cameri/nostream v3.1.0

on GitHub

Minor Changes

• #756 570a7cc Thanks @Priyanshubhartistm! - feat: add relay-load-aware adaptive PoW difficulty (NIP-13)

  Adds limits.event.pow settings that scale the required proof-of-work difficulty between a
  configured floor and ceiling based on the observed event rate, in place of the existing static
  eventId.minLeadingZeroBits value (the static pubkey.minLeadingZeroBits check is unaffected and
  still enforced independently). The event rate is tracked per worker process with the same EWMA
  shape already used by the relay's rate limiter. Disabled by default
  (limits.event.pow.enabled: false), so existing static PoW configuration is unaffected unless
  explicitly opted in.

• #641 837540b Thanks @Ferryx349! - feat: add disabled-by-default admin API with password auth, session, and health endpoints

• #666 44f3bb4 Thanks @Ferryx349! - feat: add admin observability dashboard with Grafana embed and provisioned metrics panels

• #653 8ab4825 Thanks @Ferryx349! - feat: add OpenTelemetry metrics bootstrap with OTLP export for Prometheus

• #661 237b1a4 Thanks @Ferryx349! - feat: instrument event and websocket handlers with OpenTelemetry metrics

• #662 36d95cc Thanks @Ferryx349! - feat: add Prometheus-backed admin metrics SSE endpoint

• #753 7c2875e Thanks @Ferryx349! - feat(admin): add GET /admin/network-health endpoint

• #764 ff43cd3 Thanks @Ferryx349! - feat(admin): add Network Health panel to observability dashboard

  Adds a dashboard section that renders the latest NIP-66 probe snapshot with per-target DNS, TLS, WebSocket RTT, and NIP-11 status.

• #784 c6c4c4f Thanks @Ferryx349! - feat(admin): add GET/PATCH /admin/notifications API for operator alert config

  Closes #760.

• #787 de7c9df Thanks @Ferryx349! - feat(admin): add notifications console page for operator alerts

  Adds a Notifications view to the admin dashboard for configuring targets and
  event toggles, testing delivery, and browsing the delivery log via the admin API.

  Closes #761

• #690 f70adf2 Thanks @Ferryx349! - feat: add authenticated admin settings API endpoints

• #706 841833f Thanks @Ferryx349! - feat: add settings editor tab to admin dashboard UI

• #770 07524eb Thanks @Priyanshubhartistm! - feat: add WoT-weighted NIP-56 content reporting

  Accepts and stores kind-1984 report events, weighting each report by the reporter's WoT distance
  from wot.seedPubkey (full weight for a direct follow, halving each additional hop, zero for a
  pubkey outside the trust graph). Reports from a nip56.trustedModerators pubkey always get maximum
  weight and are flagged actionable, ready for a future management-API surface to act on; every other
  report is stored for manual review only. Disabled by default (nip56.enabled: false).

• #734 fd7f56a Thanks @Priyanshubhartistm! - feat(dvm): dispatch pending DVM jobs to worker processes and publish kind 6000-6999 results back

• #729 275c30c Thanks @Priyanshubhartistm! - feat(dvm): trap NIP-90 job request events (kind 5000-5999) and record them via the job repository

• #727 d00eb42 Thanks @Priyanshubhartistm! - feat(dvm): add job persistence migration and repository for DVM job state

• #737 9f36191 Thanks @Priyanshubhartistm! - feat(dvm): add NIP-89 handler recommendation/information kinds and verify passive accept-and-serve

• #721 11ec673 Thanks @Priyanshubhartistm! - feat(dvm): add worker registry settings and dvm-orchestrator process topology

• #587 30fa252 Thanks @Anshumancanrock! - Add NIP-50 full-text search support with PostgreSQL tsvector/GIN indexing.

  Clients can now include a search field in REQ filter objects to perform full-text
  queries against event content. Results are ranked by relevance (ts_rank) instead
  of the usual created_at ordering, per the NIP-50 specification.

  Features:

  • New search filter field accepted in REQ messages
  • PostgreSQL GIN index on to_tsvector('simple', event_content) for fast full-text lookups
  • Configurable text-search language (defaults to simple, supports english, spanish, etc.)
  • Configurable max search query length for abuse prevention
  • NIP-50 listed in NIP-11 relay information document
  • Search can be combined with all existing filter fields (kinds, authors, tags, etc.)

• #702 e172cce Thanks @Anshumancanrock! - feat(nip42): enforce authentication on reads for restricted event kinds (encrypted DMs, gift wraps) across REQ, live broadcasts and COUNT

• #716 2f5a1c0 Thanks @Anshumancanrock! - feat(nip42): add session tracking with optional TTL and publish-time authRequired (NIP-11 restricted_writes)

• #732 d413bd6 Thanks @Anshumancanrock! - Add a CLI to mint NIP-43 invite codes (nostream invite create) so operators can issue a claim without SQL. New codes honor nip43.defaultMaxUses and nip43.inviteCodeExpirySeconds.

