807037ee9b
Our own keyless Bun service (not Linky's): watches relays for kind-1059 wraps
carrying the plaintext marker ["skatespots","push"] on the recipient copy,
extracts only {recipient, wrapId}, and sends a Web Push. NEVER decrypts - the
client fetches + decrypts the named wrap itself.
Endpoints: GET /health, GET /vapid-public-key, POST /auth/challenge ->
/subscribe|/unsubscribe with a one-time NIP-98 (kind 27235) challenge proof.
State is a JSON file; VAPID keys from env. Wired like the other standalone
servers (typecheck:push + check:push in npm test, deploy:push, Caddyfile +
systemd unit). Verified locally end-to-end: auth -> subscribe -> marked wrap ->
watcher -> push attempt, and proof replay rejected.
Client half (service worker, subscribe hook + Settings toggle, marker on DM
sends) is the next step.
259 lines
12 KiB
TypeScript
259 lines
12 KiB
TypeScript
/**
|
||
* SkateSpots push service
|
||
* ─────────────────────────────────────────────────────────────────────────────
|
||
* A keyless Bun service that delivers **closed-app notifications** for NIP-17
|
||
* gift wraps. It watches relays for kind-1059 wraps carrying the plaintext push
|
||
* marker `["<PUSH_MARKER>", "push"]`, extracts ONLY the recipient pubkey and the
|
||
* wrap id, and sends a Web Push. It **never decrypts** anything — the client
|
||
* fetches + decrypts the named wrap itself.
|
||
*
|
||
* Protocol (ours — independent of, though inspired by, Linky):
|
||
* GET /health → { ok, subscriptions, relays }
|
||
* GET /vapid-public-key → { key }
|
||
* POST /auth/challenge {pubkey} → { challenge, expiresAt }
|
||
* POST /subscribe { subscription, proof } → { ok }
|
||
* POST /unsubscribe { endpoint, proof } → { ok }
|
||
*
|
||
* `proof` is a NIP-98 kind-27235 event signed by the subscribing pubkey,
|
||
* carrying ["challenge", <value>] from /auth/challenge — it proves ownership
|
||
* of that pubkey. A challenge is one-time (consumed on use).
|
||
*
|
||
* State is a small JSON file (subscriptions + challenges). Env + deploy: README.md.
|
||
*/
|
||
import { readFileSync, writeFileSync } from 'node:fs';
|
||
import webpush from 'web-push';
|
||
import { verifyEvent, type NostrEvent } from 'nostr-tools';
|
||
|
||
// Bun provides this at runtime; declare it so the standalone tsc check passes
|
||
// without pulling all of @types/bun into the app's toolchain.
|
||
declare const Bun: {
|
||
serve(options: { port: number; fetch: (req: Request) => Response | Promise<Response> }): unknown;
|
||
};
|
||
|
||
// ─── Config ──────────────────────────────────────────────────────────────────
|
||
|
||
const env = process.env;
|
||
const PORT = Number(env.PORT ?? 8788);
|
||
const MARKER = (env.PUSH_MARKER ?? 'skatespots').trim();
|
||
const STORAGE_PATH = env.PUSH_STORAGE_PATH ?? './push-state.json';
|
||
const RELAYS = (env.PUSH_RELAYS ?? 'wss://goskatespots.nostr1.com')
|
||
.split(',').map((s) => s.trim()).filter(Boolean);
|
||
const LOOKBACK_SECONDS = Number(env.PUSH_LOOKBACK_SECONDS ?? 3 * 24 * 60 * 60);
|
||
const CHALLENGE_TTL_SECONDS = Number(env.PUSH_CHALLENGE_TTL_SECONDS ?? 5 * 60);
|
||
const ORIGINS = (env.PUSH_ALLOWED_ORIGINS ?? 'https://skate-spots.org,http://localhost:8080')
|
||
.split(',').map((s) => s.trim()).filter(Boolean);
|
||
|
||
let vapidPublic = env.PUSH_VAPID_PUBLIC_KEY ?? '';
|
||
let vapidPrivate = env.PUSH_VAPID_PRIVATE_KEY ?? '';
|
||
const vapidSubject = env.PUSH_VAPID_SUBJECT ?? 'mailto:owner@skate-spots.org';
|
||
|
||
if (!vapidPublic || !vapidPrivate) {
|
||
const generated = webpush.generateVAPIDKeys();
|
||
vapidPublic = generated.publicKey;
|
||
vapidPrivate = generated.privateKey;
|
||
console.warn('[push] ⚠️ PUSH_VAPID_* not set — generated EPHEMERAL keys (subscriptions break on restart).');
|
||
}
|
||
webpush.setVapidDetails(vapidSubject, vapidPublic, vapidPrivate);
|
||
|
||
// ─── State (JSON file) ───────────────────────────────────────────────────────
|
||
|
||
interface StoredSubscription { endpoint: string; pubkey: string; p256dh: string; auth: string }
|
||
interface State {
|
||
subscriptions: Record<string, StoredSubscription>; // endpoint → sub
|
||
