nostr-auth-middleware 0.2.7

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 MaiQR.app
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,216 @@
+# Nostr Auth Middleware
+
+A focused, security-first authentication middleware for Nostr applications.
+
+⚠️ **Important Security Notice**
+
+This library handles cryptographic keys and authentication tokens that are critical for securing your Nostr application and user data. Any private keys (`nsec`) or authentication tokens must be stored and managed with the utmost security and care.
+
+Developers using this middleware must inform their users about the critical nature of managing private keys and tokens. It is the user's responsibility to securely store and manage these credentials. The library and its authors disclaim any responsibility or liability for lost keys, compromised tokens, or data resulting from mismanagement.
+
+## Project Philosophy
+
+This middleware follows key principles that promote security, auditability, and simplicity:
+
+### 1. Single Responsibility
+- **Authentication Only**: Handles only Nostr key-based authentication
+- **No Business Logic**: Business rules, user tiers, and application logic belong in your API layer
+- **Simple JWT**: Issues basic JWTs with minimal claims (npub, timestamp)
+
+### 2. Security First
+- **Open Source**: Fully auditable security-critical code
+- **Transparent**: Clear, readable implementation
+- **Focused Scope**: Does one thing well - Nostr authentication
+
+### 3. Integration Ready
+```plaintext
+┌─────────────────┐
+│   Client App    │
+└────────┬────────┘
+         │
+         ▼
+┌─────────────────┐
+│  Nostr Auth     │ ◄── This Service
+│   Service       │     Simple Auth Only
+└────────┬────────┘
+         │
+         ▼
+┌─────────────────┐
+│  App Platform   │ ◄── Your Business Logic
+│     API         │     User Tiers
+└─────────────────┘     Rate Limits
+```
+
+## Core Features
+
+- 🔑 NIP-07 Compatible Authentication
+- 📝 Secure User Enrollment with Nostr
+- ⚡ Comprehensive Event Validation
+- 🔒 Advanced Cryptographic Operations
+- 🗄️ Supabase Integration for Data Persistence
+- 🎫 JWT-based Session Management
+- 🔄 Profile Management & Synchronization
+- 📊 Detailed Logging and Monitoring
+- 🔐 Automatic Key Management
+- 🚀 Environment-Aware Deployment
+- 🛠️ Development & Production Modes
+- 📁 Automated Directory Management
+
+## Documentation
+
+- [Architecture Guide](docs/architecture-guide.md) - Understanding the service architecture
+- [Key Management Guide](docs/key-management.md) - Comprehensive key management documentation
+- [Deployment Guide](docs/deployment-guide.md) - Environment-specific deployment instructions
+- [Getting Started](docs/getting-started.md) - Quick start guide
+- [Authentication Flow](docs/authentication-flow.md) - Detailed authentication process
+- [Troubleshooting Guide](docs/troubleshooting.md) - Common issues and solutions
+- [API Documentation](docs/api.md) - API endpoints and usage
+- [Security Guide](docs/security.md) - Security best practices and considerations
+- [Automated Tests](docs/automated-tests.md) - Comprehensive test suite documentation
+
+## Testing
+
+The middleware includes comprehensive test coverage for all core functionality:
+
+- ✅ Challenge Generation & Verification
+- ✅ Profile Fetching
+- ✅ Enrollment & Verification
+- ✅ Error Handling
+- ✅ Router Integration
+
+Current test coverage: 94.8%
+
+For detailed information about the test suite, please see our [Automated Tests Documentation](docs/automated-tests.md).
+
