feat(relay): NIP-98 admin auth with Operator/Moderator roles and NIP-11 discovery - #3777

Open

wpfleger96 wants to merge 28 commits into

mainfrom

wpfleger/admin-api-bearer-auth

Commits on Aug 20, 2026

feat(relay): OPERATOR/MODERATOR role model for relay admin API with NIP-98 auth

Duncan
and
wpfleger96
committed
486aca7
feat(relay): advertise admin API origin via NIP-11 admin_api field

Duncan
and
wpfleger96
committed
20d065f
fix(relay): stop requiring operator API origin for admin console boot

Duncan
and
wpfleger96
committed
6f55ac0
fix(relay): reject unbracketed IPv6 in BUZZ_ADMIN_HOST at config parse

Duncan
and
wpfleger96
committed
666da1e
fix(relay): reject any unparseable BUZZ_ADMIN_HOST authority at config parse

Duncan
and
wpfleger96
committed
b2fb224
fix(relay): require BUZZ_ADMIN_HOST to be a bare authority, not just parseable

Duncan
and
wpfleger96
committed
91042b9
feat(relay): add reopen/cancel admin endpoints and activeAction report DTO

Duncan
and
wpfleger96
committed
37d20b1
fix(relay): make admin cancel atomic + ownership-fenced (cross-report 409)

Duncan
and
wpfleger96
committed
6abc670
fix(relay): derive event-report enforcement target from stored author

Duncan
and
wpfleger96
committed
584941b
fix(relay): sync schema.sql admin tables to migrations 0034/0035

Duncan
and
wpfleger96
committed
ac88b9b
fix(relay): align outbox pending index with pgschema-representable shape

Duncan
and
wpfleger96
committed
05ca744
fix(relay): claim NIP-98 replay slot only after authorization, attribute cancels

Duncan
and
wpfleger96
committed
6157e92
feat(relay): make admin token mode read-write via relay identity

Duncan
and
wpfleger96
committed
ac4917f
test(relay): pin token-mode read-write attribution in CI

Duncan
and
wpfleger96
committed
cb746de
test(relay): make token-mode dismiss gate hermetic

Duncan
and
wpfleger96
committed
39e102b
fix(admin-auth): harden NIP-98 and Host/Origin security surface

wpfleger96
authored and
Duncan
committed
53a0d49
ci(relay): run admin API auth-boundary tests in the unit job

Duncan
and
wpfleger96
committed
14f0215
Merge remote-tracking branch 'origin/main' into wpfleger/admin-api-bearer-auth
Duncan
committed
104aa20
ci(relay): run unrostered-signer replay test in the integration job

Duncan
and
wpfleger96
committed
e21ad31

Commits on Aug 21, 2026

fix(admin-auth): audit roster mutations, bound timeout, canonicalize operator pubkey

Duncan
and
wpfleger96
committed
2dda46a
Merge origin/main into wpfleger/admin-api-bearer-auth

Duncan
and
wpfleger96
committed
76633b5
fix(admin-auth): serialize roster audit pre-image and pin fixes at their seams

Duncan
and
wpfleger96
committed
2616c0f
fix(relay): stamp roster audit at insertion time with total-order key

Duncan
and
wpfleger96
committed
09b6f1f
fix(relay): order roster audit by seq, not the non-monotonic wall clock

Duncan
and
wpfleger96
committed
d20a2fe
feat(relay): default the operator report queue to the escalation backstop

Duncan
and
wpfleger96
committed
f6ea3fb
feat(relay): auto-escalate illegal reports at ingestion

Duncan
and
wpfleger96
committed
9ef4953
Merge remote-tracking branch 'origin/main' into wpfleger/admin-api-bearer-auth
Duncan
committed
64cad3e
test(relay): drop useless vec in reopen-coherence test

Duncan
and
wpfleger96
committed
dbbb6b8

Navigation Menu

Uh oh!

feat(relay): NIP-98 admin auth with Operator/Moderator roles and NIP-11 discovery - #3777

feat(relay): NIP-98 admin auth with Operator/Moderator roles and NIP-11 discovery#3777
wpfleger96 wants to merge 28 commits into
mainfrom
wpfleger/admin-api-bearer-auth

Commits on Aug 20, 2026

feat(relay): OPERATOR/MODERATOR role model for relay admin API with NIP-98 auth

feat(relay): advertise admin API origin via NIP-11 admin_api field

fix(relay): stop requiring operator API origin for admin console boot

fix(relay): reject unbracketed IPv6 in BUZZ_ADMIN_HOST at config parse

fix(relay): reject any unparseable BUZZ_ADMIN_HOST authority at config parse

fix(relay): require BUZZ_ADMIN_HOST to be a bare authority, not just parseable

feat(relay): add reopen/cancel admin endpoints and activeAction report DTO

fix(relay): make admin cancel atomic + ownership-fenced (cross-report 409)

fix(relay): derive event-report enforcement target from stored author

fix(relay): sync schema.sql admin tables to migrations 0034/0035

fix(relay): align outbox pending index with pgschema-representable shape

fix(relay): claim NIP-98 replay slot only after authorization, attribute cancels

feat(relay): make admin token mode read-write via relay identity

test(relay): pin token-mode read-write attribution in CI

test(relay): make token-mode dismiss gate hermetic

fix(admin-auth): harden NIP-98 and Host/Origin security surface

ci(relay): run admin API auth-boundary tests in the unit job

Merge remote-tracking branch 'origin/main' into wpfleger/admin-api-bearer-auth

ci(relay): run unrostered-signer replay test in the integration job

Commits on Aug 21, 2026

fix(admin-auth): audit roster mutations, bound timeout, canonicalize operator pubkey

Merge origin/main into wpfleger/admin-api-bearer-auth

fix(admin-auth): serialize roster audit pre-image and pin fixes at their seams

fix(relay): stamp roster audit at insertion time with total-order key

fix(relay): order roster audit by seq, not the non-monotonic wall clock

feat(relay): default the operator report queue to the escalation backstop

feat(relay): auto-escalate illegal reports at ingestion

Merge remote-tracking branch 'origin/main' into wpfleger/admin-api-bearer-auth

test(relay): drop useless vec in reopen-coherence test