feat: nostr auth endpoint

[escapedcat]

Related FE PR: teambtcmap/btcmap.org#990

FE looks like this

Using private key directly (no extension)

Summary by CodeRabbit

• New Features

  • Added Nostr authentication support for user sign-in
  • Automatic user account creation upon first Nostr login
  • Access tokens generated after successful Nostr authentication

• Bug Fixes

  • Improved authentication flow to properly handle users provisioned without passwords

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR implements NIP-98 Nostr authentication for the API. It adds a database index to enforce unique npub values, query helpers for user insertion, a POST /v4/auth/nostr endpoint that exchanges verified NIP-98 events for bearer tokens with automatic user provisioning, and comprehensive tests covering validation, existing users, auto-creation, and concurrent sign-in recovery.

Changes

Nostr Authentication via NIP-98

Layer / File(s)	Summary
Database Schema & Constraints src/db/main/migrations/101.sql, src/db/main/schema.sql	Adds unique partial index user_npub_unique on user(npub) to enforce single npub per user while allowing NULL values.
Database Query Helpers src/db/main/user/blocking_queries.rs, src/db/main/user/queries.rs	New async and blocking functions insert_with_npub to insert users with npub values; blocking version uses projection/mapper and serializes roles; removes #[allow(dead_code)] from select_by_npub.
Response Type Definition src/rest/v4/nostr.rs	Introduces AuthNostrResponse struct with token, username, and npub JSON fields.
Endpoint Handler & Recovery src/rest/v4/nostr.rs	POST /v4/auth/nostr endpoint validates NIP-98 event via NostrAuth extractor, looks up user by npub, auto-creates user if unknown (with generated numbered username and Role::User), inserts access token, and returns auth response. Includes create_or_recover helper and is_unique_violation_on.
Password Handling Adjustment src/rest/v4/users.rs	create_token now returns unauthorized early when user.password is empty to avoid password verification for auto-created users.
Dead Code Cleanup src/rest/nostr_auth.rs, src/service/nip98.rs	Removes module-level #![allow(dead_code)] attributes.
Application Integration src/main.rs, src/rest/v4/mod.rs	Loads BTCMAP_API_BASE_URL (default http://127.0.0.1:8000), injects ApiBaseUrl into Actix app state, registers /v4/auth route scope with auth_nostr handler, and exports rest::v4::nostr module.
Tests src/rest/v4/nostr.rs	Adds tests for missing/invalid Authorization (401), existing-user token issuance and persistence, unknown-user auto-creation with Role::User and token binding, and a concurrency test ensuring exactly one user row per npub across parallel sign-ins.

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant Handler as auth_nostr
  participant Verifier as NostrAuth
  participant DB as UserQueries
  participant TokenStore as AccessTokenStorage
  Client->>Handler: POST /v4/auth/nostr (Authorization: NIP-98 event)
  Handler->>Verifier: validate & extract npub
  Handler->>DB: select_by_npub(npub)
  alt user exists
    Handler->>TokenStore: insert access_token(user_id)
  else user missing
    Handler->>DB: insert_with_npub (create_or_recover)
    alt insert races
      Handler->>DB: select_by_npub(npub) (recover winner)
    end
    Handler->>TokenStore: insert access_token(user_id)
  end
  TokenStore-->>Handler: token
  Handler-->>Client: AuthNostrResponse { token, username, npub }

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• teambtcmap/btcmap-api#84: Main PR builds on and wires up the NIP‑98 extractor/service introduced in PR #84 (adds endpoint, DB unique index, and user npub insertion using the previously added nostr auth and nip98 modules).

Suggested reviewers

• bubelov

Poem

🐰 A rabbit hops through crypto doors,
I wink and sign with nimble paws,
New npubs find a home,
Tokens hum and roam,
Hooray — one user, no more wars!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The PR title 'feat: nostr auth endpoint' directly and concisely describes the main change: adding a new Nostr authentication endpoint for user login.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/nostr-auth-endpoint

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

src/db/main/user/blocking_queries.rs (1)

24-45: ⚡ Quick win

Consider adding a unit test for insert_with_npub.

The function implementation is correct and follows the established pattern (consistent with insert and set_roles). However, the test module below lacks coverage for this new function. Adding a unit test would verify the atomic insertion of npub and roles and improve maintainability.

📋 Suggested test case

#[test]
fn insert_with_npub() -> Result<()> {
    let conn = conn();
    let name = "test_user";
    let password = "test_pwd";
    let npub = "npub1test123";
    let roles = vec![Role::User, Role::Admin];
    
    let user = super::insert_with_npub(name, password, npub, &roles, &conn)?;
    
    assert_eq!(name, user.name);
    assert_eq!(password, user.password);
    assert_eq!(Some(npub.to_string()), user.npub);
    assert_eq!(roles, user.roles);
    
    // Verify it was actually stored
    let retrieved = super::select_by_id(user.id, &conn)?;
    assert_eq!(user.npub, retrieved.npub);
    assert_eq!(user.roles, retrieved.roles);
    
    Ok(())
}

As per coding guidelines, tests should be inline using #[cfg(test)] modules and use db::test::pool() for in-memory SQLite test databases.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/db/main/user/blocking_queries.rs` around lines 24 - 45, Add a unit test
for insert_with_npub in the module's #[cfg(test)] tests: create an in-memory
connection via db::test::pool() (or conn()), call insert_with_npub(name,
password, npub, &roles, &conn) with roles like vec![Role::User, Role::Admin],
assert returned User has expected name, password, Some(npub.to_string()) for
npub and matching roles, then call select_by_id(user.id, &conn) to verify the
record was persisted with the same npub and roles; place the test in the
existing test module and return Result<()> so it follows existing test patterns.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/db/main/user/blocking_queries.rs`:
- Around line 24-45: Add a unit test for insert_with_npub in the module's
#[cfg(test)] tests: create an in-memory connection via db::test::pool() (or
conn()), call insert_with_npub(name, password, npub, &roles, &conn) with roles
like vec![Role::User, Role::Admin], assert returned User has expected name,
password, Some(npub.to_string()) for npub and matching roles, then call
select_by_id(user.id, &conn) to verify the record was persisted with the same
npub and roles; place the test in the existing test module and return Result<()>
so it follows existing test patterns.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f971fb2a-17c6-4278-a0bd-ee75330bc1ed

📥 Commits

Reviewing files that changed from the base of the PR and between afa4cb4 and e7046bd.

📒 Files selected for processing (4)

• src/db/main/user/blocking_queries.rs
• src/db/main/user/queries.rs
• src/rest/v4/nostr.rs
• src/rest/v4/users.rs

🚧 Files skipped from review as they are similar to previous changes (1)

• src/rest/v4/nostr.rs