test: signEvent self-verify guard + honest provider surface

sign-event-verify.test.js (7): a correctly-signed event passes and round-trips
through verifySignature; the self-verify guard throws (never returns a bad
signature) when the shared @noble/secp256k1 schnorr.sign singleton is patched
to emit a flipped-byte or wrong-message signature; verifySignature rejects
mutated content/sig/pubkey. Patches and restores the module singleton without
touching src.

provider-surface.test.js (15): window.nostr exposes exactly getPublicKey,
signEvent and nip44.{encrypt,decrypt} and does NOT expose nip04 or getRelays
(truthful feature-detection); signEvent input validation rejects bad shapes
before any wire dispatch; the podkey-request CustomEvent wiring forwards the
right type/fields (nip44 field is "pubkey", not "peer") and propagates a
background error back as a rejection. Runs the page-context IIFE against a
minimal EventTarget-backed window.

Co-Authored-By: jjohare <github@thedreamlab.uk>

Author: jjohare

test/provider-surface.test.js

@@ -0,0 +1,158 @@
+/**
+ * Tests for the NIP-07 provider surface (nostr-provider.js).
+ *
+ * The provider must advertise ONLY what it implements, so that page-side
+ * feature-detection is truthful:
+ *   - exposes getPublicKey, signEvent, nip44.{encrypt,decrypt}
+ *   - does NOT expose nip04 (deprecated, unauthenticated; not shipped)
+ *   - does NOT expose getRelays (Podkey holds no relay list)
+ *
+ * nostr-provider.js is a page-context IIFE that assigns window.nostr, so the
+ * test mounts a minimal window (EventTarget-backed) and imports the module to
+ * run it, then inspects the installed surface and its request wiring.
+ */
+
+import { describe, it, before } from 'node:test';
+import assert from 'node:assert/strict';
+
+let nostr;
+const events = new EventTarget();
+
+before(async () => {
+  global.window = {
+    addEventListener: (...a) => events.addEventListener(...a),
+    removeEventListener: (...a) => events.removeEventListener(...a),
+    dispatchEvent: (e) => events.dispatchEvent(e)
+  };
+  // Running the IIFE installs window.nostr.
+  await import('../src/nostr-provider.js');
+  nostr = global.window.nostr;
+});
+
+describe('provider surface (honest feature-detection)', () => {
+  it('exposes exactly getPublicKey, signEvent and nip44', () => {
+    assert.deepEqual(Object.keys(nostr).sort(), ['getPublicKey', 'nip44', 'signEvent']);
+  });
+
+  it('exposes nip44.encrypt and nip44.decrypt as functions', () => {
+    assert.equal(typeof nostr.nip44.encrypt, 'function');
+    assert.equal(typeof nostr.nip44.decrypt, 'function');
+  });
+
+  it('does NOT expose nip04 (deprecated scheme is not shipped)', () => {
+    assert.equal('nip04' in nostr, false);
+    assert.equal(nostr.nip04, undefined);
+  });
+
+  it('does NOT expose getRelays (no relay list is held)', () => {
+    assert.equal('getRelays' in nostr, false);
+    assert.equal(nostr.getRelays, undefined);
+  });
+
+  it('getPublicKey and signEvent are async functions', () => {
+    assert.equal(typeof nostr.getPublicKey, 'function');
+    assert.equal(typeof nostr.signEvent, 'function');
+  });
+});
+
+describe('signEvent input validation (before any signing)', () => {
+  // These reject synchronously inside the provider, never reaching the wire,
+  // so no response listener is needed.
+  it('rejects a non-object event', async () => {
+    await assert.rejects(() => nostr.signEvent(null), /Event must be an object/);
+    await assert.rejects(() => nostr.signEvent('nope'), /Event must be an object/);
+  });
+
+  it('rejects a missing/typed kind', async () => {
+    await assert.rejects(() => nostr.signEvent({ created_at: 1, tags: [], content: '' }), /kind must be a number/);
+  });
+
+  it('rejects a missing created_at', async () => {
