sattle/src/lnurlcash/keys.material-storage.cases.ts

import { sha256 } from '@noble/hashes/sha2.js';
import { bytesToHex, utf8ToBytes } from '@noble/hashes/utils.js';
import { describe, expect, it } from 'vitest';

import {
  decryptSavedWalletMaterial,
  deriveWalletMaterial,
  encryptSecretParts,
  ensureSavedWalletMaterialOwner,
  getPlainWalletMaterial,
  isValidStoredWalletMaterial,
  linkingPubKeyHex,
  restoreWalletMaterialStored,
  savedWalletMaterialExists,
  savedWalletMaterialIsEncrypted,
  savedWalletMaterialOwnerId,
  saveWalletMaterial,
  serializeWalletMaterial,
  walletMaterialLinkingKey,
} from './keys';
import { parseJsonObject, stubLocalStorage } from './test-utils';

const FIXED_MNEMONIC =
  'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about';
const PASSWORD = 'correct horse battery staple';
const MATERIAL_STORAGE_KEY = 'sattle_wallet_material_v2';
const LEGACY_STORAGE_KEY = 'sattle_linking_key';
const LINKING_KEY_HEX = 'da2a752d3d28668288ff50bed644e4a95f726d8711fd8754060f0a9e378f84aa';
const CASH_ROOT_HEX =
  'c7a2496e9b453a67c5d2a1f04936ec1259440d45454c795a99a66269e4cd3005111e1cc966fca2fe32f054f14caceab90449e536d94cf6935ea12a087e414f60';

const materialHash = (serialized: string): string => bytesToHex(sha256(utf8ToBytes(serialized)));

const readRawMaterialRecord = (): Record<string, unknown> => {
  const raw = localStorage.getItem(MATERIAL_STORAGE_KEY);
  if (raw === null) throw new Error('expected a saved wallet-material record');
  return parseJsonObject(raw);
};

describe('WalletMaterialV2 persistence', () => {
  it('round-trips canonical plaintext material in the new namespace', async () => {
    // Given complete wallet material and an unrelated legacy record
    stubLocalStorage();
    localStorage.setItem(
      LEGACY_STORAGE_KEY,
      JSON.stringify({ enc: false, value: '07'.repeat(32) }),
    );
    const material = deriveWalletMaterial(FIXED_MNEMONIC);

    // When the material is saved without a password
    await saveWalletMaterial(material);

    // Then only the new namespace carries the exact complete material
    expect(savedWalletMaterialExists()).toBe(true);
    expect(savedWalletMaterialIsEncrypted()).toBe(false);
    expect(getPlainWalletMaterial()).toEqual(material);
    expect(readRawMaterialRecord()).toEqual({
      enc: false,
      value: serializeWalletMaterial(material),
      materialHash: materialHash(serializeWalletMaterial(material)),
      ownerId: linkingPubKeyHex(walletMaterialLinkingKey(material)),
      version: 2,
    });
    expect(localStorage.getItem(LEGACY_STORAGE_KEY)).not.toBeNull();
    expect(localStorage.getItem(MATERIAL_STORAGE_KEY)).not.toContain(FIXED_MNEMONIC);
    expect(localStorage.getItem(MATERIAL_STORAGE_KEY)).not.toContain('"seed"');
  });

  it('round-trips canonical password-encrypted material without plaintext fields', async () => {
    // Given complete wallet material
    stubLocalStorage();
    const material = deriveWalletMaterial(FIXED_MNEMONIC);

    // When the material is password protected
    await saveWalletMaterial(material, PASSWORD);

    // Then only authenticated decryption returns both parts
    expect(savedWalletMaterialIsEncrypted()).toBe(true);
    expect(getPlainWalletMaterial()).toBeNull();
    expect(await decryptSavedWalletMaterial(PASSWORD)).toEqual(material);
    await expect(decryptSavedWalletMaterial('wrong password')).rejects.toThrow();
    const raw = JSON.stringify(readRawMaterialRecord());
    expect(raw).not.toContain(LINKING_KEY_HEX);
    expect(raw).not.toContain(CASH_ROOT_HEX);
    expect(raw).not.toContain(FIXED_MNEMONIC);
  });

  it('strips restored owner claims until the material proves its real owner', () => {
    // Given plaintext material carrying a foreign owner claim
    stubLocalStorage();
    const material = deriveWalletMaterial(FIXED_MNEMONIC);
    const foreignOwner = linkingPubKeyHex(new Uint8Array(32).fill(9));

