lfg2025/archy
1
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases 3 Wiki Activity
Files
v2.1.21
archy/docker/podsteadr/podsteadr-archipelago.patch
T

1047 lines
42 KiB
Diff
Raw Permalink Blame History

diff --git a/server/src/app.test.ts b/server/src/app.test.ts
index 3db2e8c..8146129 100644
--- a/server/src/app.test.ts
+++ b/server/src/app.test.ts
@@ -34,10 +34,10 @@ beforeAll(async () => {
DATA_DIR: dataDir,
PUBLIC_URL: 'http://localhost:8095',
NOSTR_RELAYS: '', // no relay publishing in tests
+ PODSTEADR_ADMIN_PUBKEYS: pk,
} as NodeJS.ProcessEnv);
app = await buildApp({ config, dbPath: ':memory:', logger: false });
});
-
afterAll(async () => {
await app.close();
rmSync(dataDir, { recursive: true, force: true });
@@ -57,7 +57,7 @@ describe('auth', () => {
});
expect(res.statusCode).toBe(200);
expect(res.json().pubkey).toBe(pk);
- expect(res.json().isAdmin).toBe(true); // first login claims admin
+ expect(res.json().isAdmin).toBe(true); // operator-bound login claims admin
const setCookie = res.headers['set-cookie'] as string;
expect(setCookie).toContain('podsteadr_session=');
cookie = setCookie.split(';')[0];
@@ -73,7 +73,7 @@ describe('auth', () => {
});
it('serves /api/auth/me with the session cookie', async () => {
- const res = await app.inject({ method: 'GET', url: '/api/auth/me', headers: { cookie } });
+ const res = await app.inject({ method: 'GET', url: '/api/auth/me', headers: { cookie, origin: 'http://localhost:8095' } });
expect(res.statusCode).toBe(200);
expect(res.json().pubkey).toBe(pk);
});
@@ -87,7 +87,7 @@ describe('podcasts, episodes, feed', () => {
const res = await app.inject({
method: 'POST',
url: '/api/podcasts',
- headers: { cookie },
+ headers: { cookie, origin: 'http://localhost:8095' },
payload: {
title: 'My Show',
description: 'About things',
@@ -111,7 +111,7 @@ describe('podcasts, episodes, feed', () => {
const res = await app.inject({
method: 'POST',
url: `/api/podcasts/${podcastId}/episodes`,
- headers: { cookie },
+ headers: { cookie, origin: 'http://localhost:8095' },
payload: { title: 'Ep 1', sha256: sha, size: 1000, mime: 'video/mp4' },
});
expect(res.statusCode).toBe(201);
@@ -132,7 +132,7 @@ describe('podcasts, episodes, feed', () => {
const res = await app.inject({
method: 'POST',
url: `/api/podcasts/${podcastId}/episodes`,
- headers: { cookie },
+ headers: { cookie, origin: 'http://localhost:8095' },
payload: { title: 'Bad', sha256: 'd'.repeat(64), size: 1000 },
});
expect(res.statusCode).toBe(422);
@@ -167,7 +167,7 @@ describe('streams + mediamtx auth webhook', () => {
const res = await app.inject({
method: 'POST',
url: '/api/streams',
- headers: { cookie },
+ headers: { cookie, origin: 'http://localhost:8095' },
payload: { title: 'Live Test', summary: 'hi', hashtags: ['podsteadr'] },
});
expect(res.statusCode).toBe(201);
@@ -228,7 +228,7 @@ describe('streams + mediamtx auth webhook', () => {
const rot = await app.inject({
method: 'POST',
url: `/api/streams/${streamId}/rotate-key`,
- headers: { cookie },
+ headers: { cookie, origin: 'http://localhost:8095' },
});
expect(rot.statusCode).toBe(200);
const oldKey = await app.inject({
@@ -258,7 +258,7 @@ describe('settings', () => {
const res = await app.inject({
method: 'PUT',
url: '/api/settings',
- headers: { cookie },
+ headers: { cookie, origin: 'http://localhost:8095' },
payload: { blossom_url: 'https://blossom.example.com' },
});
expect(res.statusCode).toBe(200);
@@ -290,7 +290,7 @@ describe('settings', () => {
const res = await app.inject({
method: 'PUT',
url: '/api/settings',
- headers: { cookie: cookie2 },
+ headers: { cookie: cookie2, origin: 'http://localhost:8095' },
payload: { blossom_url: 'https://evil.example.com' },
});
expect(res.statusCode).toBe(403);
diff --git a/server/src/auth-bootstrap.test.ts b/server/src/auth-bootstrap.test.ts
new file mode 100644
index 0000000..1a5d8c7
--- /dev/null
+++ b/server/src/auth-bootstrap.test.ts
@@ -0,0 +1,92 @@
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { afterEach, describe, expect, it } from 'vitest';
+import { finalizeEvent, generateSecretKey, getPublicKey } from 'nostr-tools/pure';
+import type { FastifyInstance } from 'fastify';
+import { buildApp } from './app.js';
+import { loadConfig } from './config.js';
+
+const apps: FastifyInstance[] = [];
+const dirs: string[] = [];
+
+function loginHeader(secretKey: Uint8Array): string {
+ const event = finalizeEvent(
+ {
+ kind: 27235,
+ created_at: Math.floor(Date.now() / 1000),
+ content: '',
+ tags: [
+ ['u', 'http://localhost:8095/api/auth/login'],
+ ['method', 'POST'],
+ ['nonce', randomUUID()],
+ ],
+ },
+ secretKey,
+ );
+ return `Nostr ${Buffer.from(JSON.stringify(event)).toString('base64')}`;
+}
+
+async function open(dataDir: string, bindings: string): Promise<FastifyInstance> {
+ const config = loadConfig({
+ DATA_DIR: dataDir,
+ PUBLIC_URL: 'http://localhost:8095',
+ NOSTR_RELAYS: '',
+ PODSTEADR_ADMIN_PUBKEYS: bindings,
+ } as NodeJS.ProcessEnv);
+ const app = await buildApp({ config, logger: false });
+ apps.push(app);
+ return app;
+}
+
+async function login(app: FastifyInstance, secretKey: Uint8Array) {
+ return app.inject({
