Blossom protocol implementation fixes.

servuscms · Jun 13, 2024 · df02d74 · df02d74
1 parent 3c2a1c5
commit df02d74
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 5 deletions.
diff --git a/admin/index.html b/admin/index.html
@@ -25,8 +25,13 @@
                 return `Nostr ${btoa(JSON.stringify(authEvent))}`;
             }
 
-            async function getBlossomAuthHeader(method) {
-                let authEvent = await getEvent(24242, "", [['t', method]]);
+            async function getBlossomAuthHeader(method, sha256) {
+                let expiration = new Date();
+                expiration.setDate(expiration.getDate() + 10); // 10 days from now
+                expiration = Math.trunc(expiration.valueOf() / 1000);
+                let content = `${method.charAt(0).toUpperCase()}${method.slice(1)} file`; // "Upload file" / "Delete file"
+                let tags = [['t', method], ['expiration', expiration.toString()], ['x', sha256]];
+                let authEvent = await getEvent(24242, content, tags);
                 return `Nostr ${btoa(JSON.stringify(authEvent))}`;
             }
 
@@ -168,10 +173,11 @@
             async function uploadFileBlossom(site) {
                 const endpoint = `${getBlossomBaseUrl(site.domain)}/upload`;
                 let fileInput = document.querySelector('#fileInput');
+                let sha256 = bytesToHex(new Uint8Array(await window.crypto.subtle.digest("SHA-256", await fileInput.files[0].arrayBuffer())));
                 const res = await fetch(new URL(endpoint), {
                     method: "PUT",
                     body: fileInput.files[0],
-                    headers: { authorization: await getBlossomAuthHeader('upload') },
+                    headers: { authorization: await getBlossomAuthHeader('upload', sha256) },
                 });
                 return (await res.json());
             }
@@ -181,7 +187,7 @@
                 await fetch(new URL(endpoint),
                     {
                         method: 'DELETE',
-                        headers: { authorization: await getBlossomAuthHeader('delete') }
+                        headers: { authorization: await getBlossomAuthHeader('delete', sha256) }
                     });
             }
         </script>

diff --git a/src/nostr.rs b/src/nostr.rs
@@ -170,10 +170,14 @@ impl Event {
         }
 
         let tags = self.get_tags_hash();
-        // TODO: check expiration
         if tags.get("t")? != method {
             return None;
         }
+        let expiration = tags.get("expiration")?;
+        let expiration = UNIX_EPOCH + Duration::from_secs(expiration.parse::<u64>().unwrap());
+        if expiration < now {
+            return None;
+        }
 
         Some(self.pubkey.to_owned())
     }