Merge pull request #6 from stakwork/signer

Signer

api/grpc/index.ts

@@ -3,11 +3,33 @@ import * as socket from '../utils/socket'
 import { sendNotification, sendInvoice } from '../hub'
 import * as jsonUtils from '../utils/json'
 import * as decodeUtils from '../utils/decode'
-import {loadLightning, SPHINX_CUSTOM_RECORD_KEY} from '../utils/lightning'
+import {loadLightning, SPHINX_CUSTOM_RECORD_KEY, verifyAscii} from '../utils/lightning'
 
 const constants = require(__dirname + '/../../config/constants.json');
 
-function parseKeysendInvoice(i, actions){
+// VERIFY PUBKEY OF SENDER
+async function parseAndVerifyPayload(data){
+	let payload
+	const li = data.lastIndexOf('}')
+	const msg = data.substring(0,li+1)
+	const sig = data.substring(li+1)
+	try {
+		payload = JSON.parse(msg)
+		if(payload) {
+			if(!sig) return payload // REMOVE THIS LINE (here for backward compat)
+			const v = await verifyAscii(msg, sig)
+			if(v && v.valid && v.pubkey) {
+				payload.sender = payload.sender||{}
+				payload.sender.pub_key=v.pubkey
+				return payload
+			}
+		}
+	} catch(e) {
+		return null
+	}
+}
+
+async function parseKeysendInvoice(i, actions){
 	const recs = i.htlcs && i.htlcs[0] && i.htlcs[0].custom_records
 	const buf = recs && recs[SPHINX_CUSTOM_RECORD_KEY]
 	const data = buf && buf.toString()
@@ -17,16 +39,16 @@ function parseKeysendInvoice(i, actions){
 	let payload
 	if(data[0]==='{'){
 		try {
-			payload = JSON.parse(data)
+			payload = await parseAndVerifyPayload(data)
 		} catch(e){}
 	} else {
 		const threads = weave(data)
-		if(threads) payload = JSON.parse(threads)
+		if(threads) payload = await parseAndVerifyPayload(threads)
 	}
 	if(payload){
 		const dat = payload.content || payload
 		if(value && dat && dat.message){
-			dat.message.amount = value
+			dat.message.amount = value // ADD IN TRUE VALUE
 		}
 		if(actions[payload.type]) {
 			actions[payload.type](payload)

api/utils/lightning.ts

@@ -133,12 +133,16 @@ const keysend = (opts) => {
   })
 }
 
-const MAX_MSG_LENGTH = 972 // 1146 - 20
+const MAX_MSG_LENGTH = 868 // 1146 - 20 ??? - 104 for sig
 async function keysendMessage(opts) {
   return new Promise(async function(resolve, reject) {
     if(!opts.data || typeof opts.data!=='string') {
       return reject('string plz')
     }
+    // SIGN HERE and append sig
+    // const sig = await signAscii(opts.data)
+    // opts.data = opts.data + sig
+
     if(opts.data.length<MAX_MSG_LENGTH){
       try {
         const res = await keysend(opts)
@@ -191,6 +195,15 @@ async function signAscii(ascii) {
   }
 }
 
+async function verifyAscii(ascii,sig): Promise<{[k:string]:any}>{
+  try {
+    const r = await verifyMessage(ascii_to_hexa(ascii),sig)
+    return r
+  } catch(e) {
+    throw e
+  }
+}
+
 function listInvoices() {  
   return new Promise(async(resolve, reject)=> {
     const lightning = await loadLightning()
@@ -256,7 +269,7 @@ const signBuffer = (msg) => {
   })
 }
 
-const verifyMessage = (msg,sig) => {
+function verifyMessage(msg,sig): Promise<{[k:string]:any}> {
   return new Promise(async(resolve, reject)=> {
     let lightning = await loadLightning()
     try {
@@ -311,6 +324,7 @@ export {
   keysendMessage,
   signMessage,
   verifyMessage,
+  verifyAscii,
   signAscii,
   signBuffer,
   LND_KEYSEND_KEY,

