pakstr 0.31.0 → 1.0.1

package/android-template/app/src/test/java/com/pakstr/app/AppOriginTest.kt

@@ -0,0 +1,114 @@
+package com.pakstr.app
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class AppOriginTest {
+    private val port = Config.PORT
+
+    @Test
+    fun originRuleIsTheExactLocalServerOrigin() {
+        assertEquals("http://127.0.0.1:$port", AppOrigin.ORIGIN)
+    }
+
+    @Test
+    fun onlyTheExactAppOriginIsTrusted() {
+        assertTrue(AppOrigin.isTrustedOrigin("http", "127.0.0.1", port, null, null))
+        assertTrue(AppOrigin.isTrustedOrigin("http", "127.0.0.1", port, null, ""))
+        assertTrue(AppOrigin.isTrustedOrigin("http", "127.0.0.1", port, null, "/"))
+    }
+
+    @Test
+    fun nearMissOriginsAreRejected() {
+        val rejected = listOf(
+            arrayOf<Any?>("https", "127.0.0.1", port, null, null),
+            arrayOf<Any?>("HTTP", "127.0.0.1", port, null, null),
+            arrayOf<Any?>("http", "127.0.0.1", port + 1, null, null),
+            arrayOf<Any?>("http", "127.0.0.1", -1, null, null),
+            arrayOf<Any?>("http", "127.0.0.1", 80, null, null),
+            arrayOf<Any?>("http", "localhost", port, null, null),
+            arrayOf<Any?>("http", "127.0.0.2", port, null, null),
+            arrayOf<Any?>("http", "[::1]", port, null, null),
+            arrayOf<Any?>("http", "127.0.0.1.example.com", port, null, null),
+            arrayOf<Any?>("http", "example.com", port, null, null),
+            arrayOf<Any?>("http", "127.0.0.1", port, "user", null),
+            arrayOf<Any?>("http", "127.0.0.1", port, null, "/index.html"),
+            arrayOf<Any?>("file", null, -1, null, "/android_asset/www/index.html"),
+            arrayOf<Any?>("data", null, -1, null, "text/html,x"),
+            arrayOf<Any?>(null, null, -1, null, null)
+        )
+        for (origin in rejected) {
+            assertFalse(
+                origin.contentToString(),
+                AppOrigin.isTrustedOrigin(
+                    origin[0] as String?,
+                    origin[1] as String?,
+                    origin[2] as Int,
+                    origin[3] as String?,
+                    origin[4] as String?
+                )
+            )
+        }
+    }
+
+    @Test
+    fun mainFrameNavigationStaysOnTheAppOrigin() {
+        assertEquals(
+            NavigationDecision.ALLOW,
+            navigationDecision("http", "127.0.0.1", port, null, isForMainFrame = true)
+        )
+        assertEquals(
+            NavigationDecision.ALLOW,
+            navigationDecision("http", "127.0.0.1", port, null, isForMainFrame = false)
+        )
+    }
+
+    @Test
+    fun navigationOffTheAppOriginIsBlocked() {
+        val blocked = listOf(
+            Triple("http", "127.0.0.1", port + 1),
+            Triple("http", "127.0.0.1", -1),
+            Triple("https", "127.0.0.1", port),
+            Triple("http", "localhost", port),
+            Triple("https", "example.com", -1),
+            Triple("intent", null, -1),
+            Triple("javascript", null, -1),
+            Triple("file", null, -1),
+            Triple("about", null, -1),
+            Triple("data", null, -1)
+        )
+        for ((scheme, host, navigationPort) in blocked) {
+            assertEquals(
+                "$scheme://$host:$navigationPort",
+                NavigationDecision.BLOCK,
+                navigationDecision(scheme, host, navigationPort, null, isForMainFrame = true)
+            )
+        }
+        assertEquals(
+            NavigationDecision.BLOCK,
+            navigationDecision("http", "127.0.0.1", port, "user:pass", isForMainFrame = true)
+        )
+        assertEquals(
+            NavigationDecision.BLOCK,
+            navigationDecision(null, null, -1, null, isForMainFrame = true)
+        )
+    }
+
+    @Test
+    fun nip55RequestsAreDispatchedOnlyFromTheMainFrame() {
+        assertEquals(
+            NavigationDecision.NIP55_SIGN_REQUEST,
+            navigationDecision("nostrsigner", null, -1, null, isForMainFrame = true)
+        )
+        assertEquals(
+            NavigationDecision.NIP55_SIGN_REQUEST,
+            navigationDecision("NostrSigner", null, -1, null, isForMainFrame = true)
