest.kt

@@ -0,0 +1,115 @@
+package com.pakstr.app
+
+import com.pakstr.app.signer.SignerType
+import kotlinx.coroutines.runBlocking
+import org.json.JSONArray
+import org.json.JSONObject
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class Nip55SignEventDispatchTest {
+    private val callback = "pakstr-test://nip55-callback#nip55_event="
+    private val activePubkey = "1".repeat(64)
+
+    @Test
+    fun bunker_valid_sign_event_signs_internally_without_external_intent() {
+        val result = dispatch(SignerType.BUNKER, validRequest())
+
+        assertTrue(result.signed)
+        assertFalse(result.forwarded)
+        assertEquals(SIGNED_EVENT, result.delivered)
+    }
+
+    @Test
+    fun bunker_invalid_sign_event_is_consumed_without_external_intent() {
+        val result = dispatch(
+            SignerType.BUNKER,
+            validRequest().replace("returnType=event", "returnType=signature")
+        )
+
+        assertFalse(result.signed)
+        assertFalse(result.forwarded)
+        assertTrue(result.rejection != null)
+    }
+
+    @Test
+    fun bunker_other_operation_is_forwarded_externally() {
+        val result = dispatch(
+            SignerType.BUNKER,
+            validRequest().replace("type=sign_event", "type=get_public_key")
+        )
+
+        assertFalse(result.signed)
+        assertTrue(result.forwarded)
+    }
+
+    @Test
+    fun amber_sign_event_is_forwarded_externally() {
+        val result = dispatch(SignerType.AMBER, validRequest())
+
+        assertFalse(result.signed)
+        assertTrue(result.forwarded)
+    }
+
+    private fun dispatch(type: SignerType, rawUrl: String): Result {
+        var forwarded = false
+        var signed = false
+        var delivered: String? = null
+        var rejection: String? = null
+
+        dispatchNip55SignEvent(
+            rawUrl = rawUrl,
+            activeSignerType = type,
+            expectedCallbackUrl = callback,
+            forwardExternally = { forwarded = true },
+            launchSigning = { operation -> runBlocking { operation() } },
+            getActivePubkey = { activePubkey },
+            signEvent = {
+                signed = true
+                SIGNED_EVENT
+            },
+            deliverSignedEvent = { delivered = it },
+            logRejection = { rejection = it }
+        )
+
+        return Result(forwarded, signed, delivered, rejection)
+    }
+
+    private fun validRequest(): String {
+        val event = JSONObject()
+            .put("kind", 27235)
+            .put("created_at", 1789552517L)
+            .put("tags", JSONArray())
+            .put("content", "")
+            .toString()
+        return "nostrsigner:${encode(event)}" +
+                "?type=sign_event&returnType=event&compressionType=none" +
+                "&callbackUrl=${encode(callback)}"
+    }
+
+    private fun encode(value: String): String {
+        return value.toByteArray(Charsets.UTF_8).joinToString("") { byte ->
+            val valueInt = byte.toInt() and 0xff
+            val character = valueInt.toChar()
+            if (character.isLetterOrDigit() || character in "-._~") {
+                character.toString()
+            } else {
+                "%${valueInt.toString(16).uppercase().padStart(2, '0')}"
+            }
+        }
+    }
+
+    private data class Result(
+        val forwarded: Boolean,
+        val signed: Boolean,
+        val delivered: String?,
+        val rejection: String?
+    )
+
+    private companion object {
+        const val SIGNED_EVENT =
+            "{\"id\":\"signed-id\",\"pubkey\":\"signed-pubkey\",\"sig\":\"signed-sig\"}"
+    }
+}

package/android-template/app/src/test/java/com/pakstr/app/Nip55SignEventRequestTest.kt