+    await assert.rejects(() => nostr.signEvent({ kind: 1, tags: [], content: '' }), /created_at must be a number/);
+  });
+
+  it('rejects non-array tags', async () => {
+    await assert.rejects(() => nostr.signEvent({ kind: 1, created_at: 1, tags: 'x', content: '' }), /tags must be an array/);
+  });
+
+  it('rejects non-string content', async () => {
+    await assert.rejects(() => nostr.signEvent({ kind: 1, created_at: 1, tags: [], content: 5 }), /content must be a string/);
+  });
+});
+
+describe('provider request wiring (podkey-request CustomEvent)', () => {
+  /**
+   * Capture the next podkey-request the provider emits, reply to it with the
+   * matching id, and return the request detail for assertions.
+   */
+  function captureRequest (reply) {
+    return new Promise((resolve) => {
+      const handler = (e) => {
+        global.window.removeEventListener('podkey-request', handler);
+        const detail = e.detail;
+        // Respond on the next tick so the provider's listener is registered.
+        queueMicrotask(() => {
+          global.window.dispatchEvent(new CustomEvent('podkey-response', {
+            detail: { id: detail.id, result: reply(detail) }
+          }));
+        });
+        resolve(detail);
+      };
+      global.window.addEventListener('podkey-request', handler);
+    });
+  }
+
+  it('getPublicKey dispatches a GET_PUBLIC_KEY request and resolves the response', async () => {
+    const reqP = captureRequest(() => 'deadbeef'.repeat(8));
+    const resP = nostr.getPublicKey();
+    const req = await reqP;
+    assert.equal(req.type, 'GET_PUBLIC_KEY');
+    assert.ok(req.id, 'request must carry a correlation id');
+    assert.equal(await resP, 'deadbeef'.repeat(8));
+  });
+
+  it('signEvent forwards the validated event under SIGN_EVENT', async () => {
+    const event = { kind: 1, created_at: 1700000000, tags: [['t', 'x']], content: 'gm' };
+    const reqP = captureRequest((d) => ({ ...d.event, id: 'a'.repeat(64), pubkey: 'b'.repeat(64), sig: 'c'.repeat(128) }));
+    const resP = nostr.signEvent(event);
+    const req = await reqP;
+    assert.equal(req.type, 'SIGN_EVENT');
+    assert.deepEqual(req.event, event);
+    const signed = await resP;
+    assert.equal(signed.sig.length, 128);
+  });
+
+  it('nip44.encrypt dispatches NIP44_ENCRYPT with pubkey + plaintext (field is "pubkey")', async () => {
+    const reqP = captureRequest(() => 'BASE64PAYLOAD');
+    const resP = nostr.nip44.encrypt('f'.repeat(64), 'secret');
+    const req = await reqP;
+    assert.equal(req.type, 'NIP44_ENCRYPT');
+    assert.equal(req.pubkey, 'f'.repeat(64));
+    assert.equal(req.plaintext, 'secret');
+    assert.equal('peer' in req, false, 'the reconciled field name is "pubkey", not "peer"');
+    assert.equal(await resP, 'BASE64PAYLOAD');
+  });
+
+  it('nip44.decrypt dispatches NIP44_DECRYPT with pubkey + ciphertext', async () => {
+    const reqP = captureRequest(() => 'plaintext-out');
+    const resP = nostr.nip44.decrypt('f'.repeat(64), 'BASE64PAYLOAD');
+    const req = await reqP;
+    assert.equal(req.type, 'NIP44_DECRYPT');
+    assert.equal(req.pubkey, 'f'.repeat(64));
+    assert.equal(req.ciphertext, 'BASE64PAYLOAD');
+    assert.equal(await resP, 'plaintext-out');
+  });
+
+  it('propagates a background error back to the caller as a rejection', async () => {
+    const handler = (e) => {
+      global.window.removeEventListener('podkey-request', handler);
+      queueMicrotask(() => {
+        global.window.dispatchEvent(new CustomEvent('podkey-response', {
+          detail: { id: e.detail.id, error: 'User denied permission' }
+        }));
+      });
+    };
+    global.window.addEventListener('podkey-request', handler);
+    await assert.rejects(() => nostr.getPublicKey(), /User denied permission/);
+  });
+});