+        )
+        assertEquals(
+            NavigationDecision.REJECT_SUBFRAME_NIP55,
+            navigationDecision("nostrsigner", null, -1, null, isForMainFrame = false)
+        )
+    }
+}

package/android-template/app/src/test/java/com/pakstr/app/WebMessageRouterTest.kt

@@ -0,0 +1,279 @@
+package com.pakstr.app
+
+import com.pakstr.app.signer.NostrBridge
+import com.pakstr.app.signer.exceptions.SignerUnavailableException
+import com.pakstr.app.signer.interfaces.NostrSigner
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import org.json.JSONObject
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class WebMessageRouterTest {
+    private val trusted = MessageSource("http", "127.0.0.1", Config.PORT, null, null, isMainFrame = true)
+
+    @Test
+    fun requestFromTheAppTopFrameIsAnsweredToTheSender() {
+        val bridge = Harness()
+
+        val replies = bridge.send(trusted, request("id-1", "nostr.getPublicKey"))
+
+        assertEquals(1, replies.size)
+        val reply = JSONObject(replies.single())
+        assertEquals(1, reply.getInt("v"))
+        assertEquals("id-1", reply.getString("id"))
+        assertTrue(reply.getBoolean("ok"))
+        assertEquals(PUBKEY, reply.getString("result"))
+        assertEquals(listOf("getPublicKey"), bridge.signer.calls)
+    }
+
+    @Test
+    fun subframesAreRejectedWithoutReachingTheSigner() {
+        val bridge = Harness()
+
+        val replies = bridge.send(trusted.copy(isMainFrame = false), request("id-1", "nostr.signEvent", EVENT))
+
+        assertTrue(replies.isEmpty())
+        assertTrue(bridge.signer.calls.isEmpty())
+        assertEquals(0, bridge.handled)
+    }
+
+    @Test
+    fun untrustedOriginsAreRejectedWithoutReachingAnyHandler() {
+        val untrusted = listOf(
+            trusted.copy(scheme = "https"),
+            trusted.copy(port = Config.PORT + 1),
+            trusted.copy(host = "localhost"),
+            trusted.copy(host = "evil.example"),
+            trusted.copy(userInfo = "user"),
+            trusted.copy(path = "/index.html"),
+            MessageSource(null, null, -1, null, null, isMainFrame = true)
+        )
+        for (source in untrusted) {
+            val bridge = Harness()
+            for (method in listOf("nostr.nip44_decrypt", "runtime.setApiBaseUrl", "runtime.getApiBaseUrl")) {
+                val replies = bridge.send(
+                    source,
+                    request("id-1", method, JSONObject().put("url", "https://evil.example"))
+                )
+                assertTrue("$source $method", replies.isEmpty())
+            }
+            assertEquals(source.toString(), 0, bridge.handled)
+            assertNull(bridge.preferences.values[RuntimeApiBaseSettings.API_BASE_OVERRIDE_KEY])
+        }
+    }
+
+    @Test
+    fun nonStringOversizedAndMalformedMessagesAreDropped() {
+        val bridge = Harness()
+        val oversized = request(
+            "id-1",
+            "nostr.nip44_encrypt",
+            JSONObject().put("pubkey", PUBKEY).put("plaintext", "x".repeat(WebMessageRouter.MAX_MESSAGE_BYTES))
+        )
+        val dropped = listOf(
+            null,
+            oversized,
+            "",
+            "not json",
+            "[1,2,3]",
+            JSONObject().put("id", "id-1").put("method", "nostr.getPublicKey").toString(),
+            request("id-1", "nostr.getPublicKey").replace("\"v\":1", "\"v\":2"),
+            request("id-1", "nostr.getPublicKey").replace("\"v\":1", "\"v\":\"1\""),
+            JSONObject().put("v", 1).put("method", "nostr.getPublicKey").toString(),
+            request("bad id", "nostr.getPublicKey"),
+            request("x".repeat(65), "nostr.getPublicKey"),
+            JSONObject().put("v", 1).put("id", 7).put("method", "nostr.getPublicKey").toString()
+        )
+        for (message in dropped) {
+            assertTrue(message?.take(80).toString(), bridge.send(trusted, message).isEmpty())
+        }
+        assertEquals(0, bridge.handled)
+    }
+
+    @Test
+    fun multiByteMessagesAreMeasuredInUtf8Bytes() {
+        val bridge = Harness()
+        // Under the limit in UTF-16 characters, over it in UTF-8 bytes.