@@ -0,0 +1,90 @@
+package com.pakstr.app
+
+import org.json.JSONObject
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class Nip55SignEventRequestTest {
+    private val callback =
+        "pakstr-7f7e720bd582301afabb6b441f89a4fb8d1a481c3e0286c69345d03e7cb1929c://nip55-callback#nip55_event="
+
+    @Test
+    fun parses_exact_regress_request() {
+        val rawUrl =
+            "nostrsigner:%7B%22kind%22%3A27235%2C%22created_at%22%3A1789552517%2C%22content%22%3A%22%22%2C%22tags%22%3A%5B%5B%22u%22%2C%22http%3A%2F%2F127.0.0.1%3A8080%2Fapi%2Fauth%2Flogin%22%5D%2C%5B%22method%22%2C%22POST%22%5D%5D%7D?compressionType=none&returnType=event&type=sign_event&callbackUrl=pakstr-7f7e720bd582301afabb6b441f89a4fb8d1a481c3e0286c69345d03e7cb1929c%3A%2F%2Fnip55-callback%23nip55_event%3D"
+
+        val parsed = Nip55SignEventParser.parse(rawUrl, callback)
+
+        assertTrue(parsed is Nip55SignEventRequest.Parsed)
+        parsed as Nip55SignEventRequest.Parsed
+        assertEquals(callback, parsed.callbackUrl)
+        assertEquals(27235, parsed.event.getInt("kind"))
+        assertEquals(1789552517L, parsed.event.getLong("created_at"))
+        assertEquals("", parsed.event.getString("content"))
+        assertEquals(
+            "http://127.0.0.1:8080/api/auth/login",
+            parsed.event.getJSONArray("tags").getJSONArray(0).getString(1)
+        )
+    }
+
+    @Test
+    fun accepts_event_return_with_none_or_omitted_compression() {
+        val base = requestQuery("type=sign_event&returnType=event&callbackUrl=${encode(callback)}")
+        val withNone = requestQuery(
+            "type=sign_event&returnType=event&compressionType=none&callbackUrl=${encode(callback)}"
+        )
+
+        assertTrue(Nip55SignEventParser.parse(base, callback) is Nip55SignEventRequest.Parsed)
+        assertTrue(Nip55SignEventParser.parse(withNone, callback) is Nip55SignEventRequest.Parsed)
+    }
+
+    @Test
+    fun rejects_malformed_or_unsupported_sign_event() {
+        val unsupported = requestQuery(
+            "type=sign_event&returnType=event&compressionType=gzip&callbackUrl=${encode(callback)}"
+        )
+        val malformed =
+            "nostrsigner:%7Bbad?type=sign_event&returnType=event&callbackUrl=${encode(callback)}"
+
+        assertTrue(
+            Nip55SignEventParser.parse(unsupported, callback) is Nip55SignEventRequest.Rejected
+        )
+        assertTrue(
+            Nip55SignEventParser.parse(malformed, callback) is Nip55SignEventRequest.Rejected
+        )
+    }
+
+    @Test
+    fun rejects_foreign_callback() {
+        val rawUrl = requestQuery(
+            "type=sign_event&returnType=event&callbackUrl=${encode("other://nip55-callback#nip55_event=")}"
+        )
+
+        assertTrue(
+            Nip55SignEventParser.parse(rawUrl, callback) is Nip55SignEventRequest.Rejected
+        )
+    }
+
+    private fun requestQuery(query: String): String {
+        val event = JSONObject()
+            .put("kind", 27235)
+            .put("created_at", 1789552517L)
+            .put("tags", org.json.JSONArray())
+            .put("content", "")
+            .toString()
+        return "nostrsigner:${encode(event)}?$query"
+    }
+
+    private fun encode(value: String): String {
+        return value.toByteArray(Charsets.UTF_8).joinToString("") { byte ->
+            val valueInt = byte.toInt() and 0xff
+            val character = valueInt.toChar()
+            if (character.isLetterOrDigit() || character in "-._~") {
+                character.toString()
+            } else {
+                "%${valueInt.toString(16).uppercase().padStart(2, '0')}"
+            }
+        }
+    }
+}

package/android-template/app/src/test/java/com/pakstr/app/PakstrBridgeRuntimeApiBaseTest.kt

