sattle/src/lnurlcash/keys.material-commitment.cases.ts

import {sha256} from '@noble/hashes/sha2.js'
import {bytesToHex, utf8ToBytes} from '@noble/hashes/utils.js'
import {beforeEach, describe, expect, it} from 'vitest'

import {
  decryptSavedWalletMaterial,
  deriveWalletMaterial,
  encryptSecretParts,
  ensureSavedWalletMaterialOwner,
  getPlainWalletMaterial,
  isValidStoredWalletMaterial,
  linkingPubKeyHex,
  restoreWalletMaterialStored,
  saveWalletMaterial,
  serializeWalletMaterial,
  savedWalletMaterialOwnerId,
  walletMaterialLinkingKey,
  WalletMaterialProofMismatchError,
} from './keys'
import {walletMaterialOwnerId} from './storage/storedSecret'
import {parseJsonObject, stubLocalStorage} from './test-utils'

const MNEMONIC =
  'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about'
const OTHER_MNEMONIC =
  'legal winner thank year wave sausage worth useful legal winner thank yellow'
const MATERIAL_STORAGE_KEY = 'sattle_wallet_material_v2'
const PASSWORD = 'correct horse battery staple'

const materialHash = (serialized: string): string =>
  bytesToHex(sha256(utf8ToBytes(serialized)))

const readRawMaterialRecord = (): Record<string, unknown> => {
  const raw = localStorage.getItem(MATERIAL_STORAGE_KEY)
  if (raw === null) throw new Error('expected a saved wallet-material record')
  return parseJsonObject(raw)
}

beforeEach(() => {
  stubLocalStorage()
})

describe('baseline: wallet material identity', () => {
  it('derives identity only from the linking key when the cash root changes', () => {
    const material = deriveWalletMaterial(MNEMONIC)
    const other = deriveWalletMaterial(OTHER_MNEMONIC)
    const alteredRoot = {...material, cashRootHex: other.cashRootHex}

    expect(walletMaterialOwnerId(alteredRoot)).toBe(walletMaterialOwnerId(material))
    expect(serializeWalletMaterial(alteredRoot)).not.toBe(serializeWalletMaterial(material))
  })
})

describe('saved wallet material commitment', () => {
  it('stores the canonical material commitment on plaintext and encrypted saves', async () => {
    const material = deriveWalletMaterial(MNEMONIC)
    const expectedHash = materialHash(serializeWalletMaterial(material))

    await saveWalletMaterial(material)
    const plaintext = readRawMaterialRecord()
    await saveWalletMaterial(material, PASSWORD)
    const encrypted = readRawMaterialRecord()

    expect(plaintext.materialHash).toBe(expectedHash)
    expect(encrypted.materialHash).toBe(expectedHash)
  })

  it('rejects authenticated encrypted material when its commitment differs', async () => {
    const material = deriveWalletMaterial(MNEMONIC)
    await saveWalletMaterial(material, PASSWORD)
    localStorage.setItem(
      MATERIAL_STORAGE_KEY,
      JSON.stringify({...readRawMaterialRecord(), materialHash: '00'.repeat(32)}),
    )

    await expect(decryptSavedWalletMaterial(PASSWORD)).rejects.toBeInstanceOf(
      WalletMaterialProofMismatchError,
    )
  })

  it('rejects plaintext material when its commitment differs', async () => {
    const material = deriveWalletMaterial(MNEMONIC)
    await saveWalletMaterial(material)
    const before = JSON.stringify({...readRawMaterialRecord(), materialHash: '00'.repeat(32)})
    localStorage.setItem(MATERIAL_STORAGE_KEY, before)

    expect(getPlainWalletMaterial()).toBeNull()
    expect(localStorage.getItem(MATERIAL_STORAGE_KEY)).toBe(before)
  })

