jerry/buzz
1
0
Fork 0
mirror of https://github.com/block/buzz.git synced 2026-11-02 23:41:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(relay): add corporate identity binding

Browse Source 
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
This commit is contained in:
Franco Sola
2026-07-02 14:20:01 -06:00
committed by Cea Stapleton Cordasco
parent 2c0ac24674
commit b53bcfdd6d
22 changed files with 1807 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
.env.example
View File

@@ -69,6 +69,32 @@ RELAY_URL=ws://localhost:3000
# BUZZ_RATE_LIMIT_AGENT_ELEVATED_MESSAGES_PER_MIN=300
# BUZZ_RATE_LIMIT_AGENT_PLATFORM_MESSAGES_PER_MIN=600
# Corporate identity verification (disabled by default). When enabled, the relay
# requires authenticated requests to present a valid corporate JWT, then binds
# the configured uid claim to the Nostr pubkey proven by NIP-42/NIP-98. The JWT
# may be injected by a trusted proxy or attached by a first-party client; the
# relay treats both as the same header. Client token forwarding and admin
# revocation/rotation workflows are separate follow-up features.
#
# Operational notes for the initial implementation:
# - When a trusted proxy injects this header, it MUST overwrite any inbound
# client-supplied value before forwarding to the relay.
# - A uid/pubkey conflict is a hard lockout until an operator resolves the
# binding out of band; admin revocation/rotation endpoints are not in this PR.
# - JWKS outages fail closed for human JWT authentication. Delegated agent
# admission can still work when the owner binding is already present.
# - DISPLAY_CLAIM is stored in identity_bindings.display_name. Using email here
# stores corporate PII and PR2 may surface it in clients.
# BUZZ_REQUIRE_CORPORATE_IDENTITY=false
# BUZZ_CORPORATE_IDENTITY_JWT_HEADER=x-forwarded-identity-token
# BUZZ_ALLOW_CORPORATE_IDENTITY_DELEGATION=true
# BUZZ_CORPORATE_IDENTITY_JWKS_URI=https://idp.example/.well-known/jwks.json
# BUZZ_CORPORATE_IDENTITY_ISSUER=https://idp.example
# BUZZ_CORPORATE_IDENTITY_AUDIENCE=buzz-relay
# BUZZ_CORPORATE_IDENTITY_UID_CLAIM=sub
# BUZZ_CORPORATE_IDENTITY_DISPLAY_CLAIM=email
# BUZZ_CORPORATE_IDENTITY_NPUB_CLAIM=buzz_npub
# -----------------------------------------------------------------------------
# Git (NIP-34 bare repositories)
# -----------------------------------------------------------------------------