+ method: 'POST',
+ url: '/api/auth/login',
+ headers: { authorization: loginHeader(secretKey) },
+ });
+}
+
+afterEach(async () => {
+ for (const app of apps.splice(0)) await app.close();
+ for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true });
+});
+
+describe('login bootstrap authorization', () => {
+ it('admits users but reserves first-admin claim for a bound identity', async () => {
+ const dataDir = mkdtempSync(join(tmpdir(), 'podsteadr-bootstrap-'));
+ dirs.push(dataDir);
+ const boundKey = generateSecretKey();
+ const unboundKey = generateSecretKey();
+ const app = await open(dataDir, getPublicKey(boundKey));
+
+ const unbound = await login(app, unboundKey);
+ expect(unbound.statusCode).toBe(200);
+ expect(unbound.json().isAdmin).toBe(false);
+
+ const bound = await login(app, boundKey);
+ expect(bound.statusCode).toBe(200);
+ expect(bound.json().isAdmin).toBe(true);
+ expect(app.ctx.db.prepare('SELECT COUNT(*) AS n FROM users').get()).toEqual({ n: 2 });
+ });
+
+ it('preserves the existing admin and users when bindings change across restart', async () => {
+ const dataDir = mkdtempSync(join(tmpdir(), 'podsteadr-bootstrap-'));
+ dirs.push(dataDir);
+ const originalKey = generateSecretKey();
+ const replacementKey = generateSecretKey();
+ const originalPubkey = getPublicKey(originalKey);
+
+ const first = await open(dataDir, originalPubkey);
+ expect((await login(first, originalKey)).json().isAdmin).toBe(true);
+ await first.close();
+ apps.splice(apps.indexOf(first), 1);
+
+ const reopened = await open(dataDir, getPublicKey(replacementKey));
+ expect((await login(reopened, replacementKey)).json().isAdmin).toBe(false);
+ expect((await login(reopened, originalKey)).json().isAdmin).toBe(true);
+ expect(reopened.ctx.settings.get('admin_pubkey')).toBe(originalPubkey);
+ expect(reopened.ctx.db.prepare('SELECT COUNT(*) AS n FROM users').get()).toEqual({ n: 2 });
+ });
+});
diff --git a/server/src/auth-origin.test.ts b/server/src/auth-origin.test.ts
new file mode 100644
index 0000000..683259b
--- /dev/null
+++ b/server/src/auth-origin.test.ts
@@ -0,0 +1,143 @@
+import { randomUUID } from 'node:crypto';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { finalizeEvent, generateSecretKey, getPublicKey } from 'nostr-tools/pure';
+import type { FastifyInstance } from 'fastify';
+import { buildApp } from './app.js';
+import { loadConfig } from './config.js';
+
+const publicOrigin = 'http://localhost:8095';
+const additionalOrigin = 'https://podsteadr.example';
+const sk = generateSecretKey();
+const pk = getPublicKey(sk);
+let app: FastifyInstance;
+let dataDir: string;
+let cookie: string;
+
+function nip98Header(url: string, method: string): string {
+ const event = finalizeEvent({
+ kind: 27235,
+ created_at: Math.floor(Date.now() / 1000),
+ content: '',
+ tags: [['u', url], ['method', method], ['nonce', randomUUID()]],
+ }, sk);
+ return `Nostr ${Buffer.from(JSON.stringify(event)).toString('base64')}`;
+}
+
+beforeAll(async () => {
+ dataDir = mkdtempSync(join(tmpdir(), 'podsteadr-origin-test-'));
+ const config = loadConfig({
+ DATA_DIR: dataDir,
+ PUBLIC_URL: publicOrigin,
+ PODSTEADR_TRUSTED_ORIGINS: `${additionalOrigin}/`,
+ NOSTR_RELAYS: '',
+ PODSTEADR_ADMIN_PUBKEYS: pk,
+ } as NodeJS.ProcessEnv);
+ app = await buildApp({ config, dbPath: ':memory:', logger: false });
+ const login = await app.inject({
+ method: 'POST',
+ url: '/api/auth/login',
+ headers: { authorization: nip98Header(`${publicOrigin}/api/auth/login`, 'POST') },
+ });
+ expect(login.statusCode).toBe(200);
+ cookie = (login.headers['set-cookie'] as string).split(';')[0];
+});
+
+afterAll(async () => {
+ await app.close();
+ rmSync(dataDir, { recursive: true, force: true });
+});
+
+describe('cookie Origin and NIP-98 URL binding', () => {
+ it('rejects cookie mutations with missing or untrusted Origin', async () => {
+ for (const origin of [undefined, 'http://localhost:9999', 'null']) {
+ const res = await app.inject({
+ method: 'PUT',
+ url: '/api/settings',
+ headers: origin ? { cookie, origin } : { cookie },
+ payload: {},
+ });
+ expect(res.statusCode).toBe(403);
+ }
+ });
+
+ it('accepts cookie mutations from PUBLIC_URL and explicit configured origins', async () => {
+ for (const origin of [publicOrigin, additionalOrigin]) {
+ const res = await app.inject({
+ method: 'PUT',
+ url: '/api/settings',
+ headers: { cookie, origin },
+ payload: {},
+ });
+ expect(res.statusCode).toBe(200);
+ }
+ });
+
+ it('does not require Origin for safe cookie reads or public reads', async () => {
+ const me = await app.inject({ method: 'GET', url: '/api/auth/me', headers: { cookie } });
+ expect(me.statusCode).toBe(200);
+ const publicRead = await app.inject({
+ method: 'GET',
+ url: '/api/settings/public',
+ headers: { origin: 'https://attacker.example' },
+ });
+ expect(publicRead.statusCode).toBe(200);
+ });
+
+ it('ignores hostile Host and forwarded headers when matching NIP-98 URLs', async () => {
+ const res = await app.inject({
+ method: 'POST',
+ url: '/api/auth/login',
+ headers: {
+ authorization: nip98Header('https://attacker.example/api/auth/login', 'POST'),
+ host: 'attacker.example',
