Merge remote-tracking branch 'origin/main' into kennylopez-welcome-message-builder

* origin/main:
  refactor(db): extract domain stores from database runtime (#6987)
  feat(desktop): add team sharing to community catalog (#3995)
  Refresh mobile utility surfaces and theme picker (#6944)
  fix(desktop): complete project empty and context states (#6980)
  Fix mobile jump-to-latest flicker (#6807)
  refactor(relay): NIP-98 admin auth with Operator/Moderator roles and NIP-11 discovery (#3777)
  refactor(db): split channel membership store (#6782)
  feat(auth): add NIP-FI canonical assertion verifier and contracts (#6776)

Signed-off-by: Clay Delk <clay.delk@gmail.com>

Author: delkc

.env.example

@@ -59,6 +59,47 @@ RELAY_URL=ws://localhost:3000
 # (use `just web` for Vite HMR instead).
 # BUZZ_WEB_DIR=./web/dist
 
+# -----------------------------------------------------------------------------
+# Admin Dashboard (private moderation surface)
+# -----------------------------------------------------------------------------
+# Host name that serves the moderation dashboard and its /api/admin/v1
+# endpoints. Leave unset to keep the admin surface absent.
+# BUZZ_ADMIN_HOST=admin.localhost:3000
+#
+# Authentication mode. Accepted values: nip98 (default), disabled.
+# Any other value is a startup error. Token authentication was removed:
+# BUZZ_ADMIN_TOKEN is ignored with a startup warning — remove it from the environment.
+# BUZZ_ADMIN_AUTH=nip98
+#
+# Option A — BUZZ_ADMIN_AUTH=nip98 (Nostr pubkey-based auth, default):
+# NIP-98 HTTP Auth. Each request must carry an Authorization: Nostr header
+# with a signed kind-27235 event. Authorized principals are resolved from:
+#   1. RELAY_OPERATOR_PUBKEYS — comma-separated 64-char hex pubkeys (config Operators).
+#   2. RELAY_OWNER_PUBKEY — implicit Operator fallback when RELAY_OPERATOR_PUBKEYS is unset.
+#   3. relay_operators table — DB-managed Operator/Moderator roster.
+# The dashboard requires a NIP-07 browser extension.
+# Setting RELAY_OPERATOR_PUBKEYS for the admin console does NOT require
+# RELAY_OPERATOR_API_ORIGIN; that origin is only for community provisioning
+# (see below). When BUZZ_ADMIN_HOST is set, the relay advertises the admin
+# origin in its NIP-11 document (`admin_api` field) so clients can auto-discover
+# the console without manual URL entry.
+# RELAY_OPERATOR_PUBKEYS=<64-char hex pubkey>[,<64-char hex pubkey>...]
+#
+# Option B — BUZZ_ADMIN_AUTH=disabled (network-layer auth only):
+# Set only when the admin API is already protected at the network layer
+# (VPN, private ingress). The relay logs a WARN on every startup.
+# `just admin` defaults to this mode for local review.
+#
+# Directory holding the built dashboard assets (`pnpm -C admin-web build`).
+# BUZZ_ADMIN_WEB_DIR=./admin-web/dist
+#
+# Canonical origin (http(s)://host[:port], no path) that community-provisioning
+# NIP-98 requests are verified against. Required only to USE the provisioning
+# endpoints (POST /operator/communities) — not for the admin console. When
+# RELAY_OPERATOR_PUBKEYS is set but this is unset, the relay boots with a WARN
+# and provisioning requests fail closed until it is set.
+# RELAY_OPERATOR_API_ORIGIN=http://127.0.0.1:3000
+
 # Optional relay-owned KLIPY key. When set, NIP-11 advertises GIF search and
 # authenticated desktop clients use this relay as the metadata/search proxy.
 # Keep the real value in your deployment's secret manager; never commit it.