• #650 3461dfe Thanks @Anshumancanrock! - Add NIP-43 invite code foundation: InviteCodeRepository with atomic claimCode, invite_codes migration, and event kind/tag constants.

• #738 a0853db Thanks @Anshumancanrock! - feat(nip43): issue kind 28935 invite codes on request

  NIP-43 kind 28935 is not an event clients publish — it is a REQ the relay answers by
  minting an invite code on the fly and returning a relay-signed ephemeral event. Nostream
  now serves those subscriptions, completing the membership flow: request a claim, join with
  kind 28934, publish.

  Off by default. It requires nip43.enabled and the new nip43.allowInviteRequests, a
  NIP-42 authenticated requester, an info.self consistent with the relay signing key, and a
  per-pubkey budget under the new limits.invite.rateLimits (5/hour by default). This also
  makes the previously inert nip43.inviteRequestWhitelist setting take effect. The minted
  event is never persisted and never broadcast: the claim tag is a bearer secret and is sent
  only to the socket that asked for it.

  Two fixes the flow depended on. The relay signs its own events with a key derived from
  SECRET, but info.self was a hand-edited string that nothing validated — by default it
  was a placeholder that is not a pubkey at all, so any NIP-43 client verifying a relay-signed
  event against self would reject it. info.self is now optional: when unset or unparseable,
  NIP-11 advertises the derived signing pubkey instead, and nostream info prints that pubkey
  so operators can pin it.

  Kind 28935 also sits in the ephemeral range, so a client-published one fell through to
  EphemeralEventStrategy and was broadcast to every subscriber — including everyone
  subscribed to kind 28935 waiting for a real invite. Anyone could inject a forged claim tag
  into that subscription. It is now rejected with an OK false and never broadcast, and
  bypasses the NIP-43 admission gate so that rejection actually reaches non-members, who are
  the ones most likely to publish it by mistake while trying to obtain a code.

  CLI.md and README.md now describe the request flow. CLI.md previously claimed the relay
  "does not yet generate kind 28935 on REQ", and never mentioned that nostream info
  prints the signing pubkey that CONFIGURATION.md tells operators to pin.

• #676 0bfa0b5 Thanks @Anshumancanrock! - Add NIP-43 join/leave request event strategies (kinds 28934/28936) with NIP-42 auth enforcement, created_at freshness validation, invite code claiming, and admission management. When nip43.enabled is set, publishing is restricted to admitted members even without payments enabled, and NIP-43 is advertised in the NIP-11 document (hidden when disabled). Join/leave update the admission cache so membership changes take effect immediately.

• #675 5a70839 Thanks @Ferryx349! - feat(nip66): add shared relay probe engine for DNS, TLS, WebSocket RTT, and NIP-11 checks

• #741 afa8999 Thanks @Ferryx349! - feat(nip66): publish kind 30166 and 10166 relay health events after probe runs

  After each relay monitor probe run, sign and store NIP-66 relay discovery and monitor
  announcement events using the configured monitor identity, bootstrap kind 0/10002 on
  first run, and persist via the existing parameterized replaceable event path.

  Fixes #696

• #724 d14b1e9 Thanks @Ferryx349! - feat(nip66): add RelayMonitorWorker cluster worker and probe scheduler

• #689 e294a71 Thanks @Ferryx349! - Add NIP-66 relay monitor settings foundation with defaults for probe interval, timeouts, targets, monitor identity, and DNS cache TTL.

• #644 2f6d773 Thanks @Anshumancanrock! - feat: reject NIP-70 protected events and reposts embedding them

• #730 ef4123e Thanks @Anshumancanrock! - feat(admin): accept NIP-98 Authorization on protected admin API routes

• #722 cf5ea4f Thanks @Anshumancanrock! - feat(nip98): add Authorization header event verifier for HTTP auth (kind 27235)

• #781 8d29f15 Thanks @Ferryx349! - feat(admin): operator notification backend with Postgres outbox

  Adds transactional outbox dispatch for operator alerts (HTTP, Discord, Slack, Telegram), delivery log, admin.notifications settings, event hooks for admission invoices and settings changes, and admin test/history endpoints. Closes #759.

• #763 358763a Thanks @Ferryx349! - feat(ops): add /readyz readiness probe for Postgres and Redis

  Adds a public readiness endpoint for zero-downtime deploy workflows. HAProxy (or similar) can use /readyz to confirm an instance can serve traffic before cutover, while /healthz remains a lightweight liveness check.

