Implements privacy-preserving bearer tokens for relay access control using Cashu-style blind signatures. Tokens prove whitelist membership without linking issuance to usage. Features: - BDHKE crypto primitives (HashToCurve, Blind, Sign, Unblind, Verify) - Keyset management with weekly rotation - Token format with kind permissions and scope isolation - Generic issuer/verifier with pluggable authorization - HTTP endpoints: POST /cashu/mint, GET /cashu/keysets, GET /cashu/info - ACL adapter bridging ORLY's access control to Cashu AuthzChecker - Stateless revocation via ACL re-check on each token use - Two-token rotation for seamless renewal (max 2 weeks after blacklist) Configuration: - ORLY_CASHU_ENABLED: Enable Cashu tokens - ORLY_CASHU_TOKEN_TTL: Token validity (default: 1 week) - ORLY_CASHU_SCOPES: Allowed scopes (relay, nip46, blossom, api) - ORLY_CASHU_REAUTHORIZE: Re-check ACL on each verification Files: - pkg/cashu/bdhke/: Core blind signature cryptography - pkg/cashu/keyset/: Keyset management and rotation - pkg/cashu/token/: Token format with kind permissions - pkg/cashu/issuer/: Token issuance with authorization - pkg/cashu/verifier/: Token verification with middleware - pkg/interfaces/cashu/: AuthzChecker, KeysetStore interfaces - pkg/bunker/acl_adapter.go: ORLY ACL integration - app/handle-cashu.go: HTTP endpoints - docs/NIP-XX-CASHU-ACCESS-TOKENS.md: Full specification 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
75 lines
1.8 KiB
Go
75 lines
1.8 KiB
Go
package keyset
|
|
|
|
// Store is the interface for persisting keysets.
|
|
// Implement this interface for your database backend.
|
|
type Store interface {
|
|
// SaveKeyset persists a keyset.
|
|
SaveKeyset(k *Keyset) error
|
|
|
|
// LoadKeyset loads a keyset by ID.
|
|
LoadKeyset(id string) (*Keyset, error)
|
|
|
|
// ListActiveKeysets returns all keysets that can be used for signing.
|
|
ListActiveKeysets() ([]*Keyset, error)
|
|
|
|
// ListVerificationKeysets returns all keysets that can be used for verification.
|
|
ListVerificationKeysets() ([]*Keyset, error)
|
|
|
|
// DeleteKeyset removes a keyset from storage.
|
|
DeleteKeyset(id string) error
|
|
}
|
|
|
|
// MemoryStore is an in-memory implementation of Store for testing.
|
|
type MemoryStore struct {
|
|
keysets map[string]*Keyset
|
|
}
|
|
|
|
// NewMemoryStore creates a new in-memory store.
|
|
func NewMemoryStore() *MemoryStore {
|
|
return &MemoryStore{
|
|
keysets: make(map[string]*Keyset),
|
|
}
|
|
}
|
|
|
|
// SaveKeyset saves a keyset to memory.
|
|
func (s *MemoryStore) SaveKeyset(k *Keyset) error {
|
|
s.keysets[k.ID] = k
|
|
return nil
|
|
}
|
|
|
|
// LoadKeyset loads a keyset by ID.
|
|
func (s *MemoryStore) LoadKeyset(id string) (*Keyset, error) {
|
|
if k, ok := s.keysets[id]; ok {
|
|
return k, nil
|
|
}
|
|
return nil, nil
|
|
}
|
|
|
|
// ListActiveKeysets returns all active keysets.
|
|
func (s *MemoryStore) ListActiveKeysets() ([]*Keyset, error) {
|
|
result := make([]*Keyset, 0)
|
|
for _, k := range s.keysets {
|
|
if k.IsActiveForSigning() {
|
|
result = append(result, k)
|
|
}
|
|
}
|
|
return result, nil
|
|
}
|
|
|
|
// ListVerificationKeysets returns all keysets valid for verification.
|
|
func (s *MemoryStore) ListVerificationKeysets() ([]*Keyset, error) {
|
|
result := make([]*Keyset, 0)
|
|
for _, k := range s.keysets {
|
|
if k.IsValidForVerification() {
|
|
result = append(result, k)
|
|
}
|
|
}
|
|
return result, nil
|
|
}
|
|
|
|
// DeleteKeyset removes a keyset.
|
|
func (s *MemoryStore) DeleteKeyset(id string) error {
|
|
delete(s.keysets, id)
|
|
return nil
|
|
}
|