+To run the tests:
+
+```bash
+npm test
+```
+
+For live testing with actual Nostr relays:
+
+```bash
+npm run test:live
+```
+
+For testing authentication flow:
+
+```bash
+npm run test:auth
+```
+
+## Quick Start
+
+1. Clone the repository
+2. Copy `.env.example` to `.env`
+3. Run `./scripts/startup.sh`
+
+The server will automatically:
+- Configure itself based on the environment (development/production)
+- Generate server keys if none exist
+- Create necessary directories with proper permissions
+- Start the service with appropriate settings
+
+## Development Mode
+
+```bash
+# Start the service in development mode
+NODE_ENV=development ./scripts/startup.sh
+
+# Stop the service
+./scripts/shutdown.sh
+```
+
+Development mode features:
+- Local directory structure
+- Auto-generated test keys
+- In-memory data storage option
+- Hot-reloading enabled
+- Detailed logging
+- No root permissions required
+
+## Production Mode
+
+```bash
+# Start the service in production mode
+sudo NODE_ENV=production ./scripts/startup.sh
+
+# Stop the service
+sudo ./scripts/shutdown.sh
+```
+
+Production mode features:
+- System-level directory structure
+- Secure key management via Supabase
+- Proper file permissions
+- Log rotation and compression
+- Automatic backups
+- Rate limiting
+- IP whitelisting
+
+## Configuration
+
+### Environment Variables
+
+```bash
+# Core Configuration
+NODE_ENV=development                    # development or production
+DOMAIN=nostr-platform.app              # your domain
+SERVICE_NAME=auth                      # service identifier
+
+# Service URLs (auto-configured in production)
+AUTH_SERVICE_URL=http://localhost:3002  # becomes https://auth.your-domain.app
+IPFS_SERVICE_URL=http://localhost:3001  # becomes https://ipfs.your-domain.app
+RELAY_SERVICE_URL=http://localhost:3000 # becomes https://relay.your-domain.app
+
+# Security Configuration
+SERVER_PRIVATE_KEY=                    # auto-generated if not provided
+SERVER_PUBLIC_KEY=                     # auto-generated if not provided
+JWT_SECRET=your_jwt_secret            # required in production
+
+# Supabase Configuration
+SUPABASE_PROJECT=your-project         # project identifier
+SUPABASE_URL=your_supabase_url       # required in production
+SUPABASE_KEY=your_supabase_key       # required in production
+
+# Service Configuration
+SERVICE_USER=nostr                    # service user (production)
+SERVICE_GROUP=nostr                   # service group (production)
+DEPLOY_DIR=/opt/nostr-platform/auth   # deployment directory (production)
+BACKUP_DIR=/opt/backups/nostr         # backup directory (production)
+LOG_DIR=/var/log/nostr-platform      # log directory (production)
+```
+
+## Scripts
+
+The `scripts` directory contains utilities for managing the service:
+
+- `startup.sh`: Service initialization and startup
+  - Environment detection
+  - Directory creation
+  - Permission setting
+  - Service startup
+
+- `shutdown.sh`: Clean service shutdown
+  - Process termination
+  - Log rotation
+  - Cleanup operations
+
+- `config.sh`: Configuration management
+  - Environment detection
+  - Directory structure
+  - Permissions handling
+  - Logging utilities
+
+## Contributing
+
+We welcome contributions! Please see our [Contributing Guide](CONTRIBUTING.md) for details.
+
+## Security
+
+Security is our top priority. For details about our security practices and how to report security issues, see our [Security Guide](docs/security.md).
+
+## License
+
+This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.

