nostr-zap 0.2.1 → 0.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8adf3c935487b6598f64c224fe196c8cf2b2e7c120dd9ef1c478b15570e2e6a3
-  data.tar.gz: 107fb7009537702c271f4205443286ba136090a1a6d14ac6e01826d654c43731
+  metadata.gz: b1feece47ab5f8862dd5c46ffce079eb5499fd850056bb3d71c4460142099fa6
+  data.tar.gz: 91712e7614befeec32b360b409cc6e16c2ad555499fcffa1f2e785302eab28c1
 SHA512:
-  metadata.gz: 6b7e8aad4a7824cdc850d73c6099b3e80723c3873d4f9930c1bc79ee4c8554693d1be28fbb768e7cff7f2939368270688fa2a75dd28953094c7a63a33e551ecb
-  data.tar.gz: 3f9c7119b791b8ec79c7a39e9d7e79b30576af5bb1c8f9e121099658a363fb29a44e612fe0e33d130579b08a130927b80fa339aefb0332d064bff46e78e4005b
+  metadata.gz: f361d7b5d2204aeec5224251403595f868e50921859b7da12bd0c7e16cb6c575e76e2a9290bf6a2d73d1745ec177ecf1a6470ad71e6a1152c108fe7e609c1cb2
+  data.tar.gz: b25fc3739c5e1412960b09c5a33109f0f7dcc2f5c3816b4b2492a0c63cbdab95fc0ad55f1ee5b83c49a24cacff032ecffd53438305f01624efda12e85e94c58b

data/README.md

@@ -127,10 +127,16 @@ error = NostrZap::RelayUrlValidator.validate("wss://relay.example.com")
 # => nil (valid)
 
 error = NostrZap::RelayUrlValidator.validate("ws://localhost")
-# => "Invalid relay URL scheme 'ws' (only wss is allowed): ws://localhost"
+# => "Relay URL points to a private/reserved address: ws://localhost"
+
+error = NostrZap::RelayUrlValidator.validate("ws://localhost:4848", check_private: false)
+# => nil
 
 error = NostrZap::RelayUrlValidator.validate("wss://192.168.1.1")
 # => "Relay URL points to a private/reserved address: wss://192.168.1.1"
+
+error = NostrZap::RelayUrlValidator.validate("wss://relay.nostr.bg")
+# => nil (hostnames that do not currently resolve are accepted)
 ```
 
 Blocked IP ranges: `127.0.0.0/8`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`, `0.0.0.0/8`, `::1`, `fc00::/7`, `fe80::/10`.

data/lib/nostr_zap/relay_url_validator.rb

@@ -5,8 +5,11 @@ require 'resolv'
 require 'uri'
 
 module NostrZap
-  # Validates that a relay URL is safe to connect to.
-  # Enforces wss:// scheme and blocks private/reserved IP ranges to prevent SSRF.
+  # Validates relay URLs for zap flows.
+  #
+  # By default, accepts ws:// and wss:// schemes and blocks private/reserved
+  # hosts to prevent SSRF. Private host checks can be disabled when validating
+  # relay tags in incoming zap requests.
   #
   # Returns nil if valid, or an error message string if invalid.
   #
@@ -15,7 +18,7 @@ module NostrZap
   #   error # => nil (valid)
   #
   #   error = NostrZap::RelayUrlValidator.validate('ws://localhost')
-  #   error # => "Invalid relay URL scheme 'ws' (only wss is allowed): ws://localhost"
+  #   error # => "Relay URL points to a private/reserved address: ws://localhost"
   #
   class RelayUrlValidator
     PRIVATE_IP_RANGES = [
@@ -27,15 +30,16 @@ module NostrZap
       IPAddr.new('0.0.0.0/8'),
       IPAddr.new('::1/128'),
       IPAddr.new('fc00::/7'),
-      IPAddr.new('fe80::/10'),
+      IPAddr.new('fe80::/10')
     ].freeze
 
-    def self.validate(url)
-      new(url).validate
+    def self.validate(url, check_private: true)
+      new(url, check_private: check_private).validate
     end
 
-    def initialize(url)
+    def initialize(url, check_private: true)
       @url = url
+      @check_private = check_private
     end
 
     def validate
@@ -46,12 +50,14 @@ module NostrZap
       "Invalid relay URL: #{@url}"
     end
 
-  private
+    private
+
+    attr_reader :check_private
 
     def validate_scheme(uri)
-      return if uri.scheme == 'wss'
+      return if %w[ws wss].include?(uri.scheme)
 
-      "Invalid relay URL scheme '#{uri.scheme}' (only wss is allowed): #{@url}"
+      "Invalid relay URL scheme '#{uri.scheme}' (only ws or wss is allowed): #{@url}"
     end
 
     def validate_host(uri)
@@ -61,18 +67,32 @@ module NostrZap
     end
 
     def validate_not_private(uri)
+      return unless check_private
       return unless private_host?(uri.host)
 
       "Relay URL points to a private/reserved address: #{@url}"
     end
 
     def private_host?(host)
+      ip = parse_ip_literal(host)
+      return private_ip?(ip) if ip
+
       addresses = Resolv.getaddresses(host)
-      return true if addresses.empty?
+      return false if addresses.empty?
 
-      addresses.any? { |addr| PRIVATE_IP_RANGES.any? { |range| range.include?(addr) } }
+      addresses.any? { |addr| private_ip?(addr) }
     rescue Resolv::ResolvError
-      true
+      false
+    end
+
+    def parse_ip_literal(host)
+      IPAddr.new(host)
+    rescue IPAddr::InvalidAddressError
+      nil
+    end
+
+    def private_ip?(ip)
+      PRIVATE_IP_RANGES.any? { |range| range.include?(ip) }
     end
   end
 end

data/lib/nostr_zap/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module NostrZap
-  VERSION = '0.2.1'
+  VERSION = '0.2.3'
 end

data/lib/nostr_zap/zap/request_validator.rb

@@ -139,7 +139,7 @@ module NostrZap
         return fail_with("Missing required 'relays' tag with at least one relay URL") if urls.nil? || urls.empty?
 
         urls.all? do |url|
-          (error = RelayUrlValidator.validate(url)) ? fail_with(error) : true
+          (error = RelayUrlValidator.validate(url, check_private: false)) ? fail_with(error) : true
         end
       end
 

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: nostr-zap
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.2.3
 platform: ruby
 authors:
 - Alexander Zykov
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-02-07 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bip-schnorr
@@ -68,7 +67,6 @@ metadata:
   source_code_uri: https://github.com/sashazykov/nostr-zap
   changelog_uri: https://github.com/sashazykov/nostr-zap/blob/main/CHANGELOG.md
   rubygems_mfa_required: 'true'
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -83,8 +81,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.6
-signing_key:
+rubygems_version: 3.6.9
 specification_version: 4
 summary: NIP-57 Zaps for NOSTR — validate zap requests, build zap receipts, publish
   to relays