+ 'x-forwarded-host': 'attacker.example',
+ 'x-forwarded-proto': 'https',
+ },
+ });
+ expect(res.statusCode).toBe(401);
+ expect(res.json().error).toMatch(/URL/i);
+ });
+
+ it('accepts NIP-98 URLs bound to an explicitly configured origin', async () => {
+ const res = await app.inject({
+ method: 'POST',
+ url: '/api/auth/login',
+ headers: {
+ authorization: nip98Header(`${additionalOrigin}/api/auth/login`, 'POST'),
+ host: 'attacker.example',
+ 'x-forwarded-host': 'attacker.example',
+ 'x-forwarded-proto': 'http',
+ },
+ });
+ expect(res.statusCode).toBe(200);
+ });
+
+ it('allows an exact NIP-98 mutation without ambient cookie Origin', async () => {
+ const res = await app.inject({
+ method: 'PUT',
+ url: '/api/settings',
+ headers: { authorization: nip98Header(`${publicOrigin}/api/settings`, 'PUT') },
+ payload: {},
+ });
+ expect(res.statusCode).toBe(200);
+ });
+
+ it('protects cookie logout from cross-origin requests', async () => {
+ const rejected = await app.inject({ method: 'POST', url: '/api/auth/logout', headers: { cookie } });
+ expect(rejected.statusCode).toBe(403);
+ const stillValid = await app.inject({ method: 'GET', url: '/api/auth/me', headers: { cookie } });
+ expect(stillValid.statusCode).toBe(200);
+
+ const accepted = await app.inject({
+ method: 'POST',
+ url: '/api/auth/logout',
+ headers: { cookie, origin: publicOrigin },
+ });
+ expect(accepted.statusCode).toBe(200);
+ const ended = await app.inject({ method: 'GET', url: '/api/auth/me', headers: { cookie } });
+ expect(ended.statusCode).toBe(401);
+ });
+});
diff --git a/server/src/config.test.ts b/server/src/config.test.ts
new file mode 100644
index 0000000..8fff033
--- /dev/null
+++ b/server/src/config.test.ts
@@ -0,0 +1,50 @@
+import { describe, expect, it } from 'vitest';
+import { loadConfig } from './config.js';
+
+const a = 'a'.repeat(64);
+const b = 'b'.repeat(64);
+
+describe('operator admin bindings', () => {
+ it('fails closed when no binding is supplied', () => {
+ expect(() => loadConfig({} as NodeJS.ProcessEnv)).toThrow(/PODSTEADR_ADMIN_PUBKEYS/);
+ });
+
+ it.each(['', ' ', 'abc', `${a},`, `${a},${'G'.repeat(64)}`])(
+ 'rejects an empty or malformed binding: %j',
+ (value) => {
+ expect(() => loadConfig({ PODSTEADR_ADMIN_PUBKEYS: value } as NodeJS.ProcessEnv)).toThrow(
+ /Nostr public keys/,
+ );
+ },
+ );
+
+ it('parses multiple bindings without granting access to duplicate entries', () => {
+ const config = loadConfig({ PODSTEADR_ADMIN_PUBKEYS: `${a}, ${b},${a}` } as NodeJS.ProcessEnv);
+ expect(config.PODSTEADR_ADMIN_PUBKEYS).toEqual([a, b]);
+ });
+
+ it('uses PUBLIC_URL plus normalized explicitly configured origins', () => {
+ const config = loadConfig({
+ PUBLIC_URL: 'https://podsteadr.example/app',
+ PODSTEADR_ADMIN_PUBKEYS: a,
+ PODSTEADR_TRUSTED_ORIGINS: 'http://node.local:8095/, https://podsteadr.example',
+ } as NodeJS.ProcessEnv);
+ expect(config.trustedOrigins).toEqual([
+ 'https://podsteadr.example',
+ 'http://node.local:8095',
+ ]);
+ });
+
+ it.each([
+ 'javascript:alert(1)',
+ 'https://user@example.com',
+ 'https://example.com/path',
+ 'https://example.com?query=1',
+ 'https://example.com,#empty',
+ ])('rejects a non-origin trusted entry: %s', (value) => {
+ expect(() => loadConfig({
+ PODSTEADR_ADMIN_PUBKEYS: a,
+ PODSTEADR_TRUSTED_ORIGINS: value,
+ } as NodeJS.ProcessEnv)).toThrow(/invalid trusted origin/);
+ });
+});
diff --git a/server/src/config.ts b/server/src/config.ts
index f2dde7a..c27f866 100644
--- a/server/src/config.ts
+++ b/server/src/config.ts
@@ -1,5 +1,45 @@
import { z } from 'zod';
+const nostrPubkeys = z.string().transform((value, ctx) => {
+ const keys = value.split(',').map((key) => key.trim());
+ if (keys.length === 0 || keys.some((key) => !/^[0-9a-f]{64}$/.test(key))) {
+ ctx.addIssue({
+ code: z.ZodIssueCode.custom,
+ message: 'expected a non-empty comma-separated list of lowercase 64-character Nostr public keys',
+ });
+ return z.NEVER;
+ }
+ return [...new Set(keys)];
+});
+
+const trustedOrigins = z.string().default('').transform((value, ctx) => {
+ if (!value.trim()) return [];
+ const origins: string[] = [];
+ for (const candidate of value.split(',').map((origin) => origin.trim())) {
+ try {
+ const url = new URL(candidate);
+ if (
+ !['http:', 'https:'].includes(url.protocol) ||
+ url.username ||
+ url.password ||
+ url.pathname !== '/' ||
+ url.search ||
+ url.hash
+ ) {
+ throw new Error('not an HTTP(S) origin');
+ }
+ origins.push(url.origin);
+ } catch {
+ ctx.addIssue({
+ code: z.ZodIssueCode.custom,
+ message: `invalid trusted origin: ${candidate || '(empty)'}`,
+ });
+ return z.NEVER;
+ }
+ }
+ return [...new Set(origins)];
+});
+
const envSchema = z.object({
PORT: z.coerce.number().default(8095),
HOST: z.string().default('0.0.0.0'),
@@ -21,14 +61,24 @@ const envSchema = z.object({
NIP98_MAX_SKEW_SECS: z.coerce.number().default(60),
SESSION_TTL_DAYS: z.coerce.number().default(30),
MEDIAMTX_POLL_INTERVAL_MS: z.coerce.number().default(3000),
+ // Archipelago renders this from {{NODE_IDENTITY_PUBKEYS}}. There is no
+ // default: an unbound installation must not fall back to first-login admin.
