pakstr 0.31.0 → 1.0.1

package/android-template/app/src/main/java/com/pakstr/app/WebMessageRouter.kt

@@ -0,0 +1,186 @@
+package com.pakstr.app
+
+import com.pakstr.app.signer.NostrBridge
+import com.pakstr.app.signer.UnsupportedBridgeMethodException
+import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.launch
+import org.json.JSONObject
+
+/** Where a bridge message came from (android.net.Uri components plus the frame flag). */
+internal data class MessageSource(
+    val scheme: String?,
+    val host: String?,
+    val port: Int,
+    val userInfo: String?,
+    val path: String?,
+    val isMainFrame: Boolean
+)
+
+internal fun interface BridgeHandler {
+    suspend fun handle(method: String, params: JSONObject?): Any?
+}
+
+/**
+ * Validates and dispatches messages posted to the injected bridge object.
+ *
+ * Fail closed: messages from subframes or other origins, non-string or
+ * oversized data, and malformed envelopes are dropped without a reply.
+ * A request `{ v: 1, id, method, params? }` is answered once, only to the
+ * frame that sent it, with `{ v: 1, id, ok: true, result }` or
+ * `{ v: 1, id, ok: false, error: { error, message } }`. Notifications
+ * (no reply) carry no id.
+ */
+internal class WebMessageRouter(
+    private val handler: BridgeHandler,
+    private val scope: CoroutineScope,
+    private val runOnMain: (() -> Unit) -> Unit,
+    private val log: (String) -> Unit = {}
+) {
+
+    fun onMessage(
+        source: MessageSource,
+        data: String?,
+        reply: (String) -> Unit
+    ) {
+        rejectionReason(source, data)?.let { reason ->
+            log("Bridge message rejected: $reason")
+            return
+        }
+        val message = try {
+            JSONObject(requireNotNull(data))
+        } catch (_: Exception) {
+            log("Bridge message rejected: malformed message")
+            return
+        }
+        if (message.opt("v") != PROTOCOL_VERSION) {
+            log("Bridge message rejected: unsupported protocol version")
+            return
+        }
+
+        val method = message.opt("method") as? String
+        val params = when (val value = message.opt("params")) {
+            null, JSONObject.NULL -> null
+            is JSONObject -> value
+            else -> INVALID_PARAMS
+        }
+
+        if (method in NOTIFICATIONS) {
+            if (params !== INVALID_PARAMS) {
+                scope.launch {
+                    try {
+                        handler.handle(requireNotNull(method), params)
+                    } catch (error: CancellationException) {
+                        throw error
+                    } catch (_: Exception) {
+                        // Notifications have no reply channel.
+                    }
+                }
+            }
+            return
+        }
+
+        val id = message.opt("id") as? String
+        if (id == null || !REQUEST_ID.matches(id)) {
+            log("Bridge message rejected: invalid request id")
+            return
+        }
+        if (method == null || params === INVALID_PARAMS) {
+            val response = failure(id, IllegalArgumentException("Invalid request"))
+            runOnMain { reply(response) }
+            return
+        }
+
+        scope.launch {
+            val response = try {
+                success(id, handler.handle(method, params))
+            } catch (error: CancellationException) {
+                throw error
+            } catch (error: Exception) {
+                failure(id, error)
+            }
+            runOnMain { reply(response) }
+        }
+    }
+
+    private fun rejectionReason(
+        source: MessageSource,
+        data: String?
+    ): String? = when {
+        !source.isMainFrame -> "subframe"
+        !AppOrigin.isTrustedOrigin(
+            source.scheme,
+            source.host,
+            source.port,
+            source.userInfo,
+            source.path
+        ) -> "untrusted origin"
+        data == null -> "non-string message"
+        data.length > MAX_MESSAGE_BYTES ||
+                data.toByteArray(Charsets.UTF_8).size > MAX_MESSAGE_BYTES -> "message too large"
+        else -> null
+    }
+
+    private fun success(id: String, result: Any?): String =
+        envelope(id)
+            .put("ok", true)
+            .put("result", result ?: JSONObject.NULL)
+            .toString()
+
+    private fun failure(id: String, error: Exception): String =
+        envelope(id)
+            .put("ok", false)
+            .put("error", JSONObject(NostrBridge.signerErrorResponse(error)))
+            .toString()
+
+    private fun envelope(id: String): JSONObject =
+        JSONObject()
+            .put("v", PROTOCOL_VERSION)
+            .put("id", id)
+
+    companion object {
+        const val PROTOCOL_VERSION = 1
+
+        /** Same limit as nip07.js, which rejects larger requests before posting them. */
+        const val MAX_MESSAGE_BYTES = 1024 * 1024
+
+        const val DEBUG_LOG_METHOD = "debug.log"
+
+        private val NOTIFICATIONS = setOf(DEBUG_LOG_METHOD)
+        private val REQUEST_ID = Regex("[A-Za-z0-9-]{1,64}")
+        private val INVALID_PARAMS = JSONObject()
+    }
+}
+
+/** Routes `nostr.*`, `runtime.*`, and `debug.log` to their native handlers. */
+internal class PakstrBridgeMethods(
+    private val nostr: NostrBridge,
+    private val runtime: PakstrBridge,
+    private val debugLog: (level: String, message: String) -> Unit
+) : BridgeHandler {
+
+    override suspend fun handle(method: String, params: JSONObject?): Any? =
+        when (method) {
+            "runtime.getApiBaseUrl" -> runtime.getApiBaseUrl()
+            "runtime.setApiBaseUrl" ->
+                (params?.opt("url") as? String)?.let(runtime::setApiBaseUrl) ?: false
+            "runtime.getNip55CallbackUrl" -> runtime.getNip55CallbackUrl()
+            WebMessageRouter.DEBUG_LOG_METHOD -> {
+                debugLog(
+                    params?.opt("level") as? String ?: "LOG",
+                    params?.opt("message") as? String ?: ""
+                )
+                null
+            }
+            else ->
+                if (method.startsWith(NOSTR_PREFIX)) {
+                    nostr.handle(method.removePrefix(NOSTR_PREFIX), params)
+                } else {
+                    throw UnsupportedBridgeMethodException()
+                }
+        }
+
+    private companion object {
+        const val NOSTR_PREFIX = "nostr."
+    }
+}