+        val plaintext = "é".repeat(WebMessageRouter.MAX_MESSAGE_BYTES / 2)
+        val message = request("id-1", "nostr.nip44_encrypt", JSONObject().put("pubkey", PUBKEY).put("plaintext", plaintext))
+
+        assertTrue(message.length <= WebMessageRouter.MAX_MESSAGE_BYTES)
+        assertTrue(bridge.send(trusted, message).isEmpty())
+    }
+
+    @Test
+    fun invalidRequestsWithAValidIdGetAnErrorReply() {
+        val bridge = Harness()
+        val noMethod = JSONObject().put("v", 1).put("id", "id-1").toString()
+        val arrayParams = JSONObject().put("v", 1).put("id", "id-2").put("method", "nostr.signEvent")
+            .put("params", org.json.JSONArray().put(1)).toString()
+
+        for ((message, id) in listOf(noMethod to "id-1", arrayParams to "id-2")) {
+            val reply = JSONObject(bridge.send(trusted, message).single())
+            assertEquals(id, reply.getString("id"))
+            assertFalse(reply.getBoolean("ok"))
+            assertEquals("SIGNER_ERROR", reply.getJSONObject("error").getString("error"))
+            assertEquals("Invalid request", reply.getJSONObject("error").getString("message"))
+        }
+        assertEquals(0, bridge.handled)
+    }
+
+    @Test
+    fun unknownMethodsAreRejected() {
+        val bridge = Harness()
+        for (method in listOf("nostr.unknown", "nostr.", "runtime.reset", "AndroidBridge.call", "debug.unknown")) {
+            val reply = JSONObject(bridge.send(trusted, request("id-1", method)).single())
+            assertFalse(method, reply.getBoolean("ok"))
+            assertEquals("SIGNER_ERROR", reply.getJSONObject("error").getString("error"))
+            assertEquals("Unsupported method", reply.getJSONObject("error").getString("message"))
+        }
+        assertTrue(bridge.signer.calls.isEmpty())
+    }
+
+    @Test
+    fun signerFailuresKeepTheirErrorCodes() {
+        val unavailable = Harness(FakeSigner(failure = SignerUnavailableException("No signer is paired")))
+        val unavailableReply = JSONObject(unavailable.send(trusted, request("id-1", "nostr.getPublicKey")).single())
+        assertEquals("SIGNER_UNAVAILABLE", unavailableReply.getJSONObject("error").getString("error"))
+        assertEquals("No signer is paired", unavailableReply.getJSONObject("error").getString("message"))
+
+        val failing = Harness(FakeSigner(failure = IllegalStateException("rejected")))
+        val failingReply = JSONObject(failing.send(trusted, request("id-1", "nostr.signEvent", EVENT)).single())
+        assertFalse(failingReply.getBoolean("ok"))
+        assertEquals("SIGNER_ERROR", failingReply.getJSONObject("error").getString("error"))
+        assertEquals("rejected", failingReply.getJSONObject("error").getString("message"))
+    }
+
+    @Test
+    fun plaintextThatLooksLikeAnErrorObjectIsStillAResult() {
+        val plaintext = """{"error":"x","message":"y"}"""
+        val bridge = Harness(FakeSigner(decrypted = plaintext))
+
+        val reply = JSONObject(
+            bridge.send(
+                trusted,
+                request("id-1", "nostr.nip44_decrypt", JSONObject().put("pubkey", PUBKEY).put("ciphertext", "c"))
+            ).single()
+        )
+
+        assertTrue(reply.getBoolean("ok"))
+        assertEquals(plaintext, reply.getString("result"))
+    }
+
+    @Test
+    fun runtimeMethodsUseTheRuntimeApiBaseSettings() {
+        val bridge = Harness()
+
+        val set = JSONObject(
+            bridge.send(trusted, request("id-1", "runtime.setApiBaseUrl", JSONObject().put("url", "https://api.example.com/"))).single()
+        )
+        assertTrue(set.getBoolean("result"))
+        val get = JSONObject(bridge.send(trusted, request("id-2", "runtime.getApiBaseUrl")).single())
+        assertEquals("https://api.example.com", get.getString("result"))
+
+        for (params in listOf(JSONObject().put("url", "http://insecure.example.com"), JSONObject().put("url", 5), null)) {
