feat: Add Nip42 handler - #629
Conversation
🦋 Changeset detectedLatest commit: 3f43783 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
There was a problem hiding this comment.
Pull request overview
Adds NIP-42 challenge/response authentication to the WebSocket ingestion path by issuing an AUTH challenge on connect and validating incoming AUTH events (kind 22242) in a dedicated handler, while preventing 22242 events from being published through the normal EVENT pipeline.
Changes:
- Send
["AUTH", <challenge>]on new WebSocket connections and track authenticated pubkeys per connection. - Introduce
AuthMessageHandlerand routeAUTHmessages to it viamessageHandlerFactory. - Block kind
22242from the standardEVENThandler to avoid persistence/pipeline handling.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
src/adapters/web-socket-adapter.ts | Generates/sends NIP-42 challenges on connect; tracks authenticated pubkeys and clears them on disconnect. |
src/handlers/auth-message-handler.ts | Implements validation for kind 22242 AUTH events (id, sig, timestamp, challenge tag, relay domain) and records authenticated pubkeys. |
src/handlers/event-message-handler.ts | Rejects kind 22242 when sent via EVENT to keep auth events out of the normal event pipeline. |
src/factories/message-handler-factory.ts | Routes AUTH messages to the new AuthMessageHandler. |
src/@types/adapters.ts | Extends IWebSocketAdapter with challenge/authenticated-pubkeys accessors/mutator. |
test/unit/adapters/web-socket-adapter.spec.ts | Adds coverage for challenge emission and new adapter auth-related methods. |
test/unit/handlers/auth-message-handler.spec.ts | Adds unit tests for AUTH validation success/failure cases. |
test/unit/factories/message-handler-factory.spec.ts | Adds a test ensuring AUTH messages produce AuthMessageHandler. |
.changeset/funky-coins-know.md | Declares a minor release for NIP-42 AUTH wiring. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
8b60719 to
a63d4c3CompareAnshumancanrock
commented
May 28, 2026
Hi @cameri , This PR is up for review. |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Ferryx349
left a comment
There was a problem hiding this comment.
Overall the changes look great, just few nits:
Description
Second PR for NIP-42 (follows #622). This one wires everything up so the adapter now sends a challenge on connect and there's a handler to verify the client's AUTH response.
WebSocketAdaptergenerates a random challenge on connect and sends["AUTH", <challenge>]AuthMessageHandlerverifies kind 22242 events (checks id, sig, timestamp, challenge tag, relay domain)messageHandlerFactoryroutes AUTH messages to the new handlerIWebSocketAdapterwithgetChallenge(),getAuthenticatedPubkeys(),addAuthenticatedPubkey()Related Issue
Closes#619
Motivation and Context
With the types from #622 in place, this wires up the actual auth flow so connections can be tied to a pubkey. Sets things up for NIP-70 protected events next.
How Has This Been Tested?
Added 20 new tests across the handler, adapter and factory specs.
Types of changes
Checklist: