mirror of
https://github.com/Such-Software/smirk-backend-core.git
synced 2026-10-17 07:21:32 +02:00
jwinterm
63d2c75194
nostr-rs-relay's [grpc] event_admission_server calls Authorization.EventAdmit once per inbound event; we answer PERMIT/DENY so the write policy is enforced at ingest (dynamic, per-event — a static pubkey whitelist can't do inbox/PoW). - proto/nauthz.proto (matches nostr-rs-relay's contract) compiled by build.rs; protoc is vendored (protoc-bin-vendored) so a source build needs no system protobuf-compiler. tonic/prost added (reuse the hyper/tower/h2 stack axum already pulls in); server-only codegen. - infra/relay/nauthz: AdmissionService resolves author + recipient (p-tag) registration via the DB, runs the pure policy engine, returns the decision; served on a loopback socket (spawned in main only when relay enabled + policy != open), mirroring the admin plane. Fail-closed on a malformed request. - db: is_registered_npub(hex) — a no-PII membership check safe to call per event. - tests/relay_admission.rs: L1 handler tests (is_registered_npub membership + outbox/inbox/deny-non-giftwrap/deny-unregistered-recipient through the real event_admit handler against live Postgres).
15 lines
596 B
Rust
15 lines
596 B
Rust
//! Compile the gRPC proto(s). `protoc` is vendored (protoc-bin-vendored) so a
|
|
//! source build needs no system protobuf-compiler.
|
|
|
|
fn main() {
|
|
// Point tonic-build/prost at the vendored protoc.
|
|
if let Ok(protoc) = protoc_bin_vendored::protoc_bin_path() {
|
|
std::env::set_var("PROTOC", protoc);
|
|
}
|
|
println!("cargo:rerun-if-changed=proto/nauthz.proto");
|
|
tonic_build::configure()
|
|
.build_client(false) // we only serve the admission service, never call it
|
|
.compile_protos(&["proto/nauthz.proto"], &["proto"])
|
|
.expect("compile proto/nauthz.proto");
|
|
}
|