- commit
- b9eb374694a3ad6d1e80435a0aa914bca051c8bd
- parent
- 7fccd10734ba4b84eff68ef0b34e2b48fc79d08f
- author
- Dami <dami.etoile@gmail.com>
| M | README.md | 1 | + |
| A | cmd/ | 132 | ++++++++++++++++++++++++++++++ |
| A | cmd/ | 42 | ++++++++++ |
| M | cmd/ | 4 | +- |
| M | docs/ | 9 | ++ |
@@ -25,6 +25,7 @@ The command is `tiny`. Useful commands include:
2525 tiny serve [--data-dir PATH] [--listen :7447]2626 tiny tenant create --name NAME --owner PUBKEY [--template default] [--source wss://...]2727 tiny tenant list|enable|disable|host [options]28+tiny git-token --repo URL [--key-env TINY_AGENT_KEY] [--format header|value|git]2829 tiny templates2930 tiny version3031 ```@@ -0,0 +1,132 @@
1+package main2+3+import (4+ "encoding/base64"5+ "encoding/hex"6+ "errors"7+ "flag"8+ "fmt"9+ "io"10+ "os"11+ "strings"12+ "time"13+14+ "github.com/FelineStateMachine/tinyrelay/internal/auth"15+ "github.com/FelineStateMachine/tinyrelay/internal/event"16+)17+18+// gitToken mints the GRASP-08 repository-root proof that private Git hosting19+// expects, so plain git and agents can clone and push with one header. The20+// key never leaves the process: it is read from an environment variable and21+// used once to sign a kind 27235 event.22+func gitToken(args []string, out io.Writer) error {23+ fs := flag.NewFlagSet("tiny git-token", flag.ContinueOnError)24+ fs.SetOutput(out)25+ repo := fs.String("repo", "", "repository URL ending in .git, or any URL beneath it")26+ keyEnv := fs.String("key-env", "TINY_AGENT_KEY", "environment variable holding the signing key as hex or nsec")27+ format := fs.String("format", "header", "output: header (Authorization line), value (token only) or git (http.extraHeader config value)")28+ if err := fs.Parse(args); err != nil {29+ return err30+ }31+ root, ok := auth.GRASP08RepositoryRoot(*repo)32+ if !ok {33+ return errors.New("git-token: --repo must be an HTTP or HTTPS repository URL ending in .git")34+ }35+ secret, err := secretKey(os.Getenv(*keyEnv))36+ if err != nil {37+ return fmt.Errorf("git-token: %s: %w", *keyEnv, err)38+ }39+ e := event.Event{Kind: 27235, CreatedAt: time.Now().Unix(), Tags: [][]string{{"u", root}, {"method", "GET"}}}40+ if err := event.Sign(&e, secret); err != nil {41+ return err42+ }43+ raw, err := event.Canonical(e)44+ if err != nil {45+ return err46+ }47+ token := base64.StdEncoding.EncodeToString(raw)48+ switch *format {49+ case "value":50+ _, err = fmt.Fprintln(out, token)51+ case "git":52+ _, err = fmt.Fprintf(out, "http.extraHeader=Authorization: Nostr %s\n", token)53+ case "header":54+ _, err = fmt.Fprintf(out, "Authorization: Nostr %s\n", token)55+ default:56+ return fmt.Errorf("git-token: unknown --format %q", *format)57+ }58+ return err59+}60+61+// secretKey accepts a 64-character hex key or an nsec.62+func secretKey(value string) (string, error) {63+ value = strings.TrimSpace(value)64+ if value == "" {65+ return "", errors.New("no key set")66+ }67+ if len(value) == 64 && strings.Trim(strings.ToLower(value), "0123456789abcdef") == "" {68+ return strings.ToLower(value), nil69+ }70+ if strings.HasPrefix(strings.ToLower(value), "nsec1") {71+ data, ok := bech32Data(strings.ToLower(value))72+ if !ok || len(data) != 32 {73+ return "", errors.New("invalid nsec")74+ }75+ return hex.EncodeToString(data), nil76+ }77+ return "", errors.New("expected a hex key or an nsec")78+}79+80+const bech32Alphabet = "qpzry9x8gf2tvdw0s3jn54khce6mua7l"81+82+// bech32Data decodes a bech32 string and returns its 8-bit payload.83+func bech32Data(value string) ([]byte, bool) {84+ separator := strings.LastIndexByte(value, '1')85+ if separator < 1 || separator+7 > len(value) {86+ return nil, false87+ }88+ hrp, encoded := value[:separator], value[separator+1:]89+ values := make([]byte, len(encoded))90+ for i, char := range encoded {91+ position := strings.IndexRune(bech32Alphabet, char)92+ if position < 0 {93+ return nil, false94+ }95+ values[i] = byte(position)96+ }97+ expanded := make([]byte, 0, len(hrp)*2+1+len(values))98+ for _, c := range hrp {99+ expanded = append(expanded, byte(c)>>5)100+ }101+ expanded = append(expanded, 0)102+ for _, c := range hrp {103+ expanded = append(expanded, byte(c)&31)104+ }105+ expanded = append(expanded, values...)106+ generators := [...]uint32{0x3b6a57b2, 0x26508e6d, 0x1ea119fa, 0x3d4233dd, 0x2a1462b3}107+ checksum := uint32(1)108+ for _, v := range expanded {109+ top := checksum >> 25110+ checksum = (checksum&0x1ffffff)<<5 ^ uint32(v)111+ for i, generator := range generators {112+ if top>>i&1 == 1 {113+ checksum ^= generator114+ }115+ }116+ }117+ if checksum != 1 {118+ return nil, false119+ }120+ data := values[:len(values)-6]121+ accumulator, bits := 0, 0122+ var result []byte123+ for _, v := range data {124+ accumulator = accumulator<<5 | int(v)125+ bits += 5126+ if bits >= 8 {127+ bits -= 8128+ result = append(result, byte(accumulator>>bits&255))129+ }130+ }131+ return result, true132+}@@ -0,0 +1,42 @@
