Do we have a user for this? Feels pretty low-level to be exposing. Echo dunxen's sentiments about improving the docs if we do want to expose it.

Yea, if we're gonna expose this we should really add a validating wrapper version that checks the stream is valid and can Err instead of panicking.

Do we have a user for this? Feels pretty low-level to be exposing.

Yeah, there is. Everyone who wants to verify that an offer is linked to a bolt12 invoice, also if the big picture is that the bolt12 invoice will never be exposed, but for now that we do not have a better PoP a person should allow this kind of verification IMHO

A possible example of verification can be

/// Verify that an offer, invoice, and preimage are valid and consistent
pub fn verify_offer_payment(offer: &str, invoice: &str, preimage: &str) -> Result<()> {
    log::info!("Starting verification process...");
    log::info!("Offer: {}", offer);
    log::info!("Invoice: {}", invoice);
    log::info!("Preimage: {}", preimage);

    let offer =
        Offer::from_str(offer).map_err(|e| anyhow::anyhow!("Failed to parse offer: {:?}", e))?;

    // Parse the bolt12 invoice preimage
    let (hrp, data) = bech32::decode_without_checksum(invoice)?;
    if hrp.as_str() != "lni" {
        return Err(anyhow::anyhow!(
            "Invalid HRP: expected 'lni', found '{}'",
            hrp
        ));
    }

    let data = Vec::<u8>::from_base32(&data)?;

    let invoice = Bolt12Invoice::try_from(data)
        .map_err(|e| anyhow::anyhow!("Failed to parse BOLT12: {e:?}"))?;

    let issuer_sign_pubkey = if let Some(issue_sign_pubkey) = offer.issuer_signing_pubkey() {
        issue_sign_pubkey
    } else {
        let valid_signing_keys = offer
            .paths()
            .iter()
            .filter_map(|path| path.blinded_hops().last())
            .map(|hop| hop.blinded_node_id)
            .collect::<Vec<_>>();
        log::debug!("{:?}", valid_signing_keys);
        let valid_signing_keys = valid_signing_keys
            .first()
            .ok_or(anyhow::anyhow!(
                "Offer does not contain issuer signing pubkey"
            ))?
            .clone();
        valid_signing_keys
    };

    let inv_signing_pubkey = invoice.signing_pubkey();
    if issuer_sign_pubkey != inv_signing_pubkey {
        return Err(anyhow::anyhow!(
            "Offer and invoice issuer signing pubkeys do not match"
        ));
    }

    let mut bytes = vec![];
    invoice
        .write(&mut bytes)
        .map_err(|e| anyhow::anyhow!("Failed to serialize invoice: {:?}", e))?;
    let tagged_hash = TaggedHash::from_valid_tlv_stream_bytes(SIGNATURE_TAG, &bytes);
    if let Err(err) =
        merkle::verify_signature(&invoice.signature(), &tagged_hash, issuer_sign_pubkey)
    {
        anyhow::bail!("Failed to verify invoice signature: {:?}", err);
    }

    let preimage =
        hex::decode(preimage).map_err(|e| anyhow::anyhow!("Failed to decode preimage: {:?}", e))?;
    let preimage: [u8; 32] = preimage
        .try_into()
        .map_err(|_| anyhow::anyhow!("Preimage must be 32 bytes"))?;
    let preimage = PaymentPreimage(preimage);
    // Validate the Proof of Payment for the invoice
    let computed_hash = PaymentHash::from(preimage);
    let payment_hash = invoice.payment_hash();

    if computed_hash != payment_hash {
        anyhow::bail!("Fail to perform PoP");
    }

    log::info!("Parsed offer: {:?}", offer);
    log::info!("Parsed invoice: {:?}", invoice);
    Ok(())
}

Hmm... we verify the invoice's signature when parsing it. So it's just a matter of matching that the Offer given is the same one that is part of the Bolt12Invoice. This should be possible by comparing Offer::id -- which is just the tagged hash of the offer's merkle root -- against one obtained from the Bolt12Invoice. We could possibly add Bolt12Invoice::offer_id for this.

Note that while OfferId uses an LDK-specific tag, it is computed over the TLV stream bytes so it doesn't matter if the offer wasn't created with LDK.

Ok implemented it @jkczyz cfd6ad4 let me know what do you think.

However, I still think that ldk should expose a way to verify the signature with the public key that is inside the offer, at least till we do not get a better PoP with bolt12

Ok implemented it @jkczyz cfd6ad4 let me know what do you think.

Thanks, left some comments.

However, I still think that ldk should expose a way to verify the signature with the public key that is inside the offer, at least till we do not get a better PoP with bolt12

Given the signature is verified when parsing, shouldn't it be sufficient to check that Bolt12Invoice::signing_pubkey matches the one in the offer? The parser is already doing this when calling check_invoice_signing_pubkey, too, FWIW. Not sure I understand why we need to expose these for the user to piece together and call on their own.

At very least, there doesn't seem to be a need to expose TaggedHash::from_valid_tlv_stream_bytes if we can just have a method on Bolt12Invoice give the TaggedHash for manual signature verification.

Given the signature is verified when parsing, shouldn't it be sufficient to check that Bolt12Invoice::signing_pubkey matches the one in the offer?

Yes, good point, I think it is just fine for a proof of linking point of view.

FWIW. Not sure I understand why we need to expose these for the user to piece together and call on their own.

At this point is just for a learning tool purpose if some users want to do the versification as specified inside the spec. Probably, this is a separate discussion

At very least, there doesn't seem to be a need to expose TaggedHash::from_valid_tlv_stream_bytes if we can just have a method on Bolt12Invoice give the TaggedHash for manual signature verification.

This is a really good point, lets me experiment with it

You can reuse OfferId::from_valid_invreq_tlv_stream (or something with a more appropriate name) rather than duplicating that code.

Make sense thanks!

Done created the from_invoice_bytes that IMHO made clear that we look at the range of the offer TLV, please let me know if you have any other suggestion on this

Ok implemented it @jkczyz cfd6ad4 let me know what do you think.

Thanks, left some comments.

However, I still think that ldk should expose a way to verify the signature with the public key that is inside the offer, at least till we do not get a better PoP with bolt12

Given the signature is verified when parsing, shouldn't it be sufficient to check that Bolt12Invoice::signing_pubkey matches the one in the offer? The parser is already doing this when calling check_invoice_signing_pubkey, too, FWIW. Not sure I understand why we need to expose these for the user to piece together and call on their own.

At very least, there doesn't seem to be a need to expose TaggedHash::from_valid_tlv_stream_bytes if we can just have a method on Bolt12Invoice give the TaggedHash for manual signature verification.

Link will need to be fixed here as described in my other comment. Or just drop the docs since this is a private method and doesn't need much explanation.

I think now should be it, let me know!