Add read and read-write dispute solver permissions

Cargo.toml

@@ -70,7 +70,7 @@ reqwest = { version = "0.12.1", default-features = false, features = [
   "json",
   "rustls-tls",
 ] }
-mostro-core = { version = "0.8.3", features = ["sqlx"] }
+mostro-core = { version = "0.8.4", features = ["sqlx"] }
 tracing = "0.1.40"
 tracing-subscriber = { version = "0.3.18", features = ["env-filter"] }
 clap = { version = "4.5.45", features = ["derive"] }

docs/ADMIN_RPC_AND_DISPUTES.md

@@ -10,8 +10,8 @@ Admin capabilities and dispute resolution paths.
 
 ## Dispute Lifecycle
 - Open: `src/app/dispute.rs` (Action=Dispute) → mark order as `Dispute` and notify.
-- Admin Take: `src/app/admin_take_dispute.rs` assigns solver.
-- Admin Settle: `src/app/admin_settle.rs` settles/cancels hold or pays out as needed.
+- Admin Take: `src/app/admin_take_dispute.rs` assigns solver. Both `read` and `read-write` solvers may take disputes.
+- Admin Settle: `src/app/admin_settle.rs` settles/cancels hold or pays out as needed. Requires a `read-write` solver.
 
 ## Admin Cancel
 - File: `src/app/admin_cancel.rs`.
@@ -42,5 +42,6 @@ sequenceDiagram
 
 ## Audit and Safety
 - Require admin authentication/authorization at message level.
+- Enforce solver permission levels in the daemon: `read` solvers can assist but cannot execute `admin-settle` or `admin-cancel`.
 - Record solver, timestamps, and decisions in DB for traceability.
 - Avoid leaking sensitive data in logs; scrub invoices and keys.

docs/ARCHITECTURE.md

@@ -62,7 +62,7 @@ flowchart LR
 - `app/orders.rs` – queries and returns order listings/history.
 - `app/restore_session.rs` – rehydrates context for a client after reconnect.
 - `app/trade_pubkey.rs` – exchanges/updates trade pubkeys for secure comms.
-- Admin modules – force cancel/settle, take disputes, add solvers; guarded and auditable.
+- Admin modules – force cancel/settle, take disputes, add solvers; guarded, auditable, and permission-gated for solver capabilities.
 
 ## Configuration Constants (src/config/constants.rs)
 

docs/ORDERS_AND_ACTIONS.md

@@ -36,9 +36,9 @@ Summary of order lifecycle and key handlers.
 | `orders` | https://github.com/MostroP2P/mostro/blob/main/src/app/orders.rs | Return order lists/history to requester |
 | `trade-pubkey` | https://github.com/MostroP2P/mostro/blob/main/src/app/trade_pubkey.rs | Exchange or update per-trade pubkeys |
 | `restore-session` | https://github.com/MostroP2P/mostro/blob/main/src/app/restore_session.rs | Rehydrate client session and state |
-| `admin-cancel` | https://github.com/MostroP2P/mostro/blob/main/src/app/admin_cancel.rs | Admin cancel; optionally cancel hold invoice |
-| `admin-settle` | https://github.com/MostroP2P/mostro/blob/main/src/app/admin_settle.rs | Admin settlement; settle/cancel holds, finalize |
-| `admin-add-solver` | https://github.com/MostroP2P/mostro/blob/main/src/app/admin_add_solver.rs | Register dispute solver key |
+| `admin-cancel` | https://github.com/MostroP2P/mostro/blob/main/src/app/admin_cancel.rs | Admin cancel; optionally cancel hold invoice. Assigned solver must have `read-write` permission |
+| `admin-settle` | https://github.com/MostroP2P/mostro/blob/main/src/app/admin_settle.rs | Admin settlement; settle/cancel holds, finalize. Assigned solver must have `read-write` permission |
+| `admin-add-solver` | https://github.com/MostroP2P/mostro/blob/main/src/app/admin_add_solver.rs | Register dispute solver key. `admin-add-solver` accepts a bare pubkey (defaults to read-write), `pubkey:read`, `pubkey:write` (alias for read-write), or `pubkey:read-write`; see the parser in `admin_add_solver.rs` for the accepted forms |
 | `admin-take-dispute` | https://github.com/MostroP2P/mostro/blob/main/src/app/admin_take_dispute.rs | Assign or take ownership of dispute |
 | `last-trade-index` | https://github.com/MostroP2P/mostro/blob/main/src/app/last_trade_index.rs | Retrieve user's last trade index from database |
 

