mirror of
https://github.com/HolgerHatGarKeineNode/einundzwanzig-nostr.git
synced 2026-05-23 13:15:36 +00:00
6bb7d93d1d
Closes a security flaw where the server trusted any pubkey the client sent. The frontend now signs a per-session, time-bound challenge (kind-22242 event) that the backend verifies with swentel/nostr-php before establishing the session. - NostrAuth: issueChallenge() + loginWithSignedEvent() with full schnorr/id verification, TTL window, and idempotent re-entry for concurrent Livewire listeners. - auth-button: mounts a fresh challenge, exposes it via data-attribute + requestNostrChallenge() fallback, renders a full-viewport AAA-style loading overlay while the wallet signs. - NostrSessionGuard: override logout() to drop the cookie-jar dep so programmatic logout works in any context.
71 lines
1.7 KiB
PHP
71 lines
1.7 KiB
PHP
<?php
|
|
|
|
namespace App\Livewire\Traits;
|
|
|
|
use App\Models\EinundzwanzigPleb;
|
|
use App\Support\NostrAuth;
|
|
use Illuminate\Support\Facades\RateLimiter;
|
|
use Livewire\Attributes\On;
|
|
|
|
trait WithNostrAuth
|
|
{
|
|
public ?string $currentPubkey = null;
|
|
|
|
public ?object $currentPleb = null;
|
|
|
|
public bool $isAllowed = false;
|
|
|
|
public bool $canEdit = false;
|
|
|
|
#[On('nostrLoggedIn')]
|
|
public function handleNostrLogin($signedEvent = null): void
|
|
{
|
|
$executed = RateLimiter::attempt(
|
|
'nostr-login:'.request()->ip(),
|
|
10,
|
|
function () {},
|
|
);
|
|
|
|
if (! $executed) {
|
|
abort(429, 'Too many login attempts.');
|
|
}
|
|
|
|
$pubkey = NostrAuth::loginWithSignedEvent($signedEvent);
|
|
|
|
$this->currentPubkey = $pubkey;
|
|
$this->currentPleb = EinundzwanzigPleb::query()
|
|
->where('pubkey', $pubkey)
|
|
->first();
|
|
|
|
if ($this->currentPleb && $this->currentPleb->isBoardMember()) {
|
|
$this->canEdit = true;
|
|
}
|
|
|
|
$this->isAllowed = true;
|
|
}
|
|
|
|
#[On('nostrLoggedOut')]
|
|
public function handleNostrLogout(): void
|
|
{
|
|
NostrAuth::logout();
|
|
|
|
$this->isAllowed = false;
|
|
$this->currentPubkey = null;
|
|
$this->currentPleb = null;
|
|
$this->canEdit = false;
|
|
}
|
|
|
|
public function mountWithNostrAuth(): void
|
|
{
|
|
if ($user = NostrAuth::user()) {
|
|
$this->currentPubkey = $user->getPubkey();
|
|
$this->currentPleb = $user->getPleb();
|
|
$this->isAllowed = true;
|
|
|
|
if ($this->currentPleb && $this->currentPleb->isBoardMember()) {
|
|
$this->canEdit = true;
|
|
}
|
|
}
|
|
}
|
|
}
|