[CI verification only] fix(relay): report verified NIP-OA owner after any admission - #2
Closed
rclod wants to merge 1 commit into
Closed
[CI verification only] fix(relay): report verified NIP-OA owner after any admission#2rclod wants to merge 1 commit into
rclod wants to merge 1 commit into
Conversation
…ission The agent→owner backfill ran only when `require_relay_membership` was false. On a closed relay it never ran, and `enforce_relay_membership` did not fill the gap: it reported an owner only when it had USED the delegation to admit the agent (`MembershipDecision::ViaOwner`). An agent that is also a direct relay member took the `::Member` branch, which returned `Ok(None)` and discarded a valid, cryptographically self-proving attestation. So on a closed relay, any agent enrolled directly in `relay_members` had `users.agent_owner_pubkey` left NULL however valid its attestation. That column is not cosmetic — `is_agent` in the admission path derives from it (so such agents are limited at `human_messages_per_min` rather than `agent_standard_messages_per_min`), owner-managed agent lists have no relationship to display, and `channel_add_policy = "owner_only"` has no owner to compare against, refusing `add-member` for every actor including the real owner. Fixed in the shared helper rather than per call site. The attestation is now verified once, before the admission branches, and `MembershipDecision::OpenRelay` and `::Member` carry it; `enforce_relay_membership` reports it from every admitted variant. Both WebSocket AUTH and `POST /events` consume that shared result, so the open-relay-only workaround each carried is deleted rather than duplicated — the HTTP path had the same gap and would otherwise have kept it. Membership answers "may this caller connect"; the attestation answers "who owns this agent". Deriving the second from the first was the bug. The security boundary is unchanged: the tag's own verification in `extract_nip_oa_owner`. The decision→owner mapping is split into `owner_from_decision` so the behaviour that regressed is testable without a database, with three tests over it — notably that a direct member reports its owner, which is what previously returned None. Co-authored-by: themiguelamador <themiguelamador@users.noreply.github.com> Signed-off-by: rclod <3385524+rclod@users.noreply.github.com>
rclod
force-pushed
the
fix/nip-oa-owner-for-direct-members
branch
from
August 16, 2026 21:25
a24e243 to
f0fbbfc
Compare
Owner
Author
|
Verified green: run 31973435216, 21 passed / 2 skipped / 0 failed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fork-internal PR to run CI on the reworked commit before block#6078 is approved for upstream CI. Not for merge.