laantungir/n_signer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 40 Wiki Activity

v0.0.57 - Migrated to unified nostr_ prefixed verb names; removed legacy verb aliases (sign_data, ssh_sign, verify_signature, kem_encapsulate, kem_decapsulate, otp_encrypt, otp_decrypt); split get_public_key into algorithm-based get_public_key and role-based nostr_get_public_key; OTP now selected via algorithm:otp instead of curve:otp; consolidated API docs from api.md into README.md

Browse Source
This commit is contained in:
Laan Tungir
2026-07-20 17:29:45 -04:00
parent 96ab9741ef
commit b3421c3e40
51 changed files with 1105 additions and 2282 deletions
Download Patch File Download Diff File Expand all files Collapse all files

51
tests/test_enforcement.c
View File

@@ -220,19 +220,20 @@ const char *selector_strerror(int err);
/* Known verbs */
#define VERB_SIGN_EVENT "sign_event"
#define VERB_GET_PUBLIC_KEY "get_public_key"
#define VERB_NIP44_ENCRYPT "nip44_encrypt"
#define VERB_NIP44_DECRYPT "nip44_decrypt"
#define VERB_NIP04_ENCRYPT "nip04_encrypt"
#define VERB_NIP04_DECRYPT "nip04_decrypt"
#define VERB_GET_PUBLIC_KEY "get_public_key"
#define VERB_NOSTR_GET_PUBLIC_KEY "nostr_get_public_key"
#define VERB_NOSTR_SIGN_EVENT "nostr_sign_event"
#define VERB_NOSTR_NIP44_ENCRYPT "nostr_nip44_encrypt"
#define VERB_NOSTR_NIP44_DECRYPT "nostr_nip44_decrypt"
#define VERB_NOSTR_NIP04_ENCRYPT "nostr_nip04_encrypt"
#define VERB_NOSTR_NIP04_DECRYPT "nostr_nip04_decrypt"
/*
* Check whether `verb` is allowed to execute against `role`.
* Returns ENFORCE_OK if allowed, or an ENFORCE_ERR_* code.
*
* The enforcement rules are:
* - All nostr verbs (sign_event, get_public_key, nip44_*, nip04_*) require:
* - All nostr verbs (nostr_sign_event, nostr_get_public_key, nostr_nip44_*, nostr_nip04_*) require:
* purpose == PURPOSE_NOSTR and curve == CURVE_SECP256K1
* - Unknown verbs return ENFORCE_ERR_UNKNOWN_VERB (fail-closed).
*/
@@ -739,43 +740,43 @@ int main(void) {
role_entry_t age_x = make_role("age", "x25519");
check_condition(
"sign_event + nostr/secp256k1 -> ENFORCE_OK",
enforce_verb_role(VERB_SIGN_EVENT, &nostr_secp) == ENFORCE_OK
"nostr_sign_event + nostr/secp256k1 -> ENFORCE_OK",
enforce_verb_role(VERB_NOSTR_SIGN_EVENT, &nostr_secp) == ENFORCE_OK
);
check_condition(
"get_public_key + nostr/secp256k1 -> ENFORCE_OK",
enforce_verb_role(VERB_GET_PUBLIC_KEY, &nostr_secp) == ENFORCE_OK
"nostr_get_public_key + nostr/secp256k1 -> ENFORCE_OK",
enforce_verb_role(VERB_NOSTR_GET_PUBLIC_KEY, &nostr_secp) == ENFORCE_OK
);
check_condition(
"nip44_encrypt + nostr/secp256k1 -> ENFORCE_OK",
enforce_verb_role(VERB_NIP44_ENCRYPT, &nostr_secp) == ENFORCE_OK
"nostr_nip44_encrypt + nostr/secp256k1 -> ENFORCE_OK",
enforce_verb_role(VERB_NOSTR_NIP44_ENCRYPT, &nostr_secp) == ENFORCE_OK
);
check_condition(
"nip44_decrypt + nostr/secp256k1 -> ENFORCE_OK",
enforce_verb_role(VERB_NIP44_DECRYPT, &nostr_secp) == ENFORCE_OK
"nostr_nip44_decrypt + nostr/secp256k1 -> ENFORCE_OK",
enforce_verb_role(VERB_NOSTR_NIP44_DECRYPT, &nostr_secp) == ENFORCE_OK
);
check_condition(
"nip04_encrypt + nostr/secp256k1 -> ENFORCE_OK",
enforce_verb_role(VERB_NIP04_ENCRYPT, &nostr_secp) == ENFORCE_OK
"nostr_nip04_encrypt + nostr/secp256k1 -> ENFORCE_OK",
enforce_verb_role(VERB_NOSTR_NIP04_ENCRYPT, &nostr_secp) == ENFORCE_OK
);
check_condition(
"sign_event + bitcoin/secp256k1 -> ENFORCE_ERR_PURPOSE",
enforce_verb_role(VERB_SIGN_EVENT, &bitcoin_secp) == ENFORCE_ERR_PURPOSE
"nostr_sign_event + bitcoin/secp256k1 -> ENFORCE_ERR_PURPOSE",
enforce_verb_role(VERB_NOSTR_SIGN_EVENT, &bitcoin_secp) == ENFORCE_ERR_PURPOSE
);
check_condition(
"sign_event + nostr/ed25519 -> ENFORCE_ERR_CURVE",
enforce_verb_role(VERB_SIGN_EVENT, &nostr_ed) == ENFORCE_ERR_CURVE
"nostr_sign_event + nostr/ed25519 -> ENFORCE_ERR_CURVE",
enforce_verb_role(VERB_NOSTR_SIGN_EVENT, &nostr_ed) == ENFORCE_ERR_CURVE
);
check_condition(
"sign_event + ssh/ed25519 -> ENFORCE_ERR_PURPOSE",
enforce_verb_role(VERB_SIGN_EVENT, &ssh_ed) == ENFORCE_ERR_PURPOSE
"nostr_sign_event + ssh/ed25519 -> ENFORCE_ERR_PURPOSE",
enforce_verb_role(VERB_NOSTR_SIGN_EVENT, &ssh_ed) == ENFORCE_ERR_PURPOSE
);
check_condition(
@@ -784,8 +785,8 @@ int main(void) {
);
check_condition(
"nip44_encrypt + age/x25519 -> ENFORCE_ERR_PURPOSE",
enforce_verb_role(VERB_NIP44_ENCRYPT, &age_x) == ENFORCE_ERR_PURPOSE
"nostr_nip44_encrypt + age/x25519 -> ENFORCE_ERR_PURPOSE",
enforce_verb_role(VERB_NOSTR_NIP44_ENCRYPT, &age_x) == ENFORCE_ERR_PURPOSE
);
printf("%d/10 tests passed\n", g_passes);