docs(nips): complete NIP-FI authorization draft - #3726
Draft
cea-block wants to merge 11 commits into
Draft
Conversation
Normative spec for authorizing a NIP-42/NIP-98-proven Nostr key only when a valid OIDC/JWT assertion resolves to the same active identity-to-key binding. Covers assertion transport (trusted-proxy and client-attached profiles), validation, per-domain binding bijection, enrollment modes (attested-key/provisioned/tofu), lease/session bounds, revocation and rotation, delegation composition, rejection semantics, discovery, and privacy. Companion formal model to follow on this branch. Generalizes the semantics implemented in #1476 into a provider-neutral standard per buzz-security thread 0d1aee9e. Co-authored-by: Tyler Longwell <tlongwell@block.xyz> Signed-off-by: Tyler Longwell <tlongwell@block.xyz>
Define the trust assumptions, authorization predicate, binding state machine, safety and liveness properties, and adversarial traces for federated identity authorization. Tighten the normative draft with a collision-free client assertion header and concrete NIP-11 discovery shape. Co-authored-by: Tyler Longwell <tlongwell@block.xyz> Signed-off-by: Tyler Longwell <tlongwell@block.xyz>
Two cold-read consistency fixes: the model's race clause still said a lost race must deny, contradicting the spec's exact-match-allows rule; and the spec's session text offered 'require a fresh assertion' at lease expiry, which has no defined mid-connection transport — assertions only arrive on an upgrade request. Co-authored-by: Tyler Longwell <tlongwell@block.xyz> Signed-off-by: Tyler Longwell <tlongwell@block.xyz>
Remove the model's remaining impossible mid-connection assertion refresh option so its WebSocket transition exactly matches the normative transport. Co-authored-by: Tyler Longwell <tlongwell@block.xyz> Signed-off-by: Tyler Longwell <tlongwell@block.xyz>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Continue #1485 as an isolated Buzz-local draft so the NIP-FI contract can be completed and reviewed without modifying its original branch or #1476.
What
(iss, sub)identity, trusted server-resolved domains, durable lifecycle gates, and atomic recovery/re-enablementRisk Assessment
Low — documentation only; no runtime code or configuration changes. This is a Buzz-local draft and does not represent upstream NIP acceptance.
References
805f1131b8c946cfdcff4508d20f1758515a59901e9822de8dbe0ae91c00c0ce0ed8ff583915692f921fd73161780df893961ef053b9aee74be80d12passed three independent Claude/GPT-family reviews with no P0/P1 findings; Gemini review was unavailable because its CLI authentication was rejectedjust cireached only six pre-existing desktop Rust Clippy warnings under Rust 1.95 after the core Rust and desktop JavaScript checks passed; this diff changes only three Markdown filesGenerated with Codex