package/dist/__tests__/nostr-auth.middleware.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/nostr-auth.middleware.test.js

@@ -0,0 +1,104 @@
+import { NostrAuthMiddleware } from '../middleware/nostr-auth.middleware';
+import { jest } from '@jest/globals';
+jest.mock('../services/nostr.service');
+describe('NostrAuthMiddleware', () => {
+    let middleware;
+    let mockNostrService;
+    let mockReq;
+    let mockRes;
+    let mockNext;
+    let mockConfig;
+    beforeEach(() => {
+        mockNostrService = {
+            createChallenge: jest.fn(),
+            verifyChallenge: jest.fn(),
+            createEnrollment: jest.fn(),
+            getProfile: jest.fn(),
+            generateToken: jest.fn(),
+        };
+        mockConfig = {
+            port: 3000,
+            nodeEnv: 'test',
+            corsOrigins: '*',
+            keyManagementMode: 'development',
+            testMode: true,
+            supabaseUrl: 'http://localhost:54321',
+            supabaseKey: 'test-key'
+        };
+        middleware = new NostrAuthMiddleware(mockConfig, mockNostrService);
+        mockReq = {
+            body: {},
+            headers: {},
+            params: {}
+        };
+        mockRes = {
+            status: jest.fn().mockReturnThis(),
+            json: jest.fn(),
+        };
+        mockNext = jest.fn();
+    });
+    describe('handleChallenge', () => {
+        const mockPubkey = '123abc';
+        const mockChallenge = {
+            id: '123',
+            pubkey: mockPubkey,
+            challenge: 'test-challenge',
+            event: {},
+            created_at: Date.now(),
+            expires_at: Date.now() + 300000
+        };
+        beforeEach(() => {
+            mockReq.params = { pubkey: mockPubkey };
+            mockNostrService.createChallenge.mockResolvedValue(mockChallenge);
+        });
+        it('should create and return a challenge', async () => {
+            await middleware.handleChallenge(mockReq, mockRes, mockNext);
+            expect(mockNostrService.createChallenge).toHaveBeenCalledWith(mockPubkey);
+            expect(mockRes.json).toHaveBeenCalledWith({ challenge: mockChallenge });
+        });
+        it('should handle errors', async () => {
+            const error = new Error('Test error');
+            mockNostrService.createChallenge.mockRejectedValue(error);
+            await middleware.handleChallenge(mockReq, mockRes, mockNext);
+            expect(mockNext).toHaveBeenCalledWith(error);
+        });
+    });
+    describe('handleVerification', () => {
+        const mockEvent = {
+            id: '1',
+            pubkey: '123abc',
+            created_at: Math.floor(Date.now() / 1000),
+            kind: 22242,
+            tags: [],
+            content: 'test-challenge',
+            sig: '123abc'
+        };
+        it('should verify challenge and return success', async () => {
+            const mockResult = {
+                success: true,
+                pubkey: mockEvent.pubkey
+            };
+            mockNostrService.verifyChallenge.mockResolvedValue(mockResult);
+            mockNostrService.generateToken.mockResolvedValue('test-token');
+            await middleware.handleVerification({ ...mockReq, body: { event: mockEvent } }, mockRes, mockNext);
+            expect(mockNostrService.verifyChallenge).toHaveBeenCalledWith(mockEvent);
+            expect(mockRes.json).toHaveBeenCalledWith({ ...mockResult, token: 'test-token' });
+        });
+        it('should handle verification failure', async () => {
+            const mockResult = {
+                success: false,
+                error: 'Invalid challenge'
+            };
+            mockNostrService.verifyChallenge.mockResolvedValue(mockResult);
+            await middleware.handleVerification({ ...mockReq, body: { event: mockEvent } }, mockRes, mockNext);
+            expect(mockRes.status).toHaveBeenCalledWith(401);
+            expect(mockRes.json).toHaveBeenCalledWith(mockResult);
+        });
+        it('should handle errors', async () => {
+            const error = new Error('Test error');
+            mockNostrService.verifyChallenge.mockRejectedValue(error);
+            await middleware.handleVerification({ ...mockReq, body: { event: mockEvent } }, mockRes, mockNext);
+            expect(mockNext).toHaveBeenCalledWith(error);
+        });
+    });
+});

package/dist/config/index.d.ts

@@ -0,0 +1,7 @@
+import { NostrConfig } from '../types/index.js';
+export interface KeyConfig {
+    privateKey: string;
+    publicKey: string;
+}
+export declare const config: NostrConfig;
+export declare function loadConfig(envPath?: string): Promise<NostrConfig>;

