mirror of
https://github.com/block/buzz.git
synced 2026-10-30 05:51:46 +00:00
7d5b6e1226
Implements PostgreSQL as the final authority for NIP-FI kind-9 admission on
the Design C (one READ COMMITTED transaction) path. This is PR 4 in the
Phase A stack; it builds on PR 3 (buzz-auth production assertion runtime,
merged as 70895b355).
- Add `connection_id UUID NOT NULL` to `nip_fi_proof_replay_claims`.
Records the WebSocket connection UUID that first claimed each proof event,
enabling per-connection ownership checks at admission time.
- `NS_ADMISSION_OP`: domain-separated namespace constant (SHA-256 of
"buzz.nip-fi.admission-op.v1", first 16 bytes).
- `deterministic_admission_op_id(community_id, proof_event_id, signed_event_id)`:
derives the admission operation_id via UUID v5 (SHA-1 namespaced),
replacing the previous `Uuid::new_v4()` call in `commit_kind9_inner`.
Same (community, proof, event) triple always produces the same operation_id,
enabling idempotent exact-replay detection via the receipt protocol.
- `Kind9Params` no longer carries an `operation_id` field; callers no
longer allocate or pass it.
- `commit_admission_body` reads `events FOR SHARE` after acquiring the
NIP-FI writer lock. If the exact (community_id, created_at, id) row
already exists, returns `AdmissionError::DuplicateEvent` immediately,
writing zero new authority rows.
- Reads `nip_fi_proof_replay_claims FOR SHARE` before any write.
Same `conn_id` → same-connection reuse, continues.
Different `conn_id` → returns `ProofReplayed`.
- Reads `authorization_operation_receipts FOR SHARE` before any write.
Same `operation_id` + same `request_fingerprint` → `DuplicateEvent`.
Same `operation_id` + different fingerprint → `Transient` (intent conflict).
- Moved from old step 10 (before epoch/POA) to after the epoch/fence and POA
upserts. Uses `ON CONFLICT (community_id, proof_event_id) DO NOTHING`.
After a DO NOTHING (PK race), re-reads the winning row under FOR SHARE:
same conn_id → same-connection race resolved; different → `ProofReplayed`.
- Includes `connection_id` in the INSERT.
- If `insert_event_with_thread_metadata_in_tx` returns `was_inserted=false`
after the authority mutations succeed (race that bypasses the precheck),
`commit_kind9_inner` explicitly rolls back before returning the result,
preventing orphaned authority mutations.
- `AdmissionError::DuplicateEvent` is intercepted before the error-mapping
closure. Returns `IngestResult { accepted: true, message: "duplicate:" }`
immediately — the same duplicate response as the non-NIP-FI path.
- Deleted `crates/buzz-nip-fi-seal-test/` and `crates/buzz-nip-fi-inner-seal-test/`.
- Removed both from workspace `Cargo.toml` members.
- Removed `nip-fi-boundary-test = []` feature from `buzz-relay/Cargo.toml`.
- Collapsed cfg-split `mod nip_fi` / `pub mod nip_fi` in `lib.rs` to single
private `mod nip_fi`.
- Collapsed cfg-split `mod context` / `pub mod context` in `nip_fi/mod.rs`.
- Updated `context.rs` doc comment (no longer references deleted crate).
Named per the #6730 `postgres_tests` CI convention so they are selected
automatically once this branch lands on main:
1. `postgres_same_conn_proof_reuse_allowed` — step 3d same-conn path
2. `postgres_cross_conn_proof_replay_rejected` — step 3d cross-conn path
3. `postgres_duplicate_event_precheck_is_noop` — step 3c precheck
4. `postgres_concurrent_same_conn_pk_race_both_succeed` — step-13 DO NOTHING
5. `postgres_concurrent_cross_conn_pk_race_one_rejected` — step-13 cross-conn
6. `postgres_deterministic_op_id_exact_replay_is_noop` — op_id idempotence
Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>