@pomade/core 0.0.12 → 0.1.0

package/dist/signer.js

@@ -1,14 +1,10 @@
 import { Lib } from "@frostr/bifrost";
 import { randomBytes } from "@noble/hashes/utils.js";
-import { not, now, filter, remove, removeUndefined, append, ms, uniq, between, call, int, ago, MINUTE, HOUR, YEAR, } from "@welshman/lib";
-import { verifyEvent, getTagValue, HTTP_AUTH } from "@welshman/util";
-import { Method, isPasswordAuth, isOTPAuth } from "./schema.js";
-import { RPC } from "./rpc.js";
+import { now, filter, remove, removeUndefined, append, ms, uniq, between, call, int, ago, MINUTE, YEAR, } from "@welshman/lib";
+import { verifyEvent, getTagValue, getPow, HTTP_AUTH } from "@welshman/util";
+import { isPasswordAuth, isOTPAuth, Schema } from "./schema.js";
 import { hashEmail, debug, context } from "./util.js";
-import { getPow } from "@welshman/util";
-import { isChallengeRequest, isEcdhRequest, isLoginSelect, isLoginStart, isRecoverySetup, isRecoverySelect, isRecoveryStart, isRegisterRequest, isSessionDelete, isSessionList, isSignRequest, makeEcdhResult, makeLoginOptions, makeLoginResult, makeRecoverySetupResult, makeRecoveryOptions, makeRecoveryResult, makeRegisterResult, makeSessionDeleteResult, makeSessionListResult, makeSignResult, } from "./message.js";
 import { isRateLimited, recordAttempt, getRateLimitResetTime, cleanupRateLimits, } from "./ratelimit.js";
-// Rate limiting for client requests (sign + ecdh combined)
 const CLIENT_RATE_LIMITS = {
     maxAttempts: 100,
     windowSeconds: int(1, MINUTE),
@@ -17,7 +13,6 @@ const EMAIL_RATE_LIMITS = {
     maxAttempts: 5,
     windowSeconds: int(2, MINUTE),
 };
-// Utils
 function randomInt(min, max) {
     const bytes = randomBytes(4);
     const value = new DataView(bytes.buffer).getUint32(0);
@@ -27,7 +22,7 @@ function makeSessionItem(session) {
     return {
         pubkey: session.group.group_pk.slice(2),
         client: session.client,
-        created_at: session.event.created_at,
+        created_at: session.created_at,
         last_activity: session.last_activity,
         threshold: session.group.threshold,
         total: session.group.commits.length,
@@ -37,7 +32,6 @@ function makeSessionItem(session) {
 }
 export class Signer {
     options;
-    rpc;
     intervals;
     logins;
     sessions;
@@ -55,49 +49,19 @@ export class Signer {
         this.sessionsByEmailHash = options.storage.collection("sessionsByEmailHash");
         this.rateLimitByEmailHash = options.storage.collection("rateLimitByEmailHash");
         this.rateLimitByClient = options.storage.collection("rateLimitByClient");
-        this.rpc = new RPC(options.signer, options.relays);
-        this.rpc.subscribe(message => {
-            // Ignore events with weird timestamps
-            if (!between([now() - int(1, HOUR), now() + int(1, HOUR)], message.event.created_at)) {
-                return debug("[signer]: ignoring event", message.event.id);
-            }
-            if (isRegisterRequest(message))
-                this.handleRegisterRequest(message);
-            if (isRecoverySetup(message))
-                this.handleRecoverySetup(message);
-            if (isChallengeRequest(message))
-                this.handleChallengeRequest(message);
-            if (isRecoveryStart(message))
-                this.handleRecoveryStart(message);
-            if (isRecoverySelect(message))
-                this.handleRecoverySelect(message);
-            if (isLoginStart(message))
-                this.handleLoginStart(message);
-            if (isLoginSelect(message))
-                this.handleLoginSelect(message);
-            if (isSignRequest(message))
-                this.handleSignRequest(message);
-            if (isEcdhRequest(message))
-                this.handleEcdhRequest(message);
-            if (isSessionList(message))
-                this.handleSessionList(message);
-            if (isSessionDelete(message))
-                this.handleSessionDelete(message);
-        });
-        // Periodically clean up recovery requests and rate limits
         this.intervals = [
             setInterval(async () => {
                 debug("[signer]: cleaning up logins, recoveries, and rate limits");
                 for (const [client, recovery] of await this.recoveries.entries()) {
-                    if (recovery.event.created_at < ago(15, MINUTE))
+                    if (recovery.created_at < ago(15, MINUTE))
                         await this.recoveries.delete(client);
                 }
                 for (const [client, login] of await this.logins.entries()) {
-                    if (login.event.created_at < ago(15, MINUTE))
+                    if (login.created_at < ago(15, MINUTE))
                         await this.logins.delete(client);
                 }
                 for (const [client, challenge] of await this.challenges.entries()) {
-                    if (challenge.event.created_at < ago(15, MINUTE))
+                    if (challenge.created_at < ago(15, MINUTE))
                         await this.challenges.delete(client);
                 }
                 await cleanupRateLimits(this.rateLimitByEmailHash, EMAIL_RATE_LIMITS.windowSeconds);
@@ -113,10 +77,28 @@ export class Signer {