package/android-template/app/src/main/java/com/pakstr/app/WebViewController.kt

@@ -31,8 +31,7 @@ import kotlinx.coroutines.withContext
  * Responsibilities:
  * - Configure secure WebView settings
  * - Load local web application from NanoHTTPD server
- * - Inject NIP-07 JavaScript provider
- * - Expose Android signer bridge to JavaScript
+ * - Install the origin-checked JavaScript bridge and NIP-07 provider
  * - Handle Web permissions
  * - Cleanup WebView resources
  */
@@ -52,6 +51,7 @@ class WebViewController(
     private var pendingNip55Result: String? = null
     private var isSetup = false
     private val nip55Scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+    private val bridgeScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
 
     // Keeps a reference to the runnable to prevent memory leaks if destroyed early
     private val loadRunnable = Runnable {
@@ -63,8 +63,6 @@ class WebViewController(
         //webView.loadUrl("http://127.0.0.1:$port/not-found.html")
     }
 
-    private var nip07Injected = false
-
     fun setup() {
         showLoader()
         setupCookies()
@@ -121,10 +119,6 @@ class WebViewController(
 
                     hideLoader()
 
-                    if (!nip07Injected) {
-                        nip07Injected = injectNip07()
-
-                    }
                     if (AppDebugLogger.isWebViewLoggingEnabled(context)) {
                         injectDebugLogger()
                     }
@@ -235,7 +229,18 @@ class WebViewController(
                     view: WebView?, request: WebResourceRequest?
                 ): Boolean {
                     val url = request?.url ?: return true
-                    if (url.scheme.equals("nostrsigner", ignoreCase = true)) {
+                    val decision = navigationDecision(
+                        url.scheme,
+                        url.host,
+                        url.port,
+                        url.userInfo,
+                        request.isForMainFrame
+                    )
+                    if (decision == NavigationDecision.REJECT_SUBFRAME_NIP55) {
+                        logNip55Rejection("subframe request")
+                        return true
+                    }
+                    if (decision == NavigationDecision.NIP55_SIGN_REQUEST) {
                         dispatchNip55SignEvent(
                             rawUrl = url.toString(),
                             activeSignerType = signerManager.getActiveType(),
@@ -269,7 +274,7 @@ class WebViewController(
                         )
                         return true
                     }
-                    return url.host != "127.0.0.1"
+                    return decision != NavigationDecision.ALLOW
                 }
 
