robosats api in node/nuxt 3 app invalid token

[learntheropes]

I'm trying to integrate robosats api in a nuxt3 application but I always get:

{ bad_request: 'Robot token SHA256 was provided in the header. However it is not a valid 39 or 40 characters Base91 string.' }

if I include all the required headers props

Or

RoboSats API error: { bad_request: 'On the first request to a RoboSats coordinator, you must provide as well a valid public and encrypted private PGP keys' }

If I only include the token (that let me assume that the token is actually correct).

A typical token that I generate is:

tokenBase91 C&UKWOoRjZS+qIs?oI{3&]*x}#d@:&;2C!W+jy`| length 40

Here it's a minimal repo to reproduce: https://github.com/learntheropes/robosats-nuxt3

The most relevant part of my code, that tries to replicate what the frontend does in this official repo, is:

import * as openpgp from 'openpgp'
import { createHash, randomBytes } from 'crypto'
import baseX from 'base-x'

const base91 = baseX("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!#$%&()*+,./:;=?@[]^_`{|}~"
)

  const rawToken = randomBytes(32)
  const token = rawToken.toString('hex')
  const tokenHash = createHash('sha256').update(rawToken).digest()
  const tokenBase91 = base91.encode(tokenHash)
  const nostrPubKey = createHash('sha256').update(rawToken).digest('hex')
  
  const { privateKey, publicKey } = await openpgp.generateKey({
    type: 'rsa',
    rsaBits: 2048,
    userIDs: [{ name: 'Robot', email: '[email protected]' }],
    passphrase: token,
    format: 'armored'
  })

  function escapeHeaderContent(str) {
  return str.replace(/\r?\n/g, '\\n').replace(/[\x00-\x1F\x7F]/g, '')
}

  const armoredPublic = escapeHeaderContent(publicKey)
  const armoredPrivate = escapeHeaderContent(privateKey)

  const authorization = [
    `Token ${tokenBase91}`,
    `^| Public ${armoredPublic}`,
    `^| Private ${armoredPrivate}`,
    `^| Nostr ${nostrPubKey}`
  ].join(' ')

What could be the issue?

[KoalaSat]

This error

RoboSats API error: { bad_request: 'On the first request to a RoboSats coordinator, you must provide as well a valid public and encrypted private PGP keys' }

Means that you are not sending the PGP keys on headers with the first request of one specific robot to one specific coordinator (coordinators are totally independent from from each other and you should treat them like separate services)

This one

{ bad_request: 'Robot token SHA256 was provided in the header. However it is not a valid 39 or 40 characters Base91 string.' }

Means that you are sending somehow a wrongly formated robot token. You can find how tokens are created in client's code https://github.com/RoboSats/robosats/blob/main/frontend/src/utils/token.ts#L2

Just a heads up. We are planing to stop using PGP keys in favour of nostr pub keys for v0.8.0

robosats/robosats/middleware.py

Line 53 in a034f4a

request.META["NOSTR_PUBKEY"] = split_auth[3]

[learntheropes]

What I don't understand is that when I send the token only, it is accepted (because the error message is not about the wrong token but about the missing keys) while when I send the complete header including the keys, the coordinator complains about the wrong token. So, in practice, I'm not able to understand if my code to generate the tokens is correct.

[KoalaSat]

Because there is no error accumulation. If you don't send the PGP keys the logic stops there. If you do, the token is validated and it raises an error because there was a validation problem. So it seems that your code is generating wrong robot tokens.

Here an example from the client

robosats/frontend/src/models/Slot.model.ts

Line 28 in a034f4a

const tokenSHA256 = hexToBase91(sha256(token));

[learntheropes]

So I updated my repo accordingly to the code you shared with:

function genRobotToken(length = 40) {
  const array = new Uint8Array(length * 2)
  crypto.getRandomValues(array)

  const base64 = btoa(String.fromCharCode(...array))
  const token = base64.replace(/[+/]/g, '').substring(0, length)

  return token
}

But the issue persists.

[KoalaSat]

That code generates the secret token the user stores to recover its robot, but that's not sent raw to the api. You need to hash it

robosats/frontend/src/models/Slot.model.ts

Line 28 in a034f4a

const tokenSHA256 = hexToBase91(sha256(token));

[learntheropes]

No way, I tested tens of solutions and I pushed the one closest to yours but the problem is still the same. If you can help me looking in my minimal repo, otherwise I'm forced to give up :(

[learntheropes]

I'm creating this project https://github.com/p2payserver where users can pay to btcpay server using fiat that is exchanged under the hood to btc on robosats, peach bitcoin etc. But with this blocker, I will not be able to integrate robosats.

Two days trying, h24, me and chatgpt https://chatgpt.com/share/6858a280-1b40-8013-917f-1180885ff3e6

[KoalaSat]

I don´t see on your code where you are doing this: const tokenSHA256 = hexToBase91(sha256(token)); I only see this one but this is not going to work: https://github.com/learntheropes/robosats-nuxt3/blob/main/server/api/robosats/identity.post.js#L15

[learntheropes]

It's here actually https://github.com/learntheropes/robosats-nuxt3/blob/f8ce2d253ca0c90d9404796f72d6636e33ab0d63/composables/useRobotIdentity.js#L34C9-L34C20

It uses the same function of your frontend:

function hexToBase91FromHashBytes(hashBytes) {
  const b16 = new Base16()
  const b91 = new Base91()
  const hex = Buffer.from(hashBytes).toString('hex')
  return b91.encode(b16.decode(hex))
}

[learntheropes]

The problem is probably on the pgp keys.
If I post them as you generate them, I get Invalid character in header content ["authorization"]
Is this function ok to escape the keys before the authorization header is generated?

function escapeHeaderContent(str) {
  return str.replace(/\r?\n/g, "\\")
}

[learntheropes]

Fixed! Finally

[learntheropes]

Damn, I realize only now that robosats requires a bond from the buyer. So it is not usable in my app, that is meant for no-coiners to pay on btcpay server. But at least I learn a lot about robosats.

[KoalaSat]

I had this idea about trying out integrating with BTC PS some time ago but didn't spent much. You are right the scrow is a thing.

Is there any partial workaround you tried?

[learntheropes]

I’m thinking about it.

Right now, the only workaround that came to my mind is that the merchant pays the bond. This is technically very easy with btcpay server api, but suboptimal in general because if many buyers abandon the purchase, the merchant is screwed.

Have you ever considered allowing a 0% bond? I understand it is risky, but with the proper premium, a counterparty may be incentivized to take the risk.

I also tried with Peach Bitcoin, but it needs some change to the trading engine that are still under progress (I started working at peach exactly to solve this, lol).

Hodl Hodl is excluded because it does not to create the account with the api.

I still have to investigate what Mostro has to offer for my use case.

[KoalaSat]

a 0% bond would break a little app's flow. I don't think that's the way we want to follow