Skip to content

Commit 57c352d

Browse files
tcheerictcheeric
authored
Merge pull request #1 from 398ja/develop
Update version and improve documentation for nostr-auth-proxy
2 parents e7b561e + e359537 commit 57c352d

12 files changed

Lines changed: 280 additions & 4 deletions

File tree

‎.github/copilot-instructions.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# GitHub Copilot Instructions
2+
3+
This repository implements a NIP-42 authentication proxy for Nostr relays. It adds client authentication support to upstream relays (like strfry) that don't natively support it.
4+
5+
## Guidelines
6+
7+
- Use Conventional Commits for titles and commit messages (e.g., `feat(scope): message`).
8+
- Ensure pull requests include a clear description and test results.
9+
- Reference related issues using `Closes #123` when applicable.
10+
- Run `mvn -q verify` before committing code.
11+
- Document new features in the README or related docs.
12+
- Maintain Java 21 compatibility and update `pom.xml` for new dependencies.
13+
- Remove unused imports.
14+
15+
## Relevant Nostr NIPs
16+
17+
When implementing features, consult the relevant NIP specifications:
18+
19+
- [NIP-01](https://github.com/nostr-protocol/nips/blob/master/01.md) - Basic protocol flow (events, subscriptions, messages)
20+
- [NIP-42](https://github.com/nostr-protocol/nips/blob/master/42.md) - Client authentication (core to this proxy)
21+
- [NIP-04](https://github.com/nostr-protocol/nips/blob/master/04.md) - Encrypted direct messages (protected kind)
22+
- [NIP-17](https://github.com/nostr-protocol/nips/blob/master/17.md) - Private direct messages (protected kinds 14, 15)
23+
- [NIP-46](https://github.com/nostr-protocol/nips/blob/master/46.md) - Nostr Connect / remote signing (protected kind 24133)
24+
- [NIP-47](https://github.com/nostr-protocol/nips/blob/master/47.md) - Wallet Connect (protected kinds 23194-23197)
25+
- [NIP-59](https://github.com/nostr-protocol/nips/blob/master/59.md) - Gift wraps (protected kinds 13, 1059)
26+
27+
## Architecture
28+
29+
```
30+
Client (port 7777) ←→ NIP-42 Auth Proxy ←→ Upstream Relay (strfry @ 7778)
31+
```
32+
33+
Key components:
34+
- `auth/` - NIP-42 authentication and BIP-340 signature verification
35+
- `session/` - WebSocket session management and state tracking
36+
- `access/` - Access control (open, allowlist, blocklist modes)
37+
- `handler/` - WebSocket message handling and upstream routing
38+
- `upstream/` - Upstream relay client connections
39+
40+
These instructions help GitHub Copilot produce code that respects the repository's conventions and protocol requirements.

‎.github/dependabot.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
version: 2
2+
3+
# Private registries used by Dependabot
4+
registries:
5+
maven-releases:
6+
type: maven-repository
7+
url: https://maven.398ja.xyz/releases
8+
username: ${{secrets.MVN_USER}}
9+
password: ${{secrets.MVN_PASSWORD}}
10+
maven-snapshots:
11+
type: maven-repository
12+
url: https://maven.398ja.xyz/snapshots
13+
username: ${{secrets.MVN_USER}}
14+
password: ${{secrets.MVN_PASSWORD}}
15+
16+
updates:
17+
- package-ecosystem: "maven"
18+
directory: "/"
19+
schedule:
20+
interval: "weekly"
21+
open-pull-requests-limit: 5
22+
target-branch: "develop"
23+
- package-ecosystem: "github-actions"
24+
directory: "/"
25+
schedule:
26+
interval: "weekly"
27+
open-pull-requests-limit: 5
28+
target-branch: "develop"