    // When the record is restored and subsequently proven by plaintext unlock
    restoreWalletMaterialStored({
      enc: false,
      value: serializeWalletMaterial(material),
      materialHash: materialHash(serializeWalletMaterial(material)),
      ownerId: foreignOwner,
      version: 2,
    });
    const beforeProof = readRawMaterialRecord();
    const unlocked = getPlainWalletMaterial();
    if (unlocked === null) throw new Error('expected restored plaintext material');
    ensureSavedWalletMaterialOwner(unlocked);

    // Then the claim was absent before proof and only the derived owner was stamped
    expect(beforeProof).toEqual({
      enc: false,
      value: serializeWalletMaterial(material),
      materialHash: materialHash(serializeWalletMaterial(material)),
    });
    expect(savedWalletMaterialOwnerId()).toBe(linkingPubKeyHex(walletMaterialLinkingKey(material)));
  });

  it('rejects a plaintext owner mismatch without returning or stamping material', () => {
    // Given canonical material stamped with a foreign current owner
    stubLocalStorage();
    const material = deriveWalletMaterial(FIXED_MNEMONIC);
    localStorage.setItem(
      MATERIAL_STORAGE_KEY,
      JSON.stringify({
        enc: false,
        value: serializeWalletMaterial(material),
        materialHash: materialHash(serializeWalletMaterial(material)),
        ownerId: linkingPubKeyHex(new Uint8Array(32).fill(9)),
        version: 2,
      }),
    );
    const before = localStorage.getItem(MATERIAL_STORAGE_KEY);

    // When it is read or offered for proof
    const unlocked = getPlainWalletMaterial();
    const stamp = () => ensureSavedWalletMaterialOwner(material);

    // Then neither operation trusts or rewrites the foreign record
    expect(unlocked).toBeNull();
    expect(stamp).toThrow('different wallet');
    expect(localStorage.getItem(MATERIAL_STORAGE_KEY)).toBe(before);
  });

  it('rejects an encrypted owner mismatch after authentication', async () => {
    // Given valid encrypted material whose owner marker was replaced
    stubLocalStorage();
    const material = deriveWalletMaterial(FIXED_MNEMONIC);
    await saveWalletMaterial(material, PASSWORD);
    const foreign = {
      ...readRawMaterialRecord(),
      ownerId: linkingPubKeyHex(new Uint8Array(32).fill(9)),
    };
    localStorage.setItem(MATERIAL_STORAGE_KEY, JSON.stringify(foreign));
    const before = localStorage.getItem(MATERIAL_STORAGE_KEY);

    // When the authenticated material contradicts the current owner marker
    const unlock = decryptSavedWalletMaterial(PASSWORD);

    // Then no material is returned or marker changed
    await expect(unlock).rejects.toThrow('different wallet');
    expect(localStorage.getItem(MATERIAL_STORAGE_KEY)).toBe(before);
  });

  it.each([
    ['legacy key-only plaintext', LINKING_KEY_HEX, 2],
    ['wrong outer version', serializeWalletMaterial(deriveWalletMaterial(FIXED_MNEMONIC)), 1],
    [
      'malformed material plaintext',
      JSON.stringify({ version: 2, linkingKeyHex: LINKING_KEY_HEX, cashRootHex: '00' }),
      2,
    ],
  ])('rejects %s records at the storage boundary', (_name, value, version) => {
    // Given an invalid record under the v2 material namespace
    stubLocalStorage();
    const material = deriveWalletMaterial(FIXED_MNEMONIC);
    const record = {
      enc: false,
      value,
      materialHash: materialHash(value),
      ownerId: linkingPubKeyHex(walletMaterialLinkingKey(material)),
      version,
    };
    localStorage.setItem(MATERIAL_STORAGE_KEY, JSON.stringify(record));

    // When storage helpers parse it
    // Then the record is unusable as wallet material
    expect(isValidStoredWalletMaterial(record)).toBe(false);
    expect(savedWalletMaterialExists()).toBe(false);
    expect(getPlainWalletMaterial()).toBeNull();
  });

  it('rejects authenticated ciphertext containing malformed material', async () => {
    // Given valid AES-GCM parts whose plaintext is not a v2 material envelope
    stubLocalStorage();
    const parts = await encryptSecretParts(LINKING_KEY_HEX, PASSWORD);
    const material = deriveWalletMaterial(FIXED_MNEMONIC);
    localStorage.setItem(
      MATERIAL_STORAGE_KEY,
      JSON.stringify({
        enc: true,
        ...parts,
        materialHash: materialHash(LINKING_KEY_HEX),
        ownerId: linkingPubKeyHex(walletMaterialLinkingKey(material)),
        version: 2,
      }),
    );

    // When the password successfully authenticates the malformed plaintext
    const unlock = decryptSavedWalletMaterial(PASSWORD);

    // Then it still fails closed as invalid material
    await expect(unlock).rejects.toThrow('valid v2 wallet material');
  });
});