External/buzz
1
0
Fork 0
mirror of https://github.com/block/buzz.git synced 2026-08-18 06:50:31 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(relay): stop requiring operator API origin for admin console boot

Browse Source 
RELAY_OPERATOR_PUBKEYS is the shared allowlist for both the NIP-98 admin
console and the community-provisioning endpoints, but only provisioning needs
RELAY_OPERATOR_API_ORIGIN. The boot hard-error forced admin-console operators
to configure a provisioning surface they never use.

Demote the boot error to a WARN naming the affected feature, and keep the
provisioning endpoints fail-closed at request time: authorize_operator_request
already rejects with a clean 500 when the origin is unset, before any replay or
DB access. Document the decoupling and the NIP-11 admin_api advertisement in
the env examples and the admin README.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
This commit is contained in:
Duncan
2026-08-12 23:20:29 -04:00
co-authored by Will Pfleger
parent bcfa86046f
commit 7a73eaa926
6 changed files with 151 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/admin/README.md
+21
View File
@@ -90,6 +90,27 @@ RELAY_OPERATOR_PUBKEYS=<64-char hex pubkey>[,<64-char hex pubkey>...]
- `BUZZ_ADMIN_TOKEN` set alongside `nip98` is a startup error (ambiguous intent).
- A malformed `RELAY_OWNER_PUBKEY` alongside `nip98` is a startup error (see
owner fallback below).
- `RELAY_OPERATOR_API_ORIGIN` is **not** required to run the admin console.
That origin is only used by the community-provisioning endpoints
(`POST /operator/communities`), which share the `RELAY_OPERATOR_PUBKEYS`
allowlist. When the pubkeys are set but the origin is not, the relay boots
with a `WARN` and provisioning requests fail closed at request time until the
origin is set — the admin console is unaffected.
#### Auto-discovery via NIP-11
When `BUZZ_ADMIN_HOST` is set, the relay advertises the admin API origin in its
NIP-11 relay-information document under an optional `admin_api` field:
```json
{ "admin_api": "https://admin.example.com" }
```
The value is the canonical origin `scheme://host[:port]` (no path), with the
scheme derived by the same loopback rule as `u`-tag verification (`http` for
`localhost`/`127.x`/`::1`, else `https`). The field is omitted entirely when no
admin surface is configured. Clients (such as the desktop console) read this to
auto-discover the admin endpoint instead of requiring manual URL entry.
Each request requires: