You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
mleku
ea4a54c5e7
Add Cashu blind signature access tokens (NIP-XX draft)
Implements privacy-preserving bearer tokens for relay access control using
Cashu-style blind signatures. Tokens prove whitelist membership without
linking issuance to usage.
Features:
- BDHKE crypto primitives (HashToCurve, Blind, Sign, Unblind, Verify)
- Keyset management with weekly rotation
- Token format with kind permissions and scope isolation
- Generic issuer/verifier with pluggable authorization
- HTTP endpoints: POST /cashu/mint, GET /cashu/keysets, GET /cashu/info
- ACL adapter bridging ORLY's access control to Cashu AuthzChecker
- Stateless revocation via ACL re-check on each token use
- Two-token rotation for seamless renewal (max 2 weeks after blacklist)
Configuration:
- ORLY_CASHU_ENABLED: Enable Cashu tokens
- ORLY_CASHU_TOKEN_TTL: Token validity (default: 1 week)
- ORLY_CASHU_SCOPES: Allowed scopes (relay, nip46, blossom, api)
- ORLY_CASHU_REAUTHORIZE: Re-check ACL on each verification
Files:
- pkg/cashu/bdhke/: Core blind signature cryptography
- pkg/cashu/keyset/: Keyset management and rotation
- pkg/cashu/token/: Token format with kind permissions
- pkg/cashu/issuer/: Token issuance with authorization
- pkg/cashu/verifier/: Token verification with middleware
- pkg/interfaces/cashu/: AuthzChecker, KeysetStore interfaces
- pkg/bunker/acl_adapter.go: ORLY ACL integration
- app/handle-cashu.go: HTTP endpoints
- docs/NIP-XX-CASHU-ACCESS-TOKENS.md: Full specification
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
|
2 weeks ago |
| .. |
|
acl
|
Fix Blossom CORS headers and add root-level upload routes (v0.36.12)
|
3 weeks ago |
|
blossom
|
Add Blossom admin UI for viewing all users' storage (v0.36.21)
|
3 weeks ago |
|
bunker
|
Add Cashu blind signature access tokens (NIP-XX draft)
|
2 weeks ago |
|
cashu
|
Add Cashu blind signature access tokens (NIP-XX draft)
|
2 weeks ago |
|
database
|
Add WireGuard VPN with random /31 subnet isolation (v0.40.0)
|
2 weeks ago |
|
event
|
Decompose handle-event.go into DDD domain services (v0.36.15)
|
3 weeks ago |
|
find
|
Remove Dgraph, check hex field case, reject if any uppercase
|
1 month ago |
|
interfaces
|
Add Cashu blind signature access tokens (NIP-XX draft)
|
2 weeks ago |
|
logbuffer
|
Fix log parser to match lol library format (v0.38.1)
|
3 weeks ago |
|
mode
|
Adjust ACL behavior for "none" mode and make query cache optional
|
1 month ago |
|
neo4j
|
Add fixed-size type support for IdPkTs and EventRef
|
3 weeks ago |
|
pid
|
Generalize PID controller as reusable library with abstract interfaces
|
1 month ago |
|
policy
|
Add ORLY_POLICY_PATH for custom policy file location
|
4 weeks ago |
|
protocol
|
Fix broken submodule and add import memory optimization plan
|
1 month ago |
|
ratelimit
|
Interim release: documentation updates and rate limiting improvements
|
1 month ago |
|
run
|
Implement PID-controlled adaptive rate limiting for database operations
|
1 month ago |
|
spider
|
add directory spider
|
2 months ago |
|
sync
|
Fix NIP-11 fetch URL scheme conversion for non-proxied relays
|
4 weeks ago |
|
utils
|
migrate to new nostr library
|
2 months ago |
|
version
|
Add git.mleku.dev remote push to release process (v0.40.1)
|
2 weeks ago |
|
wasmdb
|
implement wasm/js specific database engine
|
1 month ago |
|
wireguard
|
Add WireGuard VPN with random /31 subnet isolation (v0.40.0)
|
2 weeks ago |