         });
     }
     stop() {
-        this.rpc.stop();
         this.intervals.forEach(clearInterval);
     }
     // Internal utils
+    _parseAuth(header, path = "") {
+        if (header?.startsWith("Nostr ")) {
+            let auth;
+            try {
+                auth = JSON.parse(atob(header.slice(6)));
+            }
+            catch {
+                return;
+            }
+            if (verifyEvent(auth) &&
+                auth.kind === HTTP_AUTH &&
+                auth.created_at >= ago(15) &&
+                auth.created_at <= now() + 5 &&
+                getTagValue("u", auth.tags) === `${this.options.url}${path}` &&
+                getTagValue("method", auth.tags) === "POST") {
+                return auth;
+            }
+        }
+    }
     async _checkAndRecordRateLimit(client) {
         const bucket = await this.rateLimitByClient.get(client);
         if (isRateLimited(bucket, CLIENT_RATE_LIMITS)) {
@@ -124,13 +106,11 @@ export class Signer {
             debug(`[signer]: rate limit exceeded for client ${client.slice(0, 8)}, reset in ${resetTime}s`);
             return false;
         }
-        // Record the attempt
         const updatedBucket = recordAttempt(bucket, CLIENT_RATE_LIMITS);
         await this.rateLimitByClient.set(client, updatedBucket);
         return true;
     }
     async _getAuthenticatedSessions(auth) {
-        // Check rate limit for auth attempts
         const bucket = await this.rateLimitByEmailHash.get(auth.email_hash);
         if (isRateLimited(bucket, EMAIL_RATE_LIMITS)) {
             const resetTime = getRateLimitResetTime(bucket, EMAIL_RATE_LIMITS);
@@ -153,46 +133,25 @@ export class Signer {
                 }
             }
         }
-        // Record failed authentication attempt for rate limiting
         if (sessions.length === 0) {
             await this.rateLimitByEmailHash.set(auth.email_hash, recordAttempt(bucket, EMAIL_RATE_LIMITS));
         }
         return sessions;
     }
-    async _isNip98AuthValid(auth, method) {
-        const pubkey = await this.options.signer.getPubkey();
-        return (verifyEvent(auth) &&
-            auth.kind === HTTP_AUTH &&
-            auth.created_at > ago(15) &&
-            auth.created_at < now() + 5 &&
-            getTagValue("u", auth.tags) === pubkey &&
-            getTagValue("method", auth.tags) === method);
-    }
-    async _checkKeyReuse(event) {
-        if (await this.sessions.get(event.pubkey)) {
-            debug(`[client ${event.pubkey.slice(0, 8)}]: session key re-used`);
-            return this.rpc.channel(event.pubkey, false).send(makeRecoveryOptions({
-                ok: false,
-                message: "Do not re-use session keys.",
-                prev: event.id,
-            }));
+    async _checkKeyReuse(client) {
+        if (await this.sessions.get(client)) {
+            debug(`[client ${client.slice(0, 8)}]: session key re-used`);
+            return true;
         }
-        if (await this.recoveries.get(event.pubkey)) {
-            debug(`[client ${event.pubkey.slice(0, 8)}]: recovery key re-used`);
-            return this.rpc.channel(event.pubkey, false).send(makeRecoveryOptions({
-                ok: false,
-                message: "Do not re-use recovery keys.",
-                prev: event.id,
-            }));
+        if (await this.recoveries.get(client)) {
+            debug(`[client ${client.slice(0, 8)}]: recovery key re-used`);
+            return true;
         }
-        if (await this.logins.get(event.pubkey)) {
-            debug(`[client ${event.pubkey.slice(0, 8)}]: login key re-used`);
-            return this.rpc.channel(event.pubkey, false).send(makeRecoveryOptions({
-                ok: false,
-                message: "Do not re-use login keys.",
-                prev: event.id,
-            }));
+        if (await this.logins.get(client)) {
+            debug(`[client ${client.slice(0, 8)}]: login key re-used`);
+            return true;
         }
+        return false;
     }
     async _addSession(client, session) {
         await this.sessions.set(client, session);
@@ -224,416 +183,313 @@ export class Signer {
             await this.sessions.delete(client);
         }
     }
-    // Registration
-    async handleRegisterRequest({ payload, event }) {
+    // Handlers
+    async _handleRegister(auth, data) {
         return this.options.storage.tx(async () => {
-            const { group, share, recovery } = payload;
-            const cb = (ok, message) => this.rpc
-                .channel(event.pubkey, false)
-                .send(makeRegisterResult({ ok, message, prev: event.id }));
-            if (await this._checkKeyReuse(event))
-                return;
-            if (getPow(event) < context.registerPow) {
-                debug(`[client ${event.pubkey.slice(0, 8)}]: insufficient proof of work`);
-                return cb(false, "Registration requires 20 bits of proof of work (NIP-13).");
+            const { pubkey: client } = auth;
+            const { group, share, recovery } = data;
+            if (await this._checkKeyReuse(client)) {
+                return { ok: false, message: "Do not re-use session keys." };
+            }
