mirror of
https://github.com/block/buzz.git
synced 2026-11-06 09:21:45 +00:00
a1f79e3aba
## Summary Record that a community requires NIP-FI and provide an idempotent operator API to enable it and recover the original receipt. Acceptance checks the current owner, host, lifecycle and existing issuer trust in one transaction. It never creates trust. Receipts survive community deletion so an operation UUID cannot be reused. New acceptances default to disabled through `BUZZ_NIP_FI_UPGRADES_ENABLED`. Disabled calls return HTTP 503 `upgrades_disabled`; identical retries and authenticated readback still recover existing receipts. Policy is permanent: stopping new calls or rolling back code does not clear it. Last-issuer removal is refused for required communities, and bulk backfill leaves missing bindings for explicit operator repair. Apply additive migration 0082 before code. Existing communities remain optional. This layer records acceptance and reports only `pending` or `unavailable`; deploy and verify [per-request enforcement](https://github.com/block/buzz/pull/8988) and [session activation](https://github.com/block/buzz/pull/8991) before enabling acceptance. The global enforce floor remains. See [the operator contract](https://github.com/block/buzz/blob/seiler/BUZZ-510/relay-auth-upgrade/docs/community-auth-upgrades.md) for signing, recovery and containment. ### Related issue [BUZZ-510](https://linear.app/squareup/issue/BUZZ-510/relay-persist-community-nip-fi-requirements-and-expose-idempotent). Base of native stack `8989`; retains trunk's enforcement telemetry from [#8974](https://github.com/block/buzz/pull/8974). Includes a separate commit that repairs an observer timing flake in a desktop test required by the repository gate. ### Testing Controlled local regressions detect the old disabled error code and removal of the last issuer with `allow_last=true`; intended source is restored. Full PostgreSQL validation and the updated live relay/admin exercise remain pending. Human acceptance remains open. No deployment or production activation. Generated with Codex --------- Signed-off-by: Brad Seiler <seiler@squareup.com> Co-authored-by: Honor <e0bf479eeebe47dde1e35705212a4df70616a7bc834d907ddfb18cf0405f8b1b@seiler-test.communities.public.builderlabstaging.xyz>
34 lines
2.0 KiB
SQL
34 lines
2.0 KiB
SQL
-- ── Communities ───────────────────────────────────────────────────────────────
|
|
-- Conformance: row zero (host binding). The host map. `resolve_host(host)`
|
|
-- reads exactly one row here to mint the request's TenantContext. This table
|
|
-- is OPERATOR-GLOBAL: it is the registry of tenants, not itself tenant-scoped,
|
|
-- so it carries no `community_id` of its own (its `id` IS the community key).
|
|
-- Listed in the lint allowlist as operator-global.
|
|
--
|
|
-- Host normalization (Lane 0 contract): `host` is stored already-normalized —
|
|
-- ASCII-lowercased, trailing dot stripped, default port omitted. The UNIQUE is
|
|
-- on `lower(host)` belt-and-suspenders so `Relay.Example` and `relay.example`
|
|
-- can never become two tenants even if a writer forgets to normalize.
|
|
-- `resolve_host()` (buzz-core) applies the identical normalization before
|
|
-- lookup, so resolution and storage agree by construction.
|
|
|
|
CREATE TABLE communities (
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
host VARCHAR(255) NOT NULL,
|
|
signing_key BYTEA,
|
|
requires_nip_fi BOOLEAN NOT NULL DEFAULT false,
|
|
policy_generation BIGINT NOT NULL DEFAULT 0,
|
|
-- Per-community workspace icon (NIP-11 `icon`), set via kind:9033.
|
|
-- Added by migration 0003; kept here so desired-state applies match.
|
|
icon TEXT,
|
|
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
|
archived_at TIMESTAMPTZ,
|
|
deletion_state TEXT NOT NULL DEFAULT 'active' CHECK (deletion_state IN ('active', 'quiescing', 'fenced', 'tombstone')),
|
|
deletion_fence_generation BIGINT NOT NULL DEFAULT 0 CHECK (deletion_fence_generation >= 0),
|
|
deleted_at TIMESTAMPTZ,
|
|
artifact_policy_modified_at TIMESTAMPTZ NOT NULL DEFAULT 'epoch',
|
|
CONSTRAINT chk_communities_id_not_nil CHECK (id <> '00000000-0000-0000-0000-000000000000'::uuid)
|
|
);
|
|
|
|
CREATE UNIQUE INDEX idx_communities_host ON communities (lower(host));
|