web: join-by-address — one input, no second machine (phone join without NIP-07 + canonical-origin signing)

[loviswaternakamoto]

What

A stranger with only a phone and the relay address joins the community in the browser — no app install, no NIP-07 extension, no desktop to pair against, no invite code handed over by a member.

• /join — the one-input join page. Paste the relay address → the community's pairing material is read from the relay's own origin (join.json, see below) → the standing invite is claimed with a key made on the phone → a phone-first room view opens on the live wire (NIP-42 AUTH → NIP-29 shape: kind 9, #h = channel id): history, composer, relay verdicts rendered verbatim. No material published → a plain refusal, never a guess (fail-closed).
• Persistent browser-local identity (shared/lib/local-identity): generated once, stored locally, exportable as nsec, honestly labeled in the UI. signNostrEvent gains an optional secretKey path, so durable membership no longer requires an extension — requireNip07 flows are unchanged and NIP-07 stays preferred whenever present. (The extension gate existed because the old fallback key was page-lifetime; a persistent local key closes that gap without weakening anything.)
• Canonical-origin signing law (bug-grade for alias-host deployments). NIP-98 u tags and NIP-42 relay tags must name the community's canonical origin as the relay declares it (NIP-11 /info → push.origin), while transport rides the road the user was given. On a deployment behind an alias host this is the difference between a 401 URL mismatch and a working join — the same mismatch will bite any client that signs against the alias it dialed.

The join.json convention (operator-gated by construction)

Communities that want join-by-address serve, from the relay's origin:

{
  "v": 1,
  "community": { "host": "example.com", "name": "Example" },
  "invite_url": "/invite/v2.…",
  "default_channel": { "id": "channel-uuid", "name": "general" },
  "note": "optional human line"
}

An operator who has not published it simply has none — the client fails closed. The file may be served by the relay or by any static file server on the origin (we serve it from the edge proxy); Access-Control-Allow-Origin: * lets any hosted join page resolve any relay address. Minting rules (TTL ≤ 30 days, ≤ 10 000 uses) are unchanged — a standing invite is an operator's choice to spend them publicly.

Proof (live, stock buzz-relay 0.2.1, no server changes)

Cold 390 px phone context, no extension, address typed by hand against a members-only community behind an alias host (relay.skaists.dev ⇄ skaists.buzz, host-rewritten at the edge):

• fresh key generated on the phone → POST /api/invites/claim signed with the canonical origin → 200 {status:"joined", role:"member"}
• NIP-42 AUTH (relay tag = canonical origin) → OK true → REQ {kinds:[9], "#h":[…], limit} → history rendered, EOSE, live
• message sent from the phone and received back through the subscription
• an address whose origin publishes no material → refused in plain words, nothing guessed

Checks: pnpm check (biome + file-size + pubkey-truncation), tsc --noEmit, vite build — all green.

Scope notes

Server-side intentionally untouched: this is client capability plus a convention. A relay-native /api/join that mints/exposes the standing invite would remove the static-file step and make a nice follow-up; the client already prefers whatever the origin serves.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is f038cbbb0d4092a72ffd93f17916f84d2b39bb43...5dc78307cc6892c8b12acd3bc45ac357984fc6bd.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 5dc78307cc6892c8b12acd3bc45ac357984fc6bd to authorize a new review.
Any previous review applies only to its recorded range.

[loviswaternakamoto]

Pushed two founder-phone findings to this branch (256b4b4):

1. NEVER SEND A SECRET — a channel message is a broadcast, and a bech32 secret cannot be unsent.

• Relay side (defense in depth): kind 9 content carrying a real-shape secret token is refused before ingest, in plain words. The match is the token shape (prefix + ≥15 bech32 digits — a real nsec is ~63), so ordinary words that merely contain the prefix pass. 3 unit tests; proven live end-to-end on a throwaway stack (fresh owner mints → fresh member claims → NIP-42 → the nsec post returns OK false with the refusal; GUARD_VERDICT=PROVEN).
• Client side: the composer refuses the same shape before signing, keeps the draft with a clear-the-draft action, and the substring trap sends normally (precision proven on a live hive). The copy-the-secret control moved off the composer into its own sheet (opened from the header) with the never-paste warning beside the copy button.

2. Room switcher for the phone view — join.json gains an optional operator-curated rooms: [{id, name}]; malformed rooms refuse the whole material (fail-closed). The phone view renders rooms as chips under the header; switching resets the pane and re-opens the live socket on that channel; the join lands on the default room. Proven live: history read in two rooms.

Receipts at 390 px: nsec paste refused + draft kept; switcher reading two rooms; the key sheet.

[loviswaternakamoto]

Join by address, take two — the relay now SERVES the join material itself. New in this push: (1) relay: kind 34550 (NIP-29 community-definition) as the owner-signed join-material event — admin-scoped to publish, community-global, d-tag replaceable — and the one unauthenticated read: a REQ pinned to exactly kinds:[34550] is served pre-AUTH behind a fail-closed shape guard (unit-tested), so a client holding nothing but the wss:// URL can fetch it and join. (2) web: the join page fetches the event off the wire first, keeping join.json as the fallback for relays that have not published it (body[data-join-source] records the path). (3) mobile: the Add Community field now accepts a wss:// URL — join_by_address.dart fetches the event, mints the key in-pocket, claims the standing invite (NIP-98 u tag on the canonical url), and proves membership with a NIP-42 AUTH OK. Proven live end-to-end on our rehearsal stack: unauthenticated REQ → event → join → send+receive (390px e2e, all pass).

[loviswaternakamoto]

Correction on the mobile half (and it got simpler): the relay's web /join view already joins a room by address — it is the same flow our watch surface embeds verbatim (same relay, same origin, same localStorage identity — join once, every surface is the same member). So the phone-app change is now a LAUNCHER, not a client rebuild: a pasted wss:// URL opens https:///join/ in the browser; that view self-prefills when served by the relay, fetches the owner-signed kind-34550 join material off the wire, mints the key on-device, and joins. The Dart protocol port from the previous push is removed (5dc7830) — the web flow it duplicated is the one flow.