sattle/src/lnurlcash/ops.signature.cases.ts

import {describe, expect, it} from 'vitest'
import {noteK1, noteSignature} from 'lnurlcash-kit'

import {ensureExactAmount} from './ops'
import {requiredValue} from './test-utils'
import {
  allocateOutputSecrets,
  makeBearer,
  mint,
  noteUrl,
  secret,
  signatureKeysFor,
} from './ops.testHarness'
import {fetchNoteInfo} from 'lnurlcash-kit'

// Landed split/merge outputs carry the mint's signature in their URL (sig
// param), and earn verified:true only when that signature checks against a
// trusted CURRENT or PREVIOUS key for the mint. Invalid, missing, or
// wrong-key signatures - and mints with no trusted keys at all - keep the
// staged outputs unverified; the money is tracked either way (the notes
// exist at the mint), only the offline-verifiable badge is withheld.
describe('landed mutation signature verification', () => {
  it('verifies a landed split against the current key and preserves its signature', async () => {
    const instance = await mint()
    const bearer = await makeBearer(instance, secret('a0'), 21_000)

    const result = await ensureExactAmount([bearer], 5_000, {
      onCarve: () => undefined,
      allocateOutputSecrets,
      mintSignatureKeys: signatureKeysFor(instance),
    })

    expect(result.note.verified).toBe(true)
    const signature = noteSignature(result.note.url)
    expect(signature).not.toBeNull()
    expect(noteSignature(requiredValue(result.change).url)).not.toBeNull()
    // change stays unverified (its true post-fee value is unknown until a
    // refresh) even though its signature is preserved
    expect(result.change?.verified).toBe(false)
  })

  it('verifies a landed merge against the current key and preserves its signature', async () => {
    const instance = await mint()
    const first = await makeBearer(instance, secret('a1'), 3_000)
    const second = await makeBearer(instance, secret('a2'), 4_000)

    const result = await ensureExactAmount([first, second], 7_000, {
      onCarve: () => undefined,
      allocateOutputSecrets,
      mintSignatureKeys: signatureKeysFor(instance),
    })

    expect(result.note.verified).toBe(true)
    expect(noteSignature(result.note.url)).not.toBeNull()
  })

  it('verifies against the previous key after the mint rotated its signing key', async () => {
    // the mint signs every output under its RETIRED key while advertising
    // the current one - exactly the rekey window a holder must tolerate
    const instance = await mint({
      previousPrivateKey: '22'.repeat(32),
      signWithPreviousKey: true,
    })
    const bearer = await makeBearer(instance, secret('a3'), 21_000)

    const result = await ensureExactAmount([bearer], 5_000, {
      onCarve: () => undefined,
      allocateOutputSecrets,
      mintSignatureKeys: signatureKeysFor(instance),
    })

    expect(instance.state.previousPubkeys).toHaveLength(1)
    expect(result.note.verified).toBe(true)
    expect(noteSignature(result.note.url)).not.toBeNull()
  })

  it('rejects verification when the previous key is not trusted', async () => {
    const instance = await mint({
      previousPrivateKey: '22'.repeat(32),
      signWithPreviousKey: true,
    })
    const bearer = await makeBearer(instance, secret('a4'), 21_000)

    const result = await ensureExactAmount([bearer], 5_000, {
      onCarve: () => undefined,
      allocateOutputSecrets,
      // only the current key is trusted - the signature under the retired
      // key must not verify
      mintSignatureKeys: () => [instance.state.pubkey],
    })

    expect(result.note.verified).toBe(false)
    // the note and its signature are still tracked, recoverable by refresh
    expect(noteSignature(result.note.url)).not.toBeNull()
    const partK1 = requiredValue(noteK1(result.note.url))
    expect(instance.state.noteState(partK1)).toBe('outstanding')
    expect(instance.state.noteState(secret('a4'))).toBe('burned')
  })

  it('keeps a wrong-key signature staged unverified', async () => {
    const instance = await mint()
    const bearer = await makeBearer(instance, secret('a5'), 21_000)
    const stranger = await mint({privateKey: '33'.repeat(32)})

    const result = await ensureExactAmount([bearer], 5_000, {
      onCarve: () => undefined,
      allocateOutputSecrets,
      // the only trusted key on file belongs to a DIFFERENT mint
      mintSignatureKeys: () => [stranger.state.pubkey],
    })

    expect(result.note.verified).toBe(false)
    expect(noteSignature(result.note.url)).not.toBeNull()
    expect(instance.state.noteState(secret('a5'))).toBe('burned')
    expect(
      instance.state.noteState(requiredValue(noteK1(result.note.url))),
    ).toBe('outstanding')
  })

  it('keeps a landed split unsigned by the mint staged unverified and consumed', async () => {
    const instance = await mint({signatures: false})
    const k1 = secret('a6')
    const bearer = await makeBearer(instance, k1, 21_000)

    const result = await ensureExactAmount([bearer], 5_000, {
      onCarve: () => undefined,
      allocateOutputSecrets,
      mintSignatureKeys: signatureKeysFor(instance),
    })

    // the mutation landed (the kit refused the missing signature, the
    // rescue probe proved the burn): the inputs are retired, the staged
    // outputs are tracked at exactly their staged secrets, unverified
    expect(result.consumed.map((entry) => entry.id)).toEqual([bearer.id])
    expect(result.note.verified).toBe(false)
    expect(noteSignature(result.note.url)).toBeNull()
    expect(instance.state.noteState(k1)).toBe('burned')
    const partK1 = requiredValue(noteK1(result.note.url))
    expect(instance.state.noteState(partK1)).toBe('outstanding')
    expect((await fetchNoteInfo(noteUrl(instance, partK1))).maxWithdrawable).toBe(5_000)
  })

  it('never verifies a landed mutation without any trusted keys on file', async () => {
    const instance = await mint()
    const bearer = await makeBearer(instance, secret('a7'), 21_000)

    const result = await ensureExactAmount([bearer], 5_000, {
      onCarve: () => undefined,
      allocateOutputSecrets,
      // no key source at all: nothing may be trusted blindly
    })

    expect(result.note.verified).toBe(false)
    expect(noteSignature(result.note.url)).not.toBeNull()
    expect(
      instance.state.noteState(requiredValue(noteK1(result.note.url))),
    ).toBe('outstanding')
  })
})