+            if (getPow(auth) < context.registerPow) {
+                debug(`[client ${client.slice(0, 8)}]: insufficient proof of work`);
+                return { ok: false, message: "Registration requires 20 bits of proof of work (NIP-13)." };
             }
             if (!between([0, group.commits.length], group.threshold)) {
-                debug(`[client ${event.pubkey.slice(0, 8)}]: invalid group threshold`);
-                return cb(false, "Invalid group threshold.");
+                debug(`[client ${client.slice(0, 8)}]: invalid group threshold`);
+                return { ok: false, message: "Invalid group threshold." };
             }
             if (!Lib.is_group_member(group, share)) {
-                debug(`[client ${event.pubkey.slice(0, 8)}]: share does not belong to the provided group`);
-                return cb(false, "Share does not belong to the provided group.");
+                debug(`[client ${client.slice(0, 8)}]: share does not belong to the provided group`);
+                return { ok: false, message: "Share does not belong to the provided group." };
             }
             if (uniq(group.commits.map(c => c.idx)).length !== group.commits.length) {
-                debug(`[client ${event.pubkey.slice(0, 8)}]: group contains duplicate member indices`);
-                return cb(false, "Group contains duplicate member indices.");
+                debug(`[client ${client.slice(0, 8)}]: group contains duplicate member indices`);
+                return { ok: false, message: "Group contains duplicate member indices." };
             }
             if (!group.commits.find(c => c.idx === share.idx)) {
-                debug(`[client ${event.pubkey.slice(0, 8)}]: share index not found in group commits`);
-                return cb(false, "Share index not found in group commits.");
+                debug(`[client ${client.slice(0, 8)}]: share index not found in group commits`);
+                return { ok: false, message: "Share index not found in group commits." };
             }
-            if (await this.sessions.get(event.pubkey)) {
-                debug(`[client ${event.pubkey.slice(0, 8)}]: client is already registered`);
-                return cb(false, "Client is already registered.");
+            if (await this.sessions.get(client)) {
+                debug(`[client ${client.slice(0, 8)}]: client is already registered`);
+                return { ok: false, message: "Client is already registered." };
             }
-            await this._addSession(event.pubkey, {
-                client: event.pubkey,
-                event,
+            await this._addSession(client, {
+                client,
                 share,
                 group,
                 recovery,
+                created_at: now(),
                 last_activity: now(),
             });
-            debug(`[client ${event.pubkey.slice(0, 8)}]: registered`);
-            return cb(true, "Your key has been registered");
+            debug(`[client ${client.slice(0, 8)}]: registered`);
+            return { ok: true, message: "Your key has been registered" };
         });
     }
-    // Recovery setup
-    async handleRecoverySetup({ payload, event }) {
+    async _handleRecoverySetup({ pubkey: client }, data) {
         return this.options.storage.tx(async () => {
-            const session = await this.sessions.get(event.pubkey);
+            const session = await this.sessions.get(client);
             if (!session) {
-                debug(`[client ${event.pubkey.slice(0, 8)}]: no session found for recovery setup`);
-                return this.rpc.channel(event.pubkey, false).send(makeRecoverySetupResult({
-                    ok: false,
-                    message: "No session found.",
-                    prev: event.id,
-                }));
+                debug(`[client ${client.slice(0, 8)}]: no session found for recovery setup`);
+                return { ok: false, message: "No session found." };
             }
             if (!session.recovery) {
-                debug(`[client ${event.pubkey.slice(0, 8)}]: recovery is disabled for session`);
-                return this.rpc.channel(event.pubkey, false).send(makeRecoverySetupResult({
-                    ok: false,
-                    message: "Recovery is disabled on this session.",
-                    prev: event.id,
-                }));
-            }
-            // recovery method has to be bound at (or shorly after) session, otherwise an attacker with access
-            // to any session could escalate permissions by setting up their own recovery method
-            if (session.event.created_at < ago(15, MINUTE)) {
-                debug(`[client ${event.pubkey.slice(0, 8)}]: recovery method set too late`);
-                return this.rpc.channel(event.pubkey, false).send(makeRecoverySetupResult({
-                    ok: false,
-                    message: "Recovery method must be set within 15 minutes of session.",
-                    prev: event.id,
-                }));
+                debug(`[client ${client.slice(0, 8)}]: recovery is disabled for session`);
+                return { ok: false, message: "Recovery is disabled on this session." };
