basic kind validation policy.

README.md

@@ -69,6 +69,11 @@ func main() {
 
 	// there are many other configurable things you can set
 	relay.RejectEvent = append(relay.RejectEvent,
+		// built-in policies
+		policies.ValidateKind,
+
+		// define your own policies
+		policies.PreventLargeTags(80),
 		func(ctx context.Context, event *nostr.Event) (reject bool, msg string) {
 			if event.PubKey == "fa984bd7dbb282f07e16e7ae87b26a2a7b9b90b7246a44771f0cf5ae58018f52" {
 				return true, "we don't allow this person to write here"
@@ -79,6 +84,10 @@ func main() {
 
 	// you can request auth by rejecting an event or a request with the prefix "auth-required: "
 	relay.RejectFilter = append(relay.RejectFilter,
+		// built-in policies
+		policies.NoComplexFilters,
+
+		// define your own policies
 		func(ctx context.Context, filter nostr.Filter) (reject bool, msg string) {
 			if pubkey := khatru.GetAuthed(ctx); pubkey != "" {
 				log.Printf("request from %s\n", pubkey)

examples/basic-elasticsearch/main.go

@@ -4,8 +4,8 @@ import (
 	"fmt"
 	"net/http"
 
-	"github.com/fiatjaf/khatru"
 	"github.com/fiatjaf/eventstore/elasticsearch"
+	"github.com/fiatjaf/khatru"
 )
 
 func main() {

examples/basic-postgres/main.go

@@ -4,8 +4,8 @@ import (
 	"fmt"
 	"net/http"
 
-	"github.com/fiatjaf/khatru"
 	"github.com/fiatjaf/eventstore/postgresql"
+	"github.com/fiatjaf/khatru"
 )
 
 func main() {

examples/basic-sqlite3/main.go

@@ -4,8 +4,8 @@ import (
 	"fmt"
 	"net/http"
 
-	"github.com/fiatjaf/khatru"
 	"github.com/fiatjaf/eventstore/sqlite3"
+	"github.com/fiatjaf/khatru"
 )
 
 func main() {

examples/readme-demo/main.go

@@ -7,6 +7,7 @@ import (
 	"net/http"
 
 	"github.com/fiatjaf/khatru"
+	"github.com/fiatjaf/khatru/policies"
 	"github.com/nbd-wtf/go-nostr"
 )
 
@@ -53,6 +54,11 @@ func main() {
 
 	// there are many other configurable things you can set
 	relay.RejectEvent = append(relay.RejectEvent,
+		// built-in policies
+		policies.ValidateKind,
+
+		// define your own policies
+		policies.PreventLargeTags(80),
 		func(ctx context.Context, event *nostr.Event) (reject bool, msg string) {
 			if event.PubKey == "fa984bd7dbb282f07e16e7ae87b26a2a7b9b90b7246a44771f0cf5ae58018f52" {
 				return true, "we don't allow this person to write here"
@@ -63,6 +69,10 @@ func main() {
 
 	// you can request auth by rejecting an event or a request with the prefix "auth-required: "
 	relay.RejectFilter = append(relay.RejectFilter,
+		// built-in policies
+		policies.NoComplexFilters,
+
+		// define your own policies
 		func(ctx context.Context, filter nostr.Filter) (reject bool, msg string) {
 			if pubkey := khatru.GetAuthed(ctx); pubkey != "" {
 				log.Printf("request from %s\n", pubkey)

go.mod

@@ -9,7 +9,6 @@ require (
 	github.com/puzpuzpuz/xsync/v3 v3.0.2
 	github.com/rs/cors v1.7.0
 	github.com/sebest/xff v0.0.0-20210106013422-671bd2870b3a
-	golang.org/x/exp v0.0.0-20231006140011-7918f672742d
 )
 
 require (
@@ -51,6 +50,7 @@ require (
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fasthttp v1.51.0 // indirect
 	go.opencensus.io v0.24.0 // indirect
+	golang.org/x/exp v0.0.0-20231006140011-7918f672742d // indirect
 	golang.org/x/net v0.18.0 // indirect
 	golang.org/x/sys v0.14.0 // indirect
 	google.golang.org/protobuf v1.31.0 // indirect

handlers.go

@@ -134,6 +134,31 @@ func (rl *Relay) HandleWebsocket(w http.ResponseWriter, r *http.Request) {
 						return
 					}
 
+					// check NIP-70 protected
+					for _, v := range env.Event.Tags {
+						if len(v) == 1 && v[0] == "-" {
+							msg := "must be published by event author"
+							authed := GetAuthed(ctx)
+							if authed == "" {
+								RequestAuth(ctx)
+								ws.WriteJSON(nostr.OKEnvelope{
+									EventID: env.Event.ID,
+									OK:      false,
+									Reason:  "auth-required: " + msg,
+								})
+								return
+							}
+							if authed != env.Event.PubKey {
+								ws.WriteJSON(nostr.OKEnvelope{
+									EventID: env.Event.ID,
+									OK:      false,
+									Reason:  "blocked: " + msg,
+								})
+								return
+							}
+						}
+					}
+
 					var ok bool
 					var writeErr error
 					if env.Event.Kind == 5 {

policies/events.go

@@ -3,8 +3,9 @@ package policies
 import (
 	"context"
 
+	"slices"
+
 	"github.com/nbd-wtf/go-nostr"
-	"golang.org/x/exp/slices"
 )
 
 // PreventTooManyIndexableTags returns a function that can be used as a RejectFilter that will reject

policies/filters.go

@@ -3,8 +3,9 @@ package policies
 import (
 	"context"
 
+	"slices"
+
 	"github.com/nbd-wtf/go-nostr"
-	"golang.org/x/exp/slices"
 )
 
 // NoComplexFilters disallows filters with more than 2 tags.
@@ -45,7 +46,10 @@ func NoSearchQueries(ctx context.Context, filter nostr.Filter) (reject bool, msg
 }
 
 func RemoveSearchQueries(ctx context.Context, filter *nostr.Filter) {
-	filter.Search = ""
+	if filter.Search != "" {
+		filter.Search = ""
+		filter.Limit = -1 // signals that this query should be just skipped
+	}
 }
 
 func RemoveAllButKinds(kinds ...uint16) func(context.Context, *nostr.Filter) {
@@ -58,15 +62,23 @@ func RemoveAllButKinds(kinds ...uint16) func(context.Context, *nostr.Filter) {
 				}
 			}
 			filter.Kinds = newKinds
+			if len(filter.Kinds) == 0 {
+				filter.Limit = -1 // signals that this query should be just skipped
+			}
 		}
 	}
 }
 
 func RemoveAllButTags(tagNames ...string) func(context.Context, *nostr.Filter) {
 	return func(ctx context.Context, filter *nostr.Filter) {
-		for tagName := range filter.Tags {
-			if !slices.Contains(tagNames, tagName) {
-				delete(filter.Tags, tagName)
+		if n := len(filter.Tags); n > 0 {
+			for tagName := range filter.Tags {
+				if !slices.Contains(tagNames, tagName) {
+					delete(filter.Tags, tagName)
+				}
+			}
+			if len(filter.Tags) == 0 {
+				filter.Limit = -1 // signals that this query should be just skipped
 			}
 		}
 	}

policies/kind_validation.go

@@ -0,0 +1,29 @@
+package policies
+
+import (
+	"context"
+	"encoding/json"
+
+	"github.com/nbd-wtf/go-nostr"
+)
+
+func ValidateKind(ctx context.Context, evt *nostr.Event) (bool, string) {
+	switch evt.Kind {
+	case 0:
+		var m struct {
+			Name string `json:"name"`
+		}
+		json.Unmarshal([]byte(evt.Content), &m)
+		if m.Name == "" {
+			return true, "missing json name in kind 0"
+		}
+	case 1:
+		return false, ""
+	case 2:
+		return true, "this kind has been deprecated"
+	}
+
+	// TODO: all other kinds
+
+	return false, ""
+}

policies/nip04.go

@@ -3,9 +3,10 @@ package policies
 import (
 	"context"
 
+	"slices"
+
 	"github.com/fiatjaf/khatru"
 	"github.com/nbd-wtf/go-nostr"
-	"golang.org/x/exp/slices"
 )
 
 // RejectKind04Snoopers prevents reading NIP-04 messages from people not involved in the conversation.

relay.go

@@ -20,7 +20,7 @@ func NewRelay() *Relay {
 		Info: &nip11.RelayInformationDocument{
 			Software:      "https://github.com/fiatjaf/khatru",
 			Version:       "n/a",
-			SupportedNIPs: make([]int, 0),
+			SupportedNIPs: []int{1, 11, 70},
 		},
 
 		upgrader: websocket.Upgrader{