1// Package auth verifies Nostr request proofs without deciding host access.2// It supports NIP-98 HTTP request proofs, NIP-42 relay challenges, BUD-113// Blossom authorization and GRASP-08 repository proofs. Successful proof4// verification identifies a signer; callers must separately authorize that5// signer and apply resource, tenant, storage and hosting policy.6//7// Construct validators and challenge managers with their constructors. A nil8// clock uses time.Now. Their replay and challenge stores are in memory and9// scoped to each instance; reuse an instance across requests that share a10// replay boundary. The stores are protected for concurrent use. They do not11// persist across restarts or coordinate across processes.12//13// NIP-98 proofs are single-use within the one-minute replay window. Their URL14// binding preserves path escaping, port and query while ignoring scheme and15// hostname case. Methods compare case-insensitively. A nonempty body requires16// the matching payload hash. NIP-42 challenges are single-use and expire after17// one minute; relay URLs match exactly. Blossom proofs are reusable until18// their expiration and cannot be issued in the future. GRASP-08 GET proofs19// are reusable for supported Smart HTTP requests beneath the signed repository20// root, within the existing one-minute timestamp skew. Unlike NIP-98, GRASP-0821// requires an uppercase GET method and returns a uniform authentication error.22//23// Payload validation after streaming does not consume the proof again. It24// must follow request authentication and does not replace host authorization.25package auth