+            }
+            if (session.created_at < ago(15, MINUTE)) {
+                debug(`[client ${client.slice(0, 8)}]: recovery method set too late`);
+                return { ok: false, message: "Recovery method must be set within 15 minutes of session." };
             }
             if (session.email) {
-                debug(`[client ${event.pubkey.slice(0, 8)}]: recovery is already set`);
-                return this.rpc.channel(event.pubkey, false).send(makeRecoverySetupResult({
-                    ok: false,
-                    message: "Recovery has already been initialized.",
-                    prev: event.id,
-                }));
+                debug(`[client ${client.slice(0, 8)}]: recovery is already set`);
+                return { ok: false, message: "Recovery has already been initialized." };
             }
-            if (!payload.password_hash.match(/^[a-f0-9]{64}$/)) {
-                debug(`[client ${event.pubkey.slice(0, 8)}]: invalid password_hash provided on setup`);
-                return this.rpc.channel(event.pubkey, false).send(makeRecoverySetupResult({
+            if (!data.password_hash.match(/^[a-f0-9]{64}$/)) {
+                debug(`[client ${client.slice(0, 8)}]: invalid password_hash provided on setup`);
+                return {
                     ok: false,
                     message: "Recovery method password hash must be an argon2id hash of user email and password.",
-                    prev: event.id,
-                }));
+                };
             }
-            const { email, password_hash } = payload;
-            const pubkey = await this.options.signer.getPubkey();
-            const email_hash = await hashEmail(email, pubkey);
-            await this._addSession(event.pubkey, {
+            const { email, password_hash } = data;
+            const signerUrl = new URL(this.options.url).origin;
+            const email_hash = await hashEmail(email, signerUrl);
+            await this._addSession(client, {
                 ...session,
                 last_activity: now(),
                 email,
                 email_hash,
                 password_hash,
             });
-            debug(`[client ${event.pubkey.slice(0, 8)}]: recovery method initialized`);
-            this.rpc.channel(event.pubkey, false).send(makeRecoverySetupResult({
-                ok: true,
-                message: "Recovery method successfully initialized.",
-                prev: event.id,
-            }));
+            debug(`[client ${client.slice(0, 8)}]: recovery method initialized`);
+            return { ok: true, message: "Recovery method successfully initialized." };
         });
     }
-    async handleChallengeRequest({ payload, event }) {
-        // Check rate limit for challenge requests per email_hash
-        const bucket = await this.rateLimitByEmailHash.get(payload.email_hash);
+    async _handleChallenge(_auth, data) {
+        const bucket = await this.rateLimitByEmailHash.get(data.email_hash);
         if (isRateLimited(bucket, EMAIL_RATE_LIMITS)) {
-            const resetTime = getRateLimitResetTime(bucket, EMAIL_RATE_LIMITS);
-            debug(`[signer]: challenge rate limit exceeded for email_hash ${payload.email_hash.slice(0, 8)}, reset in ${resetTime}s`);
-            return;
+            return { ok: true, message: "Please check your email inbox for a one-time password." };
         }
-        const index = await this.sessionsByEmailHash.get(payload.email_hash);
+        const index = await this.sessionsByEmailHash.get(data.email_hash);
         if (index && index.clients.length > 0) {
             const session = await this.sessions.get(index.clients[0]);
             if (session?.email) {
-                await this.rateLimitByEmailHash.set(payload.email_hash, recordAttempt(bucket, EMAIL_RATE_LIMITS));
-                const otp = payload.prefix + randomInt(100000, 1000000).toString();
-                await this.challenges.set(payload.email_hash, { otp, event });
+                await this.rateLimitByEmailHash.set(data.email_hash, recordAttempt(bucket, EMAIL_RATE_LIMITS));
+                const otp = data.prefix + randomInt(100000, 1000000).toString();
+                await this.challenges.set(data.email_hash, { otp, created_at: now() });
                 this.options.sendChallenge({ email: session.email, otp });
-                debug(`[client ${event.pubkey.slice(0, 8)}]: challenge sent for ${payload.email_hash}`);
+                debug(`[challenge]: sent for ${data.email_hash}`);
             }
         }
         else {
-            debug(`[client ${event.pubkey.slice(0, 8)}]: no session found for ${payload.email_hash}`);
+            debug(`[challenge]: no session found for ${data.email_hash}`);
         }
+        return { ok: true, message: "Please check your email inbox for a one-time password." };
     }
-    // Recovery
-    async handleRecoveryStart({ payload, event }) {
+    async _handleRecoveryStart({ pubkey: client }, data) {
         return this.options.storage.tx(async () => {
-            if (await this._checkKeyReuse(event))
-                return;
-            const sessions = await this._getAuthenticatedSessions(payload.auth);