+            val rejected = JSONObject(bridge.send(trusted, request("id-3", "runtime.setApiBaseUrl", params)).single())
+            assertTrue(rejected.getBoolean("ok"))
+            assertFalse(rejected.getBoolean("result"))
+        }
+        assertEquals("https://api.example.com", bridge.preferences.values[RuntimeApiBaseSettings.API_BASE_OVERRIDE_KEY])
+
+        val callback = JSONObject(bridge.send(trusted, request("id-4", "runtime.getNip55CallbackUrl")).single())
+        assertEquals(Nip55Callback.callbackPrefix, callback.getString("result"))
+    }
+
+    @Test
+    fun debugLogIsANotificationWithoutAReply() {
+        val bridge = Harness()
+        val message = JSONObject().put("v", 1).put("method", WebMessageRouter.DEBUG_LOG_METHOD)
+            .put("params", JSONObject().put("level", "WARN").put("message", "hello")).toString()
+
+        assertTrue(bridge.send(trusted, message).isEmpty())
+        assertEquals(listOf("WARN" to "hello"), bridge.debugLogs)
+
+        assertTrue(bridge.send(trusted.copy(isMainFrame = false), message).isEmpty())
+        assertEquals(1, bridge.debugLogs.size)
+    }
+
+    @Test
+    fun repliesArePostedThroughTheMainThreadHook() {
+        var posted = 0
+        val bridge = Harness(runOnMain = { block -> posted++; block() })
+
+        bridge.send(trusted, request("id-1", "nostr.getPublicKey"))
+        bridge.send(trusted, JSONObject().put("v", 1).put("id", "id-2").toString())
+
+        assertEquals(2, posted)
+    }
+
+    private fun request(id: String, method: String, params: JSONObject? = null): String =
+        JSONObject().put("v", 1).put("id", id).put("method", method)
+            .apply { if (params != null) put("params", params) }
+            .toString()
+
+    private class Harness(
+        val signer: FakeSigner = FakeSigner(),
+        runOnMain: (() -> Unit) -> Unit = { block -> block() }
+    ) {
+        val preferences = FakePreferences()
+        val debugLogs = mutableListOf<Pair<String, String>>()
+        var handled = 0
+        private val methods = PakstrBridgeMethods(
+            nostr = NostrBridge(signerProvider = { signer }),
+            runtime = PakstrBridge(RuntimeApiBaseSettings.createForTesting(preferences) { null }),
+            debugLog = { level, message -> debugLogs += level to message }
+        )
+        private val router = WebMessageRouter(
+            handler = { method, params -> handled++; methods.handle(method, params) },
+            scope = CoroutineScope(Dispatchers.Unconfined),
+            runOnMain = runOnMain
+        )
+
+        fun send(source: MessageSource, data: String?): List<String> {
+            val replies = mutableListOf<String>()
+            router.onMessage(source, data) { replies += it }
+            return replies
+        }
+    }
+
+    private class FakeSigner(
+        private val failure: Exception? = null,
+        private val decrypted: String = "plaintext"
+    ) : NostrSigner {
+        val calls = mutableListOf<String>()
+
+        private fun record(name: String) {
+            calls += name
+            failure?.let { throw it }
+        }
+
+        override suspend fun getPublicKey(): String = PUBKEY.also { record("getPublicKey") }
+        override suspend fun signEvent(eventJson: String): String = eventJson.also { record("signEvent") }
+        override suspend fun nip04Encrypt(pubkey: String, plaintext: String) = "c04".also { record("nip04Encrypt") }
+        override suspend fun nip04Decrypt(pubkey: String, ciphertext: String) = decrypted.also { record("nip04Decrypt") }
+        override suspend fun nip44Encrypt(pubkey: String, plaintext: String) = "c44".also { record("nip44Encrypt") }
+        override suspend fun nip44Decrypt(pubkey: String, ciphertext: String) = decrypted.also { record("nip44Decrypt") }
+    }
+
+    private class FakePreferences : RuntimeApiBaseSettings.Preferences {
+        val values = mutableMapOf<String, String>()
