nsecbunkerd/tests/nip46-backend.test.ts

import { test } from "node:test";
import assert from "node:assert/strict";
import {
    finalizeEvent,
    verifyEvent,
    generateSecretKey,
    getPublicKey,
    nip44,
    type Event,
} from "nostr-tools";
import { MockRelay } from "./helpers/mock-relay";
import { RelayPool } from "../src/daemon/lib/relay-pool";
import { Backend } from "../src/daemon/backend/index";

/**
 * End-to-end NIP-46 round-trip against the ported Backend (#42): a real
 * nostr-tools client sends connect / ping / get_public_key / sign_event /
 * nip44_encrypt through a mock relay; we assert the responses, then FLAP the
 * relay and assert the backend still answers — proving the whole signing
 * protocol survives a reconnect, which it never did on the NDK transport (#41).
 */

const NIP46_KIND = 24133;

/** Minimal NIP-46 client: publishes requests to the bunker pubkey, decrypts the
 *  responses addressed back to it. nip44 envelope (the modern default). */
class TestClient {
    readonly sk = generateSecretKey();
    readonly pubkey = getPublicKey(this.sk);
    private pending = new Map<string, (r: { result: string; error?: string }) => void>();
    private n = 0;

    constructor(
        private readonly pool: RelayPool,
        private readonly bunkerPubkey: string,
    ) {
        this.pool.subscribe([{ kinds: [NIP46_KIND], "#p": [this.pubkey] }], (e: Event) => {
            const ck = nip44.getConversationKey(this.sk, e.pubkey);
            const msg = JSON.parse(nip44.decrypt(e.content, ck));
            this.pending.get(msg.id)?.({ result: msg.result, error: msg.error });
        });
    }

    request(method: string, params: string[] = [], timeoutMs = 5000): Promise<{ result: string; error?: string }> {
        const id = `req-${++this.n}`;
        const ck = nip44.getConversationKey(this.sk, this.bunkerPubkey);
        const content = nip44.encrypt(JSON.stringify({ id, method, params }), ck);
        const event = finalizeEvent(
            { kind: NIP46_KIND, created_at: Math.floor(Date.now() / 1000), tags: [["p", this.bunkerPubkey]], content },
            this.sk,
        );
        return new Promise((resolve, reject) => {
            const timer = setTimeout(() => reject(new Error(`${method} timed out`)), timeoutMs);
            this.pending.set(id, (r) => {
                clearTimeout(timer);
                resolve(r);
            });
            void this.pool.publish(event);
        });
    }
}

async function waitFor(pred: () => boolean, timeoutMs = 5000, stepMs = 25): Promise<void> {
    const start = Date.now();
    while (!pred()) {
        if (Date.now() - start > timeoutMs) throw new Error("waitFor timed out");
        await new Promise((r) => setTimeout(r, stepMs));
    }
}

test("Backend serves NIP-46 over the pool and survives a relay flap (#42)", async () => {
    const relay = new MockRelay();
    await relay.start();

    // The held key the bunker signs as.
    const bunkerSk = generateSecretKey();
    const bunkerPubkey = getPublicKey(bunkerSk);
    const bunkerNsec = Buffer.from(bunkerSk).toString("hex");

    let allow = true;
    const seen: string[] = [];
    const bunkerPool = new RelayPool([relay.url], { log: () => {} });
    bunkerPool.start();
    const backend = new Backend({
        pool: bunkerPool,
        nsec: bunkerNsec,
        permitCallback: async (p) => {
            seen.push(p.method);
            return allow;
        },
        applyToken: async () => {
            /* no DB in this test */
        },
    });
    await backend.start();

    const clientPool = new RelayPool([relay.url], { log: () => {} });
    clientPool.start();
    await waitFor(() => clientPool.connectedCount() === 1 && bunkerPool.healthy());
    const client = new TestClient(clientPool, bunkerPubkey);

    // connect -> ack
    assert.equal((await client.request("connect", ["", ""])).result, "ack");
    // ping -> pong
    assert.equal((await client.request("ping")).result, "pong");
    // get_public_key -> the bunker pubkey
    assert.equal((await client.request("get_public_key")).result, bunkerPubkey);

    // sign_event -> a valid event signed AS the bunker key
    const tmpl = { kind: 1, created_at: Math.floor(Date.now() / 1000), tags: [], content: "hi from atm" };
    const signRes = await client.request("sign_event", [JSON.stringify(tmpl)]);
    const signed = JSON.parse(signRes.result) as Event;
    assert.equal(signed.pubkey, bunkerPubkey, "signed as the held key");
    assert.equal(signed.kind, 1);
    assert.ok(verifyEvent(signed), "signature valid");

    // nip44_encrypt(clientPubkey, payload) -> ciphertext from bunker to client
    const enc = await client.request("nip44_encrypt", [client.pubkey, "secret-payload"]);
    const ck = nip44.getConversationKey(client.sk, bunkerPubkey);
    assert.equal(nip44.decrypt(enc.result, ck), "secret-payload", "nip44_encrypt round-trips");

    // FLAP the relay, then assert the backend still answers.
    await relay.flap();
    await waitFor(() => bunkerPool.healthy() && clientPool.healthy());
    assert.equal((await client.request("ping")).result, "pong", "still serving after flap");

    // Rejection path: permit returns false -> "Not authorized".
    allow = false;
    const denied = await client.request("ping");
    assert.equal(denied.result, "error");
    assert.equal(denied.error, "Not authorized");

    assert.ok(seen.includes("sign_event") && seen.includes("connect"), "permit callback was consulted");

    bunkerPool.stop();
    clientPool.stop();
    await relay.stop();
});