+ PODSTEADR_ADMIN_PUBKEYS: nostrPubkeys,
+ // Optional additional browser/NIP-98 origins. Forwarded headers never extend
+ // this allow-list; every non-PUBLIC_URL origin must be configured explicitly.
+ PODSTEADR_TRUSTED_ORIGINS: trustedOrigins,
});
-export type Config = z.infer<typeof envSchema> & { defaultRelays: string[] };
+export type Config = z.infer<typeof envSchema> & {
+ defaultRelays: string[];
+ trustedOrigins: string[];
+};
export function loadConfig(env: NodeJS.ProcessEnv = process.env): Config {
const parsed = envSchema.parse(env);
return {
...parsed,
+ trustedOrigins: [...new Set([new URL(parsed.PUBLIC_URL).origin, ...parsed.PODSTEADR_TRUSTED_ORIGINS])],
defaultRelays: parsed.NOSTR_RELAYS.split(',')
.map((r) => r.trim())
.filter(Boolean),
diff --git a/server/src/plugins/nostr-auth.ts b/server/src/plugins/nostr-auth.ts
index b711ae6..0d99bfe 100644
--- a/server/src/plugins/nostr-auth.ts
+++ b/server/src/plugins/nostr-auth.ts
@@ -20,6 +20,10 @@ function nowSecs(): number {
return Math.floor(Date.now() / 1000);
}
+function isSafeMethod(method: string): boolean {
+ return ['GET', 'HEAD', 'OPTIONS'].includes(method.toUpperCase());
+}
+
export interface NostrAuthOptions {
db: DB;
config: Config;
@@ -37,16 +41,20 @@ export default fp(async function nostrAuth(app: FastifyInstance, opts: NostrAuth
app.decorateRequest('userPubkey', null);
- /** Candidate URLs the client may have signed: configured public URL + the Host header it used. */
+ /** Candidate URLs come only from explicitly configured origins. */
function candidateUrls(req: FastifyRequest): string[] {
- const publicOrigin = new URL(config.PUBLIC_URL).origin;
- const urls = [`${publicOrigin}${req.raw.url}`];
- const host = req.headers['x-forwarded-host'] ?? req.headers.host;
- if (host) {
- const proto = (req.headers['x-forwarded-proto'] as string | undefined) ?? 'http';
- urls.push(`${proto}://${host}${req.raw.url}`);
+ return config.trustedOrigins.map((origin) => `${origin}${req.raw.url}`);
+ }
+
+ function hasTrustedOrigin(req: FastifyRequest): boolean {
+ const header = req.headers.origin;
+ if (!header || Array.isArray(header)) return false;
+ try {
+ const url = new URL(header);
+ return url.origin === header && config.trustedOrigins.includes(url.origin);
+ } catch {
+ return false;
}
- return urls;
}
function verifyNip98Request(req: FastifyRequest): string {
@@ -88,16 +96,8 @@ export default fp(async function nostrAuth(app: FastifyInstance, opts: NostrAuth
});
app.decorate('requireAuth', async (req: FastifyRequest, reply: FastifyReply) => {
- // Session cookie first (the normal browser path)…
- const sessionId = req.cookies[SESSION_COOKIE];
- if (sessionId) {
- const row = selectSession.get(sessionId) as { pubkey: string; expires_at: number } | undefined;
- if (row && row.expires_at > nowSecs()) {
- req.userPubkey = row.pubkey;
- return;
- }
- }
- // …then a NIP-98 header (CLI / scripting path).
+ // A NIP-98 header is a request-bound proof and does not rely on cookie
+ // ambient authority. Prefer it even when a stale session cookie is present.
if (req.headers.authorization?.startsWith('Nostr ')) {
try {
req.userPubkey = verifyNip98Request(req);
@@ -109,6 +109,20 @@ export default fp(async function nostrAuth(app: FastifyInstance, opts: NostrAuth
throw err;
}
}
+
+ // Cookie-authenticated mutations require a configured exact Origin. Host
+ // and X-Forwarded-* are deliberately irrelevant to this decision.
