🤖 NIP-FA limited the adapter session token to the NIP's own endpoints,
which stopped a client from reusing the same login for the adapter
operator's other APIs on that host. This changes the rule to the
adapter's origin (the scheme, host, and port of `{adapter_base}`). The
token still never goes to a relay or any other origin, and the rest of
the security bullet is unchanged.
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
Co-authored-by: Alia <d32955ad69077062930cc46cfe2df30ca9aaf6f8e76422681265e9e9af704d78@buzz.block.builderlab.xyz>
🤖 Moves the enterprise identity adapter's wire contract into a new
normative spec, `docs/nips/NIP-FA.md` (Federated Identity Adapter), so
third-party adapters have a spec to conform to. The Desktop-only
material stays in a guide, renamed from
`docs/enterprise-identity-adapter.md` to
`docs/federated-identity-adapter.md` to match the NIP's name.
- `NIP-FA.md` holds browser login, code exchange, session check, relay
assertion (including the denial table), NIP-FI assertion transport,
security considerations, and privacy. Agent-key assertions are out of
scope.
- `docs/federated-identity-adapter.md` is a short Desktop guide for the
client in block/buzz-app: build configuration
(`BUZZ_BUILD_ENTERPRISE_AUTH_*`), what is implemented today (build
config, discovery gate) versus planned (browser login, session check,
assertion fetch, profile projection), and the vendor-specific headers
adapters must not use as session credentials.
Endpoints, fields, headers, and denial codes are unchanged. The NIP
converts lowercase requirements to BCP 14 keywords and pins rules the
old guide left open:
- `/v1/session` reports a bad session as 401 `session_required` /
`session_expired`; clients discard the session only on those, and keep
it and retry with backoff on 429, 5xx, and network failures, matching
the assertion endpoint.
- The assertion `aud` is `https://` plus the canonical `relay_url`
authority (`wss://c.example.com:8443` → `https://c.example.com:8443`),
and adapters issue dedicated `nip-fi+jwt` assertions. Relay authorities
on port 80 are not supported.
- Codes are single-use and short-lived, only `S256` challenges are
accepted, and adapters accept only `127.0.0.1` and `[::1]` callback
hosts.
- After code exchange the client must call `/v1/session` and compare the
RFC 3339 `expires_at` instants before committing the login.
- `session_token` is sent only to adapter endpoints, never to a relay,
and no credential is logged.
- NIP-98 proofs carry exactly one `method` and one `payload` tag;
retries honor `Retry-After` and surface failure after bounded attempts;
IPv6 relay hosts have a canonical form.
- The relay-proof header example is scoped to NIP-98-protected HTTP,
with WebSocket (NIP-42 AUTH) and Blossom (kind 24242) deferred to
NIP-FI.
---------
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
Co-authored-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