dist/api/grpc/index.js

@@ -16,7 +16,33 @@ const jsonUtils = require("../utils/json");
 const decodeUtils = require("../utils/decode");
 const lightning_1 = require("../utils/lightning");
 const constants = require(__dirname + '/../../config/constants.json');
+// VERIFY PUBKEY OF SENDER
+function parseAndVerifyPayload(data) {
+    return __awaiter(this, void 0, void 0, function* () {
+        let payload;
+        const li = data.lastIndexOf('}');
+        const msg = data.substring(0, li + 1);
+        const sig = data.substring(li + 1);
+        try {
+            payload = JSON.parse(msg);
+            if (payload) {
+                if (!sig)
+                    return payload; // REMOVE THIS LINE (here for backward compat)
+                const v = yield lightning_1.verifyAscii(msg, sig);
+                if (v && v.valid && v.pubkey) {
+                    payload.sender = payload.sender || {};
+                    payload.sender.pub_key = v.pubkey;
+                    return payload;
+                }
+            }
+        }
+        catch (e) {
+            return null;
+        }
+    });
+}
 function parseKeysendInvoice(i, actions) {
+    return __awaiter(this, void 0, void 0, function* () {
         const recs = i.htlcs && i.htlcs[0] && i.htlcs[0].custom_records;
         const buf = recs && recs[lightning_1.SPHINX_CUSTOM_RECORD_KEY];
         const data = buf && buf.toString();
@@ -26,19 +52,19 @@ function parseKeysendInvoice(i, actions) {
         let payload;
         if (data[0] === '{') {
             try {
-            payload = JSON.parse(data);
+                payload = yield parseAndVerifyPayload(data);
             }
             catch (e) { }
         }
         else {
             const threads = weave(data);
             if (threads)
-            payload = JSON.parse(threads);
+                payload = yield parseAndVerifyPayload(threads);
         }
         if (payload) {
             const dat = payload.content || payload;
             if (value && dat && dat.message) {
-            dat.message.amount = value;
+                dat.message.amount = value; // ADD IN TRUE VALUE
             }
             if (actions[payload.type]) {
                 actions[payload.type](payload);
@@ -47,6 +73,7 @@ function parseKeysendInvoice(i, actions) {
                 console.log('Incorrect payload type:', payload.type);
             }
         }
+    });
 }
 const chunks = {};
 function weave(p) {

dist/api/utils/lightning.js

@@ -145,7 +145,7 @@ const keysend = (opts) => {
         });
     });
 };
-const MAX_MSG_LENGTH = 972; // 1146 - 20
+const MAX_MSG_LENGTH = 868; // 1146 - 20 ??? - 104 for sig
 function keysendMessage(opts) {
     return __awaiter(this, void 0, void 0, function* () {
         return new Promise(function (resolve, reject) {
@@ -153,6 +153,9 @@ function keysendMessage(opts) {
                 if (!opts.data || typeof opts.data !== 'string') {
                     return reject('string plz');
                 }
+                // SIGN HERE and append sig
+                // const sig = await signAscii(opts.data)
+                // opts.data = opts.data + sig
                 if (opts.data.length < MAX_MSG_LENGTH) {
                     try {
                         const res = yield keysend(opts);
@@ -212,6 +215,18 @@ function signAscii(ascii) {
     });
 }
 exports.signAscii = signAscii;
+function verifyAscii(ascii, sig) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            const r = yield verifyMessage(ascii_to_hexa(ascii), sig);
+            return r;
+        }
+        catch (e) {
+            throw e;
+        }
+    });
+}
+exports.verifyAscii = verifyAscii;
 function listInvoices() {
     return new Promise((resolve, reject) => __awaiter(this, void 0, void 0, function* () {
         const lightning = yield loadLightning();
@@ -283,8 +298,8 @@ const signBuffer = (msg) => {
     }));
 };
 exports.signBuffer = signBuffer;
-const verifyMessage = (msg, sig) => {
-    return new Promise((resolve, reject) => __awaiter(void 0, void 0, void 0, function* () {
+function verifyMessage(msg, sig) {
+    return new Promise((resolve, reject) => __awaiter(this, void 0, void 0, function* () {
         let lightning = yield loadLightning();
         try {
             const options = {
@@ -305,7 +320,7 @@ const verifyMessage = (msg, sig) => {
             reject(e);
         }
     }));
-};
+}
 exports.verifyMessage = verifyMessage;
 function checkConnection() {
     return __awaiter(this, void 0, void 0, function* () {