@@ -0,0 +1,52 @@
+package com.pakstr.app
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class PakstrBridgeRuntimeApiBaseTest {
+    @Test
+    fun setterPersistsValidatedOverrideAndGetterReturnsEffectiveValue() {
+        val preferences = FakePreferences()
+        val bridge = PakstrBridge(
+            RuntimeApiBaseSettings.createForTesting(preferences) {
+                "https://default.example.com"
+            }
+        )
+
+        assertTrue(bridge.setApiBaseUrl("https://override.example.com/"))
+        assertEquals("https://override.example.com", bridge.getApiBaseUrl())
+        assertFalse(bridge.setApiBaseUrl("http://unsafe.example.com"))
+        assertEquals("https://override.example.com", bridge.getApiBaseUrl())
+    }
+
+    @Test
+    fun setterReportsPersistenceFailure() {
+        val bridge = PakstrBridge(
+            RuntimeApiBaseSettings.createForTesting(FakePreferences(commitResult = false)) {
+                null
+            }
+        )
+
+        assertFalse(bridge.setApiBaseUrl("https://api.example.com"))
+    }
+
+    private class FakePreferences(
+        private val commitResult: Boolean = true
+    ) : RuntimeApiBaseSettings.Preferences {
+        private val values = mutableMapOf<String, String>()
+
+        override fun getString(key: String): String? = values[key]
+
+        override fun putString(key: String, value: String): Boolean {
+            if (commitResult) values[key] = value
+            return commitResult
+        }
+
+        override fun remove(key: String): Boolean {
+            if (commitResult) values.remove(key)
+            return commitResult
+        }
+    }
+}

package/android-template/app/src/test/java/com/pakstr/app/RuntimeApiBaseProxyTest.kt

@@ -0,0 +1,49 @@
+package com.pakstr.app
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class RuntimeApiBaseProxyTest {
+    @Test
+    fun proxyUsesUpdatedEffectiveValueOnSubsequentRequest() {
+        val preferences = FakePreferences()
+        val settings = RuntimeApiBaseSettings.createForTesting(preferences) {
+            "https://default.example.com"
+        }
+
+        val firstRequestApiBase = settings.current().url!!
+        assertEquals(
+            "https://default.example.com/api/items",
+            proxyApiUrl(firstRequestApiBase, "/api/items").toString()
+        )
+
+        assertTrue(settings.setOverride("https://updated.example.com/base/"))
+
+        val secondRequestApiBase = settings.current().url!!
+        assertEquals(
+            "https://updated.example.com/base/api/items",
+            proxyApiUrl(secondRequestApiBase, "/api/items").toString()
+        )
+        assertEquals(
+            "https://default.example.com/api/items",
+            proxyApiUrl(firstRequestApiBase, "/api/items").toString()
+        )
+    }
+
+    private class FakePreferences : RuntimeApiBaseSettings.Preferences {
+        private val values = mutableMapOf<String, String>()
+
+        override fun getString(key: String): String? = values[key]
+
+        override fun putString(key: String, value: String): Boolean {
+            values[key] = value
+            return true
+        }
+
+        override fun remove(key: String): Boolean {
+            values.remove(key)
+            return true
+        }
+    }
+}

package/android-template/app/src/test/java/com/pakstr/app/RuntimeApiBaseSettingsTest.kt

