Merge branch 'main' into feat/wot-graph-service

Author: Priyanshubhartistm

.changeset/bake-migrations-into-relay-image.md

@@ -0,0 +1,9 @@
+---
+"nostream": patch
+---
+
+deploy: run production migrations from the relay image
+
+Bake `migrations/` and `knexfile.js` into the runtime image and point the
+prod compose migrate service at that image so schema cannot drift from the
+code that ships.

.changeset/deploy-minimal-bootstrap.md

@@ -0,0 +1,9 @@
+---
+"nostream": patch
+---
+
+deploy: minimal server bootstrap with optional settings overrides
+
+Add deploy/bootstrap.sh, document what operators must keep locally vs what
+ships in the image, and stop seeding a full settings.yaml on first boot so
+release defaults merge with optional overrides only.

.changeset/fix-publish-container-image-trigger.md

@@ -0,0 +1,9 @@
+---
+"nostream": patch
+---
+
+fix(ci): publish container image after CI passes on main
+
+Removes the standalone publish workflow and its unsafe workflow_run trigger.
+Image publish now runs as the final job in checks.yml on pushes to main, after
+lint, build, and tests succeed.

.changeset/invoice-default-expiry.md

@@ -0,0 +1,21 @@
+---
+"nostream": patch
+---
+
+fix(payments): stop stale invoices from wedging payment polling
+
+A relay could stop clearing payments entirely, needing `delete from invoices` to
+recover. Two things combined to cause it.
+
+Invoices created without an expiry could never be retired, because the expiry
+check treats a missing date as "not expired", so the maintenance worker left them
+pending forever. The LNURL processor set no expiry on any invoice, making this
+certain there rather than incidental. Invoices now fall back to
+`payments.invoiceExpirySeconds` when the processor reports no expiry of its own,
+and existing pending rows without one are backfilled.
+
+Separately, each maintenance pass re-read the same oldest page of pending
+invoices, so one page of invoices that never resolve starved every newer one
+indefinitely. The worker now advances through the queue and wraps at the end,
+keeping the same per-pass cost while guaranteeing every pending invoice is
+eventually polled.

.changeset/nip43-invite-requests.md

@@ -0,0 +1,35 @@
+---
+"nostream": minor
+---
+
+feat(nip43): issue kind 28935 invite codes on request
+
+NIP-43 kind 28935 is not an event clients publish — it is a REQ the relay answers by
+minting an invite code on the fly and returning a relay-signed ephemeral event. Nostream
+now serves those subscriptions, completing the membership flow: request a claim, join with
+kind 28934, publish.
+
+Off by default. It requires `nip43.enabled` and the new `nip43.allowInviteRequests`, a
+NIP-42 authenticated requester, an `info.self` consistent with the relay signing key, and a
+per-pubkey budget under the new `limits.invite.rateLimits` (5/hour by default). This also
+makes the previously inert `nip43.inviteRequestWhitelist` setting take effect. The minted
+event is never persisted and never broadcast: the claim tag is a bearer secret and is sent
+only to the socket that asked for it.
+
+Two fixes the flow depended on. The relay signs its own events with a key derived from
+`SECRET`, but `info.self` was a hand-edited string that nothing validated — by default it
+was a placeholder that is not a pubkey at all, so any NIP-43 client verifying a relay-signed
+event against `self` would reject it. `info.self` is now optional: when unset or unparseable,
+NIP-11 advertises the derived signing pubkey instead, and `nostream info` prints that pubkey
+so operators can pin it.
+
+Kind 28935 also sits in the ephemeral range, so a client-published one fell through to
+`EphemeralEventStrategy` and was broadcast to every subscriber — including everyone
+subscribed to kind 28935 waiting for a real invite. Anyone could inject a forged `claim` tag
+into that subscription. It is now rejected with an `OK` false and never broadcast, and
+bypasses the NIP-43 admission gate so that rejection actually reaches non-members, who are
+the ones most likely to publish it by mistake while trying to obtain a code.
+
+CLI.md and README.md now describe the request flow. CLI.md previously claimed the relay
+"does not yet generate kind 28935 on `REQ`", and never mentioned that `nostream info`
+prints the signing pubkey that CONFIGURATION.md tells operators to pin.

.github/workflows/checks.yml

@@ -225,3 +225,60 @@ jobs:
         run: pnpm install --frozen-lockfile
       - name: Check for changeset
         run: pnpm exec changeset status --since origin/${{ github.base_ref }}
+
+  publish-container-image:
+    name: Build and push container image
+    runs-on: ubuntu-latest
+    needs:
+      - changes
+      - lint
+      - build-check
+      - test-units-and-cover
+      - test-integrations-and-cover
+      - post-tests
+    if: >-
+      always() && github.event_name == 'push' && github.ref == 'refs/heads/main' &&
+      needs.changes.result == 'success' &&
+      (
+        needs.changes.outputs.src != 'true' ||
+        (
+          needs.lint.result == 'success' &&
+          needs.build-check.result == 'success' &&
+          needs.test-units-and-cover.result == 'success' &&
+          needs.test-integrations-and-cover.result == 'success'
+        )
+      ) &&
+      needs.post-tests.result == 'success'
+    env:
+      REGISTRY: ghcr.io
+      IMAGE_NAME: ${{ github.repository }}
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=main
+            type=sha,prefix=sha-
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/publish-container-image.yml

@@ -49,3 +49,6 @@ dist
 docker-compose.overrides.yml
 # Export output
 *.jsonl
+
+# Code coverage report output
+coverage-report/

.gitignore

@@ -46,7 +46,20 @@ docker compose exec nostream node src/cli/index.js invite create
 
 `--uses` defaults to `nip43.defaultMaxUses` (1). `--expires-in` defaults to `nip43.inviteCodeExpirySeconds` (600 = 10 minutes). `--expires-in` must be a positive integer; never-expiring codes are a yaml policy (`nip43.inviteCodeExpirySeconds: 0`), not a CLI flag. The printed code is the first line of human output so scripts can capture it. If `info.self` is a hex pubkey or `npub1…`, it is stored as `created_by`.
 
