feat: Add Nip42 handler#629
Conversation
🦋 Changeset detectedLatest commit: 3f43783 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
There was a problem hiding this comment.
Pull request overview
Adds NIP-42 challenge/response authentication to the WebSocket ingestion path by issuing an AUTH challenge on connect and validating incoming AUTH events (kind 22242) in a dedicated handler, while preventing 22242 events from being published through the normal EVENT pipeline.
Changes:
- Send
["AUTH", <challenge>]on new WebSocket connections and track authenticated pubkeys per connection. - Introduce
AuthMessageHandlerand routeAUTHmessages to it viamessageHandlerFactory. - Block kind
22242from the standardEVENThandler to avoid persistence/pipeline handling.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
src/adapters/web-socket-adapter.ts |
Generates/sends NIP-42 challenges on connect; tracks authenticated pubkeys and clears them on disconnect. |
src/handlers/auth-message-handler.ts |
Implements validation for kind 22242 AUTH events (id, sig, timestamp, challenge tag, relay domain) and records authenticated pubkeys. |
src/handlers/event-message-handler.ts |
Rejects kind 22242 when sent via EVENT to keep auth events out of the normal event pipeline. |
src/factories/message-handler-factory.ts |
Routes AUTH messages to the new AuthMessageHandler. |
src/@types/adapters.ts |
Extends IWebSocketAdapter with challenge/authenticated-pubkeys accessors/mutator. |
test/unit/adapters/web-socket-adapter.spec.ts |
Adds coverage for challenge emission and new adapter auth-related methods. |
test/unit/handlers/auth-message-handler.spec.ts |
Adds unit tests for AUTH validation success/failure cases. |
test/unit/factories/message-handler-factory.spec.ts |
Adds a test ensuring AUTH messages produce AuthMessageHandler. |
.changeset/funky-coins-know.md |
Declares a minor release for NIP-42 AUTH wiring. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
8b60719 to
a63d4c3
Compare
|
Hi @cameri , This PR is up for review. |
Ferryx349
left a comment
There was a problem hiding this comment.
Overall the changes look great, just few nits:
Description
Second PR for NIP-42 (follows #622). This one wires everything up so the adapter now sends a challenge on connect and there's a handler to verify the client's AUTH response.
WebSocketAdaptergenerates a random challenge on connect and sends["AUTH", <challenge>]AuthMessageHandlerverifies kind 22242 events (checks id, sig, timestamp, challenge tag, relay domain)messageHandlerFactoryroutes AUTH messages to the new handlerIWebSocketAdapterwithgetChallenge(),getAuthenticatedPubkeys(),addAuthenticatedPubkey()Related Issue
Closes #619
Motivation and Context
With the types from #622 in place, this wires up the actual auth flow so connections can be tied to a pubkey. Sets things up for NIP-70 protected events next.
How Has This Been Tested?
Added 20 new tests across the handler, adapter and factory specs.
Types of changes
Checklist: