nostrmarket/nostr/nip59.py

"""
NIP-59: Gift Wrap

Three-layer protocol for metadata-protected messaging:
  1. Rumor (unsigned event) — carries content, deniable if leaked
  2. Seal (kind 13) — encrypts rumor, signed by author, no recipient metadata
  3. Gift Wrap (kind 1059) — encrypts seal with ephemeral key, has recipient p-tag

Reference: https://github.com/nostr-protocol/nips/blob/master/59.md

## Bunker integration (aiolabs/nostrmarket#5)

Merchant-identity layers (rumor's sender-pubkey + seal's encryption +
seal's signature) route through the lnbits `NostrSigner` abstraction
so the merchant's nsec stays in the bunker — never reaches this
process. Specifically:

- `create_seal` is async; takes a `sender_signer` instead of a
  plaintext nsec. The seal's NIP-44 encrypt + Schnorr sign happen
  via `await sender_signer.nip44_encrypt(...)` +
  `await sender_signer.sign_event(...)` over the NIP-46 channel.
- `unwrap_gift_wrap` + `unseal` are async; take a `recipient_signer`
  and call `await recipient_signer.nip44_decrypt(...)` for each layer.

The **ephemeral keypair layer** (`create_gift_wrap`) stays synchronous
+ local: the ephemeral nsec exists for the lifetime of one wrap and
provides no merchant-identity capability, so there's no reason to
involve the bunker. Generating it locally avoids one round-trip per
DM.
"""

import json
import secrets
import time
from typing import Optional

import coincurve

from .event import NostrEvent
from .nip44 import decrypt as nip44_decrypt
from .nip44 import encrypt as nip44_encrypt
from .nip44 import get_conversation_key

TWO_DAYS = 2 * 24 * 60 * 60


def _random_past_timestamp() -> int:
    """Generate a timestamp randomly in the past 0-2 days for metadata protection."""
    return int(time.time()) - secrets.randbelow(TWO_DAYS)


def _sign_event_local(event: NostrEvent, private_key_hex: str) -> NostrEvent:
    """Compute event id and sign it locally with a privkey held in this
    process. Used only for the ephemeral-keypair layer (gift wrap outer);
    merchant-identity sign goes through the signer ABC instead."""
    event.id = event.event_id
    sk = coincurve.PrivateKey(bytes.fromhex(private_key_hex))
    event.sig = sk.sign_schnorr(bytes.fromhex(event.id)).hex()
    return event


def _pubkey_from_privkey(private_key_hex: str) -> str:
    """Derive x-only public key hex from private key hex."""
    sk = coincurve.PrivateKey(bytes.fromhex(private_key_hex))
    return sk.public_key.format(compressed=True)[1:].hex()


def create_rumor(
    pubkey: str,
    content: str,
    kind: int = 14,
    tags: Optional[list[list[str]]] = None,
    created_at: Optional[int] = None,
) -> NostrEvent:
    """
    Create an unsigned rumor event.
    The event has an id but no signature, making it deniable.
    """
    event = NostrEvent(
        pubkey=pubkey,
        created_at=created_at or int(time.time()),
        kind=kind,
        tags=tags or [],
        content=content,
    )
    event.id = event.event_id
    # sig intentionally left as None (unsigned)
    return event


async def create_seal(
    rumor: NostrEvent,
    sender_signer,
    recipient_pubkey: str,
) -> NostrEvent:
    """
    Create a kind 13 seal: encrypts the rumor for the recipient.
    Signed by the sender. Tags are always empty.