+ const sessionId = req.cookies[SESSION_COOKIE];
+ if (sessionId) {
+ const row = selectSession.get(sessionId) as { pubkey: string; expires_at: number } | undefined;
+ if (row && row.expires_at > nowSecs()) {
+ if (!isSafeMethod(req.method) && !hasTrustedOrigin(req)) {
+ return reply.code(403).send({ error: 'untrusted or missing request origin' });
+ }
+ req.userPubkey = row.pubkey;
+ return;
+ }
+ }
return reply.code(401).send({ error: 'not authenticated' });
});
});
diff --git a/server/src/routes/auth.ts b/server/src/routes/auth.ts
index 7c702de..5081d74 100644
--- a/server/src/routes/auth.ts
+++ b/server/src/routes/auth.ts
@@ -25,7 +25,7 @@ export default async function authRoutes(app: FastifyInstance) {
throw err;
}
upsertUser.run(pubkey, nowSecs(), nowSecs());
- settings.claimAdminIfUnset(pubkey);
+ settings.claimAdminIfAuthorized(pubkey);
// Optional profile hints from the client (it has the user's kind-0 metadata).
const body = req.body as { displayName?: string; lud16?: string } | null;
@@ -42,7 +42,7 @@ export default async function authRoutes(app: FastifyInstance) {
return { pubkey, isAdmin: settings.isAdmin(pubkey) };
});
- app.post('/api/auth/logout', async (req, reply) => {
+ app.post('/api/auth/logout', { preHandler: app.requireAuth }, async (req, reply) => {
app.destroySession(req, reply);
return { ok: true };
});
diff --git a/server/src/routes/marketplace.test.ts b/server/src/routes/marketplace.test.ts
index 2b05f70..795d879 100644
--- a/server/src/routes/marketplace.test.ts
+++ b/server/src/routes/marketplace.test.ts
@@ -9,6 +9,8 @@ import type { FastifyInstance } from 'fastify';
// available in this test environment — fake it deterministically so the surrounding purchase
// flow (DB writes, receipt signing, paywall gating) can be verified end to end.
let nextQuote = 0;
+let mintCalls = 0;
+let failNextMint = false;
vi.mock('../services/cashu.js', () => {
class FakeCashuMintClient {
async requestMintQuote(amountSats: number) {
@@ -18,6 +20,11 @@ vi.mock('../services/cashu.js', () => {
return true;
}
async mintAndStore() {
+ mintCalls += 1;
+ if (failNextMint) {
+ failNextMint = false;
+ throw new Error('injected unknown mint outcome');
+ }
return 'fake-proof-row-id';
}
async payout(lud16: string, amountSats: number) {
@@ -41,7 +48,6 @@ vi.mock('../services/cashu.js', () => {
class CashuTokenInvalidError extends Error {}
return { CashuClientPool, CashuUnreachableError, CashuInsufficientFundsError, CashuTokenInvalidError };
});
-
const { buildApp } = await import('../app.js');
const { loadConfig } = await import('../config.js');
@@ -87,6 +93,7 @@ beforeAll(async () => {
DATA_DIR: dataDir,
PUBLIC_URL: 'http://localhost:8095',
NOSTR_RELAYS: '',
+ PODSTEADR_ADMIN_PUBKEYS: producerPk,
} as NodeJS.ProcessEnv);
app = await buildApp({ config, dbPath: ':memory:', logger: false });
@@ -96,7 +103,7 @@ beforeAll(async () => {
const podcastRes = await app.inject({
method: 'POST',
url: '/api/podcasts',
- headers: { cookie: producerCookie },
+ headers: { cookie: producerCookie, origin: 'http://localhost:8095' },
payload: { title: 'Paid Show', lightning_address: 'producer@getalby.com' },
});
podcastId = podcastRes.json().id;
@@ -105,7 +112,7 @@ beforeAll(async () => {
const episodeRes = await app.inject({
method: 'POST',
url: `/api/podcasts/${podcastId}/episodes`,
- headers: { cookie: producerCookie },
+ headers: { cookie: producerCookie, origin: 'http://localhost:8095' },
payload: { title: 'Paid Ep', sha256: sha, size: 1000, mime: 'video/mp4', price_sats: 500 },
});
vi.unstubAllGlobals();
@@ -123,7 +130,7 @@ describe('paywall gating', () => {
const res = await app.inject({
method: 'GET',
url: `/api/podcasts/${podcastId}/episodes/${episodeId}/download-url`,
- headers: { cookie: buyerCookie },
+ headers: { cookie: buyerCookie, origin: 'http://localhost:8095' },
});
expect(res.statusCode).toBe(402);
expect(res.json().price_sats).toBe(500);
@@ -133,7 +140,7 @@ describe('paywall gating', () => {
const res = await app.inject({
method: 'GET',
url: `/api/podcasts/${podcastId}/episodes/${episodeId}/download-url`,
- headers: { cookie: producerCookie },
+ headers: { cookie: producerCookie, origin: 'http://localhost:8095' },
});
expect(res.statusCode).toBe(200);
expect(res.json().url).toContain(`${sha}.mp4`);
@@ -147,7 +154,7 @@ describe('purchase flow', () => {
const res = await app.inject({
method: 'POST',
url: `/api/podcasts/${podcastId}/episodes/${episodeId}/purchase`,
- headers: { cookie: producerCookie },
+ headers: { cookie: producerCookie, origin: 'http://localhost:8095' },
payload: { source: 'producer' },
});
expect(res.statusCode).toBe(400);
@@ -157,7 +164,7 @@ describe('purchase flow', () => {
const res = await app.inject({
method: 'POST',
url: `/api/podcasts/${podcastId}/episodes/${episodeId}/purchase`,
- headers: { cookie: buyerCookie },
+ headers: { cookie: buyerCookie, origin: 'http://localhost:8095' },
payload: { source: 'producer' },
});
expect(res.statusCode).toBe(201);
@@ -170,7 +177,7 @@ describe('purchase flow', () => {
const res = await app.inject({
method: 'POST',
url: `/api/podcasts/${podcastId}/episodes/${episodeId}/purchase/${quoteId}/confirm`,
