jerry/buzz
1
0
Fork 0
mirror of https://github.com/block/buzz.git synced 2026-11-01 15:01:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(nips): align NIP-FI race and session wording across spec and model

Browse Source 
Two cold-read consistency fixes: the model's race clause still said a
lost race must deny, contradicting the spec's exact-match-allows rule;
and the spec's session text offered 'require a fresh assertion' at lease
expiry, which has no defined mid-connection transport — assertions only
arrive on an upgrade request.

Co-authored-by: Tyler Longwell <tlongwell@block.xyz>
Signed-off-by: Tyler Longwell <tlongwell@block.xyz>
This commit is contained in:
npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d
2026-07-02 20:37:11 -04:00
parent 65b9f0ae26
commit 5f09008091
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/nips/NIP-FI-MODEL.md
View File

@@ -103,7 +103,7 @@ Authorize(D, i, k_a?, k):
ALLOW(created)
```
If an insertion loses a race or storage is unavailable, deny; never fall back to an unchecked allow. The check and possible insertion must be linearizable for `(D, i, k)`.
If a concurrent attempt finds the identical committed binding, it allows as `existing`; if the committed outcome cannot be read or storage is unavailable, deny — never fall back to an unchecked allow. The check and possible insertion must be linearizable for `(D, i, k)`.
The resulting authorization lease is:

2
docs/nips/NIP-FI.md
View File

@@ -102,7 +102,7 @@ Within a domain, active bindings form a partial bijection: an identity has at mo
For HTTP requests, the decision applies to that request only.
For a NIP-42 WebSocket connection, the relay MAY cache the decision as a lease. A lease MUST NOT be honored past the assertion's `exp` (implementations MAY enforce a shorter maximum). At expiry the relay MUST require a fresh assertion, reject protected operations, or close the connection. When a relay learns a binding was revoked, it MUST invalidate matching leases; a relay that detects revocation by polling MUST NOT claim immediate revocation and SHOULD document its detection latency.
For a NIP-42 WebSocket connection, the relay MAY cache the decision as a lease. A lease MUST NOT be honored past the assertion's `exp` (implementations MAY enforce a shorter maximum). At expiry the relay MUST reject protected operations or close the connection; a fresh assertion arrives only on a new connection's upgrade request. When a relay learns a binding was revoked, it MUST invalidate matching leases; a relay that detects revocation by polling MUST NOT claim immediate revocation and SHOULD document its detection latency.
When multiple keys authenticate on one connection (NIP-42 permits this), authorization is tracked per key. A lease for one key MUST NOT authorize operations attributed to another.