nsecbunkerd/tests/admin-transport.test.ts

import { test } from "node:test";
import assert from "node:assert/strict";
import { generateSecretKey, getPublicKey, finalizeEvent, nip44, type Event } from "nostr-tools";
import { MockRelay } from "./helpers/mock-relay";
import { RelayPool } from "../src/daemon/lib/relay-pool";
import { Nip46Transport } from "../src/daemon/nip46/transport";

/**
 * The admin interface adds two things to the transport over the signer backend
 * (#42): it listens on TWO kinds (24133 client + 24134 admin) and replies on a
 * chosen kind, and it can *send* requests + match responses (the interactive
 * approval flow, `rpc.sendRequest`). This exercises both directions over the
 * pool and across a relay flap.
 */

const NOSTR_CONNECT = 24133;
const ADMIN_RESPONSE = 24134;

async function waitFor(pred: () => boolean, timeoutMs = 5000, stepMs = 25): Promise<void> {
    const start = Date.now();
    while (!pred()) {
        if (Date.now() - start > timeoutMs) throw new Error("waitFor timed out");
        await new Promise((r) => setTimeout(r, stepMs));
    }
}

/** Raw NIP-46 client: send a request on `kind`, read the response on either
 *  channel addressed back to us. nip44 envelope. */
class RawClient {
    readonly sk = generateSecretKey();
    readonly pubkey = getPublicKey(this.sk);
    private pending = new Map<string, (r: { result: string; error?: string }) => void>();
    private n = 0;

    constructor(private readonly pool: RelayPool, private readonly peer: string) {
        this.pool.subscribe([{ kinds: [NOSTR_CONNECT, ADMIN_RESPONSE], "#p": [this.pubkey] }], (e: Event) => {
            const m = JSON.parse(nip44.decrypt(e.content, nip44.getConversationKey(this.sk, e.pubkey)));
            if (m.method) return; // we only consume responses here
            this.pending.get(m.id)?.({ result: m.result, error: m.error });
        });
    }

    request(method: string, params: string[] = [], kind = NOSTR_CONNECT, timeoutMs = 5000) {
        const id = `c${++this.n}`;
        const ck = nip44.getConversationKey(this.sk, this.peer);
        const ev = finalizeEvent(
            { kind, created_at: Math.floor(Date.now() / 1000), tags: [["p", this.peer]], content: nip44.encrypt(JSON.stringify({ id, method, params }), ck) },
            this.sk,
        );
        return new Promise<{ result: string; error?: string }>((res, rej) => {
            const t = setTimeout(() => rej(new Error(`${method} timed out`)), timeoutMs);
            this.pending.set(id, (r) => { clearTimeout(t); res(r); });
            void this.pool.publish(ev);
        });
    }
}

test("admin transport: request on 24133 -> reply on 24134, survives a flap (#42)", async () => {
    const relay = new MockRelay();
    await relay.start();

    const adminSk = generateSecretKey();
    const adminPubkey = getPublicKey(adminSk);

    const adminPool = new RelayPool([relay.url], { log: () => {} });
    adminPool.start();
    const admin = new Nip46Transport(adminSk, adminPool);
    // Echo handler: reply "ok" on the admin channel (24134), like the ping cmd.
    await admin.start((req) => {
        void admin.sendResponse(req.id, req.remotePubkey, "ok", req.encryption, undefined, ADMIN_RESPONSE);
    }, [NOSTR_CONNECT, ADMIN_RESPONSE]);

    const clientPool = new RelayPool([relay.url], { log: () => {} });
    clientPool.start();
    await waitFor(() => clientPool.connectedCount() === 1 && adminPool.healthy());
    const client = new RawClient(clientPool, adminPubkey);

    assert.equal((await client.request("ping")).result, "ok");

    await relay.flap();
    await waitFor(() => adminPool.healthy() && clientPool.healthy());
    assert.equal((await client.request("ping")).result, "ok", "admin still serving after flap");

    admin.stop();
    adminPool.stop();
    clientPool.stop();
    await relay.stop();
});

test("admin transport: sendRequest + response routing (the approval flow) (#42)", async () => {
    const relay = new MockRelay();
    await relay.start();

    // "admin" (bunker) and "operator" (the human's client) — each a transport.
    const adminSk = generateSecretKey();
    const operatorSk = generateSecretKey();
    const operatorPubkey = getPublicKey(operatorSk);

    const adminPool = new RelayPool([relay.url], { log: () => {} });
    adminPool.start();
    const admin = new Nip46Transport(adminSk, adminPool);
    await admin.start(() => {}, [NOSTR_CONNECT, ADMIN_RESPONSE]);

    const opPool = new RelayPool([relay.url], { log: () => {} });
    opPool.start();
    const operator = new Nip46Transport(operatorSk, opPool);
    // The operator auto-approves any "acl" request it receives.
    await operator.start((req) => {
        if (req.method === "acl") {
            void operator.sendResponse(req.id, req.remotePubkey, JSON.stringify(["always"]), req.encryption, undefined, ADMIN_RESPONSE);
        }
    }, [NOSTR_CONNECT, ADMIN_RESPONSE]);

    await waitFor(() => adminPool.healthy() && opPool.healthy());

    // Admin asks the operator to approve; expects the routed response.
    const approved = await new Promise<string>((resolve, reject) => {
        const t = setTimeout(() => reject(new Error("approval timed out")), 5000);
        const id = admin.sendRequest(operatorPubkey, "acl", ["{}"], "nip44", ADMIN_RESPONSE, (res) => {
            admin.clearPending(id);
            clearTimeout(t);
            resolve(res.result);
        });
    });

    assert.equal(JSON.parse(approved)[0], "always", "operator's approval routed back to the admin");

    admin.stop();
    operator.stop();
    adminPool.stop();
    opPool.stop();
    await relay.stop();
});