    Both crypto operations (NIP-44 encrypt + Schnorr sign) route
    through the sender's `NostrSigner` (`sender_signer`) — the
    plaintext nsec is never observable in this process.
    """
    encrypted_rumor = await sender_signer.nip44_encrypt(
        rumor.stringify(), recipient_pubkey
    )

    seal = NostrEvent(
        pubkey=sender_signer.pubkey,
        created_at=_random_past_timestamp(),
        kind=13,
        tags=[],
        content=encrypted_rumor,
    )
    # The signer fills id + sig (computed bunker-side).
    signed = await sender_signer.sign_event(
        {
            "pubkey": seal.pubkey,
            "created_at": seal.created_at,
            "kind": seal.kind,
            "tags": seal.tags,
            "content": seal.content,
        }
    )
    seal.id = signed["id"]
    seal.sig = signed["sig"]
    return seal


def create_gift_wrap(
    seal: NostrEvent,
    recipient_pubkey: str,
) -> NostrEvent:
    """
    Create a kind 1059 gift wrap: encrypts the seal with an ephemeral key.
    The only public metadata is the recipient's p-tag.

    Stays synchronous + local: the ephemeral nsec exists only for the
    lifetime of one wrap and provides no merchant-identity capability,
    so there's no point routing through the bunker (would add one NIP-46
    round-trip per DM with zero security benefit).
    """
    ephemeral_privkey = secrets.token_bytes(32).hex()
    ephemeral_pubkey = _pubkey_from_privkey(ephemeral_privkey)

    conv_key = get_conversation_key(ephemeral_privkey, recipient_pubkey)
    encrypted_seal = nip44_encrypt(seal.stringify(), conv_key)

    wrap = NostrEvent(
        pubkey=ephemeral_pubkey,
        created_at=_random_past_timestamp(),
        kind=1059,
        tags=[["p", recipient_pubkey]],
        content=encrypted_seal,
    )
    return _sign_event_local(wrap, ephemeral_privkey)


async def unwrap_gift_wrap(
    gift_wrap: NostrEvent,
    recipient_signer,
) -> NostrEvent:
    """
    Decrypt a kind 1059 gift wrap to reveal the inner seal.
    Routes NIP-44 decrypt through the recipient's signer abstraction
    so the recipient's nsec stays in the bunker.
    """
    seal_json = await recipient_signer.nip44_decrypt(
        gift_wrap.content, gift_wrap.pubkey
    )
    return NostrEvent(**json.loads(seal_json))


async def unseal(
    seal: NostrEvent,
    recipient_signer,
) -> NostrEvent:
    """
    Decrypt a kind 13 seal to reveal the inner rumor.
    Uses the recipient signer (their nsec stays in the bunker) and the
    seal's pubkey (the sender). Validates that the rumor's pubkey
    matches the seal's pubkey.
    """
    rumor_json = await recipient_signer.nip44_decrypt(seal.content, seal.pubkey)
    rumor = NostrEvent(**json.loads(rumor_json))

    if rumor.pubkey != seal.pubkey:
        raise ValueError(
            f"rumor pubkey ({rumor.pubkey}) does not match "
            f"seal pubkey ({seal.pubkey})"
        )
    return rumor


# --- Convenience functions ---


async def wrap_message(
    content: str,
    sender_signer,
    recipient_pubkey: str,
    kind: int = 14,
    tags: Optional[list[list[str]]] = None,
) -> NostrEvent:
    """
    Full wrap pipeline: create rumor → seal → gift wrap.
    Returns the gift wrap event ready to publish.

    `sender_signer` is the sender merchant's `NostrSigner` (post-#5:
    always a `RemoteBunkerSigner`). The merchant's nsec never leaves
    the bunker.
    """
    rumor = create_rumor(sender_signer.pubkey, content, kind=kind, tags=tags)
    seal = await create_seal(rumor, sender_signer, recipient_pubkey)
    return create_gift_wrap(seal, recipient_pubkey)


async def unwrap_message(
    gift_wrap: NostrEvent,
    recipient_signer,
) -> NostrEvent:
    """
    Full unwrap pipeline: gift wrap → seal → rumor.
    Returns the rumor with sender pubkey and plaintext content.

    `recipient_signer` is the recipient merchant's `NostrSigner`. Both
    NIP-44 decrypt layers (gift wrap → seal, seal → rumor) route
    through the signer abstraction.
    """
    seal = await unwrap_gift_wrap(gift_wrap, recipient_signer)
    return await unseal(seal, recipient_signer)