Non-iOS Purple checkout flows (server-side)

[danieldaquino]

Summary

This PR adds the following:

• New OTP authentication support for LN checkout

Checklist

• I have read (or I am familiar with) the Contribution Guidelines
• I have tested the changes in this PR
• My PR is either small, or I have split it into smaller logical commits that are easier to review
• I have added the signoff line to all my commits. See Signing off your work
• I have added appropriate changelog entries for the changes in this PR. See Adding changelog entries
  • I do not need to add a changelog entry. Reason: n/a
• I have added appropriate Closes: or Fixes: tags in the commit messages wherever applicable, or made sure those are not needed. See Submitting patches — Not needed, the related issue also depends on Non-iOS Purple checkout flows (client-side) website#28

Test report

Test 1

damus-api: 8bdbd179536da01c3a74b1c8cb5cd7427437c672
Node: v18.20.4, running on NixOS
Steps: Run unit tests
Setup: Move .env file away to avoid env-dependent behavior
Results:

• PASS
• Partial PASS (Passes 5 out of 7 tries)
  • Details: There seems to be some pre-existing flakiness on the unit tests. However, I ran the test 7 times and it passed 5 times. Besides, there is not much regression risk with the current changes. Failures are most likely not being caused by this PR.

Test 2

See test report in damus-io/website#28

Other notes

• Please see Non-iOS Purple checkout flows (client-side) website#28 for frontend changes.

[danieldaquino]

Actually, @jb55, give me a moment, I will double-check this PR on node.js 18 and our CI/nix configuration. Node v22.x is not LTS, so we might want to stay in v18.x

[danieldaquino]

Actually, @jb55, give me a moment, I will double-check this PR on node.js 18 and our CI/nix configuration. Node v22.x is not LTS, so we might want to stay in v18.x

Restored Node 18 compatibility. Re-tested and updated all test reports.

[jb55]

On Mon, Sep 30, 2024 at 01:16:22PM -0700, Daniel D’Aquino wrote: Add OTP authentication endpoints for the lightning checkout process, to allow users without Damus iOS to buy Purple Changelog-Added: Add OTP authentication support to the Purple LN checkout process Signed-off-by: Daniel D’Aquino ***@***.***> Closes: #11 ---

looks good! Reviewed-by: William Casarin ***@***.***>

…

src/router_config.js | 82 +++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 81 insertions(+), 1 deletion(-) diff --git a/src/router_config.js b/src/router_config.js index bcb7f89..22c531c 100644 --- a/src/router_config.js +++ b/src/router_config.js @@ -305,7 +305,87 @@ function config_router(app) { } }) - // MARK: OTP routes + // MARK: OTP lightning checkout routes + + /** + * This route is used to request an OTP code for a specific checkout. + * + * @param {string} req.params.checkout_id - The ID of the checkout object. + * @param {string} req.params.pubkey - The public key of the user verifying the OTP. + * + * @returns {Object} - A JSON response indicating whether the OTP code was sent successfully + */ + router.post('/ln-checkout/:checkout_id/request-otp/:pubkey', async (req, res) => { + const pubkey = req.params.pubkey + if (!pubkey) { + invalid_request(res, 'Could not parse account pubkey') + return + } + + const checkout_id = req.params.checkout_id + if (!checkout_id) { + error_response(res, 'Could not parse checkout_id') + return + } + + const otp_code = await app.web_auth_manager.generate_otp(pubkey) + await app.web_auth_manager.send_otp(pubkey, otp_code) + json_response(res, { success: true }) + }); + + /** + * This route is used to verify an OTP code for a specific checkout. + * + * @param {string} req.params.checkout_id - The ID of the checkout object. + * @param {string} req.params.pubkey - The public key of the user verifying the OTP. + * @param {string} req.body.otp_code - The OTP code to verify. + * + * @returns {Object} - A JSON response containing the checkout object if the OTP is valid, or an error message if invalid. + */ + router.put('/ln-checkout/:checkout_id/verify-otp/:pubkey', async (req, res) => { + const pubkey = req.params.pubkey + if (!pubkey) { + invalid_request(res, 'Could not parse account pubkey') + return + } + + const checkout_id = req.params.checkout_id + if (!checkout_id) { + error_response(res, 'Could not parse checkout_id') + return + } + + const otp_code = req.body.otp_code + if (!otp_code) { + invalid_request(res, 'Missing otp_code') + return + } + + const is_valid = await app.web_auth_manager.validate_otp(pubkey, otp_code) + if(!is_valid) { + unauthorized_response(res, { valid: false }) + return + } + + try { + const response = await app.invoice_manager.verify_checkout_object(checkout_id, pubkey) + if (response.request_error) { + invalid_request(res, response.request_error) + } + if (response.checkout_object) { + const session_token = await app.web_auth_manager.create_session(pubkey) + json_response(res, { + checkout_object: response.checkout_object, + otp: { valid: true, session_token: session_token } + }) + } + } catch (e) { + error("%s", e.toString()) + invalid_request(res, e.toString()) + } + }) + + // MARK: OTP login routes router.post('/accounts/:pubkey/request-otp', async (req, res) => { const pubkey = req.params.pubkey

[danieldaquino]

Thanks! Merged!

[jb55]

@danieldaquino I tried to do a purchase with an account with no profile, and I did not receive a DM