feat(nostr): add NIP-98 service module and NostrAuth extractor

[escapedcat]

What this PR is

Just the NostrAuth extractor and its verifier. No endpoints, no DB changes, no RPC. The rest of the codebase stays unaware of the nostr crate.

• src/rest/nostr_auth.rs — NostrAuth { npub: Option<String> } as a FromRequest extractor, mirroring src/rest/auth.rs. Handlers work with an already-validated bech32 npub.
• src/service/nip98.rs — encapsulates the nostr crate: base64 decode, kind/recency/tag checks, Schnorr verification.
• Deps: nostr = "0.44.2". base64 already present.
• Tests: 14 (8 service + 6 extractor).

The #![allow(dead_code)] exists because nothing wires the extractor yet; it goes away in PR #2.

Addresses reviewer concerns from #83

• URL pinned to a config-provided ApiBaseUrl — Host/X-Forwarded-* spoofing can't influence what the signature is checked against.
• Case-insensitive Nostr scheme; whitespace tolerant per RFC 9110.
• npub stored as bech32, matching the existing user.npub column.
• Verifier returns crate::Error, not raw String.
• tracing::debug! on verify failures.
• Module-level doc note on why we don't verify NIP-98's payload tag yet (no body-carrying endpoints in this or the next PR; will add when we ship one).

What's next

1. This PR — extractor plumbing, isolated.
2. Next — POST /v4/auth/nostr token endpoint consuming NostrAuth. Wires ApiBaseUrl in main.rs.
3. Later — link/unlink endpoints, UNIQUE on user.npub, whoami shape. Once we can prototype end-to-end we can review semantics together.

Summary by CodeRabbit

• New Features

  • Added Nostr-based HTTP authentication (NIP-98): requests can be signed; successful verification exposes a user identity (npub) to handlers.
  • Signatures are validated against a configured trusted base URL and the HTTP method, enforce recent timestamps, and ignore spoofed Host headers.

• Tests

  • Comprehensive unit tests covering parsing, verification, edge cases, and failure modes.

[coderabbitai]

♻️ Duplicate comments (1)

src/rest/nostr_auth.rs (1)

142-250: ⚠️ Potential issue | 🔴 Critical

Async tests still use invalid #[test] async fn attributes.

#[test] cannot be used with async functions in Rust; these tests should use Actix’s async test attribute. This issue was already reported earlier and is still present.

Proposed fix

-    #[test]
+    #[actix_web::test]
     async fn missing_header_yields_none() {

-    #[test]
+    #[actix_web::test]
     async fn bearer_header_yields_none() {

-    #[test]
+    #[actix_web::test]
     async fn valid_header_yields_bech32_npub() {

-    #[test]
+    #[actix_web::test]
     async fn lowercase_scheme_accepted() {

-    #[test]
+    #[actix_web::test]
     async fn url_mismatch_yields_none() {

-    #[test]
+    #[actix_web::test]
     async fn method_derived_from_request() {

-    #[test]
+    #[actix_web::test]
     async fn spoofed_host_header_is_ignored() {

-    #[test]
+    #[actix_web::test]
     async fn no_base_url_configured_yields_none() {

Use this read-only check to confirm no invalid async test declarations remain:

#!/bin/bash
rg -nP '#\[test\]\s*\n\s*async\s+fn' src/rest/nostr_auth.rs
# Expected: no output

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/rest/nostr_auth.rs` around lines 142 - 250, Multiple async test functions
(e.g., missing_header_yields_none, bearer_header_yields_none,
valid_header_yields_bech32_npub, lowercase_scheme_accepted,
url_mismatch_yields_none, method_derived_from_request,
spoofed_host_header_is_ignored, no_base_url_configured_yields_none) are
annotated with #[test] which is invalid for async; replace each #[test] with the
appropriate Actix async test attribute (e.g., #[actix_web::test] or
#[actix_rt::test] consistent with the project) so the async test functions
compile and run under Actix’s test runtime. Ensure any required test attribute
import is present elsewhere in the module.

🧹 Nitpick comments (1)

src/rest/nostr_auth.rs (1)

5-10: Reorder imports to match repository Rust import grouping.

Current ordering places crate imports after external/std imports.

Proposed import reorder

-use actix_web::web::Data;
-use actix_web::{dev::Payload, http::header, FromRequest, HttpRequest};
-use std::future::Future;
-use std::pin::Pin;
-
-use crate::service::nip98;
+use crate::service::nip98;
+
+use actix_web::web::Data;
+use actix_web::{dev::Payload, http::header, FromRequest, HttpRequest};
+
+use std::future::Future;
+use std::pin::Pin;

As per coding guidelines, "Order imports by category with blank lines between groups: crate imports, external crate imports, then std imports".

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/rest/nostr_auth.rs` around lines 5 - 10, The imports in
src/rest/nostr_auth.rs are misordered: move the crate import (use
crate::service::nip98;) to the top of the import block, then place external
crate imports (use actix_web::web::Data; use actix_web::{dev::Payload,
http::header, FromRequest, HttpRequest};) on the next group, and finally the std
imports (use std::future::Future; use std::pin::Pin;) as the last group, with a
single blank line separating each group to match the repository Rust import
grouping convention.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@src/rest/nostr_auth.rs`:
- Around line 142-250: Multiple async test functions (e.g.,
missing_header_yields_none, bearer_header_yields_none,
valid_header_yields_bech32_npub, lowercase_scheme_accepted,
url_mismatch_yields_none, method_derived_from_request,
spoofed_host_header_is_ignored, no_base_url_configured_yields_none) are
annotated with #[test] which is invalid for async; replace each #[test] with the
appropriate Actix async test attribute (e.g., #[actix_web::test] or
#[actix_rt::test] consistent with the project) so the async test functions
compile and run under Actix’s test runtime. Ensure any required test attribute
import is present elsewhere in the module.

