Skip to content

fix(mobile): allow SAS-verified private/ws(s) relay URLs on pairing - #7266

Open
xandorklein wants to merge 1 commit into
block:mainfrom
xandorklein:fix/mobile-pairing-private-relay
Open

fix(mobile): allow SAS-verified private/ws(s) relay URLs on pairing#7266
xandorklein wants to merge 1 commit into
block:mainfrom
xandorklein:fix/mobile-pairing-private-relay

Conversation

@xandorklein

@xandorklein xandorklein commented Sep 2, 2026

Copy link
Copy Markdown

Summary

Fixes #4198.

After a successful NIP-AB SAS match, mobile still ran credential import through a release-only validator that:

  1. required the scheme to be exactly https (so wss://… and ws://… failed with Relay URL must use HTTPS)
  2. rejected RFC1918 host literals

That made VPN-only / Tailscale self-hosted communities unusable on mobile even when pairing itself succeeded, and also rejected legitimate public wss:// payloads (see issue comments). Desktop already supports private ws:// relays.

Approach

  • Extract validatePairingRelayUrl(...) with an explicit trustVerifiedPairingPayload flag.
  • SAS-verified NIP-AB path (true): accept http/https/ws/wss, allow private/VPN hosts and localhost, normalize ws→http / wss→https before storage + NIP-42 connect.
  • Legacy buzz:// paste path (false): keep production TLS + private-host rejection (SSRF posture for untrusted codes), but still normalize wss/ws so public websocket URLs are not misreported as “must use HTTPS”.
  • Invite validation in relay_validation.dart is unchanged (still strict for untrusted invite links).

Test plan

  • Unit tests for validatePairingRelayUrl (private ws://, MagicDNS, public wss://, untrusted private reject)
  • Identity-import flow tests: SAS-verified private ws://10.88.0.1:3000 and public wss:// import + normalize
  • Legacy buzz:// still rejects private IPs (incl. CGNAT 100.64/10)
  • CI mobile unit tests
  • Manual: Desktop QR pair into a Tailscale-only ws://*.ts.net:3000 community on a release/profile build with this change

@xandorklein
xandorklein requested a review from a team as a code owner September 2, 2026 23:46
@github-actions

github-actions Bot commented Sep 2, 2026 •
edited
Loading

Copy link
Copy Markdown

🔐 Codex Security Review

Status: review required for the current range.

The current range is 3c7f288c60d67df78577b237e27c3dfc8831aaa1...6a65633580bdef1ba70a54b34194997541f422a1.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 6a65633580bdef1ba70a54b34194997541f422a1 to authorize a new review.
Any previous review applies only to its recorded range.

@xandorklein
fix(mobile): allow SAS-verified private/ws(s) relay URLs on pairing
6a65633 
Post-SAS NIP-AB credential import treated every relayUrl like an untrusted
invite: release builds required exactly https and rejected RFC1918 hosts.
That blocked VPN-only and Tailscale communities (ws://private or MagicDNS)
and also rejected legitimate public wss:// payloads with a misleading
"must use HTTPS" error (block#4198).

Trust the desktop-sourced URL after SAS match (allow http/ws and private
or VPN hosts), keep strict checks for legacy buzz:// paste codes, and
normalize ws(s) → http(s) before storage so RelayConfig stays consistent.

Signed-off-by: Xandor Klein <xandorklein@users.noreply.github.com>
@xandorklein
xandorklein force-pushed the fix/mobile-pairing-private-relay branch from a54a1f4 to 6a65633 Compare September 7, 2026 17:45
@xandorklein

xandorklein commented Sep 7, 2026

Copy link
Copy Markdown
Author

Rebased onto latest main with DCO sign-off (git rebase --signoff) — previous head was missing Signed-off-by, which is what failed DCO Check.

Also cross-linked from #4198 for the people who hit the private/wss import failures.

Note: Codex Security Review still needs a Block org member to authorize:
@buzz-security-review 6a65633580bdef1ba70a54b34194997541f422a1
(head SHA after the DCO rebase — update if we push again).

@xandorklein xandorklein mentioned this pull request Sep 7, 2026
Open
@mcrisologo

mcrisologo commented Sep 8, 2026 •
edited
Loading

Copy link
Copy Markdown

Awaiting merge.
+1

@dazligth

dazligth commented Sep 15, 2026

Copy link
Copy Markdown

Awaiting merge.
+1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Mobile: QR pairing fails at credential import for private/VPN-only relays (relay URL must be HTTPS + public host)

3 participants

@xandorklein @mcrisologo @dazligth