Validate zap receipts against LNURL provider's nostrPubkey (NIP-57 Appendix F)

Receipts were only being checked for a valid event signature — anyone could
sign a kind:9735 and have it counted toward another user's zap totals. NIP-57
Appendix F mandates three additional checks: receipt.pubkey == LNURL
provider's nostrPubkey (MUST), bolt11 invoice amount == zap request "amount"
tag (MUST), and lnurl tag == recipient's lnurl (SHOULD).

- Adds LnZapReceiptValidator + LnurlForm in quartz commonMain (pure logic).
- Adds LnurlEndpointCache (jvmAndroid) and the LnurlEndpointResolver
  interface for async lookup. The cache is primed by outbound zaps (existing
  LightningAddressResolver fetches now extract nostrPubkey) and on demand for
  inbound receipts when no entry is present.
- Adds OkHttpLnurlEndpointResolver in commons, wired into LocalCache via
  AppModules using the existing money-tier OkHttp builder (so Tor settings
  apply).
- LocalCache.consume(LnZapEvent) now: drops receipts that fail MUST checks
  synchronously when the cache is warm, defers credit until async resolution
  finishes on cache miss, and falls back to legacy signature-only behavior
  when no resolver is wired (tests).
- LnZapRequestEvent.create() now accepts amountMillisats + lnurl; both are
  threaded through Account.createZapRequestFor and emitted as tags so future
  receipts can be validated against them.

21 new tests cover validator reasons, lnurl form canonicalization across
lud16/URL/bech32, and cache eviction.

commons/src/jvmAndroid/kotlin/com/vitorpamplona/amethyst/commons/services/lnurl/LightningAddressResolver.kt

@@ -24,6 +24,8 @@ import com.fasterxml.jackson.module.kotlin.jacksonObjectMapper
 import com.vitorpamplona.quartz.lightning.LnInvoiceUtil
 import com.vitorpamplona.quartz.lightning.Lud06
 import com.vitorpamplona.quartz.nip57Zaps.LnZapRequestEvent
+import com.vitorpamplona.quartz.nip57Zaps.validate.LnurlEndpointCache
+import com.vitorpamplona.quartz.nip57Zaps.validate.LnurlEndpointInfo
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
 import okhttp3.OkHttpClient
@@ -122,6 +124,15 @@ class LightningAddressResolver(
                         ?: return@withContext Result.Error("No callback URL in LNURL response")
 
                 val allowsNostr = lnurlp.get("allowsNostr")?.asBoolean() ?: false
+                val nostrPubkey = lnurlp.get("nostrPubkey")?.asText()?.ifBlank { null }
+
+                // Prime the receipt-validation cache so incoming zap receipts can
+                // be checked against this provider's nostrPubkey (NIP-57 Appendix F)
+                // without re-fetching the lnurlp endpoint.
+                LnurlEndpointCache.put(
+                    url,
+                    LnurlEndpointInfo(nostrPubkey = nostrPubkey, allowsNostr = allowsNostr),
+                )
 
                 onProgress(0.5f)
 

commons/src/jvmAndroid/kotlin/com/vitorpamplona/amethyst/commons/services/lnurl/OkHttpLnurlEndpointResolver.kt

@@ -0,0 +1,76 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.commons.services.lnurl
+
+import com.fasterxml.jackson.module.kotlin.jacksonObjectMapper
+import com.vitorpamplona.quartz.nip57Zaps.validate.LnurlEndpointCache
+import com.vitorpamplona.quartz.nip57Zaps.validate.LnurlEndpointInfo
+import com.vitorpamplona.quartz.nip57Zaps.validate.LnurlEndpointResolver
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import okhttp3.OkHttpClient
+import okhttp3.Request
+import kotlin.coroutines.cancellation.CancellationException
+
+/**
+ * OkHttp-backed [LnurlEndpointResolver]. Used by `LocalCache.consume(LnZapEvent)`
+ * to look up a recipient's LNURL provider's `nostrPubkey` when validating an
+ * incoming zap receipt (NIP-57 Appendix F).
+ *
+ * Reads from [LnurlEndpointCache] first; on miss, fetches the
+ * `/.well-known/lnurlp/<user>` endpoint, parses `nostrPubkey` + `allowsNostr`,
+ * caches the result, and returns it. Returns null on HTTP / parse failure;
+ * callers should treat that as "validation unavailable" rather than "invalid".
+ */
+class OkHttpLnurlEndpointResolver(
+    private val okHttpClient: (String) -> OkHttpClient,
+) : LnurlEndpointResolver {
+    private val mapper = jacksonObjectMapper()
+
+    override suspend fun resolve(lnurlpUrl: String): LnurlEndpointInfo? {
+        LnurlEndpointCache.get(lnurlpUrl)?.let { return it }
+
+        val info = fetch(lnurlpUrl) ?: return null
+        LnurlEndpointCache.put(lnurlpUrl, info)
+        return info
+    }
+
+    private suspend fun fetch(url: String): LnurlEndpointInfo? =
+        withContext(Dispatchers.IO) {
+            try {
+                val client = okHttpClient(url)
+                val request = Request.Builder().url(url).build()
+                client.newCall(request).execute().use { response ->
+                    if (!response.isSuccessful) return@use null
+                    val body = response.body?.string() ?: return@use null
+                    val root = mapper.readTree(body) ?: return@use null
+                    LnurlEndpointInfo(
+                        nostrPubkey = root.get("nostrPubkey")?.asText()?.ifBlank { null },
+                        allowsNostr = root.get("allowsNostr")?.asBoolean() ?: false,
+                    )
+                }
+            } catch (e: CancellationException) {
+                throw e
+            } catch (_: Exception) {
+                null
+            }
+        }
+}