package/dist/config/index.js

@@ -0,0 +1,148 @@
+import { createLogger } from '../utils/logger.js';
+import { generateKeyPair } from '../utils/crypto.utils.js';
+import { createClient } from '@supabase/supabase-js';
+import { writeFileSync, readFileSync } from 'fs';
+import { resolve } from 'path';
+import dotenv from 'dotenv';
+const logger = createLogger('Config');
+// Initialize config with default values
+export const config = {
+    // Server config
+    port: parseInt(process.env.PORT || '3002'),
+    nodeEnv: process.env.NODE_ENV || 'development',
+    corsOrigins: process.env.CORS_ORIGINS?.split(',') || '*',
+    security: {
+        trustedProxies: process.env.TRUSTED_PROXIES?.split(',') || false,
+        allowedIPs: process.env.ALLOWED_IPS?.split(',') || [],
+        apiKeys: process.env.API_KEYS?.split(',') || [],
+        rateLimitWindowMs: parseInt(process.env.RATE_LIMIT_WINDOW_MS || '900000'),
+        rateLimitMaxRequests: parseInt(process.env.RATE_LIMIT_MAX_REQUESTS || '100'),
+    },
+    // Supabase config
+    supabaseUrl: process.env.SUPABASE_URL,
+    supabaseKey: process.env.SUPABASE_KEY,
+    // Nostr config
+    nostrRelays: process.env.NOSTR_RELAYS?.split(',') || [
+        'wss://relay.maiqr.app',
+        'wss://relay.damus.io',
+        'wss://relay.nostr.band'
+    ],
+    privateKey: process.env.SERVER_PRIVATE_KEY,
+    keyManagementMode: process.env.KEY_MANAGEMENT_MODE || 'development',
+    // Auth config
+    jwtSecret: process.env.JWT_SECRET || 'maiqr_nostr_auth_secret_key_2024',
+    jwtExpiresIn: '1h',
+    testMode: process.env.TEST_MODE === 'true',
+    // Optional configs
+    eventTimeoutMs: 5000,
+    challengePrefix: 'nostr:auth:'
+};
+export async function loadConfig(envPath) {
+    // Load environment variables
+    if (envPath) {
+        dotenv.config({ path: envPath });
+    }
+    else {
+        dotenv.config();
+    }
+    const loadedConfig = {
+        // Server config
+        port: parseInt(process.env.PORT || '3002'),
+        nodeEnv: process.env.NODE_ENV || 'development',
+        corsOrigins: process.env.CORS_ORIGINS?.split(',') || '*',
+        security: {
+            trustedProxies: process.env.TRUSTED_PROXIES?.split(',') || false,
+            allowedIPs: process.env.ALLOWED_IPS?.split(',') || [],
+            apiKeys: process.env.API_KEYS?.split(',') || [],
+            rateLimitWindowMs: parseInt(process.env.RATE_LIMIT_WINDOW_MS || '900000'),
+            rateLimitMaxRequests: parseInt(process.env.RATE_LIMIT_MAX_REQUESTS || '100'),
+        },
+        // Supabase config
+        supabaseUrl: process.env.SUPABASE_URL,
+        supabaseKey: process.env.SUPABASE_KEY,
+        // Nostr config
+        nostrRelays: process.env.NOSTR_RELAYS?.split(',') || [
+            'wss://relay.maiqr.app',
+            'wss://relay.damus.io',
+            'wss://relay.nostr.band'
+        ],
+        privateKey: process.env.SERVER_PRIVATE_KEY,
+        publicKey: process.env.SERVER_PUBLIC_KEY,
+        keyManagementMode: process.env.KEY_MANAGEMENT_MODE,
+        // Auth config
+        jwtSecret: process.env.JWT_SECRET,
+        jwtExpiresIn: process.env.JWT_EXPIRES_IN || '24h',
+        testMode: process.env.NODE_ENV !== 'production',
+        // Optional configs
+        eventTimeoutMs: parseInt(process.env.EVENT_TIMEOUT_MS || '5000'),
+        challengePrefix: process.env.CHALLENGE_PREFIX || 'nostr:auth:'
+    };
+    // Try to load keys from environment
+    if (process.env.SERVER_PRIVATE_KEY) {
+        const keyPair = await generateKeyPair();
+        loadedConfig.privateKey = process.env.SERVER_PRIVATE_KEY;
+        loadedConfig.publicKey = keyPair.publicKey;
+        logger.info('Loaded server keys from environment');
+        return loadedConfig;
+    }
+    // If in production, try to load from Supabase
+    if (!loadedConfig.testMode && loadedConfig.supabaseUrl && loadedConfig.supabaseKey) {
+        const supabase = createClient(loadedConfig.supabaseUrl, loadedConfig.supabaseKey);
+        try {
+            const { data, error } = await supabase
+                .from('server_keys')
+                .select('private_key, public_key')
+                .single();
+            if (error)
+                throw error;
+            if (data) {
+                loadedConfig.privateKey = data.private_key;
+                loadedConfig.publicKey = data.public_key;
+                logger.info('Loaded server keys from Supabase');
+                return loadedConfig;
+            }
+        }
+        catch (error) {
+            logger.warn('Failed to load keys from Supabase:', error);
+        }
+    }
+    // Generate new keys if none exist
+    logger.warn('No server keys found - generating new keypair');
+    const keyPair = await generateKeyPair();
+    loadedConfig.privateKey = Buffer.from(keyPair.privateKey).toString('hex');
+    loadedConfig.publicKey = keyPair.publicKey;
+    // Save to .env file in development
+    if (loadedConfig.testMode) {
+        try {
+            const envPath = resolve(process.cwd(), '.env');
+            const envContent = readFileSync(envPath, 'utf8');
+            const updatedContent = envContent
+                .replace(/^SERVER_PRIVATE_KEY=.*$/m, `SERVER_PRIVATE_KEY=${loadedConfig.privateKey}`)
+                .replace(/^SERVER_PUBLIC_KEY=.*$/m, `SERVER_PUBLIC_KEY=${loadedConfig.publicKey}`);
+            writeFileSync(envPath, updatedContent);
+            logger.info('Saved new server keys to .env file');
+        }
+        catch (error) {
+            logger.warn('Failed to save keys to .env file:', error);
+        }
+    }
+    // Save to Supabase in production
+    else if (loadedConfig.supabaseUrl && loadedConfig.supabaseKey) {
+        const supabase = createClient(loadedConfig.supabaseUrl, loadedConfig.supabaseKey);
+        try {
+            const { error } = await supabase
+                .from('server_keys')
+                .upsert({
+                private_key: loadedConfig.privateKey,
+                public_key: loadedConfig.publicKey
+            });
+            if (error)
+                throw error;
+            logger.info('Saved new server keys to Supabase');
+        }
+        catch (error) {
+            logger.warn('Failed to save keys to Supabase:', error);
+        }
+    }
+    return loadedConfig;
+}