+        override fun getString(key: String): String? = values[key]
+        override fun putString(key: String, value: String): Boolean {
+            values[key] = value
+            return true
+        }
+        override fun remove(key: String): Boolean {
+            values.remove(key)
+            return true
+        }
+    }
+
+    private companion object {
+        val PUBKEY = "a".repeat(64)
+        val EVENT: JSONObject = JSONObject().put("kind", 1).put("created_at", 1).put("tags", org.json.JSONArray()).put("content", "hi")
+    }
+}

package/android-template/app/src/test/java/com/pakstr/app/signer/AmberRequestChannelTest.kt

@@ -0,0 +1,294 @@
+package com.pakstr.app.signer
+
+import com.pakstr.app.signer.exceptions.SignerUnavailableException
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Deferred
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.async
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.cancelAndJoin
+import kotlinx.coroutines.channels.Channel
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.runBlocking
+import kotlinx.coroutines.withTimeout
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertThrows
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import java.util.concurrent.atomic.AtomicInteger
+
+class AmberRequestChannelTest {
+    private val launched = Channel<String>(Channel.UNLIMITED)
+    private val ids = AtomicInteger()
+
+    // Failed requests must not cancel the test body that awaits them.
+    private val requests = CoroutineScope(SupervisorJob() + Dispatchers.Default)
+
+    @After
+    fun cancelRequests() {
+        requests.cancel()
+    }
+
+    private fun channel(timeoutMillis: Long = 5_000) =
+        AmberRequestChannel(timeoutMillis) { "req-${ids.incrementAndGet()}" }
+
+    @Test
+    fun concurrent_requests_launch_one_at_a_time_and_get_their_own_results() = runBlocking {
+        val channel = channel()
+        val session = channel.openSession()
+        val pending = (1..3).map { request(session) }
+
+        val results = mutableMapOf<String, String>()
+        repeat(3) {
+            val id = nextLaunch()
+            assertNoLaunch()
+            assertTrue(channel.deliver(id, Result.success("result-$id")))
+            results[id] = "result-$id"
+        }
+
+        assertEquals(results.values.toSet(), pending.map { it.await() }.toSet())
+    }
+
+    @Test
+    fun duplicate_and_unexpected_results_are_dropped() = runBlocking {
+        val channel = channel()
+        val session = channel.openSession()
+        assertFalse(channel.deliver(null, Result.success("nobody asked")))
+
+        val pending = request(session)
+        val id = nextLaunch()
+        assertTrue(channel.deliver(id, Result.success("right")))
+        assertFalse(channel.deliver(id, Result.success("duplicate")))
+        assertFalse(channel.deliver(null, Result.success("duplicate")))
+        assertEquals("right", pending.await())
+    }
+
+    @Test
+    fun results_without_an_id_resolve_the_outstanding_request() = runBlocking {
+        val channel = channel()
+        val pending = request(channel.openSession())
+        nextLaunch()
+
+        assertTrue(channel.deliver(null, Result.success("")))
+        assertEquals("", pending.await())
+    }
+
+    @Test
+    fun mismatched_result_fails_the_request_without_its_data_and_frees_the_slot() = runBlocking {
+        val channel = channel()
+        val session = channel.openSession()
+        val pending = request(session)
+        nextLaunch()
+        val queued = request(session)
+        assertNoLaunch()
+
+        assertFalse(channel.deliver("other-request", Result.success("secret payload")))
+
+        val error = failure(pending)
+        assertTrue(error is AmberResponseMismatchException)
+        assertFalse(error?.message.orEmpty().contains("secret payload"))
+
+        // The queued request launches and receives only its own result.