docs/README.md

@@ -14,3 +14,5 @@ Quick links to architecture and feature guides.
 Tips
 - Run tests and lints before pushing: `cargo test`, `cargo fmt`, `cargo clippy --all-targets --all-features`.
 - Update SQLx offline data after query/schema changes: `cargo sqlx prepare -- --bin mostrod`.
+
+- [Solver Permission Levels](./SOLVER_PERMISSION_LEVELS.md)

docs/SOLVER_PERMISSION_LEVELS.md

@@ -0,0 +1,86 @@
+# Solver Permission Levels
+
+This document specifies solver permission levels for dispute resolution.
+
+## Summary
+
+Mostro supports two solver permission levels:
+
+- `read`: solver can take a dispute, receive dispute context, and communicate with users
+- `read-write`: solver can do everything above and can also execute `admin-settle` and `admin-cancel`
+
+This split is intended to support automated dispute assistants, including AI-based agents, without giving them authority to move funds.
+
+## Goals
+
+- allow non-human dispute assistants to participate safely
+- enforce authorization at the daemon level, not in prompts or UI
+- preserve backward compatibility for existing solver registration flows
+
+## Data Model
+
+The `users.category` field is used to represent solver permissions:
+
+- `0`: regular user / no solver permissions
+- `1`: solver with `read` permission only
+- `2`: solver with `read-write` permission
+
+The legacy `is_solver` flag still indicates whether the user is a solver at all.
+
+## Authorization Rules
+
+### `admin-take-dispute`
+Allowed for:
+- Mostro daemon admin key while dispute status is `initiated` or `in-progress`
+- solvers with `is_solver = true` while dispute status is `initiated`
+
+Both `read` and `read-write` solvers may take a dispute.
+
+### `admin-settle`
+Allowed only when:
+- the caller is the solver assigned to the dispute
+- and the assigned solver has `category = 2`
+
+If the caller is assigned but only has `read` permission, Mostro returns:
+- `CantDoReason::NotAuthorized`
+
+### `admin-cancel`
+Allowed only when:
+- the caller is the solver assigned to the dispute
+- and the assigned solver has `category = 2`
+
+If the caller is assigned but only has `read` permission, Mostro returns:
+- `CantDoReason::NotAuthorized`
+
+## AdminAddSolver payload
+
+`admin-add-solver` continues using `Payload::TextMessage`, but now supports an optional permission suffix.
+
+Formats:
+
+- `npub1...` → defaults to `read-write`
+- `npub1...:read` → registers solver as read-only
+- `npub1...:read-write` → registers solver as read-write
+- `npub1...:write` → alias for read-write
+
+Invalid suffixes must be rejected with `CantDoReason::InvalidParameters`.
+
+## RPC impact
+
+The current RPC `AddSolverRequest` still only exposes `solver_pubkey`.
+
+That means RPC registration remains backward compatible and defaults to `read-write` until the protobuf/API is extended.
+
+## Dependency
+
+This feature requires `mostro-core >= 0.8.4` because it uses `CantDoReason::NotAuthorized`.
+
+## Security rationale
+
+The key security property is that read-only solvers can never execute dispute-closing actions, even if:
+
+- a UI exposes the wrong button
+- an operator misconfigures an agent prompt
+- a remote tool attempts to call `admin-settle` or `admin-cancel` directly
+
+The daemon enforces the permission boundary.

migrations/20260417145500_solver_category_backfill.sql

@@ -0,0 +1,12 @@
+-- Backfill legacy solver records so pre-existing solvers keep their historical
+-- settle/cancel authority after solver permission categories are enforced.
+--
+-- Before PR #708, solver capability was represented only by `is_solver = 1`.
+-- After PR #708, settle/cancel paths require `category = 2` (read-write).
+--
+-- Operators should not need to patch this manually, so migrate any legacy solver
+-- rows that still have the default/legacy category value to read-write.
+UPDATE users
+SET category = 2
+WHERE is_solver = 1
+  AND category = 0;

src/app/admin_add_solver.rs

@@ -7,53 +7,141 @@ use nostr::nips::nip59::UnwrappedGift;
 use nostr_sdk::prelude::*;
 use tracing::{error, info};
 