challenges: Record<string, { pubkey: string; expiresAt: number }>;
|
||
}
|
||
|
||
function load(): State {
|
||
try {
|
||
const parsed = JSON.parse(readFileSync(STORAGE_PATH, 'utf8')) as Partial<State>;
|
||
return { subscriptions: parsed.subscriptions ?? {}, challenges: parsed.challenges ?? {} };
|
||
} catch {
|
||
return { subscriptions: {}, challenges: {} };
|
||
}
|
||
}
|
||
const state = load();
|
||
function save(): void {
|
||
try { writeFileSync(STORAGE_PATH, JSON.stringify(state)); }
|
||
catch (err) { console.warn('[push] could not persist state:', (err as Error).message); }
|
||
}
|
||
|
||
function sweepChallenges(): void {
|
||
const now = Math.floor(Date.now() / 1000);
|
||
for (const [id, c] of Object.entries(state.challenges)) if (c.expiresAt < now) delete state.challenges[id];
|
||
}
|
||
|
||
// ─── NIP-98 proof ────────────────────────────────────────────────────────────
|
||
|
||
function tagValue(ev: NostrEvent, name: string): string | undefined {
|
||
return ev.tags.find(([n]) => n === name)?.[1];
|
||
}
|
||
|
||
/** Verify a kind-27235 ownership proof for `expectedPubkey`, consuming its challenge. */
|
||
function verifyProof(proof: unknown, expectedPubkey: string): { ok: boolean; error?: string } {
|
||
if (!proof || typeof proof !== 'object') return { ok: false, error: 'missing proof' };
|
||
const ev = proof as NostrEvent;
|
||
if (ev.kind !== 27235) return { ok: false, error: 'proof must be kind 27235' };
|
||
if (ev.pubkey !== expectedPubkey) return { ok: false, error: 'proof pubkey mismatch' };
|
||
const challenge = tagValue(ev, 'challenge');
|
||
if (!challenge) return { ok: false, error: 'proof missing challenge' };
|
||
if (!verifyEvent(ev)) return { ok: false, error: 'bad proof signature' };
|
||
|
||
const row = state.challenges[challenge];
|
||
delete state.challenges[challenge]; // one-time, even on failure
|
||
save();
|
||
if (!row) return { ok: false, error: 'unknown challenge' };
|
||
if (row.pubkey !== expectedPubkey) return { ok: false, error: 'challenge/pubkey mismatch' };
|
||
if (row.expiresAt < Math.floor(Date.now() / 1000)) return { ok: false, error: 'challenge expired' };
|
||
return { ok: true };
|
||
}
|
||
|
||
// ─── Web Push ────────────────────────────────────────────────────────────────
|
||
|
||
function subsFor(pubkey: string): StoredSubscription[] {
|
||
return Object.values(state.subscriptions).filter((s) => s.pubkey === pubkey);
|
||
}
|
||
|
||
async function pushTo(pubkey: string, wrapId: string): Promise<void> {
|
||
for (const s of subsFor(pubkey)) {
|
||
try {
|
||
await webpush.sendNotification(
|
||
{ endpoint: s.endpoint, keys: { p256dh: s.p256dh, auth: s.auth } },
|
||
JSON.stringify({ title: 'SkateSpots', body: 'New message', wrapId, url: '/#/messages' }),
|
||
);
|
||
} catch (err) {
|
||
const status = (err as { statusCode?: number }).statusCode;
|
||
if (status === 404 || status === 410) {
|
||
console.log(`[push] dropping dead subscription for ${pubkey.slice(0, 12)}…`);
|
||
delete state.subscriptions[s.endpoint];
|
||
save();
|
||
} else {
|
||
console.warn(`[push] send failed (${status ?? 'error'}) for ${pubkey.slice(0, 12)}…`);
|
||
}
|
||
}
|
||
}
|
||
}
|
||
|
||
// ─── Relay watcher (no keys, no decryption) ──────────────────────────────────
|
||
|
||
const relayStatus: Record<string, string> = {};
|
||
|
||
function watchRelay(url: string): void {
|
||
relayStatus[url] = 'connecting';
|
||
const ws = new WebSocket(url);
|
||
const since = Math.floor(Date.now() / 1000) - LOOKBACK_SECONDS;
|
||
|
||
ws.addEventListener('open', () => {
|
||
relayStatus[url] = 'live';
|
||
ws.send(JSON.stringify(['REQ', 'skatespots-push', { kinds: [1059], since }]));
|
||
console.log(`[push] watching ${url}`);
|
||
});
|
||
|
||
ws.addEventListener('message', (msg: MessageEvent) => {
|
||
let parsed: unknown;
|
||
try { parsed = JSON.parse(String(msg.data)); } catch { return; }
|
||
if (!Array.isArray(parsed) || parsed[0] !== 'EVENT') return;
|
||
const ev = parsed[2] as NostrEvent;
|
||
if (ev?.kind !== 1059 || !verifyEvent(ev)) return;
|
||
const recipients = [...new Set(ev.tags.filter(([n]) => n === 'p').map(([, v]) => v).filter(Boolean))];
|
||
