git_remote_htree/nostr_client/
identity.rs

1use anyhow::{Context, Result};
2use nostr_sdk::prelude::{Keys, PublicKey, SecretKey, ToBech32};
3use tracing::{debug, info};
4
5/// A stored key with optional petname
6#[derive(Debug, Clone)]
7pub struct StoredKey {
8    /// Secret key in hex format, when this identity can sign
9    pub secret_hex: Option<String>,
10    /// Public key in hex format
11    pub pubkey_hex: String,
12    /// Optional petname (e.g., "default", "work")
13    pub petname: Option<String>,
14}
15
16impl StoredKey {
17    /// Create from secret key hex, deriving pubkey
18    pub fn from_secret_hex(secret_hex: &str, petname: Option<String>) -> Result<Self> {
19        use secp256k1::{Secp256k1, SecretKey as SecpSecretKey};
20
21        let sk_bytes = hex::decode(secret_hex).context("Invalid hex in secret key")?;
22        let sk = SecpSecretKey::from_slice(&sk_bytes).context("Invalid secret key")?;
23        let secp = Secp256k1::new();
24        let pk = sk.x_only_public_key(&secp).0;
25        let pubkey_hex = hex::encode(pk.serialize());
26
27        Ok(Self {
28            secret_hex: Some(secret_hex.to_string()),
29            pubkey_hex,
30            petname,
31        })
32    }
33
34    /// Create from nsec bech32 format
35    pub fn from_nsec(nsec: &str, petname: Option<String>) -> Result<Self> {
36        let secret_key =
37            SecretKey::parse(nsec).map_err(|e| anyhow::anyhow!("Invalid nsec format: {}", e))?;
38        let secret_hex = hex::encode(secret_key.to_secret_bytes());
39        Self::from_secret_hex(&secret_hex, petname)
40    }
41
42    /// Create from pubkey hex without a signing key
43    pub fn from_pubkey_hex(pubkey_hex: &str, petname: Option<String>) -> Result<Self> {
44        let pubkey = PublicKey::from_hex(pubkey_hex)
45            .map_err(|e| anyhow::anyhow!("Invalid pubkey hex: {}", e))?;
46
47        Ok(Self {
48            secret_hex: None,
49            pubkey_hex: hex::encode(pubkey.to_bytes()),
50            petname,
51        })
52    }
53
54    /// Create from npub bech32 format without a signing key
55    pub fn from_npub(npub: &str, petname: Option<String>) -> Result<Self> {
56        let pubkey =
57            PublicKey::parse(npub).map_err(|e| anyhow::anyhow!("Invalid npub format: {}", e))?;
58
59        Ok(Self {
60            secret_hex: None,
61            pubkey_hex: hex::encode(pubkey.to_bytes()),
62            petname,
63        })
64    }
65}
66
67#[derive(Clone, Copy)]
68enum IdentityFileKind {
69    Keys,
70    Aliases,
71}
72
73fn ensure_aliases_file_hint() {
74    let aliases_path = hashtree_config::get_aliases_path();
75    if aliases_path.exists() {
76        return;
77    }
78
79    let Some(parent) = aliases_path.parent() else {
80        return;
81    };
82
83    if !parent.exists() {
84        return;
85    }
86
87    let template = format!(
88        "# Public read-only aliases for repos you clone or fetch.\n# Format: npub1... alias\n{} {}\n",
89        hashtree_config::DEFAULT_SOCIALGRAPH_ENTRYPOINT_NPUB,
90        hashtree_config::DEFAULT_SOCIALGRAPH_ENTRYPOINT_ALIAS
91    );
92
93    let _ = std::fs::OpenOptions::new()
94        .write(true)
95        .create_new(true)
96        .open(&aliases_path)
97        .and_then(|mut file| std::io::Write::write_all(&mut file, template.as_bytes()));
98}
99
100fn parse_identity_entry(
101    raw: &str,
102    petname: Option<String>,
103    kind: IdentityFileKind,
104) -> Option<StoredKey> {
105    let key = match kind {
106        IdentityFileKind::Keys => {
107            if raw.starts_with("nsec1") {
108                StoredKey::from_nsec(raw, petname)
109            } else if raw.starts_with("npub1") {
110                StoredKey::from_npub(raw, petname)
111            } else if raw.len() == 64 {
112                StoredKey::from_secret_hex(raw, petname)
113            } else {
114                return None;
115            }
116        }
117        IdentityFileKind::Aliases => {
118            if raw.starts_with("npub1") {
119                StoredKey::from_npub(raw, petname)
120            } else if raw.len() == 64 {
121                StoredKey::from_pubkey_hex(raw, petname)
122            } else {
123                return None;
124            }
125        }
126    };
127
128    key.ok()
129}
130
131fn load_identities_from_path(path: &std::path::Path, kind: IdentityFileKind) -> Vec<StoredKey> {
132    let mut keys = Vec::new();
133
134    if let Ok(content) = std::fs::read_to_string(path) {