             }
@@ -323,25 +328,7 @@ class WebViewController(
             }
         }
 
-        // Exposes native Nostr signer APIs to the WebView.
-        // Available in JavaScript as window.AndroidBridge.
-        webView.addJavascriptInterface(
-
-            NostrBridge(
-
-                signerManager = signerManager,
-
-                webView = webView,
-
-                ),
-
-            "AndroidBridge"
-
-        )
-        webView.addJavascriptInterface(
-            PakstrBridge(RuntimeApiBaseSettings.from(context)),
-            "PakstrBridge"
-        )
+        installBridge()
 
     }
 
@@ -406,6 +393,7 @@ class WebViewController(
 
     fun destroy() {
         nip55Scope.cancel()
+        bridgeScope.cancel()
         webView.stopLoading()
 
         webView.clearHistory()
@@ -422,24 +410,48 @@ class WebViewController(
         webView.destroy()
     }
 
-    private fun injectNip07(): Boolean {
-
-        return try {
-            val js = context.assets.open("nip07.js")
+    /**
+     * Exposes window.nostr and window.pakstr to the app origin's top-level
+     * frame only (see PakstrWebBridge). Runs before the first load.
+     */
+    private fun installBridge() {
+        val providerScript = try {
+            context.assets.open("nip07.js")
                 .bufferedReader()
-                .readText()
-
-            webView.evaluateJavascript(
-                js, null
-            )
-            true
+                .use { it.readText() }
         } catch (e: Exception) {
-            if (AppDebugLogger.isWebViewLoggingEnabled(context)) {
-                AppDebugLogger.log(
-                    context, "WebViewController - WEBVIEW", "Failed loading nip07.js: ${e.message}"
-                )
-            }
-            false
+            AppDebugLogger.error(context, "BRIDGE", "Failed loading nip07.js", e)
+            return
+        }
+        val router = WebMessageRouter(
+            handler = PakstrBridgeMethods(
+                nostr = NostrBridge(
+                    signerProvider = signerManager::getConfiguredSigner,
+                    log = { message -> AppDebugLogger.log(context, "SIGNER", message) },
+                    logError = { message, error ->
+                        AppDebugLogger.error(context, "SIGNER", message, error)
+                    }
+                ),
+                runtime = PakstrBridge(RuntimeApiBaseSettings.from(context)),
+                debugLog = ::logWebConsole
+            ),
+            scope = bridgeScope,
+            runOnMain = { block -> webView.post { block() } },
+            log = { message -> AppDebugLogger.log(context, "BRIDGE", message) }
+        )
+        PakstrWebBridge.install(webView, router, providerScript) { message ->
+            AppDebugLogger.error(context, "BRIDGE", message)
+        }
+    }
+
+    private fun logWebConsole(level: String, message: String) {
+        if (!AppDebugLogger.isWebViewLoggingEnabled(context)) {
+            return
+        }
+        when (level.uppercase()) {
+            "ERROR" -> AppDebugLogger.error(context, "WEB-JS", message)
+            "WARN" -> AppDebugLogger.log(context, "WEB-WARN", message)
+            else -> AppDebugLogger.log(context, "WEB", message)
         }
     }
 
@@ -448,7 +460,8 @@ class WebViewController(
         val js = """
         (function(){
 
-            if (!window.AndroidBridge) {
+            const channel = window.__pakstrNative;
+            if (!channel) {
                 return;
             }
 
@@ -475,9 +488,12 @@ class WebViewController(
                         })
                         .join(" ");
 
-                    window.AndroidBridge.debugLog(
-                        level,
-                        message
+                    channel.postMessage(
+                        JSON.stringify({
+                            v: 1,
+                            method: "debug.log",
+                            params: { level, message }
+                        })
                     );
 
                 } catch(e){

package/android-template/app/src/main/java/com/pakstr/app/signer/AmberRequestChannel.kt

