diff options
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/ecash.ts | 229 | ||||
| -rw-r--r-- | lib/nwc.ts | 79 |
2 files changed, 148 insertions, 160 deletions
diff --git a/lib/ecash.ts b/lib/ecash.ts index b1d8b7fb..e9e099c3 100644 --- a/lib/ecash.ts +++ b/lib/ecash.ts @@ -1,101 +1,44 @@ import config from "$config"; -import { db, g } from "$lib/db"; -import { lnb } from "$lib/ln"; +import { g } from "$lib/db"; +import { generate } from "$lib/invoices"; import { warn } from "$lib/logging"; import { safeGot } from "$lib/safe-fetch"; -import { fail, wait } from "$lib/utils"; +import { PaymentType } from "$lib/types"; +import { fail, getPayment, sleep, wait } from "$lib/utils"; import { CashuMint, CashuWallet, - MintQuoteState, PaymentRequest, PaymentRequestTransportType, getDecodedToken, - getEncodedToken, } from "@cashu/cashu-ts"; - const { URL } = process.env; const m = new CashuMint(config.mintUrl); -// The mint issues NUT-02 v1 keyset ids (`01…`, 33 bytes). cashu-ts 2.9.0 only -// derives v0 ids, so CashuWallet.getKeys() rejects every keyset with "Couldn't -// verify keyset ID" and receive()/send() can never run — ecash claims have been -// failing since the July keyset cutover. (4.x derives v1 ids, but not the way -// this nutshell build does, so upgrading wouldn't help either.) config.mintUrl -// is our own mint, so skip the derivation check: CashuMint.getKeys() returns -// the keys unverified, and a wallet constructed with them preloaded uses them -// as-is. Re-fetched periodically so a keyset rotation is picked up. -const KEYS_TTL = 10 * 60 * 1000; -let cached: { w: CashuWallet; keysets: any[]; at: number } | undefined; -const wallet = async () => { - if (cached && Date.now() - cached.at < KEYS_TTL) return cached; - const [{ keysets: keys }, { keysets }] = await Promise.all([ - m.getKeys(), - m.getKeySets(), - ]); - const w = new CashuWallet(m, { keys, keysets }); - cached = { w, keysets, at: Date.now() }; - return cached; -}; - -// 2.9.0 writes v1 keyset ids into V4 tokens in their 8-byte short form, and -// refuses to decode a short id unless it's handed the mint's keysets to expand -// it against — so every token we encode (the house pool included) has to be -// decoded through here rather than with a bare getDecodedToken(). -const decode = async (token) => - getDecodedToken(token, (await wallet()).keysets); - -const enc = (proofs) => - getEncodedToken({ - mint: config.mintUrl, - proofs, - }); +// Redeeming ecash is a plain NUT-05 melt: the proofs pay a Lightning invoice +// that belongs to the redeeming user, and the settlement is credited by the +// regular lightning listener like any other incoming payment. The mint's node +// is our own, so the melt is a self-payment on cl — nothing is held in a house +// wallet and no proofs are swapped or stored on our side. -// The house wallet is a single encoded token under the `cash` key. g() JSON- -// parses whatever is stored there, and the key has been found holding a bare -// integer — getDecodedToken(number) then threw "n.startsWith is not a function" -// on every claim. Only trust the value when it decodes; otherwise start from -// no proofs and let the next write replace it. -export const pool = async () => { - const v = await g("cash"); - if (typeof v === "string") { - try { - return (await decode(v)).proofs; - } catch (e: any) { - warn("cash pool token unreadable, treating as empty:", e.message); - } - } else { - warn("cash pool key is not a token, treating as empty:", typeof v); - } - return []; +// cashu-ts 2.9.0 writes v1 keyset ids into V4 tokens in their 8-byte short form +// and refuses to decode a short id unless it's handed the mint's keysets to +// expand it against. config.mintUrl fronts every keyset we've ever issued, so +// its list is enough to decode any token of ours. +const KEYSETS_TTL = 10 * 60 * 1000; +let cached: { keysets: any[]; at: number } | undefined; +const keysets = async () => { + if (cached && Date.now() - cached.at < KEYSETS_TTL) return cached.keysets; + const { keysets } = await m.getKeySets(); + // Never cache an empty list: a token can't be decoded or fee-checked + // against it, and the next call should try the mint again. + if (!keysets?.length) fail("Mint keysets unavailable"); + cached = { keysets, at: Date.now() }; + return keysets; }; -// s() is fire-and-forget; a dropped write here would silently strand the -// proofs we just swapped in, so await the set directly. -const setPool = (proofs) => db.set("cash", JSON.stringify(enc(proofs))); - -// Serialize every read-modify-write of the shared `cash` house-wallet token. The -// mint swap sits between reading the current proofs and writing the merged set, -// so two concurrent claim()/mint() calls would each read the same `current` and -// the later write would clobber the earlier — the earlier call's freshly-swapped -// proofs vanish from the stored token while both users stay credited (an -// insolvency leak). This mutex is in-process; if the server ever runs -// multi-process, move to a redis lock (WATCH/MULTI or SET NX). -let cashLock: Promise<void> = Promise.resolve(); -const withCashLock = async <T>(fn: () => Promise<T>): Promise<T> => { - const prev = cashLock; - let release: () => void = () => {}; - cashLock = new Promise((res) => { - release = res; - }); - await prev; - try { - return await fn(); - } finally { - release(); - } -}; +const decode = async (token) => getDecodedToken(token, await keysets()); // `mint` comes straight out of an attacker-supplied cashu token, and this is // the first thing we do with it — so fetching it with cashu-ts's plain fetch @@ -112,68 +55,112 @@ const ext = async (mint) => { return issuerPk !== ourPk; }; +const sum = (proofs) => proofs.reduce((a, p) => a + p.amount, 0); + +// NUT-02 input fee: ceil of the summed per-proof ppk. +const inputFee = (proofs, ks) => + Math.ceil( + proofs.reduce( + (a, p) => a + (ks.find((k) => k.id === p.id)?.input_fee_ppk || 0), + 0, + ) / 1000, + ); + +// nutshell's Lightning fee reserve: max(lightning_reserve_fee_min = 2 sat, +// lightning_fee_percent = 1%), rounded up to whole sats. The actual routing fee +// of a self-payment is zero, but without NUT-08 change outputs the mint keeps +// the reserve — it's our mint, so nothing leaves the system. +const reserve = (amount) => Math.max(2, Math.ceil(amount / 100)); + export async function get(id) { const token = await g(`cash:${id}`); return token; } -export async function claim(token) { - const { mint } = await decode(token); - +// Melt `token` into a Lightning invoice owned by `user`. With `invoice` (a +// NUT-18 payment-request invoice of type ecash) the Lightning invoice takes +// over that id, so whatever is waiting on it sees the payment land. Returns +// the amount the user receives: the token's value less the mint's input fee +// and Lightning fee reserve. +export async function redeem({ token, user, invoice = undefined, memo = undefined }) { + const { mint, proofs } = await decode(token); + if (!proofs?.length) fail("Token has no proofs"); if (await ext(mint)) fail("Unable to receive from other mints"); - const { w } = await wallet(); - return withCashLock(async () => { - const current = await pool(); - const rcvd = await w.receive(token); - await setPool([...current, ...rcvd]); - return rcvd.reduce((a, b) => a + b.amount, 0); - }); -} + // Cheap pre-check so a spent token fails before an invoice is created for + // it (the melt would reject it anyway, but not before leaving an unpaid + // invoice on the user's account). + const states = await new CashuWallet(m).checkProofsStates(proofs); + if (states.some((p) => p.state !== "UNSPENT")) fail("Token already spent"); -export async function mint(amount) { - const { w } = await wallet(); - return withCashLock(async () => { - const proofs = await pool(); - const { send, keep } = await w.send(amount, proofs); - const rcvd = await w.receive(enc(send)); - await setPool(keep); - return enc(rcvd); + const ks = await keysets(); + const total = sum(proofs); + const fees = inputFee(proofs, ks); + let amount = total - fees - 2; + while (amount > 0 && amount + reserve(amount) + fees > total) amount--; + if (amount < 1) fail("Token is too small to redeem"); + + invoice = await generate({ + invoice: { + ...(invoice ?? {}), + id: invoice?.id, + amount, + // The invoice amount is exactly what the melt can cover: no tip on top, + // and no fiat re-pricing of it. + tip: null, + fiat: undefined, + bolt11: undefined, + bolt12: undefined, + memo: memo ?? invoice?.memo, + type: PaymentType.lightning, + }, + user, }); + + const quote = await m.createMeltQuote({ unit: "sat", request: invoice.text }); + if (quote.amount + quote.fee_reserve + fees > total) + fail("Mint fee reserve exceeds the token's value"); + + let r = await m.melt({ quote: quote.quote, inputs: proofs }); + for (let i = 0; r.state === "PENDING" && i < 60; i++) { + await sleep(1000); + r = await m.checkMeltQuote(quote.quote); + } + if (r.state === "PENDING") + fail("Redemption is still settling; the funds will arrive once it does"); + if (r.state !