mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
tlongwell-blockandDawn
3ca6918078
- New module crates/sprout-relay/src/iroh_relay.rs (~290 lines incl. tests).
- pub fn spawn(state, bind_addr) constructs an iroh_relay::server::Server
with AccessConfig::Restricted set to a closure that:
1. Pulls the Bearer token from ClientRequest::auth_token().
2. base64-decodes (accepts STANDARD + URL_SAFE, padded or not).
3. Calls sprout_auth::verify_nip98_event against canonical URL
(= sprout_auth::nip98_canonical_url(public_url, '/relay')).
4. Runs check_relay_membership against the NIP-98 pubkey.
Anything other than Member/ViaOwner/OpenRelay -> Deny.
Per Max's review notes: fail-closed on missing/invalid token, run
membership only after NIP-98 verifies the pubkey, no caching.
- Returns Ok(None) gracefully when SPROUT_IROH_RELAY_PUBLIC_URL is unset
(the canonical URL can't be built without it).
- patched-iroh-relay feature flag reserved for upstream PR C's per-client
max-lifetime hook (kept behind cfg so unpatched rc.0 still compiles).
- MSRV bumped from 1.88.0 -> 1.91.0 (iroh-relay rc.0's MSRV). Repo's
rust-toolchain.toml already pins 1.95.0 so builds are unaffected; the
bump just keeps Cargo.toml honest with the actual transitive floor.
- README updated: 'Rust 1.88+' -> 'Rust 1.91+'.
- crates/sprout-relay/Cargo.toml: added
iroh-relay = { version = "=1.0.0-rc.0", features = ["server"] }
plus the patched-iroh-relay feature.
Tests (rustc 1.95, via rust-toolchain.toml; also verified independently
on 1.91.1):
- sprout-relay --lib: 195 -> 206 (+11 iroh_relay tests covering valid
admission, missing/empty/non-base64/wrong-method/wrong-URL/wrong-kind/
stale-timestamp denials, and bearer-encoding round-trips).
- cargo clippy --workspace --all-targets -- -D warnings: clean.
- cargo fmt --all -- --check: clean.
Signed-off-by: Tyler Longwell <109685178+tlongwell-block@users.noreply.github.com>
Co-authored-by: Dawn (sprout agent) <c6237ef84fa537c78dcee78efd2d4e59f728859c7f194da42ac51ededfa0be05@sprout-oss.stage.blox.sqprod.co>
142 lines
4.1 KiB
TOML
142 lines
4.1 KiB
TOML
[workspace]
|
|
members = [
|
|
"crates/sprout-relay",
|
|
"crates/sprout-core",
|
|
"crates/sprout-db",
|
|
"crates/sprout-pubsub",
|
|
"crates/sprout-auth",
|
|
"crates/sprout-search",
|
|
"crates/sprout-audit",
|
|
"crates/sprout-mcp",
|
|
"crates/sprout-acp",
|
|
"crates/sprout-agent",
|
|
"crates/sprig",
|
|
"crates/sprout-proxy",
|
|
"crates/sprout-test-client",
|
|
"crates/sprout-admin",
|
|
"crates/sprout-workflow",
|
|
"crates/sprout-media",
|
|
"crates/sprout-cli",
|
|
"crates/sprout-pairing-cli",
|
|
"crates/sprout-sdk",
|
|
"crates/sprout-persona",
|
|
"crates/git-credential-nostr",
|
|
"crates/git-sign-nostr",
|
|
"crates/sprout-pair-relay",
|
|
"crates/sprout-dev-mcp",
|
|
"examples/countdown-bot",
|
|
]
|
|
exclude = ["desktop/src-tauri"]
|
|
resolver = "2"
|
|
|
|
[workspace.package]
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
rust-version = "1.91.0"
|
|
license = "Apache-2.0"
|
|
repository = "https://github.com/sprout-rs/sprout"
|
|
|
|
[workspace.dependencies]
|
|
# Runtime
|
|
tokio = { version = "1", features = ["rt-multi-thread", "macros", "net", "time", "sync", "io-util", "signal", "process"] }
|
|
tokio-util = { version = "0.7", features = ["rt", "codec"] }
|
|
