use dekey by default on gift wrap and unwrap.

gift.go

@@ -4,10 +4,14 @@ import (
 	"context"
 	"fmt"
 	"math/rand"
+	"os"
+	"path/filepath"
 	"time"
 
 	"fiatjaf.com/nostr"
+	"fiatjaf.com/nostr/keyer"
 	"fiatjaf.com/nostr/nip44"
+	"github.com/fatih/color"
 	"github.com/mailru/easyjson"
 	"github.com/urfave/cli/v3"
 )
@@ -16,19 +20,27 @@ var gift = &cli.Command{
 	Name:  "gift",
 	Usage: "gift-wraps (or unwraps) an event according to NIP-59",
 	Description: `example:
-  nak event | nak gift wrap --sec <sec-a> -p <sec-b> | nak gift unwrap --sec <sec-b> --from <pub-a>`,
+  nak event | nak gift wrap --sec <sec-a> -p <sec-b> | nak gift unwrap --sec <sec-b> --from <pub-a>
+
+a decoupled key (if it has been created or received with "nak dekey" previously) will be used by default.`,
 	DisableSliceFlagSeparator: true,
+	Flags: append(
+		defaultKeyFlags,
+		&cli.BoolFlag{
+			Name:  "use-direct",
+			Usage: "Use the key given to --sec directly even when a decoupled key exists.",
+		},
+	),
 	Commands: []*cli.Command{
 		{
 			Name: "wrap",
-			Flags: append(
-				defaultKeyFlags,
+			Flags: []cli.Flag{
 				&PubKeyFlag{
 					Name:     "recipient-pubkey",
 					Aliases:  []string{"p", "tgt", "target", "pubkey", "to"},
 					Required: true,
 				},
-			),
+			},
 			Usage: "turns an event into a rumor (unsigned) then gift-wraps it to the recipient",
 			Description: `example:
   nak event -c 'hello' | nak gift wrap --sec <my-secret-key> -p <target-public-key>`,
@@ -38,14 +50,25 @@ var gift = &cli.Command{
 					return err
 				}
 
-				recipient := getPubKey(c, "recipient-pubkey")
-
-				// get sender pubkey
+				// get sender pubkey (ourselves)
 				sender, err := kr.GetPublicKey(ctx)
 				if err != nil {
 					return fmt.Errorf("failed to get sender pubkey: %w", err)
 				}
 
+				var cipher nostr.Cipher = kr
+				// use decoupled key if it exists
+				configPath := c.String("config-path")
+				eSec, has, err := getDecoupledEncryptionKey(ctx, configPath, sender)
+				if has {
+					if err != nil {
+						return fmt.Errorf("decoupled encryption key exists, but we failed to get it: %w; call `nak dekey` to attempt a fix or call this again with --use-direct to bypass", err)
+					}
+					cipher = keyer.NewPlainKeySigner(eSec)
+				}
+
+				recipient := getPubKey(c, "recipient-pubkey")
+
 				// read event from stdin
 				for eventJSON := range getJsonsOrBlank() {
 					if eventJSON == "{}" {
@@ -65,7 +88,7 @@ var gift = &cli.Command{
 
 					// create seal
 					rumorJSON, _ := easyjson.Marshal(rumor)
-					encryptedRumor, err := kr.Encrypt(ctx, string(rumorJSON), recipient)
+					encryptedRumor, err := cipher.Encrypt(ctx, string(rumorJSON), recipient)
 					if err != nil {
 						return fmt.Errorf("failed to encrypt rumor: %w", err)
 					}
@@ -115,20 +138,36 @@ var gift = &cli.Command{
 			Usage: "decrypts a gift-wrap event sent by the sender to us and exposes its internal rumor (unsigned event).",
 			Description: `example:
   nak req -p <my-public-key> -k 1059 dmrelay.com | nak gift unwrap --sec <my-secret-key> --from <sender-public-key>`,
-			Flags: append(
-				defaultKeyFlags,
+			Flags: []cli.Flag{
 				&PubKeyFlag{
 					Name:     "sender-pubkey",
 					Aliases:  []string{"p", "src", "source", "pubkey", "from"},
 					Required: true,
 				},
-			),
+			},
 			Action: func(ctx context.Context, c *cli.Command) error {
 				kr, _, err := gatherKeyerFromArguments(ctx, c)
 				if err != nil {
 					return err
 				}
 