+            if (await this._checkKeyReuse(client)) {
+                return { ok: false, message: "Do not re-use session keys." };
+            }
+            const sessions = await this._getAuthenticatedSessions(data.auth);
             if (sessions.length === 0) {
-                debug(`[client ${event.pubkey.slice(0, 8)}]: no sessions found for recovery`);
-                return this.rpc.channel(event.pubkey, false).send(makeRecoveryOptions({
-                    ok: false,
-                    message: "No sessions found.",
-                    prev: event.id,
-                }));
+                debug(`[client ${client.slice(0, 8)}]: no sessions found for recovery`);
+                return { ok: false, message: "No sessions found." };
             }
-            debug(`[client ${event.pubkey.slice(0, 8)}]: sending recovery options`);
+            debug(`[client ${client.slice(0, 8)}]: sending recovery options`);
             const clients = sessions.map(s => s.client);
             const items = sessions.map(makeSessionItem);
-            await this.recoveries.set(event.pubkey, { event, clients });
-            this.rpc.channel(event.pubkey, false).send(makeRecoveryOptions({
-                items,
-                ok: true,
-                message: "Successfully retrieved recovery options.",
-                prev: event.id,
-            }));
+            await this.recoveries.set(client, { created_at: now(), clients });
+            return { ok: true, message: "Successfully retrieved recovery options.", items };
         });
     }
-    async handleRecoverySelect({ payload, event }) {
-        const recovery = await this.recoveries.get(event.pubkey);
+    async _handleRecoverySelect({ pubkey: client }, data) {
+        const recovery = await this.recoveries.get(client);
         if (!recovery) {
-            debug(`[client ${event.pubkey.slice(0, 8)}]: no active recovery found`);
-            return this.rpc.channel(event.pubkey, false).send(makeRecoveryResult({
-                ok: false,
-                message: `No active recovery found.`,
-                prev: event.id,
-            }));
+            debug(`[client ${client.slice(0, 8)}]: no active recovery found`);
+            return { ok: false, message: "No active recovery found." };
         }
-        // Cleanup right away
-        await this.recoveries.delete(event.pubkey);
-        if (!recovery.clients.includes(payload.client)) {
-            debug(`[client ${event.pubkey.slice(0, 8)}]: invalid session selected for recovery`);
-            return this.rpc.channel(event.pubkey, false).send(makeRecoveryResult({
-                ok: false,
-                message: `Invalid session selected for recovery.`,
-                prev: event.id,
-            }));
+        await this.recoveries.delete(client);
+        if (!recovery.clients.includes(data.client)) {
+            debug(`[client ${client.slice(0, 8)}]: invalid session selected for recovery`);
+            return { ok: false, message: "Invalid session selected for recovery." };
         }
-        const session = await this.sessions.get(payload.client);
+        const session = await this.sessions.get(data.client);
         if (!session) {
-            debug(`[client ${event.pubkey.slice(0, 8)}]: recovery session not found`);
-            return this.rpc.channel(event.pubkey, false).send(makeRecoveryResult({
-                ok: false,
-                message: `Recovery session not found.`,
-                prev: event.id,
-            }));
+            debug(`[client ${client.slice(0, 8)}]: recovery session not found`);
+            return { ok: false, message: "Recovery session not found." };
         }
-        this.rpc.channel(event.pubkey, false).send(makeRecoveryResult({
+        debug(`[client ${client.slice(0, 8)}]: recovery successfully completed`);
+        return {
             ok: true,
             message: "Recovery successfully completed.",
             group: session.group,
             share: session.share,
-            prev: event.id,
-        }));
-        debug(`[client ${event.pubkey.slice(0, 8)}]: recovery successfully completed`);
+        };
     }
-    // Login
-    async handleLoginStart({ payload, event }) {
+    async _handleLoginStart({ pubkey: client }, data) {
         return this.options.storage.tx(async () => {
-            if (await this._checkKeyReuse(event))
-                return;
-            const sessions = await this._getAuthenticatedSessions(payload.auth);
+            if (await this._checkKeyReuse(client)) {
+                return { ok: false, message: "Do not re-use session keys." };
+            }
+            const sessions = await this._getAuthenticatedSessions(data.auth);
             if (sessions.length === 0) {
-                debug(`[client ${event.pubkey.slice(0, 8)}]: no sessions found for login`);
-                return this.rpc.channel(event.pubkey, false).send(makeLoginOptions({
-                    ok: false,
-                    message: "No sessions found.",
-                    prev: event.id,
-                }));
+                debug(`[client ${client.slice(0, 8)}]: no sessions found for login`);
+                return { ok: false, message: "No sessions found." };