@@ -0,0 +1,156 @@
+package com.pakstr.app.signer
+
+import com.pakstr.app.signer.exceptions.SignerUnavailableException
+import kotlinx.coroutines.CompletableDeferred
+import kotlinx.coroutines.TimeoutCancellationException
+import kotlinx.coroutines.coroutineScope
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
+import kotlinx.coroutines.withTimeout
+import java.util.UUID
+
+/**
+ * Matches NIP-55 activity results to the request that launched them.
+ *
+ * One ActivityResultLauncher delivers every result through the same
+ * callback, so one channel serves the launcher and at most one signer
+ * activity is outstanding at a time. Each launch carries an `id` extra.
+ *
+ * Every launch yields exactly one result. A request abandoned by its caller
+ * (timeout, cancellation, closed session) therefore keeps its slot until its
+ * result arrives, and a result echoing a different id means the matching one
+ * can never follow: the outstanding request fails without receiving that
+ * result's data and the slot is released.
+ */
+internal class AmberRequestChannel(
+    private val timeoutMillis: Long = DEFAULT_TIMEOUT_MILLIS,
+    private val newRequestId: () -> String = { UUID.randomUUID().toString() }
+) {
+    private val mutex = Mutex()
+    private val lock = Any()
+    private var outstanding: Outstanding? = null // guarded by lock
+
+    private class Outstanding(val id: String) {
+        val result = CompletableDeferred<String>()
+    }
+
+    /** Opens a request session for one AmberSigner instance. */
+    fun openSession(): Session = Session()
+
+    /**
+     * Resolves the outstanding request with [outcome]. A [requestId] of null
+     * (signers that do not echo ids, cancelled activities) matches the
+     * outstanding request. Returns false if the result was not delivered.
+     */
+    fun deliver(requestId: String?, outcome: Result<String>): Boolean {
+        val current = synchronized(lock) {
+            outstanding.also { outstanding = null }
+        } ?: return false
+        if (requestId != null && requestId != current.id) {
+            current.result.completeExceptionally(AmberResponseMismatchException())
+            return false
+        }
+        outcome.fold(current.result::complete, current.result::completeExceptionally)
+        return true
+    }
+
+    private suspend fun exchange(
+        session: Session,
+        start: (requestId: String) -> Unit
+    ): String = mutex.withLock {
+        // Wait out an abandoned launch so its result cannot resolve this one.
+        synchronized(lock) { outstanding }?.result?.join()
+
+        val current = Outstanding(newRequestId())
+        // Holding the session lock makes close() and launch mutually exclusive.
+        synchronized(session) {
+            if (session.closed) throw closedException()
+            synchronized(lock) { outstanding = current }
+            try {
+                start(current.id)
+            } catch (error: Throwable) {
+                synchronized(lock) {
+                    if (outstanding === current) outstanding = null
+                }
+                throw error
+            }
+        }
+        current.result.await()
+    }
+
+    inner class Session internal constructor() {
+        internal var closed = false // guarded by this
+        private val waiters = mutableSetOf<CompletableDeferred<String>>()
+
+        /**
+         * Runs [block] under the request timeout, failing with
+         * [AmberRequestTimeoutException] instead of a cancellation so callers
+         * still get an error response.
+         */
+        suspend fun <T> withRequestTimeout(block: suspend () -> T): T {
+            return try {
+                withTimeout(timeoutMillis) { block() }
+            } catch (_: TimeoutCancellationException) {
+                throw AmberRequestTimeoutException()
+            }
+        }
+
+        /**
+         * Waits for the signer to be free, calls [start] with the request id
+         * and suspends until the matching result is delivered. If [start]
+         * throws, nothing is outstanding and the exception propagates.
+         */
+        suspend fun request(start: (requestId: String) -> Unit): String = coroutineScope {
+            val waiter = CompletableDeferred<String>()
+            synchronized(this@Session) {
+                if (closed) throw closedException()
+                waiters += waiter
+            }
+            val worker = launch {
+                try {
+                    waiter.complete(exchange(this@Session, start))
+                } catch (error: Throwable) {
+                    waiter.completeExceptionally(error)
+                }
+            }
+            try {
+                waiter.await()
+            } finally {
+                worker.cancel()
+                synchronized(this@Session) { waiters -= waiter }
+            }
+        }
+
+        /**
+         * Fails this session's waiting and queued requests and rejects new
+         * ones. A launch already in flight keeps the slot until its result.
+         */
+        fun close() {
+            val pending = synchronized(this) {
+                closed = true
+                waiters.toList()
+            }
+            pending.forEach { it.completeExceptionally(closedException()) }
+        }
+    }
+
+    private fun closedException() =
+        SignerUnavailableException("Amber signer was closed")
+
+    companion object {
+        const val DEFAULT_TIMEOUT_MILLIS = 30_000L
+    }
+}
+
+class AmberRequestTimeoutException : Exception(
+    "Amber request timed out"
+)
+
+class AmberRequestRejectedException : Exception(
+    "Amber request was rejected"
+)
+
+class AmberResponseMismatchException : Exception(
+    "Amber returned a response for a different request"
+)