‎.github/pull_request_template.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
## Summary
2+
<!-- What motivated this change? -->
3+
4+
## What changed?
5+
<!-- Provide a concise summary of the changes. -->
6+
7+
## Breaking changes
8+
- [ ] BREAKING: this change introduces breaking API or behavior
9+
10+
## Review focus
11+
<!-- Highlight areas that need the most attention from reviewers. -->
12+
13+
## Checklist
14+
- [ ] Tests added or updated
15+
- [ ] `mvn -q verify` passes
16+
- [ ] Documentation updated (README, docs, etc.)
17+
- [ ] No unused imports

‎.github/workflows/ci.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [main, develop]
6+
pull_request:
7+
branches: [main, develop]
8+
9+
jobs:
10+
build:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- uses: actions/checkout@v5
14+
- uses: actions/setup-java@v5
15+
with:
16+
java-version: '21'
17+
distribution: 'temurin'
18+
cache: 'maven'
19+
- name: Build with Maven
20+
run: mvn -q verify
21+
- name: Upload surefire reports
22+
if: always()
23+
uses: actions/upload-artifact@v4
24+
with:
25+
name: surefire-reports
26+
path: '**/target/surefire-reports'
27+
if-no-files-found: ignore
28+
- name: Upload JaCoCo coverage
29+
if: always()
30+
uses: actions/upload-artifact@v4
31+
with:
32+
name: jacoco-exec
33+
path: '**/target/jacoco.exec'
34+
if-no-files-found: ignore
35+
- name: Upload coverage to Codecov
36+
uses: codecov/codecov-action@v5
37+
with:
38+
files: '**/target/site/jacoco/jacoco.xml'
39+
token: ${{ secrets.CODECOV_TOKEN }}
40+
- name: Upload test results to Codecov
41+
if: ${{ !cancelled() }}
42+
uses: codecov/test-results-action@v1
43+
with:
44+
token: ${{ secrets.CODECOV_TOKEN }}
45+
files: '**/target/surefire-reports/*.xml'
46+

‎.github/workflows/enforce_conventional_commits.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: Conventional Commits
2+
3+
permissions:
4+
contents: read
5+
pull-requests: read
6+
7+
on:
8+
pull_request:
9+
branches:
10+
- main
11+
- develop
12+
13+
jobs:
14+
commit-lint:
15+
name: Verify Conventional Commits
16+
if: (github.event_name == 'pull_request' && !startsWith(github.event.pull_request.head.ref, 'release-please--'))
17+
runs-on: ubuntu-latest
18+
19+
steps:
20+
- name: Checkout
21+
uses: actions/checkout@v5
22+
with:
23+
fetch-depth: 0
24+
25+
- name: Check Commit Messages
26+
uses: wagoid/commitlint-github-action@v6
27+
with:
28+
configFile: .commitlintrc.yml
29+
token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/google-java-format.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: Format
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
8+
permissions:
9+
contents: write
10+
11+
jobs:
12+
13+
formatting:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- uses: actions/checkout@v5 # v2 minimum required
17+
- name: Set up JDK 21
18+
uses: actions/setup-java@v5
19+
with:
20+
distribution: 'temurin'
21+
java-version: '21'
22+
- uses: axel-op/googlejavaformat-action@v4
23+
with:
24+
args: "--replace"
25+
# Recommended if you use MacOS:
26+
github-token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/qodana.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: Qodana
2+
on:
3+
workflow_dispatch:
4+
pull_request:
5+
push:
6+
branches:
7+
- main
8+
- develop
9+
10+
jobs:
11+
qodana:
12+
runs-on: ubuntu-latest
13+
permissions:
14+
contents: write
15+
pull-requests: write
16+
checks: write
17+
steps:
18+
- uses: actions/checkout@v3
19+
with:
20+
ref: ${{ github.event.pull_request.head.sha }} # to check out the actual pull request commit, not the merge commit
21+
fetch-depth: 0 # a full history is required for pull request analysis
22+
- name: 'Qodana Scan'
23+
uses: JetBrains/qodana-action@v2025.2
24+
with:
25+
pr-mode: false
26+
env:
27+
QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}
28+
QODANA_ENDPOINT: 'https://qodana.cloud'