- headers: { cookie: buyerCookie },
+ headers: { cookie: buyerCookie, origin: 'http://localhost:8095' },
});
expect(res.statusCode).toBe(201);
const purchase = res.json();
@@ -191,16 +198,73 @@ describe('purchase flow', () => {
const res = await app.inject({
method: 'POST',
url: `/api/podcasts/${podcastId}/episodes/${episodeId}/purchase/${quoteId}/confirm`,
- headers: { cookie: buyerCookie },
+ headers: { cookie: buyerCookie, origin: 'http://localhost:8095' },
});
expect(res.statusCode).toBe(200);
});
+ it('fails closed instead of reminting a paid quote after an interrupted confirmation', async () => {
+ const sk = generateSecretKey();
+ const recoveryBuyerPk = getPublicKey(sk);
+ const recoveryCookie = await login(sk);
+ const quoteId = 'interrupted-paid-quote';
+ app.ctx.db.prepare(
+ 'INSERT INTO cashu_quotes (quote_id, purchase_ctx, state, created_at) VALUES (?, ?, ?, ?)',
+ ).run(quoteId, JSON.stringify({
+ episodeId,
+ buyerPubkey: recoveryBuyerPk,
+ source: 'producer',
+ amountSats: 500,
+ }), 'paid', Math.floor(Date.now() / 1000));
+
+ const before = mintCalls;
+ const res = await app.inject({
+ method: 'POST',
+ url: `/api/podcasts/${podcastId}/episodes/${episodeId}/purchase/${quoteId}/confirm`,
+ headers: { cookie: recoveryCookie, origin: 'http://localhost:8095' },
+ });
+ expect(res.statusCode).toBe(409);
+ expect(res.json().error).toMatch(/refusing to mint it again/);
+ expect(mintCalls).toBe(before);
+ });
+
+ it('persists the recovery guard when the mint outcome is unknown', async () => {
+ const sk = generateSecretKey();
+ const recoveryCookie = await login(sk);
+ const requested = await app.inject({
+ method: 'POST',
+ url: `/api/podcasts/${podcastId}/episodes/${episodeId}/purchase`,
+ headers: { cookie: recoveryCookie, origin: 'http://localhost:8095' },
+ payload: { source: 'producer' },
+ });
+ expect(requested.statusCode).toBe(201);
+ const quoteId = requested.json().quoteId as string;
+ failNextMint = true;
+ const before = mintCalls;
+
+ const failed = await app.inject({
+ method: 'POST',
+ url: `/api/podcasts/${podcastId}/episodes/${episodeId}/purchase/${quoteId}/confirm`,
+ headers: { cookie: recoveryCookie, origin: 'http://localhost:8095' },
+ });
+ expect(failed.statusCode).toBe(503);
+ expect(app.ctx.db.prepare('SELECT state FROM cashu_quotes WHERE quote_id = ?').get(quoteId))
+ .toEqual({ state: 'paid' });
+
+ const retry = await app.inject({
+ method: 'POST',
+ url: `/api/podcasts/${podcastId}/episodes/${episodeId}/purchase/${quoteId}/confirm`,
+ headers: { cookie: recoveryCookie, origin: 'http://localhost:8095' },
+ });
+ expect(retry.statusCode).toBe(409);
+ expect(mintCalls).toBe(before + 1);
+ });
+
it('rejects buying the same episode twice', async () => {
const res = await app.inject({
method: 'POST',
url: `/api/podcasts/${podcastId}/episodes/${episodeId}/purchase`,
- headers: { cookie: buyerCookie },
+ headers: { cookie: buyerCookie, origin: 'http://localhost:8095' },
payload: { source: 'producer' },
});
expect(res.statusCode).toBe(400);
@@ -210,7 +274,7 @@ describe('purchase flow', () => {
const res = await app.inject({
method: 'GET',
url: `/api/podcasts/${podcastId}/episodes/${episodeId}/download-url`,
- headers: { cookie: buyerCookie },
+ headers: { cookie: buyerCookie, origin: 'http://localhost:8095' },
});
expect(res.statusCode).toBe(200);
expect(res.json().url).toContain(`${sha}.mp4`);
@@ -232,7 +296,7 @@ describe('paying with a Cashu token', () => {
const podcastRes = await app.inject({
method: 'POST',
url: '/api/podcasts',
- headers: { cookie },
+ headers: { cookie, origin: 'http://localhost:8095' },
payload: { title: 'Token-Paid Show', lightning_address: 'tokenproducer@getalby.com' },
});
tokenPodcastId = podcastRes.json().id;
@@ -241,7 +305,7 @@ describe('paying with a Cashu token', () => {
const episodeRes = await app.inject({
method: 'POST',
url: `/api/podcasts/${tokenPodcastId}/episodes`,
- headers: { cookie },
+ headers: { cookie, origin: 'http://localhost:8095' },
payload: { title: 'Token-Paid Ep', sha256: 'f'.repeat(64), size: 1000, mime: 'video/mp4', price_sats: 500 },
});
vi.unstubAllGlobals();
@@ -255,7 +319,7 @@ describe('paying with a Cashu token', () => {
const res = await app.inject({
method: 'POST',
url: `/api/podcasts/${tokenPodcastId}/episodes/${tokenEpisodeId}/purchase/token`,
- headers: { cookie },
+ headers: { cookie, origin: 'http://localhost:8095' },
payload: { source: 'producer', token: 'fake-token-500' },
});
expect(res.statusCode).toBe(201);
@@ -271,7 +335,7 @@ describe('paying with a Cashu token', () => {
const res = await app.inject({
method: 'POST',
url: `/api/podcasts/${tokenPodcastId}/episodes/${tokenEpisodeId}/purchase/token`,
- headers: { cookie },
+ headers: { cookie, origin: 'http://localhost:8095' },
payload: { source: 'producer', token: 'fake-token-600' },
});
expect(res.statusCode).toBe(201);
@@ -284,7 +348,7 @@ describe('paying with a Cashu token', () => {
const res = await app.inject({
method: 'POST',
url: `/api/podcasts/${tokenPodcastId}/episodes/${tokenEpisodeId}/purchase/token`,
- headers: { cookie },
+ headers: { cookie, origin: 'http://localhost:8095' },
