From c85280259c1225a864eff5b0409e529e36a4a1ad Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 2 Jul 2026 18:13:34 +0000 Subject: [PATCH] feat: add reports, torrents, and addressable content to the reasonable set MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Complete the "Let's be reasonable" content set: - reports (1984) and torrents (2003/2004) — additive public events whose reputational weight is no greater than the arbitrary kind-1 notes an app can already publish. - long-form articles (30023), wiki (30818), and the legacy addressable video kinds (34235/34236) — addressable content. Re-signing with the same d tag replaces the app's own prior version; accepted as no worse than the arbitrary posting a kind-1 grant already permits. Only replaceable *configuration* (profile 0, contacts 3, 10000-range lists) stays ASK, since a bad write there can silently wipe account settings — distinct from addressable content. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01WMrHZfwN5tM4ecvdz7xigo --- .../signers/NostrSignerPermissionLedger.kt | 33 ++++++++++++++----- .../NostrSignerPermissionLedgerTest.kt | 16 ++++----- 2 files changed, 32 insertions(+), 17 deletions(-) diff --git a/commons/src/commonMain/kotlin/com/vitorpamplona/amethyst/commons/napplet/signers/NostrSignerPermissionLedger.kt b/commons/src/commonMain/kotlin/com/vitorpamplona/amethyst/commons/napplet/signers/NostrSignerPermissionLedger.kt index 18d1b17b0c..fd213ba1bd 100644 --- a/commons/src/commonMain/kotlin/com/vitorpamplona/amethyst/commons/napplet/signers/NostrSignerPermissionLedger.kt +++ b/commons/src/commonMain/kotlin/com/vitorpamplona/amethyst/commons/napplet/signers/NostrSignerPermissionLedger.kt @@ -24,15 +24,22 @@ import com.vitorpamplona.quartz.nip10Notes.TextNoteEvent import com.vitorpamplona.quartz.nip18Reposts.GenericRepostEvent import com.vitorpamplona.quartz.nip18Reposts.RepostEvent import com.vitorpamplona.quartz.nip22Comments.CommentEvent +import com.vitorpamplona.quartz.nip23LongContent.LongTextNoteEvent import com.vitorpamplona.quartz.nip25Reactions.ReactionEvent import com.vitorpamplona.quartz.nip28PublicChat.message.ChannelMessageEvent +import com.vitorpamplona.quartz.nip35Torrents.TorrentCommentEvent +import com.vitorpamplona.quartz.nip35Torrents.TorrentEvent import com.vitorpamplona.quartz.nip38UserStatus.StatusEvent import com.vitorpamplona.quartz.nip42RelayAuth.RelayAuthEvent import com.vitorpamplona.quartz.nip53LiveActivities.chat.LiveActivitiesChatMessageEvent +import com.vitorpamplona.quartz.nip54Wiki.WikiNoteEvent +import com.vitorpamplona.quartz.nip56Reports.ReportEvent import com.vitorpamplona.quartz.nip57Zaps.LnZapRequestEvent import com.vitorpamplona.quartz.nip68Picture.PictureEvent +import com.vitorpamplona.quartz.nip71Video.VideoHorizontalEvent import com.vitorpamplona.quartz.nip71Video.VideoNormalEvent import com.vitorpamplona.quartz.nip71Video.VideoShortEvent +import com.vitorpamplona.quartz.nip71Video.VideoVerticalEvent import com.vitorpamplona.quartz.nip7DThreads.ThreadEvent import com.vitorpamplona.quartz.nip84Highlights.HighlightEvent import com.vitorpamplona.quartz.nip88Polls.poll.PollEvent @@ -149,11 +156,14 @@ class NostrSignerPermissionLedger( /** * Event kinds auto-approved under [AppSignerPolicy.REASONABLE]. * - * Most of these are *additive, public, non-destructive content* — a new note-like event the - * user could delete afterwards, in the same risk class as the original kind 1/6/7 set (notes, - * reposts, reactions, pictures, videos, voice, public/live/relay chat, threads, polls, - * comments, highlights, code snippets, file metadata, status). The set also includes two - * harmless non-content signatures: + * Most of these are *public, non-destructive content* — an event the user creates and could + * delete afterwards, in the same risk class as the original kind 1/6/7 set (notes, reposts, + * reactions, pictures, videos, voice, public/live/relay chat, threads, polls, comments, + * highlights, code snippets, file metadata, reports, torrents, long-form articles, wiki, status). + * Some are *addressable* (long-form 30023, wiki 30818, legacy video 34235/34236): re-signing + * with the same `d` tag replaces the app's own prior version at that address — an accepted + * trade-off, since an app that can already post arbitrary notes could do equal reputational harm. + * The set also includes two harmless non-content signatures: * - **zap