mirror of
https://github.com/block/buzz.git
synced 2026-11-06 17:31:19 +00:00
a1f79e3aba
## Summary Record that a community requires NIP-FI and provide an idempotent operator API to enable it and recover the original receipt. Acceptance checks the current owner, host, lifecycle and existing issuer trust in one transaction. It never creates trust. Receipts survive community deletion so an operation UUID cannot be reused. New acceptances default to disabled through `BUZZ_NIP_FI_UPGRADES_ENABLED`. Disabled calls return HTTP 503 `upgrades_disabled`; identical retries and authenticated readback still recover existing receipts. Policy is permanent: stopping new calls or rolling back code does not clear it. Last-issuer removal is refused for required communities, and bulk backfill leaves missing bindings for explicit operator repair. Apply additive migration 0082 before code. Existing communities remain optional. This layer records acceptance and reports only `pending` or `unavailable`; deploy and verify [per-request enforcement](https://github.com/block/buzz/pull/8988) and [session activation](https://github.com/block/buzz/pull/8991) before enabling acceptance. The global enforce floor remains. See [the operator contract](https://github.com/block/buzz/blob/seiler/BUZZ-510/relay-auth-upgrade/docs/community-auth-upgrades.md) for signing, recovery and containment. ### Related issue [BUZZ-510](https://linear.app/squareup/issue/BUZZ-510/relay-persist-community-nip-fi-requirements-and-expose-idempotent). Base of native stack `8989`; retains trunk's enforcement telemetry from [#8974](https://github.com/block/buzz/pull/8974). Includes a separate commit that repairs an observer timing flake in a desktop test required by the repository gate. ### Testing Controlled local regressions detect the old disabled error code and removal of the last issuer with `allow_last=true`; intended source is restored. Full PostgreSQL validation and the updated live relay/admin exercise remain pending. Human acceptance remains open. No deployment or production activation. Generated with Codex --------- Signed-off-by: Brad Seiler <seiler@squareup.com> Co-authored-by: Honor <e0bf479eeebe47dde1e35705212a4df70616a7bc834d907ddfb18cf0405f8b1b@seiler-test.communities.public.builderlabstaging.xyz>
15 lines
652 B
SQL
15 lines
652 B
SQL
-- Operator-global acceptance receipts. Retained across community deletion so
|
|
-- lost-response retries cannot reuse an old operation ID for a different target.
|
|
-- target_community_id is provenance, not tenant-owned data. No serving writer.
|
|
CREATE TABLE community_auth_upgrades (
|
|
operation_id UUID PRIMARY KEY,
|
|
target_community_id UUID NOT NULL,
|
|
expected_host TEXT NOT NULL,
|
|
actor_pubkey TEXT NOT NULL,
|
|
expected_owner_pubkey TEXT NOT NULL,
|
|
expected_issuer TEXT NOT NULL,
|
|
operator_pubkey TEXT NOT NULL,
|
|
policy_generation BIGINT NOT NULL CHECK (policy_generation > 0),
|
|
accepted_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
);
|