npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d 1151eca83d fix(relay): scope relay membership to its community ...

NIP-43 admission confinement (Max review #3 on PR #1321). The
`relay_members` table is keyed `(community_id, pubkey)`, but every DB
access keyed on `pubkey` alone. In closed mode a pubkey admitted to
community A was therefore admitted to community B — the exact M9
mutation #1285 targets.

Request-path scoping:
- thread `CommunityId` through all 9 `buzz-db::relay_members` functions
  and their `Db` wrappers; every query/insert/list/bootstrap now binds
  `community_id` (PK `ON CONFLICT (community_id, pubkey)`, WHERE clauses
  carry community).
- `check_/enforce_relay_membership` take the server-resolved community;
  pass `tenant.community()` at every entrypoint that already binds a
  tenant: bridge (events/query/count), media upload, git transport,
  audio handle, WS auth (`conn.tenant`), mesh `require_mesh_member`
  (connect + status), relay-admin events, leave-request ingest,
  identity-archive consent, NIP-43 list publish, and the buzz-admin CLI
  (via `resolve_admin_tenant`).

Startup seeding (the bootstrap half of the same fix): membership
backfill and owner bootstrap previously ran with no community. They now
run against the deployment's own community, seeded via
`ensure_configured_community` under the *same* normalized host that live
request resolution derives (`relay_url_authority` → `normalize_host`, now
`pub`), so the bootstrapped owner lands in exactly the community requests
for this host resolve to. An unparseable `relay_url` fails fast when
membership is enforced rather than seeding an unreachable empty-host
community.

Regression (Postgres-backed, `#[ignore]`):
- `membership_is_confined_to_its_community`: A admits a pubkey, B does
  not — `is_/get_/list_relay_members` confine it to A.
- `owner_bootstrap_is_confined_to_its_community`: owner bootstrapped in A
  is not a member of B.

cargo test -p buzz-db -p buzz-relay -p buzz-admin green; both new tests
pass against live Postgres; clippy clean on all three crates.

Co-authored-by: Tyler Longwell <tlongwell@block.xyz>
Signed-off-by: Tyler Longwell <tlongwell@block.xyz>

2026-06-27 14:43:51 -04:00

..

main.rs

fix(relay): scope relay membership to its community

2026-06-27 14:43:51 -04:00