feat(nip98): add Authorization header verifier

[Anshumancanrock]

Description

First chunk of NIP-98 support. Adds a standalone verifier for Authorization: Nostr <base64-event> headers.

• verifyNip98Auth() in src/utils/nip98.ts
• checks kind 27235, timestamp skew, exact u/method, optional body payload hash, then id + sig
• oversized headers get rejected early
• also fixed a small sinon redeclare in info.spec.ts that was breaking the full unit suite

Middleware / admin API wiring comes next.

Related Issue

Part of NIP-98 admin auth work.

Motivation and Context

Need a solid crypto check we can drop into middleware later. Keeping it as a pure util makes this easy to review on its own.

Types of changes

• Non-functional change (docs, style, minor refactor)
• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my code changes.
• I added a changeset, or this is docs-only and I added an empty changeset.
• All new and existing tests passed.

[changeset-bot]

🦋 Changeset detected

Latest commit: 798292a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
nostream	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coveralls]

coverage: 70.199% (+0.4%) from 69.776% — Anshumancanrock:feat/nip98-verifier into cameri:main

[Copilot]

Pull request overview

Adds foundational NIP-98 support by introducing a standalone utility to verify Authorization: Nostr <base64-event> headers (kind 27235) and accompanying unit tests, plus a small unit test import cleanup.

Changes:

• Added verifyNip98Auth() + helpers to parse and validate NIP-98 auth headers (kind, skew window, payload binding, event id + signature).
• Added a comprehensive unit test suite for NIP-98 verification behavior.
• Updated info.spec.ts to use ES module imports (fixing the sinon redeclare issue) and extended constants for NIP-98 kind/tags.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/utils/nip98.ts	New NIP-98 Authorization header verification utility.
src/constants/base.ts	Adds NIP-98 HTTP_AUTH kind and u/method/payload tag constants.
test/unit/utils/nip98.spec.ts	New unit tests covering NIP-98 parsing/validation edge cases.
test/unit/cli/info.spec.ts	Switches to ESM imports and reformats a stub to fix test suite issues.
.knip.json	Updates Knip ignore configuration for the new util file.
.changeset/nip98-auth-verifier.md	Adds a changeset entry for the new feature.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.