+				// get receiver public key (ourselves)
+				receiver, err := kr.GetPublicKey(ctx)
+				if err != nil {
+					return err
+				}
+
+				var cipher nostr.Cipher = kr
+				// use decoupled key if it exists
+				configPath := c.String("config-path")
+				eSec, has, err := getDecoupledEncryptionKey(ctx, configPath, receiver)
+				if has {
+					if err != nil {
+						return fmt.Errorf("decoupled encryption key exists, but we failed to get it: %w; call `nak dekey` to attempt a fix or call this again with --use-direct to bypass", err)
+					}
+					cipher = keyer.NewPlainKeySigner(eSec)
+				}
+
 				sender := getPubKey(c, "sender-pubkey")
 
 				// read gift-wrapped event from stdin
@@ -149,7 +188,7 @@ var gift = &cli.Command{
 					ephemeralPubkey := wrap.PubKey
 
 					// decrypt seal
-					sealJSON, err := kr.Decrypt(ctx, wrap.Content, ephemeralPubkey)
+					sealJSON, err := cipher.Decrypt(ctx, wrap.Content, ephemeralPubkey)
 					if err != nil {
 						return fmt.Errorf("failed to decrypt seal: %w", err)
 					}
@@ -164,7 +203,7 @@ var gift = &cli.Command{
 					}
 
 					// decrypt rumor
-					rumorJSON, err := kr.Decrypt(ctx, seal.Content, sender)
+					rumorJSON, err := cipher.Decrypt(ctx, seal.Content, sender)
 					if err != nil {
 						return fmt.Errorf("failed to decrypt rumor: %w", err)
 					}
@@ -190,3 +229,45 @@ func randomNow() nostr.Timestamp {
 	randomOffset := rand.Int63n(twoDays)
 	return nostr.Timestamp(now - randomOffset)
 }
+
+func getDecoupledEncryptionKey(ctx context.Context, configPath string, pubkey nostr.PubKey) (nostr.SecretKey, bool, error) {
+	relays := sys.FetchWriteRelays(ctx, pubkey)
+
+	keyAnnouncementResult := sys.Pool.FetchManyReplaceable(ctx, relays, nostr.Filter{
+		Kinds:   []nostr.Kind{10044},
+		Authors: []nostr.PubKey{pubkey},
+	}, nostr.SubscriptionOptions{Label: "nak-nip4e-gift"})
+	var eSec nostr.SecretKey
+	var ePub nostr.PubKey
+
+	keyAnnouncementEvent, ok := keyAnnouncementResult.Load(nostr.ReplaceableKey{PubKey: pubkey, D: ""})
+	if ok {
+		// get the pub from the tag
+		for _, tag := range keyAnnouncementEvent.Tags {
+			if len(tag) >= 2 && tag[0] == "n" {
+				ePub, _ = nostr.PubKeyFromHex(tag[1])
+				break
+			}
+		}
+		if ePub == nostr.ZeroPK {
+			return [32]byte{}, true, fmt.Errorf("got invalid kind:10044 event, no 'n' tag")
+		}
+
+		// check if we have the key
+		eKeyPath := filepath.Join(configPath, "dekey", "p", pubkey.Hex(), "e", ePub.Hex())
+		if data, err := os.ReadFile(eKeyPath); err == nil {
+			log(color.GreenString("- and we have it locally already\n"))
+			eSec, err = nostr.SecretKeyFromHex(string(data))
+			if err != nil {
+				return [32]byte{}, true, fmt.Errorf("invalid main key: %w", err)
+			}
+			if eSec.Public() != ePub {
+				return [32]byte{}, true, fmt.Errorf("stored decoupled encryption key is corrupted: %w", err)
+			}
+
+			return eSec, true, nil
+		}
+	}
+
+	return [32]byte{}, false, nil
+}