• #672 595c0a6 Thanks @Ferryx349! - refactor: extract shared settings-config module and guided schema for admin settings editor foundation

• #779 f6ee3e3 Thanks @Priyanshubhartistm! - feat: wire the WoT graph into adaptive PoW difficulty

  Adds limits.event.pow.wotThresholds, letting operators reduce (or bypass) the eventId PoW
  requirement for pubkeys within their configured WoT distance. A direct follow can post instantly
  under load while an unknown pubkey pays the full adaptive difficulty. Disabled by default (no
  thresholds configured); requires wot.enabled to have any effect, since a pubkey's distance is
  otherwise always unknown.

• #745 276fe16 Thanks @Priyanshubhartistm! - feat: add a Web of Trust graph service that tracks NIP-02 follow distance from an operator-configured seed pubkey

  Adds a WotGraphService that builds a trust graph rooted at wot.seedPubkey, updated in real
  time as kind-3 contact list events are ingested, with configurable depth (wot.maxDepth) and a
  minimum-followers threshold for 2+ hop trust (wot.minimumFollowers). Exposes getDistance() and
  isTrusted() for other parts of the relay to query. Disabled by default (wot.enabled: false).

• #773 5577070 Thanks @Ferryx349! - feat(shutdown): drain WebSocket clients on SIGTERM

  On SIGTERM, /readyz returns 503, new WebSocket connections are rejected, and existing clients receive Nostr CLOSED messages before the socket closes. Drain is bounded by WS_DRAIN_TIMEOUT_MS (default 30s).

Patch Changes

• #714 df1ed5d Thanks @Ferryx349! - fix(admin): update aria-expanded and label when mobile menu is toggled

• #680 f92eabe Thanks @Priyanshubhartistm! - fix: advertise NIP-13 (Proof of Work) support in supportedNips

• #750 f5c8dc8 Thanks @Anshumancanrock! - deploy: run production migrations from the relay image

  Bake migrations/ and knexfile.js into the runtime image and point the
  prod compose migrate service at that image so schema cannot drift from the
  code that ships.

• #743 f36410a Thanks @Ferryx349! - ci: build and push container image to GHCR after CI passes on main

  Adds a GitHub Actions workflow that publishes ghcr.io/cameri/nostream:main and a
  per-commit sha-* tag once the CI Checks workflow succeeds for pushes to main.

• #775 59b1e51 Thanks @Anshumancanrock! - fix: return COUNT results for filters with generic tag queries (#e, #p, #g, #h), which projected event_id twice and failed with "error: unable to count events"

• #646 eb64d8a Thanks @dependabot! - chore(deps): bump js-yaml from 4.1.1 to 4.2.0

• #647 68da3d4 Thanks @dependabot! - chore(deps): bump ws from 8.20.1 to 8.21.0

• #705 95a672e Thanks @dependabot! - chore(deps): bump axios from 1.16.0 to 1.18.0

• #751 8509aea Thanks @Ferryx349! - deploy: minimal server bootstrap with optional settings overrides

  Add deploy/bootstrap.sh, document what operators must keep locally vs what
  ships in the image, and stop seeding a full settings.yaml on first boot so
  release defaults merge with optional overrides only.

• #744 8fa72d6 Thanks @Ferryx349! - deploy: add production Docker Compose stack for relay servers

  Adds a minimal prod compose file, migrate image Dockerfile, and server layout docs
  for deployments that pull ghcr.io/cameri/nostream:main instead of building on the host.

• #765 3690bd8 Thanks @Ferryx349! - ci: disable CodeQL workflow

  Removes the CodeQL Advanced GitHub Actions workflow, custom query pack, config,
  and route suppression comments to stop false-positive security alerts on admin
  routes that already use custom auth and rate limiting.

• #694 7c4b728 Thanks @Priyanshubhartistm! - fix: de-duplicate events returned by generic tag-filter subscriptions

  EventRepository.findByFilters() left-joins event_tags for generic tag filters
  (#e, #p, etc.) without deduplicating the result. An event matching more than one
  tag row for the same filter (e.g. {"#p": ["a", "b"]} matching an event tagged with
  both) was returned once per matching event_tags row, so subscribers received the
  same EVENT message multiple times. The query now selects DISTINCT events.* for
  tag-filtered queries so each stored event is returned at most once. This also covers
  generic tag filters combined with a NIP-50 search term (e.g.
  {"search": "...", "#p": ["a", "b"]}), which take the search branch and are now
  de-duplicated as well.

• #771 b07f9c3 Thanks @chappie-daemon! - fix: enforce limits.client.subscription.maxFilterValues on REQ and COUNT filters

  Filters whose array criteria (ids, authors, kinds, #<tag>) hold more than
  maxFilterValues values in total are now rejected with Too many filter values
  instead of being handed to PostgreSQL as an unbounded WHERE IN (...). The
  limit was previously defined in settings and surfaced in the admin settings
  editor while being read by nothing at all.