  it('refuses to stamp same-owner material with an altered cash root', async () => {
    const material = deriveWalletMaterial(MNEMONIC)
    const other = deriveWalletMaterial(OTHER_MNEMONIC)
    await saveWalletMaterial(material, PASSWORD)

    expect(() =>
      ensureSavedWalletMaterialOwner({...material, cashRootHex: other.cashRootHex}),
    ).toThrow(WalletMaterialProofMismatchError)
  })

  it('requires exactly one lowercase 64-hex commitment at the storage boundary', () => {
    const material = deriveWalletMaterial(MNEMONIC)
    const serialized = serializeWalletMaterial(material)
    const record = {
      enc: false,
      value: serialized,
      materialHash: materialHash(serialized),
      ownerId: walletMaterialOwnerId(material),
      version: 2,
    }

    expect(isValidStoredWalletMaterial(record)).toBe(true)
    expect(isValidStoredWalletMaterial({...record, materialHash: record.materialHash.toUpperCase()})).toBe(
      false,
    )
    expect(
      isValidStoredWalletMaterial({
        enc: record.enc,
        value: record.value,
        ownerId: record.ownerId,
        version: record.version,
      }),
    ).toBe(false)
  })

  it('rejects malformed authenticated material after its correct commitment matches', async () => {
    const material = deriveWalletMaterial(MNEMONIC)
    const malformed = JSON.stringify({...material, cashRootHex: '00'.repeat(64)})
    const parts = await encryptSecretParts(malformed, PASSWORD)
    localStorage.setItem(
      MATERIAL_STORAGE_KEY,
      JSON.stringify({
        enc: true,
        ...parts,
        materialHash: materialHash(malformed),
        ownerId: linkingPubKeyHex(walletMaterialLinkingKey(material)),
        version: 2,
      }),
    )

    await expect(decryptSavedWalletMaterial(PASSWORD)).rejects.toThrow(
      'valid v2 wallet material',
    )
  })

  it('preserves a verified restored commitment while discarding its owner claim', () => {
    const material = deriveWalletMaterial(MNEMONIC)
    const serialized = serializeWalletMaterial(material)

    restoreWalletMaterialStored({
      enc: false,
      value: serialized,
      materialHash: materialHash(serialized),
      ownerId: linkingPubKeyHex(new Uint8Array(32).fill(9)),
      version: 2,
    })

    expect(readRawMaterialRecord()).toEqual({
      enc: false,
      value: serialized,
      materialHash: materialHash(serialized),
    })
    expect(getPlainWalletMaterial()).toEqual(material)
  })

  it('proves an encrypted restored commitment before owner stamping', async () => {
    const material = deriveWalletMaterial(MNEMONIC)
    const serialized = serializeWalletMaterial(material)
    const parts = await encryptSecretParts(serialized, PASSWORD)
    restoreWalletMaterialStored({
      enc: true,
      ...parts,
      materialHash: materialHash(serialized),
      ownerId: linkingPubKeyHex(new Uint8Array(32).fill(9)),
      version: 2,
    })

    expect(savedWalletMaterialOwnerId()).toBeNull()
    const proven = await decryptSavedWalletMaterial(PASSWORD)
    ensureSavedWalletMaterialOwner(proven)

    expect(savedWalletMaterialOwnerId()).toBe(walletMaterialOwnerId(material))
  })

  it('rejects an unproven restored hash that contradicts encrypted material', async () => {
    const material = deriveWalletMaterial(MNEMONIC)
    const serialized = serializeWalletMaterial(material)
    const parts = await encryptSecretParts(serialized, PASSWORD)
    restoreWalletMaterialStored({
      enc: true,
      ...parts,
      materialHash: '00'.repeat(32),
      ownerId: walletMaterialOwnerId(material),
      version: 2,
    })

    await expect(decryptSavedWalletMaterial(PASSWORD)).rejects.toBeInstanceOf(
      WalletMaterialProofMismatchError,
    )
    expect(savedWalletMaterialOwnerId()).toBeNull()
  })
})