payload: { source: 'producer', token: 'fake-token-100' },
});
expect(res.statusCode).toBe(400);
@@ -297,7 +361,7 @@ describe('paying with a Cashu token', () => {
const res = await app.inject({
method: 'POST',
url: `/api/podcasts/${tokenPodcastId}/episodes/${tokenEpisodeId}/purchase/token`,
- headers: { cookie },
+ headers: { cookie, origin: 'http://localhost:8095' },
payload: { source: 'producer', token: 'not-a-real-token' },
});
expect(res.statusCode).toBe(400);
@@ -316,7 +380,7 @@ describe('resale', () => {
const res = await app.inject({
method: 'POST',
url: `/api/podcasts/${podcastId}/episodes/${episodeId}/resellers`,
- headers: { cookie: strangerCookie },
+ headers: { cookie: strangerCookie, origin: 'http://localhost:8095' },
payload: { download_url: resellerMirrorUrl, price_sats: 300 },
});
expect(res.statusCode).toBe(403);
@@ -329,7 +393,7 @@ describe('resale', () => {
res = await app.inject({
method: 'POST',
url: `/api/podcasts/${podcastId}/episodes/${episodeId}/resellers`,
- headers: { cookie: buyerCookie },
+ headers: { cookie: buyerCookie, origin: 'http://localhost:8095' },
payload: { download_url: resellerMirrorUrl, price_sats: 300 },
});
} finally {
@@ -360,7 +424,7 @@ describe('resale', () => {
const purchaseRes = await app.inject({
method: 'POST',
url: `/api/podcasts/${podcastId}/episodes/${episodeId}/purchase`,
- headers: { cookie: secondBuyerCookie },
+ headers: { cookie: secondBuyerCookie, origin: 'http://localhost:8095' },
payload: { source: buyerPk },
});
expect(purchaseRes.statusCode).toBe(201);
@@ -370,7 +434,7 @@ describe('resale', () => {
const confirmRes = await app.inject({
method: 'POST',
url: `/api/podcasts/${podcastId}/episodes/${episodeId}/purchase/${resellerQuoteId}/confirm`,
- headers: { cookie: secondBuyerCookie },
+ headers: { cookie: secondBuyerCookie, origin: 'http://localhost:8095' },
});
expect(confirmRes.statusCode).toBe(201);
const purchase = confirmRes.json();
@@ -396,20 +460,20 @@ describe('resale', () => {
describe('earnings', () => {
it('credits the producer for both the direct sale and their share of the resale', async () => {
- const res = await app.inject({ method: 'GET', url: '/api/earnings', headers: { cookie: producerCookie } });
+ const res = await app.inject({ method: 'GET', url: '/api/earnings', headers: { cookie: producerCookie, origin: 'http://localhost:8095' } });
expect(res.statusCode).toBe(200);
// 500 sats direct sale + 50% of the 300-sat resale (default resale_producer_share_pct)
expect(res.json().unwithdrawn_sats).toBe(500 + 150);
});
it("credits the reseller for their share of the resale they made", async () => {
- const res = await app.inject({ method: 'GET', url: '/api/earnings', headers: { cookie: buyerCookie } });
+ const res = await app.inject({ method: 'GET', url: '/api/earnings', headers: { cookie: buyerCookie, origin: 'http://localhost:8095' } });
expect(res.statusCode).toBe(200);
expect(res.json().unwithdrawn_sats).toBe(150);
});
it('refuses to withdraw without a lightning address on file', async () => {
- const res = await app.inject({ method: 'POST', url: '/api/earnings/withdraw', headers: { cookie: buyerCookie } });
+ const res = await app.inject({ method: 'POST', url: '/api/earnings/withdraw', headers: { cookie: buyerCookie, origin: 'http://localhost:8095' } });
expect(res.statusCode).toBe(400);
});
@@ -417,19 +481,19 @@ describe('earnings', () => {
const res = await app.inject({
method: 'POST',
url: '/api/earnings/withdraw',
- headers: { cookie: buyerCookie },
+ headers: { cookie: buyerCookie, origin: 'http://localhost:8095' },
payload: { lud16: 'reseller@getalby.com' },
});
expect(res.statusCode).toBe(200);
expect(res.json().paid_sats).toBe(150);
expect(res.json().preimage).toContain('reseller@getalby.com');
- const after = await app.inject({ method: 'GET', url: '/api/earnings', headers: { cookie: buyerCookie } });
+ const after = await app.inject({ method: 'GET', url: '/api/earnings', headers: { cookie: buyerCookie, origin: 'http://localhost:8095' } });
expect(after.json().unwithdrawn_sats).toBe(0);
});
it('remembers the lud16 for next time', async () => {
- const res = await app.inject({ method: 'GET', url: '/api/auth/me', headers: { cookie: buyerCookie } });
+ const res = await app.inject({ method: 'GET', url: '/api/auth/me', headers: { cookie: buyerCookie, origin: 'http://localhost:8095' } });
expect(res.json().lud16).toBe('reseller@getalby.com');
});
});
diff --git a/server/src/routes/marketplace.ts b/server/src/routes/marketplace.ts
index 9179341..6a79a5d 100644
--- a/server/src/routes/marketplace.ts
+++ b/server/src/routes/marketplace.ts
@@ -130,6 +130,11 @@ export default async function marketplaceRoutes(app: FastifyInstance) {
if (quoteRow.state === 'settled') {
return getPurchase.get(eid, ctx.buyerPubkey) as Purchase;
}
+ if (quoteRow.state === 'paid') {
+ return reply.code(409).send({
+ error: 'paid quote requires recovery; refusing to mint it again',
+ });
+ }
// Resolve seller(s) + split now, at confirm time, rather than trusting whatever was
// true when the quote was requested (a reseller could have been revoked meanwhile).
