Wallets

mutation CreateWallet {
  payment {
    wallet {
      create(input: {
        name: "Main USDT wallet"
        environment_id: "81b73615-ddf3-46e3-943a-467c3e442e04"
        asset_id: "<asset_id from taproot_assets.list>"
      }) {
        id
        name
        is_ready
        asset { symbol precision }
        balance { balance received sent }
      }
    }
  }
}

curl -X POST https://rails.amboss.tech/graphql \
  -H "Content-Type: application/json" \
  -H "x-api-key: $AMBOSS_API_KEY" \
  -d '{
    "query": "mutation($input: CreatePaymentsWalletInput!) { payment { wallet { create(input: $input) { id name is_ready asset { symbol precision } balance { balance received sent } } } } }",
    "variables": {
      "input": {
        "name": "Main USDT wallet",
        "environment_id": "81b73615-ddf3-46e3-943a-467c3e442e04",
        "asset_id": "<asset_id>"
      }
    }
  }'

import { GraphQLClient, gql } from "graphql-request";

const client = new GraphQLClient("https://rails.amboss.tech/graphql", {
  headers: { "x-api-key": process.env.AMBOSS_API_KEY },
});

const CREATE_WALLET = gql`
  mutation CreateWallet($input: CreatePaymentsWalletInput!) {
    payment {
      wallet {
        create(input: $input) {
          id
          name
          is_ready
          asset { symbol precision }
          balance { balance received sent }
        }
      }
    }
  }
`;

const { payment } = await client.request(CREATE_WALLET, {
  input: {
    name: "Main USDT wallet",
    environment_id: process.env.AMBOSS_ENV_ID,
    asset_id: process.env.AMBOSS_ASSET_ID_USDT,
  },
});
console.log(payment.wallet.create.id);

query GetWalletCredentials($id: String!, $password_hash: String!) {
  payment {
    wallet {
      find_one(id: $id) {
        id
        node_permissions(password_hash: $password_hash) {
          encrypted_symmetric_key
          nodes {
            node_id
            network
            macaroon_id
            encrypted_macaroon
            tls_cert
            sockets {
              lnd { grpc rest }
              litd { grpc rest }
            }
          }
        }
      }
    }
  }
}

curl -X POST https://rails.amboss.tech/graphql \
  -H "Content-Type: application/json" \
  -H "x-api-key: $AMBOSS_API_KEY" \
  -d '{
    "query": "query($id: String!, $pw: String!) { payment { wallet { find_one(id: $id) { id node_permissions(password_hash: $pw) { encrypted_symmetric_key nodes { node_id network macaroon_id encrypted_macaroon tls_cert sockets { lnd { grpc rest } litd { grpc rest } } } } } } } }",
    "variables": {
      "id": "5e4b1e2a-9f3c-4a5b-8c7d-1234567890ab",
      "pw": "<argon2id-hash-of-master-password>"
    }
  }'

// npm install nostr-tools @noble/hashes argon2
import argon2 from "argon2";
import { hexToBytes } from "@noble/hashes/utils";
import { nip44 } from "nostr-tools";

const ARGON_DEFAULTS = {
  type: argon2.argon2id,
  hashLength: 32,
  timeCost: 3,
  memoryCost: 64_000, // KiB
  parallelism: 4,
  raw: true as const,
};

export async function decryptWalletCredentials(opts: {
  password: string;
  teamId: string;
  encryptedSymmetricKey: string;
  encryptedMacaroon: string;
}): Promise<{ symmetricKeyHex: string; macaroon: string }> {
  // 1. Argon2id(password, salt = lowercased team id) → 32-byte master key.
  const masterKey = (await argon2.hash(opts.password.trim(), {
    ...ARGON_DEFAULTS,
    salt: Buffer.from(opts.teamId.trim().toLowerCase()),
  })) as Buffer;

  // 2. NIP-44 v2 decrypt the team symmetric key (returns 128-char hex string).
  const symmetricKeyHex = nip44.v2.decrypt(
    opts.encryptedSymmetricKey,
    new Uint8Array(masterKey),
  );

  // 3. NIP-44 v2 decrypt the macaroon with the symmetric key (raw bytes).
  const macaroon = nip44.v2.decrypt(
    opts.encryptedMacaroon,
    hexToBytes(symmetricKeyHex),
  );

  return { symmetricKeyHex, macaroon };
}

# pip install argon2-cffi cryptography
import base64
import hashlib
import hmac
from argon2.low_level import Type, hash_secret_raw
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms

ARGON_DEFAULTS = dict(time_cost=3, memory_cost=64_000, parallelism=4, hash_len=32)


def _hkdf_expand_sha256(prk: bytes, info: bytes, length: int) -> bytes:
    out, t, counter = b"", b"", 1
    while len(out) < length:
        t = hmac.new(prk, t + info + bytes([counter]), hashlib.sha256).digest()
        out += t
        counter += 1
    return out[:length]


def _nip44_v2_decrypt(payload_b64: str, conversation_key: bytes) -> str:
    """Minimal NIP-44 v2 decryption — see https://github.com/nostr-protocol/nips/blob/master/44.md"""
    payload = base64.b64decode(payload_b64)
    if payload[0] != 0x02:
        raise ValueError(f"Unsupported NIP-44 version: {payload[0]:#x}")
    nonce, mac, ciphertext = payload[1:33], payload[-32:], payload[33:-32]

    keys = _hkdf_expand_sha256(conversation_key, nonce, 76)
    chacha_key, chacha_nonce, hmac_key = keys[0:32], keys[32:44], keys[44:76]

    expected = hmac.new(hmac_key, nonce + ciphertext, hashlib.sha256).digest()
    if not hmac.compare_digest(expected, mac):
        raise ValueError("NIP-44 MAC mismatch")

    # cryptography's ChaCha20 wants a 16-byte nonce = 4-byte counter || 12-byte nonce.
    full_nonce = b"\x00\x00\x00\x00" + chacha_nonce
    decryptor = Cipher(algorithms.ChaCha20(chacha_key, full_nonce), mode=None).decryptor()
    padded = decryptor.update(ciphertext) + decryptor.finalize()

    plaintext_len = int.from_bytes(padded[0:2], "big")
    return padded[2 : 2 + plaintext_len].decode("utf-8")


def decrypt_wallet_credentials(
    password: str,
    team_id: str,
    encrypted_symmetric_key: str,
    encrypted_macaroon: str,
) -> tuple[str, str]:
    # 1. Derive 32-byte master key.
    master_key = hash_secret_raw(
        secret=password.strip().encode("utf-8"),
        salt=team_id.strip().lower().encode("utf-8"),
        type=Type.ID,
        **ARGON_DEFAULTS,
    )

    # 2. Decrypt the team symmetric key (returns 128-char hex string).
    symmetric_key_hex = _nip44_v2_decrypt(encrypted_symmetric_key, master_key)

    # 3. Decrypt the macaroon with the symmetric key (raw bytes).
    macaroon = _nip44_v2_decrypt(encrypted_macaroon, bytes.fromhex(symmetric_key_hex))

    return symmetric_key_hex, macaroon