+pub const SOLVER_CATEGORY_READ_ONLY: i64 = 1;
+pub const SOLVER_CATEGORY_READ_WRITE: i64 = 2;
+
+fn parse_solver_payload(payload: &Payload) -> Result<(String, i64), MostroError> {
+    let raw = match payload {
+        Payload::TextMessage(p) => p.trim(),
+        _ => return Err(MostroCantDo(CantDoReason::InvalidTextMessage)),
+    };
+
+    if raw.is_empty() {
+        return Err(MostroCantDo(CantDoReason::InvalidTextMessage));
+    }
+
+    let mut parts = raw.split(':');
+    let npub = parts
+        .next()
+        .ok_or(MostroCantDo(CantDoReason::InvalidTextMessage))?
+        .trim();
+
+    if npub.is_empty() {
+        return Err(MostroCantDo(CantDoReason::InvalidTextMessage));
+    }
+
+    let category = match parts.next().map(str::trim) {
+        None => SOLVER_CATEGORY_READ_WRITE,
+        Some("read") => SOLVER_CATEGORY_READ_ONLY,
+        Some("read-write") | Some("write") => SOLVER_CATEGORY_READ_WRITE,
+        Some("") | Some(_) => return Err(MostroCantDo(CantDoReason::InvalidParameters)),
+    };
+
+    if parts.next().is_some() {
+        return Err(MostroCantDo(CantDoReason::InvalidParameters));
+    }
+
+    Ok((npub.to_string(), category))
+}
+
 pub async fn admin_add_solver_action(
     ctx: &AppContext,
     msg: Message,
     event: &UnwrappedGift,
     my_keys: &Keys,
 ) -> Result<(), MostroError> {
     let pool = ctx.pool();
-    // Get request id
     let request_id = msg.get_inner_message_kind().request_id;
 
     let inner_message = msg.get_inner_message_kind();
-    let payload = if let Some(payload) = &inner_message.payload {
-        payload
-    } else {
-        error!("No pubkey found!");
-        return Ok(());
-    };
-    let npubkey = if let Payload::TextMessage(p) = payload {
-        p
-    } else {
-        error!("No pubkey found!");
-        return Ok(());
-    };
+    let payload = inner_message
+        .payload
+        .as_ref()
+        .ok_or(MostroCantDo(CantDoReason::InvalidTextMessage))?;
 
-    // Check if the pubkey is Mostro
     if event.sender.to_string() != my_keys.public_key().to_string() {
-        // We create a Message
         return Err(MostroInternalErr(ServiceError::InvalidPubkey));
     }
+
     let trade_index = inner_message.trade_index.unwrap_or(0);
-    let public_key = PublicKey::from_bech32(npubkey)
+    let (npubkey, category) = parse_solver_payload(payload)?;
+    let public_key = PublicKey::from_bech32(&npubkey)
         .map_err(|_| MostroInternalErr(ServiceError::InvalidPubkey))?;
-    let user = User::new(public_key.to_string(), 0, 1, 0, 0, trade_index);
-    // Use CRUD to create user
+
+    let user = User::new(public_key.to_string(), 0, 1, 0, category, trade_index);
+
     match add_new_user(pool, user).await {
-        Ok(r) => info!("Solver added: {:#?}", r),
-        Err(ee) => error!("Error creating solver: {:#?}", ee),
+        Ok(r) => info!("Solver added: {} with category {}", r, category),
+        Err(ee) => {
+            error!("Error creating solver: {:#?}", ee);
+            return Err(MostroInternalErr(ServiceError::DbAccessError(
+                ee.to_string(),
+            )));
+        }
     }
-    // We create a Message for admin
+
     let message = Message::new_dispute(None, request_id, None, Action::AdminAddSolver, None);
     let message = message
         .as_json()
         .map_err(|_| MostroInternalErr(ServiceError::MessageSerializationError))?;
-    // Send the message
+
     send_dm(event.rumor.pubkey, my_keys, &message, None)
         .await
         .map_err(|e| MostroInternalErr(ServiceError::NostrError(e.to_string())))?;
 