             }
-            debug(`[client ${event.pubkey.slice(0, 8)}]: sending login options`);
+            debug(`[client ${client.slice(0, 8)}]: sending login options`);
             const clients = sessions.map(s => s.client);
             const items = sessions.map(makeSessionItem);
-            await this.logins.set(event.pubkey, { event, clients });
-            this.rpc.channel(event.pubkey, false).send(makeLoginOptions({
-                items,
-                ok: true,
-                message: "Successfully retrieved login options.",
-                prev: event.id,
-            }));
+            await this.logins.set(client, { created_at: now(), clients });
+            return { ok: true, message: "Successfully retrieved login options.", items };
         });
     }
-    async handleLoginSelect({ payload, event }) {
-        const login = await this.logins.get(event.pubkey);
+    async _handleLoginSelect({ pubkey: client }, data) {
+        const login = await this.logins.get(client);
         if (!login) {
-            debug(`[client ${event.pubkey.slice(0, 8)}]: no active login found`);
-            return this.rpc.channel(event.pubkey, false).send(makeLoginResult({
-                ok: false,
-                message: `No active login found.`,
-                prev: event.id,
-            }));
+            debug(`[client ${client.slice(0, 8)}]: no active login found`);
+            return { ok: false, message: "No active login found." };
         }
-        // Cleanup right away
-        await this.logins.delete(event.pubkey);
-        if (!login.clients.includes(payload.client)) {
-            debug(`[client ${event.pubkey.slice(0, 8)}]: invalid session selected for login`);
-            return this.rpc.channel(event.pubkey, false).send(makeLoginResult({
-                ok: false,
-                message: `Invalid session selected for login.`,
-                prev: event.id,
-            }));
+        await this.logins.delete(client);
+        if (!login.clients.includes(data.client)) {
+            debug(`[client ${client.slice(0, 8)}]: invalid session selected for login`);
+            return { ok: false, message: "Invalid session selected for login." };
         }
-        const session = await this.sessions.get(payload.client);
+        const session = await this.sessions.get(data.client);
         if (!session) {
-            debug(`[client ${event.pubkey.slice(0, 8)}]: login session not found`);
-            return this.rpc.channel(event.pubkey, false).send(makeLoginResult({
-                ok: false,
-                message: `Login session not found.`,
-                prev: event.id,
-            }));
+            debug(`[client ${client.slice(0, 8)}]: login session not found`);
+            return { ok: false, message: "Login session not found." };
         }
-        await this._addSession(event.pubkey, {
-            event,
+        await this._addSession(client, {
             recovery: true,
-            client: event.pubkey,
+            client,
             share: session.share,
             group: session.group,
             email: session.email,
             email_hash: session.email_hash,
             password_hash: session.password_hash,
+            created_at: now(),
             last_activity: now(),
         });
-        this.rpc.channel(event.pubkey, false).send(makeLoginResult({
-            ok: true,
-            message: "Login successfully completed.",
-            group: session.group,
-            prev: event.id,
-        }));
-        debug(`[client ${event.pubkey.slice(0, 8)}]: login successfully completed`);
+        debug(`[client ${client.slice(0, 8)}]: login successfully completed`);
+        return { ok: true, message: "Login successfully completed.", group: session.group };
     }
-    // Signing
-    async handleSignRequest({ payload, event }) {
+    async _handleSign({ pubkey: client }, data) {
         return this.options.storage.tx(async () => {
-            const session = await this.sessions.get(event.pubkey);
+            const session = await this.sessions.get(client);
             if (!session) {
-                debug(`[client ${event.pubkey.slice(0, 8)}]: signing failed - no session found`);
-                return this.rpc.channel(event.pubkey, false).send(makeSignResult({
-                    ok: false,
-                    message: "No session found for client",
-                    prev: event.id,
-                }));
+                debug(`[client ${client.slice(0, 8)}]: signing failed - no session found`);
+                return { ok: false, message: "No session found for client" };
             }
-            // Check rate limit
-            const allowed = await this._checkAndRecordRateLimit(event.pubkey);
+            const allowed = await this._checkAndRecordRateLimit(client);
             if (!allowed) {
-                return this.rpc.channel(event.pubkey, false).send(makeSignResult({
-                    ok: false,
-                    message: "Rate limit exceeded. Please try again later.",
-                    prev: event.id,
-                }));
+                return { ok: false, message: "Rate limit exceeded. Please try again later." };
             }