  The enforced limit is also advertised in the NIP-11 limitation object as
  max_filter_values, a non-standard extension since NIP-11 has no field for
  per-filter value counts.

• #703 7af0387 Thanks @Priyanshubhartistm! - Fix the Content-Security-Policy connect-src directive for relays served over plain ws://.

  The web app factory derived an HTTP(S) origin from the relay's WebSocket URL but mapped
  ws: to the invalid scheme ':', which the WHATWG URL API silently ignores. As a result the
  connect-src directive kept a ws://… entry instead of the intended http://… origin for
  local/dev, Tor, or reverse-proxied setups. The ws: protocol now correctly maps to http:.

  Adds regression test coverage for the protocol mapping (getWebProtocolForRelay, extracted from
  createWebApp so it can be unit tested directly), since this file previously had no test coverage
  at all.

• #708 a76d0b5 Thanks @Priyanshubhartistm! - fix: reject expiration timestamp 0 and millisecond-scale values, and accept safe-integer second-based timestamps up to the Postgres int4 max (2038-01-19T03:14:07Z) in getEventExpiration()

• #747 14cca60 Thanks @Ferryx349! - fix(ci): publish container image after CI passes on main

  Removes the standalone publish workflow and its unsafe workflow_run trigger.
  Image publish now runs as the final job in checks.yml on pushes to main, after
  lint, build, and tests succeed.

• #735 f0aab15 Thanks @Ferryx349! - fix: include event id in expired and rate-limited rejection logs

  Expired and rate-limited event rejections logged event %s rejected: ... without
  passing event.id, so operators saw a literal %s instead of the event id.

• #715 9361601 Thanks @Priyanshubhartistm! - fix: abort in-flight streaming queries when a subscription is cancelled

• #746 7297b96 Thanks @Anshumancanrock! - fix(payments): stop stale invoices from wedging payment polling

  A relay could stop clearing payments entirely, needing delete from invoices to
  recover. Two things combined to cause it.

  Invoices created without an expiry could never be retired, because the expiry
  check treats a missing date as "not expired", so the maintenance worker left them
  pending forever. The LNURL processor set no expiry on any invoice, making this
  certain there rather than incidental. Invoices now fall back to
  payments.invoiceExpirySeconds when the processor reports no expiry of its own,
  and existing pending rows without one are backfilled.

  Separately, each maintenance pass re-read the same oldest page of pending
  invoices, so one page of invoices that never resolve starved every newer one
  indefinitely. The worker now advances through the queue and wraps at the end,
  keeping the same per-pass cost while guaranteeing every pending invoice is
  eventually polled.

• #786 e87e1af Thanks @Priyanshubhartistm! - fix(nip56): skip targetless report rows, record every p/e target, batch report inserts in one transaction, and warm the WoT graph at boot instead of blocking the first report on a cold-start rebuild

• #733 9fb1c10 Thanks @Ferryx349! - test(nip66): add integration tests for RelayMonitorWorker snapshot storage

• #725 849c3f7 Thanks @Anshumancanrock! - feat(http): build absolute request URL from relay_url

• #726 3d3848e Thanks @Anshumancanrock! - feat(redis): add setKeyIfNotExists for one-time claims

• #640 ca23be1 Thanks @Anshumancanrock! - test: optimize nip05.spec.ts & nip03.spec.ts resource management

  • Lift sinon stub to before/after in verifyNip05Identifier tests (create once, reset between tests)
  • Extract SSRF guard callback once in before instead of per-test beforeEach
  • Pre-build shared OTS buffers and attestations at module scope to eliminate redundant Buffer.concat calls
  • Add shared event factory for extractNip05FromEvent tests

• #686 cb7daf6 Thanks @Priyanshubhartistm! - fix: stop checking additional rate limit windows once a client is already rate-limited

  isRateLimited() in EventMessageHandler and WebSocketAdapter looped through every
  configured rate limit window even after one had already tripped, calling rateLimiter.hit()
  (a Redis write) for each remaining window. Both now return as soon as the first exceeded
  window is found, avoiding redundant Redis writes for clients that are already being limited.

• #684 3648954 Thanks @Priyanshubhartistm! - fix: await Redis EXISTS call in RedisAdapter.hasKey() so it reflects actual key presence instead of always returning true

• #711 220949d Thanks @Priyanshubhartistm! - fix: include the actual error message in replaceable event rejection responses

  ReplaceableEventStrategy.execute() sent clients a bare error: command result
  (with no message body) whenever eventRepository.upsert() failed for a reason other
  than a duplicate event id. The underlying error.message was caught but never
  included in the response, leaving clients with no actionable information about why
  the event was rejected. The command result now includes error.message.

• #682 dc78df5 Thanks @Priyanshubhartistm! - fix: prevent crash in NIP-11 relay information document when payments settings are absent