|
|
# HTTP + WebSocket
|
|
axum = { version = "0.8", features = ["ws", "macros"] }
|
|
tower = { version = "0.5", features = ["timeout", "util"] }
|
|
tower-http = { version = "0.6", features = ["trace", "cors", "compression-gzip", "limit", "fs"] }
|
|
|
|
# Database
|
|
sqlx = { version = "0.8", features = [
|
|
"runtime-tokio-rustls", "postgres", "uuid", "chrono", "json"
|
|
] }
|
|
|
|
# Redis
|
|
redis = { version = "0.27", features = ["tokio-comp", "connection-manager"] }
|
|
deadpool-redis = { version = "0.18", features = ["rt_tokio_1"] }
|
|
|
|
# Nostr
|
|
nostr = { version = "0.36" }
|
|
|
|
# Serialization
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
serde_yaml = "0.9"
|
|
evalexpr = "11"
|
|
cron = "0.16"
|
|
# Observability
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
|
|
metrics = "0.24"
|
|
metrics-exporter-prometheus = "0.18"
|
|
|
|
# Error handling
|
|
thiserror = "2"
|
|
anyhow = "1"
|
|
|
|
# Utilities
|
|
uuid = { version = "1", features = ["v4", "serde"] }
|
|
chrono = { version = "0.4", features = ["serde"] }
|
|
|
|
# HTTP client (webhook delivery, Typesense indexing)
|
|
reqwest = { version = "0.13", features = ["json", "rustls"], default-features = false }
|
|
|
|
# Cryptography
|
|
sha2 = "0.11"
|
|
hex = "0.4"
|
|
hmac = "0.13"
|
|
|
|
# Randomness
|
|
rand = "0.10"
|
|
subtle = "2.6"
|
|
zeroize = "1.8"
|
|
|
|
# Concurrent data structures
|
|
dashmap = "6"
|
|
moka = { version = "0.12", features = ["sync"] }
|
|
|
|
# Async stream utilities
|
|
futures-util = "0.3"
|
|
|
|
# WebSocket client (test client)
|
|
tokio-tungstenite = { version = "0.29", features = ["rustls-tls-webpki-roots"] }
|
|
url = "2"
|
|
|
|
# MCP SDK
|
|
rmcp = { version = "1.1.0", features = ["server", "transport-io", "macros"] }
|
|
schemars = { version = "1", default-features = false }
|
|
|
|
# Internal crates
|
|
sprout-core = { path = "crates/sprout-core" }
|
|
sprout-db = { path = "crates/sprout-db" }
|
|
sprout-auth = { path = "crates/sprout-auth" }
|
|
sprout-pubsub = { path = "crates/sprout-pubsub" }
|
|
sprout-search = { path = "crates/sprout-search" }
|
|
sprout-audit = { path = "crates/sprout-audit" }
|
|
sprout-mcp = { path = "crates/sprout-mcp" }
|
|
sprout-proxy = { path = "crates/sprout-proxy" }
|
|
sprout-workflow = { path = "crates/sprout-workflow" }
|
|
sprout-media = { path = "crates/sprout-media" }
|
|
sprout-sdk = { path = "crates/sprout-sdk" }
|
|
|
|
# CI profile — release-grade codegen for the relay so e2e tests hit a
|
|
# realistic binary, not an unoptimised debug build. Inherits `release`
|
|
# defaults (opt-level 3, no debug-assertions) but keeps incremental
|
|
# compilation enabled and avoids LTO so the build stays fast.
|
|
[profile.ci]
|
|
inherits = "release"
|
|
lto = false
|
|
|
|
# Sprig profile — optimized for deploy-anywhere Sprig release artifacts.
|
|
# Sprig is distributed over the network and installed on fresh hosts, so binary
|
|
# size matters more than compile speed here. Keep this separate from the normal
|
|
# `release` profile so desktop/dev release builds do not inherit the slower
|
|
# size-focused settings unless they opt in explicitly.
|
|
[profile.sprig]
|
|
inherits = "release"
|
|
opt-level = "z"
|
|
lto = "fat"
|
|
codegen-units = 1
|
|
panic = "abort"
|
|
strip = true
|