+        val id = nextLaunch()
+        assertEquals("req-2", id)
+        assertTrue(channel.deliver(id, Result.success("fresh")))
+        assertEquals("fresh", queued.await())
+    }
+
+    @Test
+    fun mismatched_result_releases_a_slot_held_by_an_abandoned_request() = runBlocking {
+        val channel = channel(timeoutMillis = 100)
+        val session = channel.openSession()
+        val abandoned = request(session)
+        nextLaunch()
+        assertTrue(failure(abandoned) is AmberRequestTimeoutException)
+
+        val next = request(session, timeout = false)
+        assertNoLaunch()
+
+        assertFalse(channel.deliver("other-request", Result.success("secret payload")))
+        val id = nextLaunch()
+        assertTrue(channel.deliver(id, Result.success("fresh")))
+        assertEquals("fresh", next.await())
+    }
+
+    @Test
+    fun rejected_result_fails_the_request_and_frees_the_slot() = runBlocking {
+        val channel = channel()
+        val session = channel.openSession()
+        val pending = request(session)
+        val id = nextLaunch()
+
+        assertTrue(channel.deliver(id, Result.failure(AmberRequestRejectedException())))
+        assertTrue(failure(pending) is AmberRequestRejectedException)
+
+        val next = request(session)
+        val nextId = nextLaunch()
+        assertTrue(channel.deliver(nextId, Result.success("ok")))
+        assertEquals("ok", next.await())
+    }
+
+    @Test
+    fun timeout_fails_with_a_regular_exception_and_late_result_does_not_leak() = runBlocking {
+        val channel = channel(timeoutMillis = 100)
+        val session = channel.openSession()
+        val abandoned = request(session)
+        nextLaunch()
+        val error = failure(abandoned)
+        assertTrue(error is AmberRequestTimeoutException)
+        assertEquals("Amber request timed out", error?.message)
+
+        val next = request(session, timeout = false)
+        assertNoLaunch()
+
+        // The abandoned activity's id-less result drains its own slot.
+        assertTrue(channel.deliver(null, Result.success("late")))
+        val id = nextLaunch()
+        assertTrue(channel.deliver(id, Result.success("fresh")))
+        assertEquals("fresh", next.await())
+    }
+
+    @Test
+    fun cancelled_caller_keeps_its_slot_until_its_result_arrives() = runBlocking {
+        val channel = channel()
+        val session = channel.openSession()
+        val cancelled = request(session)
+        val cancelledId = nextLaunch()
+        cancelled.cancelAndJoin()
+
+        val next = request(session)
+        assertNoLaunch()
+
+        assertTrue(channel.deliver(cancelledId, Result.success("late")))
+        val id = nextLaunch()
+        assertTrue(channel.deliver(id, Result.success("fresh")))
+        assertEquals("fresh", next.await())
+    }
+
+    @Test
+    fun requests_timing_out_in_the_queue_are_never_launched() = runBlocking {
+        val channel = channel(timeoutMillis = 100)
+        val session = channel.openSession()
+        val first = request(session)
+        val firstId = nextLaunch()
+        val queued = request(session)
+
+        assertTrue(failure(queued) is AmberRequestTimeoutException)
+        assertTrue(failure(first) is AmberRequestTimeoutException)
+        assertTrue(channel.deliver(firstId, Result.success("late")))
+        assertNoLaunch()
+    }
+
+    @Test
+    fun launch_failure_propagates_and_frees_the_signer() = runBlocking {
+        val channel = channel()
+        val session = channel.openSession()
+        assertThrows(IllegalStateException::class.java) {
+            runBlocking {
+                session.request { throw IllegalStateException("no activity") }
+            }
+        }
+
+        val next = request(session)
+        val id = nextLaunch()
+        assertTrue(channel.deliver(id, Result.success("ok")))
+        assertEquals("ok", next.await())
+    }
+
+    @Test
+    fun closing_a_session_fails_its_requests_at_once_and_queued_ones_never_launch() = runBlocking {
+        val channel = channel()
+        val old = channel.openSession()
+        val inFlight = request(old)
+        val inFlightId = nextLaunch()
+        val queued = request(old)
+        assertNoLaunch()
+
+        old.close()
+
+        withTimeout(1_000) {
+            assertTrue(failure(inFlight) is SignerUnavailableException)
+            assertTrue(failure(queued) is SignerUnavailableException)
+        }
+        assertTrue(failure(request(old)) is SignerUnavailableException)
+
+        // The old session's Amber activity still drains its own slot.