             try {
-                const ctx = Lib.get_session_ctx(session.group, payload.request);
+                const ctx = Lib.get_session_ctx(session.group, data.request);
                 const partialSignature = Lib.create_psig_pkg(ctx, session.share);
-                await this.sessions.set(event.pubkey, { ...session, last_activity: now() });
-                debug(`[client ${event.pubkey.slice(0, 8)}]: signing complete`);
-                this.rpc.channel(event.pubkey, false).send(makeSignResult({
-                    result: partialSignature,
-                    ok: true,
-                    message: "Successfully signed event",
-                    prev: event.id,
-                }));
+                await this.sessions.set(client, { ...session, last_activity: now() });
+                debug(`[client ${client.slice(0, 8)}]: signing complete`);
+                return { result: partialSignature, ok: true, message: "Successfully signed event" };
             }
             catch (e) {
-                debug(`[client ${event.pubkey.slice(0, 8)}]: signing failed - ${e.message || e}`);
-                return this.rpc.channel(event.pubkey, false).send(makeSignResult({
-                    ok: false,
-                    message: "Failed to sign event",
-                    prev: event.id,
-                }));
+                const msg = e instanceof Error ? e.message : String(e);
+                debug(`[client ${client.slice(0, 8)}]: signing failed - ${msg}`);
+                return { ok: false, message: "Failed to sign event" };
             }
         });
     }
-    // Key exchange
-    async handleEcdhRequest({ payload, event }) {
+    async _handleEcdh({ pubkey: client }, { members, ecdh_pk }) {
         return this.options.storage.tx(async () => {
-            const session = await this.sessions.get(event.pubkey);
+            const session = await this.sessions.get(client);
             if (!session) {
-                debug(`[client ${event.pubkey.slice(0, 8)}]: ecdh failed - no session found`);
-                return this.rpc.channel(event.pubkey, false).send(makeSignResult({
-                    ok: false,
-                    message: "No session found for client",
-                    prev: event.id,
-                }));
+                debug(`[client ${client.slice(0, 8)}]: ecdh failed - no session found`);
+                return { ok: false, message: "No session found for client" };
             }
-            // Check rate limit
-            const allowed = await this._checkAndRecordRateLimit(event.pubkey);
+            const allowed = await this._checkAndRecordRateLimit(client);
             if (!allowed) {
-                return this.rpc.channel(event.pubkey, false).send(makeEcdhResult({
-                    ok: false,
-                    message: "Rate limit exceeded. Please try again later.",
-                    prev: event.id,
-                }));
+                return { ok: false, message: "Rate limit exceeded. Please try again later." };
             }
-            const { members, ecdh_pk } = payload;
             try {
                 const ecdhPackage = Lib.create_ecdh_pkg(members, ecdh_pk, session.share);
-                await this.sessions.set(event.pubkey, { ...session, last_activity: now() });
-                debug(`[client ${event.pubkey.slice(0, 8)}]: ecdh complete`);
-                this.rpc.channel(event.pubkey, false).send(makeEcdhResult({
-                    result: ecdhPackage,
-                    ok: true,
-                    message: "Successfully signed event",
-                    prev: event.id,
-                }));
+                await this.sessions.set(client, { ...session, last_activity: now() });
+                debug(`[client ${client.slice(0, 8)}]: ecdh complete`);
+                return { result: ecdhPackage, ok: true, message: "Successfully derived shared secret" };
             }
             catch (e) {
-                debug(`[client ${event.pubkey.slice(0, 8)}]: ecdh failed - ${e.message || e}`);
-                return this.rpc.channel(event.pubkey, false).send(makeSignResult({
-                    ok: false,
-                    message: "Key derivation failed",
-                    prev: event.id,
-                }));
+                const msg = e instanceof Error ? e.message : String(e);
+                debug(`[client ${client.slice(0, 8)}]: ecdh failed - ${msg}`);
+                return { ok: false, message: "Key derivation failed" };
             }
         });
     }
-    // Session management
-    async handleSessionList({ payload, event }) {
-        if (not(await this._isNip98AuthValid(payload.auth, Method.SessionList))) {
-            debug(`[client ${event.pubkey.slice(0, 8)}]: invalid auth event for session list`);
-            return this.rpc.channel(event.pubkey, false).send(makeSessionListResult({
-                items: [],
-                ok: false,
-                message: "Failed to validate authentication.",
-                prev: event.id,
-            }));
-        }
+    async _handleSessionList({ pubkey }, _data) {
         const items = [];
         for (const [_, session] of await this.sessions.entries()) {