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::{parse_solver_payload, SOLVER_CATEGORY_READ_ONLY, SOLVER_CATEGORY_READ_WRITE};
+    use mostro_core::error::CantDoReason;
+    use mostro_core::message::Payload;
+
+    #[test]
+    fn parse_solver_payload_defaults_to_read_write() {
+        let (npub, category) =
+            parse_solver_payload(&Payload::TextMessage("npub1test".to_string())).unwrap();
+        assert_eq!(npub, "npub1test");
+        assert_eq!(category, SOLVER_CATEGORY_READ_WRITE);
+    }
+
+    #[test]
+    fn parse_solver_payload_accepts_read_only() {
+        let (_, category) =
+            parse_solver_payload(&Payload::TextMessage("npub1test:read".to_string())).unwrap();
+        assert_eq!(category, SOLVER_CATEGORY_READ_ONLY);
+    }
+
+    #[test]
+    fn parse_solver_payload_accepts_read_write_aliases() {
+        let (_, category) =
+            parse_solver_payload(&Payload::TextMessage("npub1test:read-write".to_string()))
+                .unwrap();
+        assert_eq!(category, SOLVER_CATEGORY_READ_WRITE);
+
+        let (_, category) =
+            parse_solver_payload(&Payload::TextMessage("npub1test:write".to_string())).unwrap();
+        assert_eq!(category, SOLVER_CATEGORY_READ_WRITE);
+    }
+
+    #[test]
+    fn parse_solver_payload_rejects_invalid_permission() {
+        let err =
+            parse_solver_payload(&Payload::TextMessage("npub1test:admin".to_string())).unwrap_err();
+        assert_eq!(
+            err,
+            mostro_core::error::MostroError::MostroCantDo(CantDoReason::InvalidParameters)
+        );
+    }
+
+    #[test]
+    fn parse_solver_payload_rejects_empty_permission_token() {
+        let err =
+            parse_solver_payload(&Payload::TextMessage("npub1test:".to_string())).unwrap_err();
+        assert_eq!(
+            err,
+            mostro_core::error::MostroError::MostroCantDo(CantDoReason::InvalidParameters)
+        );
+    }
+}

src/app/admin_cancel.rs

@@ -2,7 +2,10 @@ use std::borrow::Cow;
 use std::str::FromStr;
 
 use crate::app::context::AppContext;
-use crate::db::{find_dispute_by_order_id, is_assigned_solver, is_dispute_taken_by_admin};
+use crate::db::{
+    find_dispute_by_order_id, is_assigned_solver, is_dispute_taken_by_admin,
+    solver_has_write_permission,
+};
 use crate::lightning::LndConnector;
 use crate::nip33::{create_platform_tag_values, new_dispute_event};
 use crate::util::{enqueue_order_msg, get_order, send_dm, update_order_event};
@@ -70,6 +73,10 @@ pub async fn admin_cancel_action(
         _ => {}
     }
 
+    if !solver_has_write_permission(pool, &event.sender.to_string(), order.id).await? {
+        return Err(MostroCantDo(CantDoReason::NotAuthorized));
+    }
+
     // Was order cooperatively cancelled?
     if order.check_status(Status::CooperativelyCanceled).is_ok() {
         enqueue_order_msg(

src/app/admin_settle.rs

@@ -1,5 +1,8 @@
 use crate::app::context::AppContext;
-use crate::db::{find_dispute_by_order_id, is_assigned_solver, is_dispute_taken_by_admin};
+use crate::db::{
+    find_dispute_by_order_id, is_assigned_solver, is_dispute_taken_by_admin,
+    solver_has_write_permission,
+};
 use crate::lightning::LndConnector;
 use crate::nip33::{create_platform_tag_values, new_dispute_event};
 use crate::util::{enqueue_order_msg, get_order, settle_seller_hold_invoice, update_order_event};
@@ -47,6 +50,10 @@ pub async fn admin_settle_action(
         _ => {}
     }
 
+    if !solver_has_write_permission(pool, &event.sender.to_string(), order.id).await? {
+        return Err(MostroCantDo(CantDoReason::NotAuthorized));
+    }
+
     // Was order cooperatively cancelled?
     if order.check_status(Status::CooperativelyCanceled).is_ok() {
         enqueue_order_msg(
@@ -206,7 +213,12 @@ mod tests {
         let admin_error = CantDoReason::DisputeTakenByAdmin;
         assert_eq!(format!("{:?}", admin_error), "DisputeTakenByAdmin");
 
+        // New error for authenticated callers lacking enough permissions
+        let unauthorized_error = CantDoReason::NotAuthorized;
+        assert_eq!(format!("{:?}", unauthorized_error), "NotAuthorized");
+
         // Verify they are different error types
         assert_ne!(regular_error, admin_error);
+        assert_ne!(admin_error, unauthorized_error);
     }
 }