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,3 +32,4 @@ logs/
3232
*.swp
3333
*.swo
3434
*~
35+
/.claude/

‎CHANGELOG.md‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# Changelog
2+
3+
All notable changes to this project will be documented in this file.
4+
5+
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
6+
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7+
8+
## [Unreleased]
9+
10+
### Fixed
11+
12+
- Add null checks for upstream response body in NIP-11 handlers
13+
- Use system Maven instead of wrapper in CI workflow
14+
15+
### Changed
16+
17+
- Update `actions/setup-java` to v5 in google-java-format workflow
18+
19+
### Security
20+
21+
- Upgrade Spring Boot 3.5.5 → 3.5.8 (fixes CVE-2025-41249, CVE-2025-41254, CVE-2025-55754, CVE-2025-11226)
22+
- Upgrade commons-lang3 3.17.0 → 3.18.0 (fixes CVE-2025-48924)
23+
- Upgrade commons-compress 1.24.0 → 1.27.1 (fixes CVE-2024-25710, CVE-2024-26308)
24+
25+
## [0.1.1] - 2026-01-06
26+
27+
### Fixed
28+
29+
- Enforce auth requirement for REQ messages when `require-auth=true`
30+
31+
## [0.1.0] - 2026-01-06
32+
33+
### Added
34+
35+
- Initial standalone nostr-auth-proxy project
36+
- NIP-42 client authentication with BIP-340 signature verification
37+
- WebSocket proxy to upstream Nostr relays (strfry)
38+
- Session management with per-pubkey connection limits
39+
- Access control modes: open, allowlist, blocklist
40+
- Protection for privacy-sensitive event kinds (DMs, wallet data, etc.)
41+
- Spring Boot Actuator health checks and Prometheus metrics
42+
- Docker image support via Jib
43+
44+
[Unreleased]: https://github.com/tcheeric/nostr-auth-proxy/compare/v0.1.1...HEAD
45+
[0.1.1]: https://github.com/tcheeric/nostr-auth-proxy/compare/v0.1.0...v0.1.1
46+
[0.1.0]: https://github.com/tcheeric/nostr-auth-proxy/releases/tag/v0.1.0

‎pom.xml‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,13 @@
88
<parent>
99
<groupId>org.springframework.boot</groupId>
1010
<artifactId>spring-boot-starter-parent</artifactId>
11-
<version>3.5.5</version>
11+
<version>3.5.8</version>
1212
<relativePath/>
1313
</parent>
1414

1515
<groupId>xyz.tcheeric</groupId>
1616
<artifactId>nostr-auth-proxy</artifactId>
17-
<version>0.1.0</version>
17+
<version>0.1.1</version>
1818
<packaging>jar</packaging>
1919

2020
<name>Nostr Auth Proxy</name>
@@ -26,8 +26,21 @@
2626
<bcprov-jdk18on.version>1.81</bcprov-jdk18on.version>
2727
<testcontainers.version>1.20.4</testcontainers.version>
2828
<awaitility.version>4.3.0</awaitility.version>
29+
<!-- Override transitive dependency versions for CVE fixes -->
30+
<commons-lang3.version>3.18.0</commons-lang3.version>
2931
</properties>
3032

33+
<dependencyManagement>
34+
<dependencies>
35+
<!-- CVE-2024-25710, CVE-2024-26308: fix in 1.26.0+ -->
36+
<dependency>
37+
<groupId>org.apache.commons</groupId>
38+
<artifactId>commons-compress</artifactId>
39+
<version>1.27.1</version>
40+
</dependency>
41+
</dependencies>
42+
</dependencyManagement>
43+
3144
<distributionManagement>
3245
<repository>
3346
<id>reposilite-releases</id>

0 commit comments

Comments
 (0)