-            if (session.group.group_pk.slice(2) === payload.auth.pubkey) {
+            if (session.group.group_pk.slice(2) === pubkey) {
                 items.push(makeSessionItem(session));
             }
         }
-        debug(`[client ${event.pubkey.slice(0, 8)}]: successfully retrieved session list`);
-        this.rpc.channel(event.pubkey, false).send(makeSessionListResult({
-            items,
-            ok: true,
-            message: "Successfully retrieved session list.",
-            prev: event.id,
-        }));
+        debug(`[session/list]: successfully retrieved ${items.length} sessions`);
+        return { items, ok: true, message: "Successfully retrieved session list." };
     }
-    async handleSessionDelete({ payload, event }) {
-        if (not(await this._isNip98AuthValid(payload.auth, Method.SessionDelete))) {
-            debug(`[client ${event.pubkey.slice(0, 8)}]: invalid auth event for session deletion`);
-            return this.rpc.channel(event.pubkey, false).send(makeSessionDeleteResult({
-                ok: false,
-                message: "Failed to delete selected session.",
-                prev: event.id,
-            }));
-        }
+    async _handleSessionDelete({ pubkey }, data) {
         return this.options.storage.tx(async () => {
-            const session = await this.sessions.get(payload.client);
-            if (session?.group.group_pk.slice(2) === payload.auth.pubkey) {
-                await this._deleteSession(payload.client);
-                debug(`[client ${event.pubkey.slice(0, 8)}]: deleted session`, payload.client);
-                this.rpc.channel(event.pubkey, false).send(makeSessionDeleteResult({
-                    ok: true,
-                    message: "Successfully deleted selected session.",
-                    prev: event.id,
-                }));
+            const session = await this.sessions.get(data.client);
+            if (session?.group.group_pk.slice(2) === pubkey) {
+                await this._deleteSession(data.client);
+                debug(`[session/delete]: deleted session ${data.client.slice(0, 8)}`);
+                return { ok: true, message: "Successfully deleted selected session." };
             }
             else {
-                debug(`[client ${event.pubkey.slice(0, 8)}]: failed to delete session`, payload.client);
-                return this.rpc.channel(event.pubkey, false).send(makeSessionDeleteResult({
-                    ok: false,
-                    message: "Failed to logout selected client.",
-                    prev: event.id,
-                }));
+                debug(`[session/delete]: failed to delete session ${data.client.slice(0, 8)}`);
+                return { ok: false, message: "Failed to logout selected client." };
             }
         });
     }
+    // Routing handlers
+    async _handle(auth, body, schema, handler) {
+        const result = schema.safeParse(body);
+        if (!result.success) {
+            debug(`[route]: failed to validate request body: ${result.error.message}`);
+            return { ok: false, message: "Failed to validate request data." };
+        }
+        return handler(auth, result.data);
+    }
+    async handle(path, authHeader, body) {
+        const auth = this._parseAuth(authHeader, path);
+        if (!auth) {
+            debug(`[path]: failed to validate authentication`);
+            return { ok: false, message: "Failed to validate authentication." };
+        }
+        switch (path) {
+            case "/challenge":
+                return this._handle(auth, body, Schema.challengeRequest, this._handleChallenge.bind(this));
+            case "/ecdh":
+                return this._handle(auth, body, Schema.ecdhRequest, this._handleEcdh.bind(this));
+            case "/login/select":
+                return this._handle(auth, body, Schema.loginSelectRequest, this._handleLoginSelect.bind(this));
+            case "/login/start":
+                return this._handle(auth, body, Schema.loginStartRequest, this._handleLoginStart.bind(this));
+            case "/recovery/select":
+                return this._handle(auth, body, Schema.recoverySelectRequest, this._handleRecoverySelect.bind(this));
+            case "/recovery/setup":
+                return this._handle(auth, body, Schema.recoverySetupRequest, this._handleRecoverySetup.bind(this));
+            case "/recovery/start":
+                return this._handle(auth, body, Schema.recoveryStartRequest, this._handleRecoveryStart.bind(this));
+            case "/register":
+                return this._handle(auth, body, Schema.registerRequest, this._handleRegister.bind(this));
+            case "/session/delete":
+                return this._handle(auth, body, Schema.sessionDeleteRequest, this._handleSessionDelete.bind(this));
+            case "/session/list":
+                return this._handle(auth, body, Schema.sessionListRequest, this._handleSessionList.bind(this));
+            case "/sign":
+                return this._handle(auth, body, Schema.signRequest, this._handleSign.bind(this));
+            default:
+                return { ok: false, message: "Not found" };
+        }
+    }
 }
 //# sourceMappingURL=signer.js.map