-This does not yet generate kind 28935 on `REQ` or publish membership list events.
+The relay also answers `REQ`s for kind 28935 by minting a code on the fly and returning it as a relay-signed ephemeral event, so users can obtain a claim string without an operator handing one out. It is off by default and requires `nip43.enabled`, `nip43.allowInviteRequests` and a NIP-42 authenticated client — see [CONFIGURATION.md](CONFIGURATION.md). Membership list events (kind 13534) are not published yet.
+
+Invites minted over `REQ` record the requesting pubkey as `created_by`; `nostream invite create` records `info.self`.
+
+### Relay signing pubkey
+
+NIP-43 clients verify relay-signed events against the `self` field of the NIP-11 document, so `self` must match the key the relay actually signs with. That key is derived from `SECRET` and is otherwise invisible, so `nostream info` prints it:
+
+```bash
+nostream info | grep 'Signing pubkey'
+nostream info --json     # same value under relay.signingPubkey
+```
+
+Leave `info.self` unset in settings to have this value advertised automatically. Set it only if you want to pin it explicitly, and set it to exactly this value — a mismatch disables kind 28935 invite requests.
 
 ## Removed Legacy Wrappers
 

CLI.md

@@ -148,7 +148,7 @@ The settings below are listed in alphabetical order by name. Please keep this ta
 | info.name                                   | Public name of your relay. (e.g. TBG's Public Relay) |
 | info.pubkey                                 | Relay operator's Nostr pubkey in hex format. |
 | info.relay_url                              | Public-facing URL of your relay. (e.g. wss://relay.your-domain.com) |
-| info.self                                   | Relay pubkey in hex format for the relay information document `self` field. |
+| info.self                                   | Optional. The relay's own signing pubkey (hex or `npub1...`), published as `self` in the relay information document. NIP-43 clients verify relay-signed events against it, so it must match the key the relay signs with. Leave unset to derive it from `SECRET`; run `nostream info` to print the derived value. A configured value that does not match disables kind 28935 invite requests. |
 | info.terms_of_service                       | Public URL to relay terms of service. |
 | limits.admissionCheck.ipWhitelist           | List of IPs (IPv4 or IPv6) to ignore rate limits. |
 | limits.admissionCheck.rateLimits[].period   | Rate limit period in milliseconds. |
@@ -173,6 +173,8 @@ The settings below are listed in alphabetical order by name. Please keep this ta
 | limits.event.retention.pubkey.whitelist     | Public keys excluded from retention purge. |
 | limits.event.whitelists.ipAddresses         | List of IPs (IPv4 or IPv6) to ignore rate limits. |
 | limits.event.whitelists.pubkeys             | List of public keys to ignore rate limits. |
+| limits.invite.rateLimits[].period            | Rate limit period in milliseconds for NIP-43 kind 28935 invite requests, counted per requesting pubkey. |
+| limits.invite.rateLimits[].rate              | Maximum number of invite requests a single pubkey may make during period. Each granted request writes a row to `invite_codes`, so this is the main defence against a code flood. Defaults to 5 per hour. |
 | limits.message.ipWhitelist                  | List of IPs (IPv4 or IPv6) to ignore rate limits. |
 | limits.message.rateLimits[].period          | Rate limit period in milliseconds. |
 | limits.client.subscription.maxSubscriptions | Maximum number of subscriptions per connected client. Defaults to 10. Disabled when set to zero. |
@@ -199,6 +201,8 @@ The settings below are listed in alphabetical order by name. Please keep this ta
 | nip43.enabled                               | Enable NIP-43 invite-based membership. When true, only admitted members may publish. Defaults to false. |
 | nip43.inviteCodeExpirySeconds               | Seconds until a newly minted invite code expires. `0` means the code never expires. Defaults to 600 (10 minutes). |
 | nip43.defaultMaxUses                        | How many times a newly minted invite code can be claimed. Defaults to 1. |
+| nip43.allowInviteRequests                   | Answer REQs for kind 28935 by minting an invite code on the fly and returning it as a relay-signed ephemeral event on that subscription. NIP-43 requires relays to opt in to this explicitly. Requesters must be authenticated via NIP-42, and `info.self` must match the relay's signing pubkey. Defaults to false. |
+| nip43.inviteRequestWhitelist                | Public keys allowed to request kind 28935 invite codes. Empty (the default) means any authenticated pubkey may request one; a non-empty list restricts minting to those pubkeys. |
 | nip45.enabled                               | Enable or disable NIP-45 COUNT handling. Defaults to true. |
 | nip50.enabled                               | Enable or disable NIP-50 full-text search. Defaults to false. When enabled, clients can include a `search` field in REQ filters to perform text queries against event content. Requires the GIN full-text index migration. |
 | nip50.language                              | PostgreSQL text-search configuration name. Defaults to `simple` (language-agnostic tokenization). Set to `english`, `spanish`, etc. for stemming support. See [PostgreSQL text search configurations](https://www.postgresql.org/docs/current/textsearch-configuration.html). **Note:** The GIN index migration is built with the `simple` configuration. If you change this value, you must manually rebuild the index: `DROP INDEX CONCURRENTLY events_content_fts_idx; CREATE INDEX CONCURRENTLY events_content_fts_idx ON events USING gin (to_tsvector('<your_language>', event_content));` — otherwise the planner cannot use the index and queries fall back to sequential scans. |