---

Nitpick comments:
In `@src/rest/nostr_auth.rs`:
- Around line 5-10: The imports in src/rest/nostr_auth.rs are misordered: move
the crate import (use crate::service::nip98;) to the top of the import block,
then place external crate imports (use actix_web::web::Data; use
actix_web::{dev::Payload, http::header, FromRequest, HttpRequest};) on the next
group, and finally the std imports (use std::future::Future; use std::pin::Pin;)
as the last group, with a single blank line separating each group to match the
repository Rust import grouping convention.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 152b5049-8db7-4797-b689-9ac6a6f3d87f

📥 Commits

Reviewing files that changed from the base of the PR and between e51cf5b and 1e9a072.

📒 Files selected for processing (2)

• src/rest/nostr_auth.rs
• src/service/nip98.rs

🚧 Files skipped from review as they are similar to previous changes (1)

• src/service/nip98.rs

[coderabbitai]

♻️ Duplicate comments (1)

src/rest/nostr_auth.rs (1)

142-249: ⚠️ Potential issue | 🔴 Critical

Use an async test attribute compatible with Actix; current annotations are invalid.

#[test] async fn (e.g., Line 142 and the other async tests in this block) is not valid for these async Actix tests and will fail to compile.

Proposed fix

-    #[test]
+    #[actix_web::test]
     async fn missing_header_yields_none() {

-    #[test]
+    #[actix_web::test]
     async fn bearer_header_yields_none() {

-    #[test]
+    #[actix_web::test]
     async fn valid_header_yields_bech32_npub() {

-    #[test]
+    #[actix_web::test]
     async fn lowercase_scheme_accepted() {

-    #[test]
+    #[actix_web::test]
     async fn url_mismatch_yields_none() {

-    #[test]
+    #[actix_web::test]
     async fn method_derived_from_request() {

-    #[test]
+    #[actix_web::test]
     async fn spoofed_host_header_is_ignored() {

-    #[test]
+    #[actix_web::test]
     async fn no_base_url_configured_yields_none() {

#!/bin/bash
# Verify no invalid async test declarations remain in this file.
rg -nP '#\[test\]\s*\n\s*async\s+fn' src/rest/nostr_auth.rs
# Expected: no output

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/rest/nostr_auth.rs` around lines 142 - 249, The tests are declared as
`#[test] async fn ...` which is invalid for Actix async tests; replace the
`#[test]` attribute with the Actix async test attribute (e.g.,
`#[actix_web::test]`) on each async test function (examples:
missing_header_yields_none, bearer_header_yields_none,
valid_header_yields_bech32_npub, lowercase_scheme_accepted,
url_mismatch_yields_none, method_derived_from_request,
spoofed_host_header_is_ignored, no_base_url_configured_yields_none) so the async
tests compile and run under Actix's runtime.

🧹 Nitpick comments (1)

src/rest/nostr_auth.rs (1)

5-10: Reorder imports to match the Rust import grouping rule.

Current ordering is external → std → crate; repository rule requires crate → external → std.

Proposed import reorder

-use actix_web::web::Data;
-use actix_web::{dev::Payload, http::header, FromRequest, HttpRequest};
-use std::future::Future;
-use std::pin::Pin;
-
-use crate::service::nip98;
+use crate::service::nip98;
+
+use actix_web::web::Data;
+use actix_web::{dev::Payload, http::header, FromRequest, HttpRequest};
+
+use std::future::Future;
+use std::pin::Pin;

As per coding guidelines, "Order imports by category with blank lines between groups: crate imports, external crate imports, then std imports".

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/rest/nostr_auth.rs` around lines 5 - 10, Reorder the use statements so
crate imports come first, then external crates, then std imports with blank
lines between groups: move "use crate::service::nip98;" to the top of the import
block, followed by the actix_web imports ("use actix_web::web::Data;", "use
actix_web::{dev::Payload, http::header, FromRequest, HttpRequest};"), and
finally the std imports ("use std::future::Future;", "use std::pin::Pin;"),
preserving the existing symbols and punctuation.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@src/rest/nostr_auth.rs`:
- Around line 142-249: The tests are declared as `#[test] async fn ...` which is
invalid for Actix async tests; replace the `#[test]` attribute with the Actix
async test attribute (e.g., `#[actix_web::test]`) on each async test function
(examples: missing_header_yields_none, bearer_header_yields_none,
valid_header_yields_bech32_npub, lowercase_scheme_accepted,
url_mismatch_yields_none, method_derived_from_request,
spoofed_host_header_is_ignored, no_base_url_configured_yields_none) so the async
tests compile and run under Actix's runtime.

---

Nitpick comments:
In `@src/rest/nostr_auth.rs`:
- Around line 5-10: Reorder the use statements so crate imports come first, then
external crates, then std imports with blank lines between groups: move "use
crate::service::nip98;" to the top of the import block, followed by the
actix_web imports ("use actix_web::web::Data;", "use actix_web::{dev::Payload,
http::header, FromRequest, HttpRequest};"), and finally the std imports ("use
std::future::Future;", "use std::pin::Pin;"), preserving the existing symbols
and punctuation.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 56ae1ebd-7eef-4d51-bdf0-16c8d2b2cfe2

📥 Commits

Reviewing files that changed from the base of the PR and between 1e9a072 and a627e64.

📒 Files selected for processing (1)

• src/rest/nostr_auth.rs

[Copilot]

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.