lfg2025/archy
1
0
Fork 0
Code Issues 24 Pull Requests 4 Actions Packages Projects Releases 71 Wiki Activity

docs: record the end-to-end Nostr login proof through the gate

Browse Source 
The node signed a real NIP-98 event with its own key and presented it to
IndeeHub through the gate: 200, with a real JWT pair issued. The app's own
bearer token then rides back through the gate — /api/auth/me,
/api/projects/private and /api/projects all 200, matching loopback.
/api/projects/private was the endpoint recorded as unreachable without a
Nostr session, so item 4's private-films path is unblocked.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
archipelago
2026-08-06 20:19:11 -04:00
co-authored by Claude Opus 5
parent 3d4d329787
commit aeb40b93d9
1 changed files with 17 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.planning/RESUME-2026-08-06-media-loop.md
+17 -1
View File
@@ -56,7 +56,23 @@ Live proof on archi-dev-box, authenticated with a real gate session:
that authenticate with the `Authorization` header (Vaultwarden, Jellyfin, Nextcloud/WebDAV,
Gitea tokens, Grafana). Same mechanism — not individually retested.
Still needs a human: an actual extension login in a browser.
**End-to-end proof, no browser required** (2026-08-06 ~20:20). The node signed a real
NIP-98 event with its own key via RPC (`auth.login` → `node.nostr-pubkey` →
`node.nostr-sign`, CSRF header required for the sign) and presented it to IndeeHub
**through the gate**, exactly as `nostr-provider.js` does:
- `POST :7778/api/auth/nostr/session` → **200**, IndeeHub issued a real JWT pair
(`typ: nostr-session` / `nostr-refresh`, `sub` = the node's pubkey). A complete
Nostr login.
- Then the app's OWN bearer token back through the gate — the other half of the fix:
`/api/auth/me` **200**, `/api/projects/private` **200**, `/api/projects` **200**,
each identical to loopback.
`/api/projects/private` was the endpoint recorded here as unreachable without a Nostr
session; it now answers 200 through the gate. Item 4's private-films path is unblocked.
Still worth a human pass: a real NIP-07 **browser extension** login (this proved the
transport and the app's acceptance, using the node's key rather than the extension's).
### 2. AI Data Access grants → node-side (unblocks everything AI)
`aiPermissions.ts` uses `localStorage` (`archipelago-ai-permissions`), which is PER-ORIGIN.