From 973cd23540d3abf6a14175cab739b8d4555ab4cc Mon Sep 17 00:00:00 2001
From: Vitor Pamplona <vitor@vitorpamplona.com>
Date: Wed, 1 May 2024 19:05:37 -0400
Subject: [PATCH] Adds Sharing with Read-only and Write Permissions

---
 73.md | 111 ++++++++++++++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 100 insertions(+), 11 deletions(-)

diff --git a/73.md b/73.md
index 2a6fe0c2..de2fa2a5 100644
--- a/73.md
+++ b/73.md
@@ -15,23 +15,19 @@ Event kind `35337` describes a workbook with `data` tags that contain the value
   "kind": 35337,
   "tags": [
     ["d", "<unique identifier>"],
-    ["title", "Name of this spreadsheet"] // public title
-    ["data", "<sheet name>", "<column letter>", "<row number>", "<value>"]
-    ["data", "<sheet name>", "<column letter>", "<row number>", "<value>", "<style>"]
-    ["style", "<TBD>"] // Need to specify all options here. 
+    ["title", "Name of this spreadsheet"], // public title
+    ["data", "<sheet name>", "<column letter>", "<row number>", "<value>"],
+    ["data", "<sheet name>", "<column letter>", "<row number>", "<value>", "<style>"],
+    ["style", "<TBD>"], // Need to specify all options here. 
   ],
-  "content": nip44Encrypt([
-    ["title", "Name of this spreadsheet"] // private title
-    ["data", "<sheet name>", "<column letter>", "<row number>", "<value>"] // private data
-    // ... other tags
-  ]),
+  "content": "",
   // ...
 }
 ``` 
 
 Sheets MUST be rendered in the order of their tags. 
 
-## Example
+As an example: 
 
 ```json
 {
@@ -48,4 +44,97 @@ Sheets MUST be rendered in the order of their tags.
   "pubkey": "460c25e682fda7832b52d1f22d3d22b3176d972f60dcdc3212ed8c92ef85065c",
   "sig": "880eb3d67fc66ca2d4e7819ae9b9ca577df35950fb5d11d24f95f350cfeab0b4532646c52113d5bb629cf9a2e4d8ef646ff434b59f1c894c8f719f65d59ed8f0",
 }
-```  
\ No newline at end of file
+``` 
+
+## Styling
+
+TBD
+
+## Private SpreadSheets
+
+A private spreadsheet has all tags in a JSON-stringified and NIP-44-encrypted to the user's own pubkey `.content`
+
+```js
+{
+  "kind": 35337,
+  "tags": [
+    ["d", "<unique identifier>"]
+  ],
+  "content": nip44Encrypt([
+    ["title", "Name of this spreadsheet"], // private title
+    ["data", "<sheet name>", "<column letter>", "<row number>", "<value>"], // private data
+    ["data", "<sheet name>", "<column letter>", "<row number>", "<value>", "<style>"],
+    ["style", "<TBD>"], // Need to specify all options here. 
+    // ... other tags
+  ], privateKey, pubkey),
+  // ...
+}
+``` 
+
+## Sharing Encrypted Spreadsheets with Viewer-only permission.
+
+Ready-only sharing is achieved by adding a `p` tag to each receiver with a shared secret to decrypt the `.content`. 
+
+The shared secret is a Nostr Private Key in hex, NIP-44-encrypted to each `p` tag and placed as a 4th value in each tag.  
+
+The `.content` is then encrypted by a conversation key between the new private and the public key. 
+
+```js
+val keyPair = nostr.generateKeyPair()
+
+{
+  "kind": 35337,
+  "tags": [
+    ["d", "<unique identifier>"]
+    ["p", "<pubkey 1>", "<relay url>", nip44Encrypt(keyPair.privateKeyHex, "<pubkey 1>") ]
+    ["p", "<pubkey 2>", "<relay url>", nip44Encrypt(keyPair.privateKeyHex, "<pubkey 2>") ]
+    ["p", "<pubkey 3>", "<relay url>", nip44Encrypt(keyPair.privateKeyHex, "<pubkey 3>") ]
+  ],
+  "content": nip44Encrypt([
+    ["title", "Name of this spreadsheet"], // private title
+    ["data", "<sheet name>", "<column letter>", "<row number>", "<value>"], // private data
+    ["data", "<sheet name>", "<column letter>", "<row number>", "<value>", "<style>"],
+    ["style", "<TBD>"], // Need to specify all options here. 
+    // ... other tags
+  ], keyPair.privateKey, keyPair.publicKey),
+  // ...
+}
+``` 
+
+To decrypt, receivers SHOULD find the ciphertext for their key, decrypt that to get the shared private key and use the shared private key to decrypt the `.content`.
+
+Clients SHOULD include the author as a `p` tag to save the secret that will allow the author to decrypt and modify the event further. 
+
+## Sharing Encrypted Spreadsheets with Editor permission.
+
+This method allows anyone listed as the `p` tag to edit the Spreadsheet. It follows a similar process to read-only spreadsheets, but instead of signing the event with the author's main key, the event is signed by the shared secret as well. 
+
+```js
+val keyPair = nostr.generateKeyPair()
+
+{
+  "pubkey": keyPair.publicKey
+  "kind": 35337,
+  "tags": [
+    ["d", "<unique identifier>"]
+    ["p", "<pubkey 1>", "<relay url>", nip44Encrypt(keyPair.privateKeyHex, "<pubkey 1>") ]
+    ["p", "<pubkey 2>", "<relay url>", nip44Encrypt(keyPair.privateKeyHex, "<pubkey 2>") ]
+    ["p", "<pubkey 3>", "<relay url>", nip44Encrypt(keyPair.privateKeyHex, "<pubkey 3>") ]
+  ],
+  "content": nip44Encrypt([
+    ["title", "Name of this spreadsheet"], // private title
+    ["data", "<sheet name>", "<column letter>", "<row number>", "<value>"], // private data
+    ["data", "<sheet name>", "<column letter>", "<row number>", "<value>", "<style>"],
+    ["style", "<TBD>"], // Need to specify all options here. 
+    // ... other tags
+  ], keyPair.privateKey, keyPair.publicKey),
+  "sig": signWith(id, keyPair.privateKey)
+  // ...
+}
+``` 
+
+To edit, receivers SHOULD find the ciphertext for their key, decrypt that to get the shared private key and use the shared private key to encrypt the `.content` and sign the event. 
+
+
+
+ 
\ No newline at end of file