v7.9.38

Author: Spl0itable

package.json

@@ -1,6 +1,6 @@
 {
   "name": "nosflare",
-  "version": "7.9.37",
+  "version": "7.9.38",
   "main": "worker.js",
   "type": "module",
   "scripts": {

src/config.ts

@@ -12,7 +12,7 @@ export const PAY_TO_RELAY_ENABLED = true; // Set to false to disable pay to rela
 export const RELAY_ACCESS_PRICE_SATS = 212121; // Price in SATS for relay access
 
 // NIP-42 Authentication
-export const AUTH_REQUIRED = false; // Set to false to disable NIP-42 authentication requirement
+export const AUTH_REQUIRED = true; // Set to false to disable NIP-42 authentication requirement
 export const AUTH_TIMEOUT_MS = 600000; // 10 minutes - how long the challenge is valid
 
 // Relay info
@@ -23,7 +23,7 @@ export const relayInfo: RelayInfo = {
   contact: "lux@fed.wtf",
   supported_nips: [1, 2, 4, 5, 9, 11, 12, 15, 16, 17, 20, 22, 33, 40, 42],
   software: "https://github.com/Spl0itable/nosflare",
-  version: "7.9.37",
+  version: "7.9.38",
   icon: "https://raw.githubusercontent.com/Spl0itable/nosflare/main/images/flare.png",
 
   // Optional fields (uncomment as needed):

src/durable-object.ts

@@ -778,10 +778,21 @@ export class RelayWebSocket implements DurableObject {
         return;
       }
 
-      // NIP-42: Check if the event's pubkey is authenticated
-      if (AUTH_REQUIRED && !session.authenticatedPubkeys.has(event.pubkey)) {
-        this.sendOK(session.webSocket, event.id, false, 'auth-required: authenticate to publish events');
-        return;
+      // NIP-42: Check authentication
+      if (AUTH_REQUIRED) {
+        if (session.authenticatedPubkeys.size === 0) {
+          // Not authenticated at all
+          this.sendOK(session.webSocket, event.id, false, 'auth-required: authenticate to publish events');
+          return;
+        }
+        // Kind 1059 (gift wrap / NIP-59) uses throwaway pubkeys, so only require
+        // connection-level auth, not per-pubkey auth
+        if (event.kind !== 1059 && !session.authenticatedPubkeys.has(event.pubkey)) {
+          // Authenticated but event pubkey doesn't match - use "restricted:" per NIP-42
+          // so the client knows not to retry auth
+          this.sendOK(session.webSocket, event.id, false, 'restricted: event pubkey does not match authenticated pubkey');
+          return;
+        }
       }
 
       // Rate limiting (skip for excluded kinds)
@@ -802,7 +813,8 @@ export class RelayWebSocket implements DurableObject {
       }
 
       // Check if pay to relay is enabled (payment status cached on session at AUTH time)
-      if (PAY_TO_RELAY_ENABLED) {
+      // Skip for kind 1059 (gift wrap) since the pubkey is a throwaway key with no payment record
+      if (PAY_TO_RELAY_ENABLED && event.kind !== 1059) {
         if (session.hasPaid === false) {
           const protocol = 'https:';
           const relayUrl = `${protocol}//${session.host}`;

worker.js

@@ -73,7 +73,7 @@ __export(config_exports, {
 var relayNpub = "npub16jdfqgazrkapk0yrqm9rdxlnys7ck39c7zmdzxtxqlmmpxg04r0sd733sv";
 var PAY_TO_RELAY_ENABLED = true;
 var RELAY_ACCESS_PRICE_SATS = 212121;
-var AUTH_REQUIRED = false;
+var AUTH_REQUIRED = true;
 var AUTH_TIMEOUT_MS = 6e5;
 var relayInfo = {
   name: "Nosflare",
@@ -82,7 +82,7 @@ var relayInfo = {
   contact: "lux@fed.wtf",
   supported_nips: [1, 2, 4, 5, 9, 11, 12, 15, 16, 17, 20, 22, 33, 40, 42],
   software: "https://github.com/Spl0itable/nosflare",
-  version: "7.9.37",
+  version: "7.9.38",
   icon: "https://raw.githubusercontent.com/Spl0itable/nosflare/main/images/flare.png",
   // Optional fields (uncomment as needed):
   // banner: "https://example.com/banner.jpg",
@@ -4974,9 +4974,15 @@ var _RelayWebSocket = class _RelayWebSocket {
         this.sendOK(session.webSocket, event.id, false, "invalid: kind 22242 events are for authentication only");
         return;
       }
-      if (AUTH_REQUIRED && !session.authenticatedPubkeys.has(event.pubkey)) {
-        this.sendOK(session.webSocket, event.id, false, "auth-required: authenticate to publish events");
-        return;
+      if (AUTH_REQUIRED) {
+        if (session.authenticatedPubkeys.size === 0) {
+          this.sendOK(session.webSocket, event.id, false, "auth-required: authenticate to publish events");
+          return;
+        }
+        if (event.kind !== 1059 && !session.authenticatedPubkeys.has(event.pubkey)) {
+          this.sendOK(session.webSocket, event.id, false, "restricted: event pubkey does not match authenticated pubkey");
+          return;
+        }
       }
       if (!excludedRateLimitKinds.has(event.kind)) {
         if (!session.pubkeyRateLimiter.removeToken()) {
@@ -4991,7 +4997,7 @@ var _RelayWebSocket = class _RelayWebSocket {
         this.sendOK(session.webSocket, event.id, false, "invalid: signature verification failed");
         return;
       }
-      if (PAY_TO_RELAY_ENABLED) {
+      if (PAY_TO_RELAY_ENABLED && event.kind !== 1059) {
         if (session.hasPaid === false) {
           const protocol = "https:";
           const relayUrl = `${protocol}//${session.host}`;