@@ -161,7 +166,31 @@ export default async function marketplaceRoutes(app: FastifyInstance) {
const paid = await cashu.isQuotePaid(quoteId);
if (!paid) return reply.code(402).send({ error: 'invoice not paid yet' });
- await cashu.mintAndStore(ctx.amountSats, quoteId);
+ // Claim this paid quote before the externally visible mint operation.
+ // Only one confirmer can move pending -> paid. If the process stops after
+ // this point, a retry fails closed instead of attempting a second mint.
+ // Completing an interrupted `paid` quote needs mint-side reconciliation;
+ // it must never request another invoice or blindly mint again.
+ const claimed = db.prepare(
+ "UPDATE cashu_quotes SET state = 'paid' WHERE quote_id = ? AND state = 'pending'",
+ ).run(quoteId).changes;
+ if (claimed !== 1) {
+ const current = getQuote.get(quoteId) as { state: string } | undefined;
+ if (current?.state === 'settled') {
+ return getPurchase.get(eid, ctx.buyerPubkey) as Purchase;
+ }
+ return reply.code(409).send({
+ error: 'paid quote requires recovery; refusing to mint it again',
+ });
+ }
+
+ try {
+ await cashu.mintAndStore(ctx.amountSats, quoteId);
+ } catch {
+ return reply.code(503).send({
+ error: 'mint outcome requires recovery; refusing automatic retry',
+ });
+ }
const purchaseId = randomUUID();
const receipt = await publisher.publishPurchaseReceipt(settings.all().relays, {
diff --git a/server/src/services/settings.test.ts b/server/src/services/settings.test.ts
new file mode 100644
index 0000000..7cd0fe1
--- /dev/null
+++ b/server/src/services/settings.test.ts
@@ -0,0 +1,52 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import { loadConfig } from '../config.js';
+import { openDatabase, type DB } from '../db/database.js';
+import { SettingsService } from './settings.js';
+
+const boundA = 'a'.repeat(64);
+const boundB = 'b'.repeat(64);
+const unbound = 'c'.repeat(64);
+const databases: DB[] = [];
+
+function service(bindings: string, db = openDatabase(':memory:')): { db: DB; settings: SettingsService } {
+ databases.push(db);
+ const config = loadConfig({ PODSTEADR_ADMIN_PUBKEYS: bindings } as NodeJS.ProcessEnv);
+ return { db, settings: new SettingsService(db, config) };
+}
+
+afterEach(() => {
+ for (const db of databases.splice(0)) {
+ if (db.open) db.close();
+ }
+});
+
+describe('operator-bound first-admin bootstrap', () => {
+ it('does not let an earlier unbound user claim administrator authority', () => {
+ const { db, settings } = service(`${boundA},${boundB}`);
+ db.prepare(
+ 'INSERT INTO users (pubkey, created_at, last_login_at) VALUES (?, ?, ?)',
+ ).run(unbound, 1, 1);
+
+ expect(settings.claimAdminIfAuthorized(unbound)).toBe(false);
+ expect(settings.get('admin_pubkey')).toBeNull();
+ expect(settings.claimAdminIfAuthorized(boundA)).toBe(true);
+ expect(settings.get('admin_pubkey')).toBe(boundA);
+ });
+
+ it('never reassigns an existing administrator to another bound identity', () => {
+ const { settings } = service(`${boundA},${boundB}`);
+ expect(settings.claimAdminIfAuthorized(boundA)).toBe(true);
+ expect(settings.claimAdminIfAuthorized(boundB)).toBe(false);
+ expect(settings.get('admin_pubkey')).toBe(boundA);
+ });
+
+ it('preserves an existing administrator even when current bindings differ', () => {
+ const db = openDatabase(':memory:');
+ db.prepare('INSERT INTO settings (key, value) VALUES (?, ?)').run('admin_pubkey', unbound);
+ const { settings } = service(`${boundA},${boundB}`, db);
+
+ expect(settings.isAdmin(unbound)).toBe(true);
+ expect(settings.claimAdminIfAuthorized(boundA)).toBe(false);
+ expect(settings.get('admin_pubkey')).toBe(unbound);
+ });
+});
diff --git a/server/src/services/settings.ts b/server/src/services/settings.ts
index 713e5de..a81781e 100644
--- a/server/src/services/settings.ts
+++ b/server/src/services/settings.ts
@@ -56,9 +56,22 @@ export class SettingsService {
return publicBlossomUrl;
}
- /** First pubkey to ever log in becomes the admin. */
- claimAdminIfUnset(pubkey: string): void {
- if (!this.get('admin_pubkey')) this.set('admin_pubkey', pubkey);
+ /**
+ * Claim an uninitialised installation only for an operator-bound identity.
+ *
+ * INSERT OR IGNORE makes competing first logins atomic. An existing admin is
+ * deliberately never changed here, including when the node identity list is
+ * later edited; reassignment requires a separate explicit migration policy.
+ */
+ claimAdminIfAuthorized(pubkey: string): boolean {
+ const existing = this.get('admin_pubkey');
+ if (existing) return existing === pubkey;
+ if (!this.config.PODSTEADR_ADMIN_PUBKEYS.includes(pubkey)) return false;
+
+ this.db
+ .prepare('INSERT OR IGNORE INTO settings (key, value) VALUES (?, ?)')
+ .run('admin_pubkey', pubkey);
+ return this.isAdmin(pubkey);
}
isAdmin(pubkey: string): boolean {
Reference in New Issue View Git Blame Copy Permalink