+        assertTrue(channel.deliver(inFlightId, Result.success("late")))
+        assertNoLaunch()
+    }
+
+    @Test
+    fun session_closed_just_before_launch_never_launches() = runBlocking {
+        lateinit var session: AmberRequestChannel.Session
+        // newRequestId runs after the request has its turn, right before launch.
+        val channel = AmberRequestChannel(5_000) { session.close(); "req-1" }
+        session = channel.openSession()
+
+        assertTrue(failure(request(session)) is SignerUnavailableException)
+        assertNoLaunch()
+        assertFalse(channel.deliver(null, Result.success("nobody asked")))
+    }
+
+    @Test
+    fun replacement_session_waits_for_the_closed_sessions_launch_and_gets_only_its_own_result() = runBlocking {
+        val channel = channel()
+        val old = channel.openSession()
+        val stale = request(old)
+        val staleId = nextLaunch()
+        old.close()
+        assertTrue(failure(stale) is SignerUnavailableException)
+
+        val replacement = channel.openSession()
+        val next = request(replacement)
+        assertNoLaunch()
+
+        // The stale result answers the old launch, not the replacement's request.
+        assertTrue(channel.deliver(staleId, Result.success("stale payload")))
+        val id = nextLaunch()
+        assertFalse(next.isCompleted)
+        assertTrue(channel.deliver(id, Result.success("fresh")))
+        assertEquals("fresh", next.await())
+    }
+
+    @Test
+    fun result_outcome_follows_nip55_result_codes_and_rejection() {
+        val extras = mapOf("result" to "sig", "event" to "{}", "id" to "req-1")
+
+        assertEquals("sig", amberResultOutcome(RESULT_OK, false, extras::get).getOrThrow())
+        assertEquals("{}", amberResultOutcome(RESULT_OK, false, mapOf("event" to "{}")::get).getOrThrow())
+        assertEquals("", amberResultOutcome(RESULT_OK, false, emptyMap<String, String>()::get).getOrThrow())
+        assertEquals("", amberResultOutcome(RESULT_CANCELED, false, extras::get).getOrThrow())
+
+        val read = mutableListOf<String>()
+        val rejected = amberResultOutcome(RESULT_OK, true) { name -> read += name; extras[name] }
+        assertTrue(rejected.exceptionOrNull() is AmberRequestRejectedException)
+        assertEquals(emptyList<String>(), read)
+    }
+
+    private fun request(
+        session: AmberRequestChannel.Session,
+        timeout: Boolean = true
+    ): Deferred<String> = requests.async {
+        val call = suspend { session.request { id -> launched.trySend(id) } }
+        if (timeout) session.withRequestTimeout { call() } else call()
+    }
+
+    private suspend fun failure(request: Deferred<String>): Throwable? =
+        runCatching { request.await() }.exceptionOrNull()
+
+    private suspend fun nextLaunch(): String =
+        withTimeout(2_000) { launched.receive() }
+
+    private suspend fun assertNoLaunch() {
+        delay(150)
+        assertTrue(launched.tryReceive().isFailure)
+    }
+
+    private companion object {
+        const val RESULT_OK = -1
+        const val RESULT_CANCELED = 0
+    }
+}