Add Nostr profile management and encrypted NWC secret storage

Author: shadowbipnode

src/main/db.js

@@ -73,13 +73,14 @@ function init() {
     );
 
     CREATE TABLE IF NOT EXISTS nwc_connections (
-      id            INTEGER PRIMARY KEY AUTOINCREMENT,
-      name          TEXT    NOT NULL,
-      relay_url     TEXT    NOT NULL,
-      wallet_pubkey TEXT    NOT NULL,
-      secret        TEXT    NOT NULL,
-      active        INTEGER NOT NULL DEFAULT 1,
-      created_at    INTEGER NOT NULL
+      id               INTEGER PRIMARY KEY AUTOINCREMENT,
+      name             TEXT    NOT NULL,
+      relay_url        TEXT    NOT NULL,
+      wallet_pubkey    TEXT    NOT NULL,
+      secret           TEXT    NOT NULL DEFAULT '',
+      encrypted_secret TEXT,
+      active           INTEGER NOT NULL DEFAULT 1,
+      created_at       INTEGER NOT NULL
     );
 
     CREATE TABLE IF NOT EXISTS privacy_settings (
@@ -93,8 +94,20 @@ function init() {
     );
     INSERT OR IGNORE INTO privacy_settings (id) VALUES (1);
   `)
+migrateNwcConnectionsSchema()
 }
+function migrateNwcConnectionsSchema() {
+  const columns = db
+    .prepare('PRAGMA table_info(nwc_connections)')
+    .all()
+    .map(c => c.name)
 
+  if (!columns.includes('encrypted_secret')) {
+    db.prepare(
+      'ALTER TABLE nwc_connections ADD COLUMN encrypted_secret TEXT'
+    ).run()
+  }
+}
 const now = () => Math.floor(Date.now() / 1000)
 
 // ── Settings ──────────────────────────────────────────────────────────────────

src/main/index.js

@@ -357,6 +357,7 @@ ipcMain.handle('nostr-create-profile', (_, args) => nostr.createProfile(DB, args
 ipcMain.handle('nostr-import-nsec',    (_, args) => nostr.importNsec(DB, args))
 ipcMain.handle('nostr-skip',           () => DB.setSetting('nostr_skipped', '1'))
 ipcMain.handle('nostr-get-profile',    () => nostr.getProfile(DB))
+ipcMain.handle('nostr-remove-profile', () => nostr.removeProfile(DB))
 ipcMain.handle('nostr-get-relays',     () => nostr.getRelays())
 ipcMain.handle('nostr-sign-event',     (_, { event }) => nostr.signEvent(DB, event))
 ipcMain.handle('nostr-get-pubkey',     () => nostr.getPubkey(DB))

src/main/nostr.js

@@ -122,5 +122,22 @@ function getRelays() {
     'wss://nostr.wine':          { read: true,  write: false },
   }
 }
+function removeProfile(DB) {
+  DB._db()
+    .prepare('DELETE FROM nostr_profile WHERE id=1')
+    .run()
+
+  DB.setSetting('nostr_skipped', '0')
+
+  return { ok: true }
+}
 
-module.exports = { createProfile, importNsec, getProfile, getPubkey, signEvent, getRelays }
+module.exports = {
+  createProfile,
+  importNsec,
+  getProfile,
+  getPubkey,
+  signEvent,
+  getRelays,
+  removeProfile,
+}

src/main/nwc.js

@@ -3,11 +3,19 @@
 const WebSocket = require('ws')
 const { getPublicKey, getSignature, getEventHash, nip04 } = require('nostr-tools')
 const { hexToBytes } = require('@noble/hashes/utils')
-
+const keychain = require('./keychain')
 let activeWs     = null
 let activeConn   = null
 let pendingCalls = new Map()
+async function decryptStoredSecret(row) {
+  if (row.encrypted_secret) {
+    const key = await keychain.getOrCreateKey()
+    return keychain.decrypt(row.encrypted_secret, key)
+  }
 
+  // Backward compatibility with older databases
+  return row.secret
+}
 function parseNwcUri(uri) {
   const normalised = uri.trim()
     .replace('nostr+walletconnect://', 'nwc://')
@@ -91,30 +99,97 @@ async function nwcRequest(method, params = {}) {
   })
 }
 