1+package main2+3+import (4+ "bytes"5+ "strings"6+ "testing"7+ "time"8+9+ "github.com/FelineStateMachine/tinyrelay/internal/auth"10+)11+12+func TestGitTokenMintsAReusableRepositoryRootProof(t *testing.T) {13+ secret := strings.Repeat("7", 64)14+ t.Setenv("TINY_AGENT_KEY", secret)15+ var out bytes.Buffer16+ if err := gitToken([]string{"--repo", "https://relay.example/npub1owner/notes.git/info/refs?service=git-upload-pack", "--format", "value"}, &out); err != nil {17+ t.Fatal(err)18+ }19+ token := strings.TrimSpace(out.String())20+ validator := auth.NewValidator(time.Now)21+ for _, request := range []string{"https://relay.example/npub1owner/notes.git/git-upload-pack", "https://relay.example/npub1owner/notes.git/git-receive-pack"} {22+ if _, err := validator.VerifyGRASP08("Nostr "+token, request); err != nil {23+ t.Fatalf("%s: %v", request, err)24+ }25+ }26+ out.Reset()27+ if err := gitToken([]string{"--repo", "https://relay.example/npub1owner/notes.git", "--format", "git"}, &out); err != nil || !strings.HasPrefix(out.String(), "http.extraHeader=Authorization: Nostr ") {28+ t.Fatalf("git format: %v %q", err, out.String())29+ }30+ t.Setenv("TINY_AGENT_KEY", "nsec1vl029mgpspedva04g90vltkh6fvh240zqtv9k0t9af8935ke9laqsnlfe5")31+ out.Reset()32+ if err := gitToken([]string{"--repo", "https://relay.example/npub1owner/notes.git", "--format", "value"}, &out); err != nil {33+ t.Fatalf("nsec key: %v", err)34+ }35+ if err := gitToken([]string{"--repo", "https://relay.example/not-a-repo"}, &out); err == nil {36+ t.Fatal("non-repository URL accepted")37+ }38+ t.Setenv("TINY_AGENT_KEY", "")39+ if err := gitToken([]string{"--repo", "https://relay.example/npub1owner/notes.git"}, &out); err == nil {40+ t.Fatal("missing key accepted")41+ }42+}@@ -35,7 +35,7 @@ func main() {
3535 3636 func run(ctx context.Context, args []string, out io.Writer) error {3737 if len(args) == 0 || args[0] == "help" || args[0] == "--help" || args[0] == "-h" {38- _, err := fmt.Fprintln(out, "tiny serve [--data-dir PATH] [--listen :7447]\ntiny tenant create --name NAME --owner PUBKEY [--template default]\ntiny tenant list|enable|disable|host [options]\ntiny templates\ntiny version")38+ _, err := fmt.Fprintln(out, "tiny serve [--data-dir PATH] [--listen :7447]\ntiny tenant create --name NAME --owner PUBKEY [--template default]\ntiny tenant list|enable|disable|host [options]\ntiny git-token --repo URL [--key-env TINY_AGENT_KEY] [--format header|value|git]\ntiny templates\ntiny version")3939 return err4040 }4141 switch args[0] {@@ -48,6 +48,8 @@ func run(ctx context.Context, args []string, out io.Writer) error {
4848 return serve(ctx, args[1:], out)4949 case "tenant":5050 return tenantCommand(ctx, args[1:], out)51+ case "git-token":52+ return gitToken(args[1:], out)5153 default:5254 return fmt.Errorf("unknown command %q; run tiny help", args[0])5355 }@@ -59,6 +59,15 @@ Private repositories require a dedicated [GRASP-08 private tenant](https://ngit.
5959 6060 Git clients authenticate with a signed kind 27235 event whose URL is the repository root ending in `.git` and whose method is `GET`. The proof can be reused across that repository's Git HTTP requests while its timestamp is within a minute of the server's clock. Relay events require NIP-42 authentication and current membership.6161 62+Plain git and agents can mint that proof with `tiny git-token`. Put the signing key in an environment variable as hex or an `nsec`, then pass the header to git for the push or clone:63+64+```sh65+export TINY_AGENT_KEY=nsec1...66+git -c "$(tiny git-token --repo https://relay.example/<npub>/project.git --format git)" push tiny main67+```68+69+The token is valid for about a minute and never contains the key.70+6271 Open tenants reject private repository announcements. A tenant that already holds a private repository announcement stays private, including after that announcement is removed. Policy changes and configuration imports cannot reopen a private tenant. Moving data to a public tenant requires a deliberate migration.6372 6473 Under **Manage > Connect**, edit your encrypted kind 10318 private service list. URLs and other private entries are encrypted to your own signer with NIP-44. The editor saves the event on the current relay; clients must be able to find it there.