if (recipients.length !== 1) return; // fan-out wraps aren't pushable
|
||
if (!ev.tags.some(([n, v]) => n === MARKER && v === 'push')) return;
|
||
console.log(`[push] 🔔 marked wrap ${ev.id.slice(0, 12)}… → recipient ${recipients[0].slice(0, 12)}…`);
|
||
void pushTo(recipients[0], ev.id);
|
||
});
|
||
|
||
const retry = () => { relayStatus[url] = 'down'; setTimeout(() => watchRelay(url), 5000); };
|
||
ws.addEventListener('close', retry);
|
||
ws.addEventListener('error', () => { try { ws.close(); } catch { /* noop */ } });
|
||
}
|
||
|
||
for (const url of RELAYS) watchRelay(url);
|
||
|
||
// ─── HTTP ────────────────────────────────────────────────────────────────────
|
||
|
||
function cors(origin: string | null): Record<string, string> {
|
||
if (origin && ORIGINS.includes(origin)) return { 'access-control-allow-origin': origin, vary: 'Origin' };
|
||
return {};
|
||
}
|
||
function json(body: unknown, status = 200, extra: Record<string, string> = {}): Response {
|
||
return new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json', ...extra } });
|
||
}
|
||
|
||
Bun.serve({
|
||
port: PORT,
|
||
async fetch(req: Request) {
|
||
const url = new URL(req.url);
|
||
const headers = cors(req.headers.get('origin'));
|
||
|
||
if (req.method === 'OPTIONS') {
|
||
return new Response(null, {
|
||
status: 204,
|
||
headers: {
|
||
...headers,
|
||
'access-control-allow-methods': 'GET,POST,OPTIONS',
|
||
'access-control-allow-headers': 'content-type',
|
||
'access-control-max-age': '86400',
|
||
},
|
||
});
|
||
}
|
||
|
||
if (url.pathname === '/health') {
|
||
return json({
|
||
ok: true,
|
||
subscriptions: Object.keys(state.subscriptions).length,
|
||
relays: relayStatus,
|
||
}, 200, headers);
|
||
}
|
||
|
||
if (url.pathname === '/vapid-public-key') return json({ key: vapidPublic }, 200, headers);
|
||
|
||
if (req.method === 'POST' && url.pathname === '/auth/challenge') {
|
||
const body = (await req.json().catch(() => null)) as { pubkey?: string } | null;
|
||
if (!body?.pubkey || !/^[0-9a-f]{64}$/i.test(body.pubkey)) {
|
||
return json({ error: 'valid hex pubkey required' }, 400, headers);
|
||
}
|
||
sweepChallenges();
|
||
const id = crypto.randomUUID();
|
||
const expiresAt = Math.floor(Date.now() / 1000) + CHALLENGE_TTL_SECONDS;
|
||
state.challenges[id] = { pubkey: body.pubkey.toLowerCase(), expiresAt };
|
||
save();
|
||
return json({ challenge: id, expiresAt }, 200, headers);
|
||
}
|
||
|
||
if (req.method === 'POST' && url.pathname === '/subscribe') {
|
||
const body = (await req.json().catch(() => null)) as {
|
||
subscription?: { endpoint?: string; keys?: { p256dh?: string; auth?: string } };
|
||
proof?: NostrEvent;
|
||
} | null;
|
||
const sub = body?.subscription;
|
||
if (!sub?.endpoint || !sub.keys?.p256dh || !sub.keys.auth) {
|
||
return json({ error: 'subscription { endpoint, keys{ p256dh, auth } } required' }, 400, headers);
|
||
}
|
||
if (!body?.proof) return json({ error: 'proof required' }, 400, headers);
|
||
const check = verifyProof(body.proof, body.proof.pubkey);
|
||
if (!check.ok) return json({ error: check.error }, 401, headers);
|
||
state.subscriptions[sub.endpoint] = {
|
||
endpoint: sub.endpoint,
|
||
pubkey: body.proof.pubkey.toLowerCase(),
|
||
p256dh: sub.keys.p256dh,
|
||
auth: sub.keys.auth,
|
||
};
|
||
save();
|
||
console.log(`[push] ➕ subscribed ${body.proof.pubkey.slice(0, 12)}…`);
|
||
return json({ ok: true }, 200, headers);
|
||
}
|
||
|
||
if (req.method === 'POST' && url.pathname === '/unsubscribe') {
|
||
const body = (await req.json().catch(() => null)) as { endpoint?: string; proof?: NostrEvent } | null;
|
||
if (!body?.endpoint || !body?.proof) return json({ error: 'endpoint and proof required' }, 400, headers);
|
||
const check = verifyProof(body.proof, body.proof.pubkey);
|
||
if (!check.ok) return json({ error: check.error }, 401, headers);
|
||
delete state.subscriptions[body.endpoint];
|
||
save();
|
||
return json({ ok: true }, 200, headers);
|
||
}
|
||
|
||
return json({ error: 'not found' }, 404, headers);
|
||
},
|
||
});
|
||
|
||
console.log(`[push] listening on :${PORT} — marker "${MARKER}", relays: ${RELAYS.join(', ')}`);
|