feat(NIP-42): pubkey authentication

Configurable in `config.toml`.  Limited functionality, but this does
send metadata to gRPC for event authorization.

fixes: https://todo.sr.ht/~gheartsfield/nostr-rs-relay/66

src/conn.rs

@@ -1,16 +1,30 @@
 //! Client connection state
-use crate::close::Close;
-use crate::error::Error;
-use crate::error::Result;
-
-use crate::subscription::Subscription;
 use std::collections::HashMap;
+
 use tracing::{debug, trace};
 use uuid::Uuid;
 
+use crate::close::Close;
+use crate::conn::Nip42AuthState::{AuthPubkey, Challenge, NoAuth};
+use crate::error::Error;
+use crate::error::Result;
+use crate::event::Event;
+use crate::subscription::Subscription;
+use crate::utils::{host_str, unix_time};
+
 /// A subscription identifier has a maximum length
 const MAX_SUBSCRIPTION_ID_LEN: usize = 256;
 
+/// NIP-42 authentication state
+pub enum Nip42AuthState {
+    /// The client is not authenticated yet
+    NoAuth,
+    /// The AUTH challenge sent
+    Challenge(String),
+    /// The client is authenticated
+    AuthPubkey(String),
+}
+
 /// State for a client connection
 pub struct ClientConn {
     /// Client IP (either from socket, or configured proxy header
@@ -21,6 +35,8 @@ pub struct ClientConn {
     subscriptions: HashMap<String, Subscription>,
     /// Per-connection maximum concurrent subscriptions
     max_subs: usize,
+    /// NIP-42 AUTH
+    auth: Nip42AuthState,
 }
 
 impl Default for ClientConn {
@@ -39,15 +55,18 @@ impl ClientConn {
             client_id,
             subscriptions: HashMap::new(),
             max_subs: 32,
+            auth: NoAuth,
         }
     }
 
-    #[must_use] pub fn subscriptions(&self) -> &HashMap<String, Subscription> {
+    #[must_use]
+    pub fn subscriptions(&self) -> &HashMap<String, Subscription> {
         &self.subscriptions
     }
 
     /// Check if the given subscription already exists
-    #[must_use] pub fn has_subscription(&self, sub: &Subscription) -> bool {
+    #[must_use]
+    pub fn has_subscription(&self, sub: &Subscription) -> bool {
         self.subscriptions.values().any(|x| x == sub)
     }
 
@@ -63,6 +82,22 @@ impl ClientConn {
         &self.client_ip_addr
     }
 
+    #[must_use]
+    pub fn auth_pubkey(&self) -> Option<&String> {
+        match &self.auth {
+            AuthPubkey(pubkey) => Some(pubkey),
+            _ => None,
+        }
+    }
+
+    #[must_use]
+    pub fn auth_challenge(&self) -> Option<&String> {
+        match &self.auth {
+            Challenge(pubkey) => Some(pubkey),
+            _ => None,
+        }
+    }
+
     /// Add a new subscription for this connection.
     /// # Errors
     ///
@@ -116,4 +151,79 @@ impl ClientConn {
             self.get_client_prefix(),
         );
     }
+
+    pub fn generate_auth_challenge(&mut self) {
+        self.auth = Challenge(Uuid::new_v4().to_string());
+    }
+
+    pub fn authenticate(&mut self, event: &Event, relay_url: &String) -> Result<()> {
+        match &self.auth {
+            Challenge(_) => (),
+            AuthPubkey(_) => {
+                // already authenticated
+                return Ok(())
+            },
+            NoAuth => {
+                // unexpected AUTH request
+                return Err(Error::AuthFailure);
+            },
+        }
+        match event.validate() {
+            Ok(_) => {
+                if event.kind != 22242 {
+                    return Err(Error::AuthFailure);
+                }
+
+                let curr_time = unix_time();
+                let past_cutoff = curr_time - 600; // 10 minutes
+                let future_cutoff = curr_time + 600; // 10 minutes
+                if event.created_at < past_cutoff || event.created_at > future_cutoff {
+                    return Err(Error::AuthFailure);
+                }
+
+                let mut challenge: Option<&String> = None;
+                let mut relay: Option<&String> = None;
+
+                for tag in &event.tags {
+                    if tag.len() == 2 && tag.get(0) == Some(&"challenge".into()) {
+                        challenge = tag.get(1);
+                    }
+                    if tag.len() == 2 && tag.get(0) == Some(&"relay".into()) {
+                        relay = tag.get(1);
+                    }
+                }
+
+                match (challenge, &self.auth) {
+                    (Some(received_challenge), Challenge(sent_challenge)) => {
+                        if received_challenge != sent_challenge {
+                            return Err(Error::AuthFailure);
+                        }
+                    }
+                    (_, _) => {
+                        return Err(Error::AuthFailure);
+                    }
+                }
+
+                match (relay.and_then(|url| host_str(url)), host_str(relay_url)) {
+                    (Some(received_relay), Some(our_relay)) => {
+                        if received_relay != our_relay {
+                            return Err(Error::AuthFailure);
+                        }
+                    }
+                    (_, _) => {
+                        return Err(Error::AuthFailure);
+                    }
+                }
+
+                self.auth = AuthPubkey(event.pubkey.clone());
+                trace!(
+                    "authenticated pubkey {} (cid: {})",
+                    event.pubkey.chars().take(8).collect::<String>(),
+                    self.get_client_prefix()
+                );
+                Ok(())
+            }
+            Err(_) => Err(Error::AuthFailure),
+        }
+    }
 }