1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
|
// A site's login lnurl (LNURL-auth) pasted into Send is a login, not a
// payment: the wallet asks first, naming the site, then signs the challenge
// and tells the site; the site's refusal is shown as its own words. Against
// a stand-in login server that checks the signature the way a real one does.
// Run: bun tools/lnurl-auth-test.js
import puppeteer from './puppeteer.js';
import { generateMnemonic } from '@scure/bip39';
import { wordlist } from '@scure/bip39/wordlists/english';
import { secp256k1 } from '@noble/curves/secp256k1';
import { hexToBytes } from '@noble/hashes/utils';
import { encodeLnurl } from '../src/lnurl.js';
import { buildHtml } from '../build.js';
const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
let ok = true;
const check = (n, c, d = '') => { console.log(` ${c ? '✓' : '✗'} ${n}${d ? ' — ' + d : ''}`); if (!c) ok = false; };
const html = await buildHtml({ minify: true, pwa: false });
const logins = []; // what the stand-in site was told
const server = Bun.serve({ port: 0, fetch: (req) => {
const u = new URL(req.url), p = u.pathname;
if (p === '/lnauth') {
const sig = u.searchParams.get('sig'), key = u.searchParams.get('key'), k1 = u.searchParams.get('k1');
if (!sig) return Response.json({ status: 'ERROR', reason: 'no sig query variable provided' });
let good = false;
try { good = secp256k1.verify(secp256k1.Signature.fromDER(sig), hexToBytes(k1), hexToBytes(key)); } catch {}
logins.push({ k1, key, good });
return Response.json(good ? { status: 'OK' } : { status: 'ERROR', reason: 'bad signature' });
}
if (p === '/lnauth-closed') return Response.json({ status: 'ERROR', reason: 'registrations are closed' });
if (p.startsWith('/punks') || p === '/verify-worker.js' || p.startsWith('/locales') || /\.js$/.test(p)) { const f = Bun.file('dist' + p); return f.size ? new Response(f) : new Response('', { status: 404 }); }
return new Response(html, { headers: { 'content-type': 'text/html' } });
} });
const k1 = 'c0ffee'.repeat(10) + 'abcd';
const loginLnurl = encodeLnurl(server.url.origin + '/lnauth?tag=login&k1=' + k1 + '&action=login');
const closedLnurl = encodeLnurl(server.url.origin + '/lnauth-closed?tag=login&k1=' + k1 + '&action=register');
const browser = await puppeteer.launch({ executablePath: process.env.CHROME || '/usr/bin/google-chrome', headless: 'new', args: ['--no-sandbox'] });
const ctx = browser.defaultBrowserContext();
await ctx.overridePermissions(server.url.origin, ['clipboard-read', 'clipboard-write', 'clipboard-sanitized-write']);
const page = await browser.newPage();
const errs = []; page.on('pageerror', (e) => errs.push(String(e)));
const click = (t) => page.evaluate((x) => { const e = [...document.querySelectorAll('button')].find((n) => n.textContent.trim().toLowerCase() === x || n.textContent.trim().toLowerCase().includes(x)); if (e) { e.click(); return true; } return false; }, t);
const text = () => page.evaluate(() => document.body.innerText);
const waitText = async (x, ms = 8000) => { for (let i = 0; i < ms / 200; i++) { if ((await text()).includes(x)) return true; await sleep(200); } return false; };
const freshSend = async () => {
await page.evaluate(() => [...document.querySelectorAll('button')].find((b) => b.textContent.trim() === 'Receive')?.click()); await sleep(300);
await page.evaluate(() => [...document.querySelectorAll('button')].find((b) => b.textContent.trim() === 'Send')?.click());
await page.waitForSelector('textarea.send-dest', { timeout: 10000 });
await page.$eval('textarea.send-dest', (e) => { e.value = ''; e.dispatchEvent(new Event('input', { bubbles: true })); }); await sleep(300);
await page.focus('textarea.send-dest');
};
const paste = async (s) => { await page.evaluate((v) => navigator.clipboard.writeText(v), s); await page.keyboard.down('Control'); await page.keyboard.press('KeyV'); await page.keyboard.up('Control'); };
try {
await page.setViewport({ width: 390, height: 844 });
await page.goto(server.url.origin, { waitUntil: 'domcontentloaded' });
await sleep(400);
await click('create a new wallet'); await sleep(500); await click('to import'); await sleep(400);
await page.waitForSelector('textarea'); await page.type('textarea', generateMnemonic(wordlist)); await click('open wallet');
for (let i = 0; i < 80 && !(await page.evaluate(() => [...document.querySelectorAll('button')].some((b) => b.textContent.trim() === 'Send'))); i++) {
await page.evaluate(() => [...document.querySelectorAll('button')].find((b) => /^(not now|skip|continue|later)$/i.test(b.textContent.trim()))?.click());
await sleep(400);
}
await sleep(3000);
const host = new URL(server.url.origin).hostname;
console.log('[a login lnurl pasted into Send]');
await freshSend();
await paste(loginLnurl);
check('the wallet asks first, naming the site', await waitText('Log in with Lightning') && (await text()).includes(host + ' is asking you to log in'), (await text()).slice(0, 200));
check('…says what it is about to do, and that nothing is paid', /key it keeps for this site alone/.test(await text()) && /No payment is made/.test(await text()));
check('…no amount field, no payment flow', !(await page.$('input[type=number]')));
check('nothing was sent to the site before the user agreed', logins.length === 0);
await click('log in');
check('the site accepts the signed challenge', await waitText('Logged in to ' + host, 8000), (await text()).slice(0, 300));
check('…it was told once, with a signature that verifies under the key', logins.length === 1 && logins[0].good && logins[0].k1 === k1, JSON.stringify(logins));
const key1 = logins[0].key;
await click('done');
check('Done returns to a blank Send form', await page.waitForSelector('textarea.send-dest', { timeout: 5000 }).then(() => true, () => false) && (await page.$eval('textarea.send-dest', (e) => e.value)) === '');
console.log('[the same site again: the same key]');
await freshSend();
await paste(loginLnurl);
await waitText('Log in with Lightning'); await click('log in');
await waitText('Logged in to ' + host, 8000);
check('the wallet is the same user on the site next time', logins.length === 2 && logins[1].key === key1, JSON.stringify(logins.map((l) => l.key.slice(0, 12))));
await click('done');
console.log('[a site that says no]');
await freshSend();
await paste(closedLnurl);
check('a register link asks to create an account', await waitText('asking you to create an account'));
await click('create account');
check("the site's reason is shown", await waitText('registrations are closed', 8000), (await text()).slice(0, 300));
check('…with a way to try again, and back', (await text()).includes('Try again') && (await text()).includes('Back'));
await click('back');
check('Back leaves the login', await page.waitForSelector('textarea.send-dest', { timeout: 5000 }).then(() => true, () => false));
check('no page errors', errs.length === 0, errs.join('; ').slice(0, 300));
} catch (e) {
check('run completed', false, e.stack);
} finally {
await browser.close(); server.stop(true);
}
console.log(ok ? '\n✅ a login lnurl logs in' : '\n❌ failures above');
process.exit(ok ? 0 : 1);
|
