jwinterm fea90e3bf1 fix(nip05): always serve the well-known directory with CORS * (federation) ...

The NIP-05 directory (/.well-known/nostr.json) is public, read-only, unauth'd data
that MUST be cross-origin fetchable — any Nostr client on any domain resolves
`user@this-instance` by fetching it. It was covered by the single global CORS layer,
so it only got `Access-Control-Allow-Origin: *` when CORS_ALLOWED_ORIGINS was empty
(the default). An operator who restricts CORS to their own frontend would silently
break NIP-05 resolution for every other domain/wallet — federation dies for that
instance with no error.

Split CORS into two route groups: the public surface (well-known + health + landing)
always serves `*`; the /api/v1 surface keeps the operator's configurable policy. The
API's CORS behavior is unchanged (it still gets the same `cors` layer); only the
public directory is now unconditionally cross-origin. cargo check clean.

2026-07-08 08:58:50 -04:00

..

api

security(auth): make gated registration fully atomic (F3/F4 fast-follow)

2026-07-06 05:58:04 -04:00

bin

feat(admin): migrate-legacy — import v0.2.x user identity into v0.3

2026-07-02 13:49:45 -04:00

core

fix(auth): canonicalize verified Nostr pubkey + harden the link/login grade

2026-07-02 05:43:20 -04:00

infra

feat(relay): operator write-allowlist (owner/announcements exemption)

2026-07-07 04:56:55 -04:00

models

feat(erasure): self-service account erasure + export [operator §5]

2026-06-27 20:43:10 -04:00

config.rs

feat(relay): operator write-allowlist (owner/announcements exemption)

2026-07-07 04:56:55 -04:00

error.rs

security(auth): harden registration/identity against verified review findings

2026-07-06 04:23:11 -04:00

lib.rs

fix(nip05): always serve the well-known directory with CORS * (federation)

2026-07-08 08:58:50 -04:00

main.rs

fix(relay): harden admission (fail-safe, loopback-only, bounded, size cap) [review]

2026-07-02 08:35:37 -04:00