request** (9734) — moves nothing; it only fetches a Lightning invoice. The payment * itself is the separately-gated `value.payInvoice` capability that prompts on *every* use * regardless of policy. @@ -169,10 +179,8 @@ class NostrSignerPermissionLedger( * destructive/admin calls (NIP-96 blob deletes, NIP-86 relay management); blast radius is too * broad to auto-approve. * - **decryption** ([NostrSignerOp.Decrypt]) and DMs — reveal private content. - * - **reports** (1984) and **torrents** (2003/2004) — publicly attributable social/legal acts - * whose reputational weight makes silent signing surprising, even though they are additive. - * - **addressable/replaceable content** (long-form 30023, wiki 30818, etc.) — a re-sign with - * the same `d` tag overwrites a prior version, so they carry an overwrite risk. + * - **replaceable configuration** (profile 0, contacts 3, and the 10000-range lists above) — + * unlike addressable *content*, these hold account settings a bad write can silently wipe. * * Deliberately conservative: when a kind's blast radius is unclear, it is left out so the user * is asked rather than surprised. @@ -198,10 +206,17 @@ class NostrSignerPermissionLedger( VoiceReplyEvent.KIND, // 1244 — voice replies LiveActivitiesChatMessageEvent.KIND, // 1311 — live-stream chat (sibling of kind 42) CodeSnippetEvent.KIND, // 1337 — NIP-C0 code snippets (additive public content) + ReportEvent.KIND, // 1984 — NIP-56 content/spam reports (moderation flag) + TorrentEvent.KIND, // 2003 — NIP-35 torrent announcements (additive public content) + TorrentCommentEvent.KIND, // 2004 — NIP-35 torrent comments HighlightEvent.KIND, // 9802 — highlighted snippets shared publicly LnZapRequestEvent.KIND, // 9734 — Lightning zap request; the payment itself still prompts RelayAuthEvent.KIND, // 22242 — NIP-42 relay auth; ephemeral, bound to one relay+challenge + LongTextNoteEvent.KIND, // 30023 — NIP-23 long-form articles (addressable content) StatusEvent.KIND, // 30315 — ephemeral user status / presence + WikiNoteEvent.KIND, // 30818 — NIP-54 wiki articles (addressable content) + VideoHorizontalEvent.KIND, // 34235 — legacy addressable horizontal video (NIP-71) + VideoVerticalEvent.KIND, // 34236 — legacy addressable vertical video (NIP-71) ) } } diff --git a/commons/src/commonTest/kotlin/com/vitorpamplona/amethyst/commons/napplet/signers/NostrSignerPermissionLedgerTest.kt b/commons/src/commonTest/kotlin/com/vitorpamplona/amethyst/commons/napplet/signers/NostrSignerPermissionLedgerTest.kt index 7903415825..e872b25ddb 100644 --- a/commons/src/commonTest/kotlin/com/vitorpamplona/amethyst/commons/napplet/signers/NostrSignerPermissionLedgerTest.kt +++ b/commons/src/commonTest/kotlin/com/vitorpamplona/amethyst/commons/napplet/signers/NostrSignerPermissionLedgerTest.kt @@ -51,14 +51,14 @@ class NostrSignerPermissionLedgerTest { ledger.setPolicy(coordinate, AppSignerPolicy.REASONABLE) // Profile (0), contacts (3), deletion (5), relay list (10002), nutzap (9321), NIP-98 HTTP - // auth (27235), gift-wrapped DM (1059), report (1984), torrent (2003), and long-form - // article (30023) must never auto-sign — they change config, delete, spend ecash, authorize - // arbitrary HTTP calls, leak, carry reputational/legal weight, or overwrite prior versions. - // A nutzap in particular *is* the payment (it carries the ecash proofs), unlike a zap - // request (9734) which only fetches an invoice; and NIP-98 authorizes destructive/admin HTTP - // requests, unlike NIP-42 relay auth (22242) which is a replay-bound read proof. Decryption - // reveals private content, so it also asks. - for (kind in listOf(0, 3, 5, 10002, 9321, 27235, 1059, 1984, 2003, 30023)) { + // auth (27235), and gift-wrapped DM (1059) must never auto-sign — they change config, + // delete, spend ecash, authorize arbitrary HTTP calls, or leak. These are replaceable + // *configuration* (0/3/10002), unlike addressable *content* such as long-form (30023) which + // is allowed. A nutzap in particular *is* the payment (it carries the ecash proofs), unlike a + // zap request (9734) which only fetches an invoice; and NIP-98 authorizes destructive/admin + // HTTP requests, unlike NIP-42 relay auth (22242) which is a replay-bound read proof. + // Decryption reveals private content, so it also asks. + for (kind in listOf(0, 3, 5, 10002, 9321, 27235, 1059)) { assertEquals( NostrOpDecision.ASK, ledger.decide(coordinate, NostrSignerOp.SignKind(kind)),