+
 async function connect(DB, { nwcUri, name }) {
   const parsed = parseNwcUri(nwcUri)
+
   await openWs(parsed.relay, parsed.pubkey, parsed.secret)
+
+  const key = await keychain.getOrCreateKey()
+  const encryptedSecret = keychain.encrypt(parsed.secret, key)
+
   const db = DB._db()
+
   db.prepare('UPDATE nwc_connections SET active=0').run()
+
   const r = db
-    .prepare('INSERT INTO nwc_connections(name,relay_url,wallet_pubkey,secret,active,created_at) VALUES(?,?,?,?,1,?)')
-    .run(name || 'My node', parsed.relay, parsed.pubkey, parsed.secret, Math.floor(Date.now() / 1000))
-  activeConn = { relay_url: parsed.relay, wallet_pubkey: parsed.pubkey, secret: parsed.secret }
-  return { id: r.lastInsertRowid, name, relay: parsed.relay, pubkey: parsed.pubkey, active: true }
+    .prepare(`
+      INSERT INTO nwc_connections
+      (name, relay_url, wallet_pubkey, secret, encrypted_secret, active, created_at)
+      VALUES (?, ?, ?, ?, ?, 1, ?)
+    `)
+    .run(
+      name || 'My node',
+      parsed.relay,
+      parsed.pubkey,
+      '', // legacy field intentionally blank
+      encryptedSecret,
+      Math.floor(Date.now() / 1000)
+    )
+
+  activeConn = {
+    relay_url: parsed.relay,
+    wallet_pubkey: parsed.pubkey,
+    secret: parsed.secret,
+  }
+
+  return {
+    id: r.lastInsertRowid,
+    name,
+    relay: parsed.relay,
+    pubkey: parsed.pubkey,
+    active: true,
+  }
 }
 
 async function reconnectFromDB(DB) {
-  const row = DB._db().prepare('SELECT * FROM nwc_connections WHERE active=1').get()
+  const row = DB._db()
+    .prepare('SELECT * FROM nwc_connections WHERE active=1')
+    .get()
+
   if (!row) return false
+
   try {
-    await openWs(row.relay_url, row.wallet_pubkey, row.secret)
-    activeConn = row
+    const secret = await decryptStoredSecret(row)
+
+    await openWs(
+      row.relay_url,
+      row.wallet_pubkey,
+      secret
+    )
+
+    // Auto-migrate legacy plaintext entries
+    if (!row.encrypted_secret && row.secret) {
+      const key = await keychain.getOrCreateKey()
+      const encryptedSecret = keychain.encrypt(row.secret, key)
+
+      DB._db()
+        .prepare(`
+          UPDATE nwc_connections
+          SET encrypted_secret = ?, secret = ''
+          WHERE id = ?
+        `)
+        .run(encryptedSecret, row.id)
+    }
+
+    activeConn = {
+      ...row,
+      secret,
+    }
+
     return true
-  } catch (_) {
+  } catch (err) {
+    console.error('Failed to reconnect NWC:', err.message)
     return false
   }
 }
 
+
+
+
+
+
+
 function disconnect(DB) {
   if (activeWs) { try { activeWs.close() } catch (_) {} activeWs = null }
   activeConn = null

src/preload/shell.js

@@ -45,6 +45,7 @@ contextBridge.exposeInMainWorld('zap', {
   nostrImportNsec:    (a) => ipcRenderer.invoke('nostr-import-nsec', a),
   nostrSkip:          () => ipcRenderer.invoke('nostr-skip'),
   nostrGetProfile:    () => ipcRenderer.invoke('nostr-get-profile'),
+  nostrRemoveProfile: () => ipcRenderer.invoke('nostr-remove-profile'),
   nostrGetRelays:     () => ipcRenderer.invoke('nostr-get-relays'),
   nostrSignEvent:     (a) => ipcRenderer.invoke('nostr-sign-event', a),
   nostrGetPubkey:     () => ipcRenderer.invoke('nostr-get-pubkey'),