package/dist/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAkB,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,MAAM,MAAM,QAAQ,CAAC;AAG5B,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;AAOtC,wCAAwC;AACxC,MAAM,CAAC,MAAM,MAAM,GAAgB;IACjC,gBAAgB;IAChB,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa;IAC9C,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG;IACxD,QAAQ,EAAE;QACR,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK;QAChE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;QACrD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;QAC/C,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,QAAQ,CAAC;QACzE,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,KAAK,CAAC;KAC7E;IACD,kBAAkB;IAClB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY;IACrC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY;IACrC,eAAe;IACf,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI;QACnD,uBAAuB;QACvB,sBAAsB;QACtB,wBAAwB;KACzB;IACD,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;IAC1C,iBAAiB,EAAG,OAAO,CAAC,GAAG,CAAC,mBAAoD,IAAI,aAAa;IACrG,cAAc;IACd,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,kCAAkC;IACvE,YAAY,EAAE,IAAI;IAClB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,MAAM;IAC1C,mBAAmB;IACnB,cAAc,EAAE,IAAI;IACpB,eAAe,EAAE,aAAa;CAC/B,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAgB;IAC/C,6BAA6B;IAC7B,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,MAAM,EAAE,CAAC;IAClB,CAAC;IAED,MAAM,YAAY,GAAgB;QAChC,gBAAgB;QAChB,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC;QAC1C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa;QAC9C,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG;QACxD,QAAQ,EAAE;YACR,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK;YAChE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;YACrD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;YAC/C,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,QAAQ,CAAC;YACzE,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,KAAK,CAAC;SAC7E;QACD,kBAAkB;QAClB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY;QACrC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY;QACrC,eAAe;QACf,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI;YACnD,uBAAuB;YACvB,sBAAsB;YACtB,wBAAwB;SACzB;QACD,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC1C,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;QACxC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmD;QAClF,cAAc;QACd,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;QACjC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,KAAK;QACjD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QAC/C,mBAAmB;QACnB,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,MAAM,CAAC;QAChE,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,aAAa;KAC/D,CAAC;IAEF,oCAAoC;IACpC,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,eAAe,EAAE,CAAC;QACxC,YAAY,CAAC,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACzD,YAAY,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACnD,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,8CAA8C;IAC9C,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,YAAY,CAAC,WAAW,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;QACnF,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC;QAClF,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ;iBACnC,IAAI,CAAC,aAAa,CAAC;iBACnB,MAAM,CAAC,yBAAyB,CAAC;iBACjC,MAAM,EAAE,CAAC;YAEZ,IAAI,KAAK;gBAAE,MAAM,KAAK,CAAC;YACvB,IAAI,IAAI,EAAE,CAAC;gBACT,YAAY,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC;gBAC3C,YAAY,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;gBACzC,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;gBAChD,OAAO,YAAY,CAAC;YACtB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,eAAe,EAAE,CAAC;IACxC,YAAY,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1E,YAAY,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAE3C,mCAAmC;IACnC,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YAC/C,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACjD,MAAM,cAAc,GAAG,UAAU;iBAC9B,OAAO,CAAC,0BAA0B,EAAE,sBAAsB,YAAY,CAAC,UAAU,EAAE,CAAC;iBACpF,OAAO,CAAC,yBAAyB,EAAE,qBAAqB,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC;YACrF,aAAa,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,iCAAiC;SAC5B,IAAI,YAAY,CAAC,WAAW,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;QAC9D,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC;QAClF,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ;iBAC7B,IAAI,CAAC,aAAa,CAAC;iBACnB,MAAM,CAAC;gBACN,WAAW,EAAE,YAAY,CAAC,UAAU;gBACpC,UAAU,EAAE,YAAY,CAAC,SAAS;aACnC,CAAC,CAAC;YACL,IAAI,KAAK;gBAAE,MAAM,KAAK,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,3 @@
+import { NostrAuthConfig } from './types';
+export declare const config: NostrAuthConfig;
+export declare function validateConfig(config: NostrAuthConfig): void;