@@ -0,0 +1,107 @@
+package com.pakstr.app
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class RuntimeApiBaseSettingsTest {
+    @Test
+    fun persistedOverrideTakesPrecedenceOverPackagedDefault() {
+        val preferences = FakePreferences()
+        val settings = settings(preferences, "https://default.example.com")
+
+        assertTrue(settings.setOverride("https://override.example.com/"))
+        assertEquals(
+            "https://override.example.com",
+            preferences.values[RuntimeApiBaseSettings.API_BASE_OVERRIDE_KEY]
+        )
+        assertEquals(
+            RuntimeApiBaseSettings.Value(
+                "https://override.example.com",
+                RuntimeApiBaseSettings.Source.RUNTIME_OVERRIDE
+            ),
+            settings.current()
+        )
+    }
+
+    @Test
+    fun resetRemovesOverrideAndRestoresPackagedDefault() {
+        val preferences = FakePreferences()
+        val settings = settings(preferences, "https://default.example.com/")
+        settings.setOverride("https://override.example.com")
+
+        assertTrue(settings.reset())
+        assertFalse(preferences.values.containsKey(RuntimeApiBaseSettings.API_BASE_OVERRIDE_KEY))
+        assertEquals(
+            RuntimeApiBaseSettings.Value(
+                "https://default.example.com",
+                RuntimeApiBaseSettings.Source.PACKAGED_DEFAULT
+            ),
+            settings.current()
+        )
+    }
+
+    @Test
+    fun noConfiguredDefaultDisablesApiProxy() {
+        val settings = settings(FakePreferences(), null)
+
+        assertEquals(
+            RuntimeApiBaseSettings.Value(
+                null,
+                RuntimeApiBaseSettings.Source.DISABLED
+            ),
+            settings.current()
+        )
+    }
+
+    @Test
+    fun invalidPersistedValueIsIgnored() {
+        val preferences = FakePreferences(
+            mutableMapOf(
+                RuntimeApiBaseSettings.API_BASE_OVERRIDE_KEY to "http://unsafe.example.com"
+            )
+        )
+
+        assertEquals(
+            "https://default.example.com",
+            settings(preferences, "https://default.example.com").current().url
+        )
+        assertNull(settings(preferences, null).current().url)
+    }
+
+    @Test
+    fun invalidOverrideDoesNotPersist() {
+        val preferences = FakePreferences()
+        val settings = settings(preferences, "https://default.example.com")
+
+        assertFalse(settings.setOverride("https://user@example.com"))
+        assertTrue(preferences.values.isEmpty())
+    }
+
+    private fun settings(
+        preferences: FakePreferences,
+        packagedDefault: String?
+    ): RuntimeApiBaseSettings = RuntimeApiBaseSettings.createForTesting(
+        preferences
+    ) {
+        packagedDefault
+    }
+
+    private class FakePreferences(
+        val values: MutableMap<String, String> = mutableMapOf()
+    ) : RuntimeApiBaseSettings.Preferences {
+        override fun getString(key: String): String? = values[key]
+
+        override fun putString(key: String, value: String): Boolean {
+            values[key] = value
+            return true
+        }
+
+        override fun remove(key: String): Boolean {
+            values.remove(key)
+            return true
+        }
+    }
+}

package/android-template/app/src/test/java/com/pakstr/app/RuntimeApiBaseValidatorTest.kt

@@ -0,0 +1,50 @@
+package com.pakstr.app
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+class RuntimeApiBaseValidatorTest {
+    @Test
+    fun acceptsAbsoluteHttpsUrlWithHostname() {
+        assertEquals(
+            "https://api.example.com/v1",
+            RuntimeApiBaseValidator.validateAndCanonicalize(
+                "https://api.example.com/v1"
+            )
+        )
+    }
+
+    @Test
+    fun normalizesTrailingSlashesAndHostCase() {
+        assertEquals(
+            "https://api.example.com/v1",
+            RuntimeApiBaseValidator.validateAndCanonicalize(
+                "HTTPS://API.Example.COM/v1///"
+            )
+        )
+        assertEquals(
+            "https://api.example.com",
+            RuntimeApiBaseValidator.validateAndCanonicalize(
+                "https://api.example.com/"
+            )
+        )
+    }
+
+    @Test
+    fun rejectsInvalidOrUnsafeUrls() {
+        listOf(
+            "",
+            " https://api.example.com",
+            "http://api.example.com",
+            "api.example.com",
+            "https:///v1",
+            "https://user:password@api.example.com",
+            "https://api.example.com?v=1",
+            "https://api.example.com#fragment",
+            "https://api.example.com/${"a".repeat(RuntimeApiBaseValidator.MAX_LENGTH)}"
+        ).forEach { value ->
+            assertNull(value, RuntimeApiBaseValidator.validateAndCanonicalize(value))
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pakstr",
-  "version": "0.21.1",
+  "version": "0.23.0",
   "description": "CLI for packaging Nostr web apps into Android APKs",
   "type": "commonjs",
   "main": "dist/index.js",