test/sign-event-verify.test.js

@@ -0,0 +1,103 @@
+/**
+ * Tests for the schnorr self-verification guard in signEvent (crypto.js).
+ *
+ * A key-holder must never emit a signature it cannot itself verify: a faulty
+ * signing path (bad RNG, a library regression) producing a structurally-valid
+ * but cryptographically-wrong signature has to throw, not return a bad token.
+ *
+ * The positive path is tested directly. The throw path is forced by patching
+ * the shared @noble/secp256k1 schnorr.sign singleton (the same module instance
+ * crypto.js imports) so it returns a corrupted signature — without touching src.
+ */
+
+import { describe, it, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { schnorr } from '@noble/secp256k1';
+import { generateKeypair, signEvent, verifySignature, getEventHash } from '../src/crypto.js';
+
+const baseEvent = () => ({ kind: 1, created_at: 1700000000, tags: [], content: 'self-verify' });
+
+describe('signEvent self-verification', () => {
+  const realSign = schnorr.sign;
+  afterEach(() => { schnorr.sign = realSign; }); // always restore the singleton
+
+  it('a correctly-signed event passes and round-trips through verifySignature', async () => {
+    const kp = await generateKeypair();
+    const signed = await signEvent(baseEvent(), kp.privateKey);
+
+    assert.equal(signed.sig.length, 128);
+    assert.equal(signed.pubkey, kp.publicKey);
+    assert.equal(signed.id, getEventHash(signed), 'id must be the NIP-01 event hash');
+    assert.equal(await verifySignature(signed), true);
+  });
+
+  it('throws when signing yields a signature that does not verify (flipped byte)', async () => {
+    const kp = await generateKeypair();
+    // Emit a 64-byte signature that is structurally valid but wrong: passes the
+    // length check, fails schnorr.verify. The guard must catch it.
+    schnorr.sign = (msg, sk) => {
+      const sig = realSign(msg, sk);
+      sig[0] ^= 0xff;
+      return sig;
+    };
+    await assert.rejects(
+      () => signEvent(baseEvent(), kp.privateKey),
+      /Signature self-verification failed/
+    );
+  });
+
+  it('throws when the signature is over the wrong message id', async () => {
+    const kp = await generateKeypair();
+    // Produce a real schnorr signature, but over a different 32-byte message
+    // than the event id. It is a valid signature for *something* — just not for
+    // this event — so length passes and self-verify against the true id fails.
+    const wrongMsg = new Uint8Array(32).fill(7);
+    schnorr.sign = (_msg, sk) => realSign(wrongMsg, sk);
+    await assert.rejects(
+      () => signEvent(baseEvent(), kp.privateKey),
+      /Signature self-verification failed/
+    );
+  });
+
+  it('does NOT leak the bad signature when it throws', async () => {
+    const kp = await generateKeypair();
+    let emitted;
+    schnorr.sign = (msg, sk) => {
+      const sig = realSign(msg, sk);
+      sig[10] ^= 0x01;
+      emitted = sig;
+      return sig;
+    };
+    await assert.rejects(() => signEvent(baseEvent(), kp.privateKey));
+    assert.ok(emitted, 'the patched signer ran');
+    // The point of the guard: a bad signature is produced internally but never
+    // returned to a caller. (The rejection above already proves no value is
+    // returned; this asserts the failure happened *after* signing, at verify.)
+  });
+});
+
+describe('verifySignature (guard primitive) rejects mutations', () => {
+  it('rejects a mutated content (id no longer matches)', async () => {
+    const kp = await generateKeypair();
+    const signed = await signEvent(baseEvent(), kp.privateKey);
+    const tampered = { ...signed, content: 'tampered' };
+    // The signature is over the original id; verifying against the original id
+    // still passes, but a consumer recomputing the id would reject it.
+    assert.notEqual(getEventHash(tampered), signed.id, 'mutated content changes the id');
+    assert.equal(await verifySignature({ ...tampered, id: getEventHash(tampered) }), false);
+  });
+
+  it('rejects a flipped signature byte', async () => {
+    const kp = await generateKeypair();
+    const signed = await signEvent(baseEvent(), kp.privateKey);
+    const badSig = (parseInt(signed.sig[0], 16) ^ 0x8).toString(16) + signed.sig.slice(1);
+    assert.equal(await verifySignature({ ...signed, sig: badSig }), false);
+  });
+
+  it('rejects a signature verified against a different pubkey', async () => {
+    const kp = await generateKeypair();
+    const other = await generateKeypair();
+    const signed = await signEvent(baseEvent(), kp.privateKey);
+    assert.equal(await verifySignature({ ...signed, pubkey: other.publicKey }), false);
+  });
+});