== "PAID") fail("Redemption failed"); + + // The lightning listener credits the settlement. Give it a moment so the + // caller's payment list already shows it, but the credit doesn't depend on + // this wait. + try { + await wait(() => getPayment(invoice.hash), 50, 200); + } catch { + warn("ecash redeemed but credit not yet visible", user.username, invoice.hash); + } + + return amount; } export async function check(token) { const { mint, proofs } = await decode(token); - const total = proofs.reduce((a, b) => a + b.amount, 0); + const total = sum(proofs); const external = await ext(mint); - const { w } = await wallet(); + // Only ask our own mint about proof states; an external mint URL is never + // contacted with cashu-ts's unpinned fetch. let spent = 0; - for (const [i, p] of (await w.checkProofsStates(proofs)).entries()) { - if (p.state === "SPENT") spent += proofs[i].amount; + if (!external) { + const w = new CashuWallet(m); + for (const [i, p] of (await w.checkProofsStates(proofs)).entries()) { + if (p.state === "SPENT") spent += proofs[i].amount; + } } return { total, spent, mint, external }; } -export async function init(amount = 100000) { - try { - await new Promise((r) => setTimeout(r, 2000)); - const { w } = await wallet(); - const { quote, request } = await w.createMintQuote(amount); - await lnb.pay(request); - - await wait(async () => { - const { state } = await w.checkMintQuote(quote); - return state === MintQuoteState.PAID; - }); - - const proofs = await w.mintProofs(amount, quote); - await setPool(proofs); - } catch (e) {} -} - export function request(uuid, amount, memo) { const target = `${URL}/api/ecash/${uuid}`; @@ -657,9 +657,12 @@ const handle = (method, params, ev, app, user) => if (payee === id) { const invoice = await getInvoice(pr); - const recipient = await g(`user:${invoice.uid}`); + const recipient = await g(`user:${invoice?.uid}`); - if (recipient?.username !== "mint") { + // No coinos invoice record means the bolt11 is on our node but not + // ours to settle internally (a mint quote, say) — pay it over + // Lightning below like any other. + if (invoice) { const { id: pid } = await sendInternal({ amount, invoice, @@ -823,48 +826,46 @@ const handle = (method, params, ev, app, user) => if (invoice) { const recipient = await g(`user:${invoice.uid}`); - if (recipient?.username !== "mint") { - // Internal settlement never builds a bolt12 invoice request, so the - // spec's deliver-or-reject rule for payer_note is met by handing the - // note to the recipient as the payment memo (bolt11 + payer_note was - // already rejected above) - const { id: pid } = await sendInternal({ - amount, - invoice, - memo: payer_note, - recipient, - sender: user, - maxTotal: remaining, - }); + // Internal settlement never builds a bolt12 invoice request, so the + // spec's deliver-or-reject rule for payer_note is met by handing the + // note to the recipient as the payment memo (bolt11 + payer_note was + // already rejected above) + const { id: pid } = await sendInternal({ + amount, + invoice, + memo: payer_note, + recipient, + sender: user, + maxTotal: remaining, + }); - await db.lPush(`${pubkey}:payments`, pid); + await db.lPush(`${pubkey}:payments`, pid); - if (invoice.memo?.includes("9734")) { - const { invoices } = await ln.listinvoices({ invstring: pr }); - const inv = invoices[0]; - if (inv) { - inv.payment_preimage = pid; - inv.paid_at = created_at; - try { - await handleZap(inv, user.pubkey); - } catch (e) { - console.log("zap receipt failed", e); - } + if (invoice.memo?.includes("9734")) { + const { invoices } = await ln.listinvoices({ invstring: pr }); + const inv = invoices[0]; + if (inv) { + inv.payment_preimage = pid; + inv.paid_at = created_at; + try { + await handleZap(inv, user.pubkey); + } catch (e) { + console.log("zap receipt failed", e); } } - - // Internal settlement never touches CLN, so there's no real - // preimage or payer proof to hand back - return result({ - transaction_id: pid, - state: "settled", - instruction_type, - amount: amountMsat, - fees_paid: 0, - created_at, - settled_at: Math.floor(Date.now() / 1000), - }); } + + // Internal settlement never touches CLN, so there's no real + // preimage or payer proof to hand back + return result({ + transaction_id: pid, + state: "settled", + instruction_type, + amount: amountMsat, + fees_paid: 0, + created_at, + settled_at: Math.floor(Date.now() / 1000), + }); } try { |