135        for entry in hashtree_config::parse_keys_file(&content) {
136            if let Some(key) = parse_identity_entry(&entry.secret, entry.alias, kind) {
137                debug!(
138                    "Loaded identity: pubkey={}, petname={:?}, has_secret={}",
139                    key.pubkey_hex,
140                    key.petname,
141                    key.secret_hex.is_some()
142                );
143                keys.push(key);
144            }
145        }
146    }
147
148    keys
149}
150
151pub(super) fn resolve_self_identity(keys: &[StoredKey]) -> Option<(String, Option<String>)> {
152    keys.iter()
153        .find(|k| k.petname.as_deref() == Some("self") && k.secret_hex.is_some())
154        .or_else(|| {
155            keys.iter()
156                .find(|k| k.petname.as_deref() == Some("default") && k.secret_hex.is_some())
157        })
158        .or_else(|| keys.iter().find(|k| k.secret_hex.is_some()))
159        .map(|key| (key.pubkey_hex.clone(), key.secret_hex.clone()))
160}
161
162/// Load all keys from config files
163pub fn load_keys() -> Vec<StoredKey> {
164    ensure_aliases_file_hint();
165
166    let mut keys =
167        load_identities_from_path(&hashtree_config::get_keys_path(), IdentityFileKind::Keys);
168    keys.extend(load_identities_from_path(
169        &hashtree_config::get_aliases_path(),
170        IdentityFileKind::Aliases,
171    ));
172
173    keys
174}
175
176/// Resolve an identifier to (pubkey_hex, secret_hex)
177/// Identifier can be:
178/// - "self" (uses default key, auto-generates if needed)
179/// - petname (e.g., "work", "default")
180/// - pubkey hex (64 chars)
181/// - npub bech32
182pub fn resolve_identity(identifier: &str) -> Result<(String, Option<String>)> {
183    let keys = load_keys();
184
185    if identifier == "self" {
186        if let Some(resolved) = resolve_self_identity(&keys) {
187            return Ok(resolved);
188        }
189        let new_key = generate_and_save_key("self")?;
190        info!("Generated new identity: npub1{}", &new_key.pubkey_hex[..12]);
191        return Ok((new_key.pubkey_hex, new_key.secret_hex));
192    }
193
194    for key in &keys {
195        if key.petname.as_deref() == Some(identifier) {
196            return Ok((key.pubkey_hex.clone(), key.secret_hex.clone()));
197        }
198    }
199
200    if identifier.starts_with("npub1") {
201        let pk = PublicKey::parse(identifier)
202            .map_err(|e| anyhow::anyhow!("Invalid npub format: {}", e))?;
203        let pubkey_hex = hex::encode(pk.to_bytes());
204
205        let secret = keys
206            .iter()
207            .find(|k| k.pubkey_hex == pubkey_hex)
208            .and_then(|k| k.secret_hex.clone());
209
210        return Ok((pubkey_hex, secret));
211    }
212
213    if identifier.len() == 64 && hex::decode(identifier).is_ok() {
214        let secret = keys
215            .iter()
216            .find(|k| k.pubkey_hex == identifier)
217            .and_then(|k| k.secret_hex.clone());
218
219        return Ok((identifier.to_string(), secret));
220    }
221
222    anyhow::bail!(
223        "Unknown identity '{}'. Add it to ~/.hashtree/aliases (preferred) or ~/.hashtree/keys, or use a pubkey/npub.",
224        identifier
225    )
226}
227
228/// Generate a new key and save it to ~/.hashtree/keys with the given petname
229fn generate_and_save_key(petname: &str) -> Result<StoredKey> {
230    use std::fs::{self, OpenOptions};
231    use std::io::Write;
232
233    let keys = Keys::generate();
234    let secret_hex = hex::encode(keys.secret_key().to_secret_bytes());
235    let pubkey_hex = hex::encode(keys.public_key().to_bytes());
236
237    let keys_path = hashtree_config::get_keys_path();
238    if let Some(parent) = keys_path.parent() {
239        fs::create_dir_all(parent)?;
240    }
241    ensure_aliases_file_hint();
242
243    let mut file = OpenOptions::new()
244        .create(true)
245        .append(true)
246        .open(&keys_path)?;
247
248    let nsec = keys
249        .secret_key()
250        .to_bech32()
251        .map_err(|e| anyhow::anyhow!("Failed to encode nsec: {}", e))?;
252    writeln!(file, "{} {}", nsec, petname)?;
253
254    info!(
255        "Saved new key to {:?} with petname '{}'",
256        keys_path, petname
257    );
258
259    Ok(StoredKey {
260        secret_hex: Some(secret_hex),
261        pubkey_hex,
262        petname: Some(petname.to_string()),
263    })
264}
git_remote_htree/nostr_client/identity.rs

git_remote_htree/nostr_client/
identity.rs
