mirror of
https://github.com/vitorpamplona/amethyst.git
synced 2026-08-09 08:04:45 +00:00
nrobi144
2ba051a952
The current Android-only AuthCoordinator signs every NIP-42 AUTH challenge from every relay unconditionally (and across every logged-in account). For desktop there is no AUTH wiring at all — challenges are ignored, so AUTH-walled relays silently drop DMs. Both behaviours fail the security review: unconditional signing lets any relay the user reads (or any malicious relay they touch) extract an identity-key signature with timestamp, and signing across all accounts links them under one relay observer. This commit adds the substrate for a tiered classifier — wire-up will follow with the desktop AuthCoordinator (P2.5) and SQLite-backed persistence (P2.4). The policy itself is platform-agnostic and lives in commons so Android can adopt the same design later. Two tiers, no third silent-drop path: - auto-allow when the relay is in the user's own outbox/DM-inbox set, or has a persisted ALWAYS grant (subject to BLOCKED override) - prompt-and-suspend via CompletableDeferred for everything else, with the user's `[Once] [Always] [Never]` choice driving the deferred Includes InMemoryAuthApprovalStore for tests + the ONCE session cache; SqliteAuthApprovalStore lands in P2.4 with the sibling outbox.db. Eight unit tests cover tier-1, persisted ALWAYS, persisted BLOCKED (including BLOCKED overriding tier-1), unknown-prompt-then-cache, re-eval of selfApprovedRelays on Account changes, and store.clear().