package/dist/config.js

@@ -0,0 +1,68 @@
+import { createLogger } from './utils/logger';
+const logger = createLogger('Config');
+function getEnvWithWarning(key) {
+    const value = process.env[key];
+    if (!value) {
+        logger.warn(`${key} not set in environment variables`);
+    }
+    return value;
+}
+function validatePrivateKey(privateKey) {
+    if (!privateKey) {
+        return undefined;
+    }
+    try {
+        // Validate hex format
+        if (!/^[0-9a-f]{64}$/.test(privateKey)) {
+            throw new Error('Invalid private key format');
+        }
+        return privateKey;
+    }
+    catch (error) {
+        logger.error('Invalid SERVER_PRIVATE_KEY:', error);
+        throw error;
+    }
+}
+export const config = {
+    keyManagementMode: process.env.KEY_MANAGEMENT_MODE === 'production' ? 'production' : 'development',
+    port: parseInt(process.env.PORT || '3002', 10),
+    nodeEnv: process.env.NODE_ENV || 'development',
+    corsOrigin: process.env.CORS_ORIGIN || '*',
+    corsCredentials: process.env.CORS_CREDENTIALS === 'true',
+    eventTimeoutMs: parseInt(process.env.EVENT_TIMEOUT_MS || '5000', 10),
+    challengePrefix: process.env.CHALLENGE_PREFIX || 'nostr:auth:',
+    testMode: process.env.TEST_MODE === 'true',
+    logLevel: process.env.LOG_LEVEL || 'info',
+    jwtSecret: getEnvWithWarning('JWT_SECRET'),
+    jwtExpiresIn: process.env.JWT_EXPIRES_IN || '24h',
+    supabaseUrl: getEnvWithWarning('SUPABASE_URL'),
+    supabaseKey: getEnvWithWarning('SUPABASE_KEY'),
+    privateKey: validatePrivateKey(process.env.SERVER_PRIVATE_KEY),
+    publicKey: process.env.SERVER_PUBLIC_KEY
+};
+export function validateConfig(config) {
+    if (!config) {
+        throw new Error('Config is required');
+    }
+    if (!config.keyManagementMode) {
+        throw new Error('keyManagementMode is required in config');
+    }
+    if (config.keyManagementMode === 'production') {
+        if (!config.privateKey) {
+            throw new Error('privateKey is required in production mode');
+        }
+        // Validate private key format
+        if (!/^[0-9a-f]{64}$/.test(config.privateKey)) {
+            throw new Error('Invalid private key format');
+        }
+    }
+    // Log config (excluding sensitive values)
+    const sanitizedConfig = {
+        ...config,
+        privateKey: config.privateKey ? '***' : undefined,
+        jwtSecret: config.jwtSecret ? '***' : undefined,
+        supabaseKey: config.supabaseKey ? '***' : undefined
+    };
+    logger.info('Config validated:', sanitizedConfig);
+}
+validateConfig(config);

