mleku ea4a54c5e7 Add Cashu blind signature access tokens (NIP-XX draft) ...

Implements privacy-preserving bearer tokens for relay access control using
Cashu-style blind signatures. Tokens prove whitelist membership without
linking issuance to usage.

Features:
- BDHKE crypto primitives (HashToCurve, Blind, Sign, Unblind, Verify)
- Keyset management with weekly rotation
- Token format with kind permissions and scope isolation
- Generic issuer/verifier with pluggable authorization
- HTTP endpoints: POST /cashu/mint, GET /cashu/keysets, GET /cashu/info
- ACL adapter bridging ORLY's access control to Cashu AuthzChecker
- Stateless revocation via ACL re-check on each token use
- Two-token rotation for seamless renewal (max 2 weeks after blacklist)

Configuration:
- ORLY_CASHU_ENABLED: Enable Cashu tokens
- ORLY_CASHU_TOKEN_TTL: Token validity (default: 1 week)
- ORLY_CASHU_SCOPES: Allowed scopes (relay, nip46, blossom, api)
- ORLY_CASHU_REAUTHORIZE: Re-check ACL on each verification

Files:
- pkg/cashu/bdhke/: Core blind signature cryptography
- pkg/cashu/keyset/: Keyset management and rotation
- pkg/cashu/token/: Token format with kind permissions
- pkg/cashu/issuer/: Token issuance with authorization
- pkg/cashu/verifier/: Token verification with middleware
- pkg/interfaces/cashu/: AuthzChecker, KeysetStore interfaces
- pkg/bunker/acl_adapter.go: ORLY ACL integration
- app/handle-cashu.go: HTTP endpoints
- docs/NIP-XX-CASHU-ACCESS-TOKENS.md: Full specification

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

2025-12-28 11:30:11 +02:00

..

config

Add Cashu blind signature access tokens (NIP-XX draft)

2025-12-28 11:30:11 +02:00

web

Add WireGuard VPN with random /31 subnet isolation (v0.40.0)

2025-12-27 16:32:48 +02:00

blossom.go

Fix Blossom CORS headers and add root-level upload routes (v0.36.12)

2025-12-24 11:32:52 +01:00

handle_policy_config_test.go

Add ORLY_POLICY_PATH for custom policy file location

2025-12-14 18:36:04 +01:00

handle-auth.go

Fix NIP-42 AUTH compliance: always respond with OK message

2025-12-12 06:14:24 +01:00

handle-cashu.go

Add Cashu blind signature access tokens (NIP-XX draft)

2025-12-28 11:30:11 +02:00

handle-close.go

migrate to new nostr library

2025-11-23 08:15:06 +00:00

handle-count.go

migrate to new nostr library

2025-11-23 08:15:06 +00:00

handle-delete.go

Refactor Neo4j tests and improve tag handling in Cypher

2025-12-04 20:09:24 +00:00

handle-event-types.go

Decompose handle-event.go into DDD domain services (v0.36.15)

2025-12-25 05:30:07 +01:00

handle-event.go

Decompose handle-event.go into DDD domain services (v0.36.15)

2025-12-25 05:30:07 +01:00

handle-logs.go

Add log viewer for relay owners (v0.37.3)

2025-12-25 13:49:43 +01:00

handle-message.go

initial draft of hot reload policy

2025-11-27 06:31:34 +00:00

handle-nip43_test.go

Adjust ACL behavior for "none" mode and make query cache optional

2025-12-05 11:25:34 +00:00

handle-nip43.go

migrate to new nostr library

2025-11-23 08:15:06 +00:00

handle-nip86_minimal_test.go

fix handleevents not prompting auth for event publish with auth-required

2025-11-18 20:26:36 +00:00

handle-nip86.go

migrate to new nostr library

2025-11-23 08:15:06 +00:00

handle-policy-config.go

Add ORLY_POLICY_PATH for custom policy file location

2025-12-14 18:36:04 +01:00

handle-relayinfo.go

migrate to new nostr library

2025-11-23 08:15:06 +00:00

handle-req.go

Update privileged event filtering to respect ACL mode

2025-12-05 10:02:49 +00:00

handle-websocket.go

Add memory optimization improvements for reduced GC pressure (v0.36.16)

2025-12-25 06:03:53 +01:00

handle-wireguard.go

Add WireGuard VPN with random /31 subnet isolation (v0.40.0)

2025-12-27 16:32:48 +02:00

helpers.go

update docker and apache stuff to new next-orly and make it all more proxy-friendly

2025-10-03 11:44:02 +02:00

listener.go

Add memory optimization improvements for reduced GC pressure (v0.36.16)

2025-12-25 06:03:53 +01:00

main.go

Add WireGuard VPN with random /31 subnet isolation (v0.40.0)

2025-12-27 16:32:48 +02:00

nip43_e2e_test.go

Adjust ACL behavior for "none" mode and make query cache optional

2025-12-05 11:25:34 +00:00

ok.go

migrate to new nostr library

2025-11-23 08:15:06 +00:00

payment_processor.go

migrate to new nostr library

2025-11-23 08:15:06 +00:00

privileged_events_test.go

Update privileged event filtering to respect ACL mode

2025-12-05 10:02:49 +00:00

publisher.go

migrate to new nostr library

2025-11-23 08:15:06 +00:00

server.go

Add Cashu blind signature access tokens (NIP-XX draft)

2025-12-28 11:30:11 +02:00

sprocket.go

migrate to new nostr library

2025-11-23 08:15:06 +00:00

tls.go

Update dependencies and enhance deployment scripts

2025-10-24 21:03:44 +01:00

web.go

Implement NIP-98 authentication for HTTP requests, enhancing security for event export and import functionalities. Update server methods to validate authentication and permissions, and refactor event handling in the Svelte app to support new export and import features. Add UI components for exporting and importing events with appropriate permission checks.

2025-10-08 20:06:58 +01:00

wireguard-helpers.go

Add WireGuard VPN with random /31 subnet isolation (v0.40.0)

2025-12-27 16:32:48 +02:00