Mari (trust):
- Add 64 KiB pre-decode length cap on the bearer token. NIP-98 events are
well under a kilobyte; rejecting oversized inputs before allocating the
base64 decode buffer prevents an admission request from coercing the
relay into multi-megabyte allocations. New const MAX_BEARER_LEN.
- New verify_bearer_rejects_oversized_token test.
- New verify_bearer_rejects_internal_whitespace test: pins the fact that
base64 0.22's general_purpose engines reject mid-token whitespace
(no MIME mode), which is what we want.
Max (review):
- Soften the module-level 'patched-fork hooks' docs so they don't imply
the per-client max-lifetime hook is already wired, and add an explicit
TODO(patched-iroh-relay) marker at the future insertion site in spawn.
- Add SPROUT_IROH_RELAY_BIND_ADDR to Config (iroh_relay_bind_addr:
Option<SocketAddr>) now, so the main.rs wiring follow-up can read it
without a separate config churn. Server::spawn owns its own listener,
so this is independent of the Sprout HTTP bind_addr.
sprout-relay --lib: 206 -> 208 tests pass (+2).
workspace clippy -D warnings: clean.
workspace cargo fmt --check: clean.
Signed-off-by: Tyler Longwell <109685178+tlongwell-block@users.noreply.github.com>
Co-authored-by: Dawn (sprout agent) <c6237ef84fa537c78dcee78efd2d4e59f728859c7f194da42ac51ededfa0be05@sprout-oss.stage.blox.sqprod.co>
- New module crates/sprout-relay/src/iroh_relay.rs (~290 lines incl. tests).
- pub fn spawn(state, bind_addr) constructs an iroh_relay::server::Server
with AccessConfig::Restricted set to a closure that:
1. Pulls the Bearer token from ClientRequest::auth_token().
2. base64-decodes (accepts STANDARD + URL_SAFE, padded or not).
3. Calls sprout_auth::verify_nip98_event against canonical URL
(= sprout_auth::nip98_canonical_url(public_url, '/relay')).
4. Runs check_relay_membership against the NIP-98 pubkey.
Anything other than Member/ViaOwner/OpenRelay -> Deny.
Per Max's review notes: fail-closed on missing/invalid token, run
membership only after NIP-98 verifies the pubkey, no caching.
- Returns Ok(None) gracefully when SPROUT_IROH_RELAY_PUBLIC_URL is unset
(the canonical URL can't be built without it).
- patched-iroh-relay feature flag reserved for upstream PR C's per-client
max-lifetime hook (kept behind cfg so unpatched rc.0 still compiles).
- MSRV bumped from 1.88.0 -> 1.91.0 (iroh-relay rc.0's MSRV). Repo's
rust-toolchain.toml already pins 1.95.0 so builds are unaffected; the
bump just keeps Cargo.toml honest with the actual transitive floor.
- README updated: 'Rust 1.88+' -> 'Rust 1.91+'.
- crates/sprout-relay/Cargo.toml: added
iroh-relay = { version = "=1.0.0-rc.0", features = ["server"] }
plus the patched-iroh-relay feature.
Tests (rustc 1.95, via rust-toolchain.toml; also verified independently
on 1.91.1):
- sprout-relay --lib: 195 -> 206 (+11 iroh_relay tests covering valid
admission, missing/empty/non-base64/wrong-method/wrong-URL/wrong-kind/
stale-timestamp denials, and bearer-encoding round-trips).
- cargo clippy --workspace --all-targets -- -D warnings: clean.
- cargo fmt --all -- --check: clean.
Signed-off-by: Tyler Longwell <109685178+tlongwell-block@users.noreply.github.com>
Co-authored-by: Dawn (sprout agent) <c6237ef84fa537c78dcee78efd2d4e59f728859c7f194da42ac51ededfa0be05@sprout-oss.stage.blox.sqprod.co>
- Step 1: KIND_MESH_LLM_DISCOVERY = 31990 (parameterized replaceable,
global-only, MessagesWrite scope) — relay members announce compute offers
through the same NIP-43-gated fan-out path as messages.
- Step 2: extract transport-neutral check_relay_membership returning
MembershipDecision. HTTP enforce_relay_membership becomes a thin
wrapper that maps Denied -> 403 JSON. Same behavior for all 6 existing
HTTP callers; non-HTTP gates (iroh-relay AccessConfig) can call the
core directly without a StatusCode in their return type.
- Step 4: NIP-11 iroh_relay_url field, fed from new
SPROUT_IROH_RELAY_PUBLIC_URL config. Absent unless configured (older
clients unaffected). This is what mesh-llm sidecars read to wire their
iroh endpoints to Sprout's own relay -- no out-of-band config required.
- Step 5: sprout-auth::nip98_canonical_url helper. Single source of truth
for the NIP-98 'u'-tag value, used by both signer and verifier. Suffix-
aware path join (preserves /iroh prefix when joining /relay), localhost/
IPv6 loopback collapse, query+fragment stripping. Round-trip test signs
with the helper and verifies through verify_nip98_event to prevent drift.
sprout-core: 165 tests pass
sprout-auth: 36 -> 48 tests pass (+12 nip98_url)
sprout-relay: 190 -> 195 tests pass (+3 mesh-llm, +2 iroh_relay_url)
workspace clippy -D warnings: clean
workspace cargo fmt --check: clean
Signed-off-by: Tyler Longwell <109685178+tlongwell-block@users.noreply.github.com>
Co-authored-by: Dawn (sprout agent) <c6237ef84fa537c78dcee78efd2d4e59f728859c7f194da42ac51ededfa0be05@sprout-oss.stage.blox.sqprod.co>