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,MAAM,CAAC,MAAM,EAAE,CAAC;AAEhB,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;AAEtC,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,iCAAiC,GAAG,iCAAiC,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAuB;IACjD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC;QACH,sBAAsB;QACtB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,sBAAsB;QACtB,MAAM,eAAe,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,MAAM,CAAC,CAAC;QAC1D,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;QACnD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,gBAAgB;IAChB,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC;IAC9C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa;IAE9C,OAAO;IACP,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG;IAExD,eAAe;IACf,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI;QACnD,sBAAsB;QACtB,wBAAwB;KACzB;IAED,yCAAyC;IACzC,WAAW,EAAE,iBAAiB,CAAC,cAAc,CAAC;IAC9C,WAAW,EAAE,iBAAiB,CAAC,cAAc,CAAC;IAE9C,oCAAoC;IACpC,SAAS,EAAE,iBAAiB,CAAC,YAAY,CAAC;IAC1C,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,KAAK;IAEjD,sBAAsB;IACtB,iBAAiB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAiC;IAEpI,2CAA2C;IAC3C,UAAU,EAAE,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC9D,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;IAExC,wDAAwD;IACxD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,MAAM;IAE1C,UAAU;IACV,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM;CACjC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Main exports for the Nostr Auth Middleware package
+ * @module @maiqr/nostr-auth-enroll
+ */
+import { NostrAuthMiddleware } from './middleware/nostr-auth.middleware.js';
+import type { NostrAuthConfig } from './types/index.js';
+export { NostrAuthMiddleware };
+export type { NostrAuthConfig, NostrChallenge, NostrProfile, NostrEnrollment, VerificationResult } from './types/index.js';
+export type { NostrEvent } from './utils/types.js';
+export { generateChallenge, generateEventHash, getPublicKey, verifySignature } from './utils/crypto.utils.js';
+export { NostrService } from './services/nostr.service.js';
+export { validateEvent, validateChallengeEvent, validateEnrollmentEvent } from './validators/event.validator.js';
+export { config } from './config.js';
+/**
+ * Create and configure a new Nostr Auth Middleware instance
+ * @param config Configuration options for the middleware
+ * @returns Configured NostrAuthMiddleware instance
+ *
+ * @example
+ * ```typescript
+ * import { createNostrAuth } from '@maiqr/nostr-auth-enroll';
+ *
+ * const nostrAuth = createNostrAuth({
+ *   supabaseUrl: process.env.SUPABASE_URL,
+ *   supabaseKey: process.env.SUPABASE_KEY,
+ *   privateKey: process.env.SERVER_PRIVATE_KEY
+ * });
+ *
+ * app.use('/auth/nostr', nostrAuth.router);
+ * ```
+ */
+export declare const createNostrAuth: (config: NostrAuthConfig) => NostrAuthMiddleware;
+export default NostrAuthMiddleware;

package/dist/index.js

@@ -0,0 +1,39 @@
+/**
+ * Main exports for the Nostr Auth Middleware package
+ * @module @maiqr/nostr-auth-enroll
+ */
+// Core middleware
+import { NostrAuthMiddleware } from './middleware/nostr-auth.middleware.js';
+// Re-export middleware
+export { NostrAuthMiddleware };
+// Crypto utilities
+export { generateChallenge, generateEventHash, getPublicKey, verifySignature } from './utils/crypto.utils.js';
+// Services
+export { NostrService } from './services/nostr.service.js';
+// Validators
+export { validateEvent, validateChallengeEvent, validateEnrollmentEvent } from './validators/event.validator.js';
+// Configuration
+export { config } from './config.js';
+/**
+ * Create and configure a new Nostr Auth Middleware instance
+ * @param config Configuration options for the middleware
+ * @returns Configured NostrAuthMiddleware instance
+ *
+ * @example
+ * ```typescript
+ * import { createNostrAuth } from '@maiqr/nostr-auth-enroll';
+ *
+ * const nostrAuth = createNostrAuth({
+ *   supabaseUrl: process.env.SUPABASE_URL,
+ *   supabaseKey: process.env.SUPABASE_KEY,
+ *   privateKey: process.env.SERVER_PRIVATE_KEY
+ * });
+ *
+ * app.use('/auth/nostr', nostrAuth.router);
+ * ```
+ */
+export const createNostrAuth = (config) => {
+    return new NostrAuthMiddleware(config);
+};
+// Default export for CommonJS compatibility
+export default NostrAuthMiddleware;

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,kBAAkB;AAClB,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAG5E,uBAAuB;AACvB,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAa/B,mBAAmB;AACnB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EAChB,MAAM,yBAAyB,CAAC;AAEjC,WAAW;AACX,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAE3D,aAAa;AACb,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEtE,gBAAgB;AAChB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAuB,EAAuB,EAAE;IAC9E,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC,CAAC;AAEF,4CAA4C;AAC5C,eAAe,mBAAmB,CAAC"}