From 8fad46d5cbd97e255cdc01ebe7c8e3bd2aea9e64 Mon Sep 17 00:00:00 2001 From: Wren <5217c5c2f7bfb4333e46d17c98a9255a52dadee18dcd43a43536b95e6776dfa0@buzz.block.builderlab.xyz> Date: Sat, 15 Aug 2026 11:44:23 -0400 Subject: [PATCH] docs(nip-fi): close direct enrollment denials Co-authored-by: Wren <5217c5c2f7bfb4333e46d17c98a9255a52dadee18dcd43a43536b95e6776dfa0@buzz.block.builderlab.xyz> Signed-off-by: Wren <5217c5c2f7bfb4333e46d17c98a9255a52dadee18dcd43a43536b95e6776dfa0@buzz.block.builderlab.xyz> --- docs/nips/NIP-FI.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/nips/NIP-FI.md b/docs/nips/NIP-FI.md index cd7d299fd..8bfa34d44 100644 --- a/docs/nips/NIP-FI.md +++ b/docs/nips/NIP-FI.md @@ -321,10 +321,12 @@ PrepareDirect(request, assertion, proof): else if B_D(i) exists or B_D(k) exists: DENY(binding_conflict) else if enrollment policy = attested-key: - require e.asserted_key = k + if e.asserted_key != k: DENY(attestation_required) proposal := enroll(i, k, attested-key) else if enrollment policy = tofu: proposal := enroll(i, k, e.asserted_key = k ? attested-key : tofu) + else: + DENY(binding_required) EvaluateLocalPolicy(D, R, operation, resource, k, e.claims_or_capabilities) or DENY @@ -426,7 +428,7 @@ the private-state anonymity set. |---|---|---|---| | assertion/proof absent | `missing_evidence` | `auth-required: authentication required` | `401` + `authentication required\n` | | malformed, invalid, expired, or replayed evidence | `evidence_rejected` | `restricted: evidence rejected` | `403` + `evidence rejected\n` | -| key mismatch; binding conflict; retired pair; revoked key; lifecycle gate; binding required/expired; local policy denial | `authorization_denied` | `restricted: authorization denied` | `403` + `authorization denied\n` | +| key mismatch; attestation required; binding conflict; retired pair; revoked key; lifecycle gate; binding required/expired; local policy denial | `authorization_denied` | `restricted: authorization denied` | `403` + `authorization denied\n` | | required current dependency unreadable | `authorization_unavailable` | `restricted: authorization unavailable` | `503` + `authorization unavailable\n` | Nostr text is the exact UTF-8 text after an applicable NIP-42/NIP-01 prefix;