.github/workflows/ci.yml

@@ -780,6 +780,77 @@ jobs:
             --run-ignored ignored-only
         env:
           DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz
+      - name: Admin API nip98 read-write attribution test
+        # The only real HTTP → nip98 operator principal → mutation → cross-table
+        # attribution coverage: an authenticated operator's dismiss attributes
+        # to the operator's own key with relay_operator authority. Staffing
+        # PUT/DELETE attribution is covered by
+        # nip98_staffing_put_and_delete_write_attributed_audit_rows in the
+        # roster-audit lane below. #[ignore]d in the default suite — see
+        # api::admin::tests::nip98_operator_dismiss_succeeds_attributed_to_operator.
+        run: |
+          cargo nextest run \
+            --archive-file target/ci/backend-integration-tests.tar.zst \
+            -E 'package(buzz-relay) and test(=api::admin::tests::nip98_operator_dismiss_succeeds_attributed_to_operator)' \
+            --run-ignored ignored-only
+        env:
+          DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz
+      - name: Admin API unrostered-signer replay invariant
+        # The only causal proof that a validly-signing but unrostered key cannot
+        # consume NIP-98 replay slots: it asserts principal resolution fails
+        # BEFORE the replay ID is claimed (tracking.claim_count() == 0). This
+        # test is non-ignored, so it runs neither in Backend Integration's
+        # ignored-only selectors nor in the infra-free unit job — the unit job's
+        # api::admin selector excludes it because DB-free it only passes by
+        # waiting out the ~30s sqlx acquire timeout on a read-route fallthrough.
+        # It lives here so a reachable Postgres resolves (and fails) the lookup
+        # fast instead of timing out.
+        run: |
+          cargo nextest run \
+            --archive-file target/ci/backend-integration-tests.tar.zst \
+            -E 'package(buzz-relay) and test(=api::admin::tests::nip98_mode_unrostered_signer_does_not_consume_a_replay_slot)'
+        env:
+          DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz
+      - name: Admin API roster-audit / timeout / canonicalization security tests
+        # Security-review fixes for the roster admin API, all #[ignore]d in the
+        # default suite (they need Postgres) and selected by no other job:
+        #  - buzz-db relay_operators::tests: audit pre-image trail, per-target
+        #    lock serialization, insertion-time audit ordering, and
+        #    audit-failure rollback coupling.
+        #  - buzz-db relay_operators::tests last-operator invariant: sole DB
+        #    operator cannot self-demote or self-delete to zero, config presence
+        #    lifts the guard, and concurrent cross-target deletes racing to zero
+        #    leave exactly one operator (roster-wide advisory lock).
+        #  - buzz-relay api::admin: NIP-98 staffing writes attributed audit rows,
+        #    adversarial expirationSecs rejected at the resolve route, mixed-case
+        #    staffing normalizes to one canonical row.
+        #
+        # --test-threads=1: the last-operator invariant counts the roster
+        # globally, and the sole-operator tests clear the roster then assert
+        # their operator is the only one. They must not race each other on the
+        # shared test roster, so this lane runs serially.
+        run: |
+          cargo nextest run \
+            --archive-file target/ci/backend-integration-tests.tar.zst \
+            --test-threads=1 \
+            -E '(package(buzz-db) and test(=relay_operators::tests::roster_mutations_write_pre_image_audit_rows)) or (package(buzz-db) and test(=relay_operators::tests::concurrent_upserts_serialize_and_record_true_pre_image)) or (package(buzz-db) and test(=relay_operators::tests::audit_order_follows_seq_under_backward_clock)) or (package(buzz-db) and test(=relay_operators::tests::audit_insert_failure_rolls_back_roster_mutation)) or (package(buzz-db) and test(=relay_operators::tests::demoting_sole_db_operator_without_config_is_rejected)) or (package(buzz-db) and test(=relay_operators::tests::deleting_sole_db_operator_without_config_is_rejected)) or (package(buzz-db) and test(=relay_operators::tests::config_present_allows_deleting_last_db_operator)) or (package(buzz-db) and test(=relay_operators::tests::concurrent_deletes_racing_to_zero_leave_one_operator)) or (package(buzz-relay) and test(=api::admin::tests::nip98_staffing_put_and_delete_write_attributed_audit_rows)) or (package(buzz-relay) and test(=api::admin::tests::resolve_route_rejects_adversarial_expiration_and_leaves_report_open)) or (package(buzz-relay) and test(=api::admin::tests::mixed_case_non_config_staffing_normalizes_to_one_row))' \
+            --run-ignored ignored-only
+        env:
+          DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz
+      - name: Admin API escalation-scoping tests
+        # Escalation scoping for the moderation queue, all #[ignore]d (they need
+        # Postgres) and selected by no other job:
+        #  - GET /reports defaults to the escalated-only backstop, scope=all
+        #    restores full visibility, explicit status= overrides the default.
+        #  - member reports with category 'illegal' auto-escalate at ingestion
+        #    while every other category still lands 'open'.
+        run: |
+          cargo nextest run \
+            --archive-file target/ci/backend-integration-tests.tar.zst \
+            -E '(package(buzz-relay) and test(=api::admin::tests::reports_default_lists_escalated_only)) or (package(buzz-relay) and test(=api::admin::tests::reports_scope_all_lists_every_status)) or (package(buzz-relay) and test(=api::admin::tests::reports_explicit_status_filter_overrides_default)) or (package(buzz-db) and test(=moderation::tests::illegal_report_auto_escalates_at_ingest)) or (package(buzz-db) and test(=moderation::tests::non_illegal_report_lands_open_at_ingest)) or (package(buzz-db) and test(=relay_admin_actions::tests::auto_escalated_report_reopens_like_an_admin_escalated_one))' \
+            --run-ignored ignored-only
+        env:
+          DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz
       - name: Upload relay log
         if: failure()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7