preparing to build grasp-audit against git-relay

1 files changed, 577 insertions, 0 deletions

diff --git a/grasp-audit/src/specs/grasp01_nostr_relay.rs b/grasp-audit/src/specs/grasp01_nostr_relay.rs
new file mode 100644
index 0000000..1d1de79
--- /dev/null
+++ b/grasp-audit/src/specs/grasp01_nostr_relay.rs
@@ -0,0 +1,577 @@
+//! GRASP-01 Nostr Relay Tests
+//!
+//! Tests for GRASP-01 Nostr relay requirements (lines 1-14 of ../grasp/01.md)
+//!
+//! These tests validate that a GRASP-01 compliant relay:
+//! - Accepts valid NIP-34 repository announcements and state announcements
+//! - Rejects announcements that don't list the service
+//! - Accepts related events (issues, patches, PRs)
+//! - Serves proper NIP-11 relay information document
+
+use crate::{AuditClient, AuditResult, TestResult};
+use nostr_sdk::prelude::*;
+
+pub struct Grasp01NostrRelayTests;
+
+impl Grasp01NostrRelayTests {
+    /// Run all GRASP-01 Nostr relay tests
+    pub async fn run_all(client: &AuditClient) -> AuditResult {
+        let mut results = AuditResult::new("GRASP-01 Nostr Relay Tests");
+        
+        // Repository announcement acceptance tests
+        results.add(Self::test_accept_valid_repo_announcement(client).await);
+        results.add(Self::test_reject_repo_announcement_missing_clone_tag(client).await);
+        results.add(Self::test_reject_repo_announcement_missing_relays_tag(client).await);
+        
+        // Repository state announcement tests
+        results.add(Self::test_accept_valid_repo_state_announcement(client).await);
+        results.add(Self::test_accept_state_announcement_multiple_refs(client).await);
+        results.add(Self::test_accept_state_announcement_no_refs(client).await);
+        
+        // Related event acceptance tests
+        results.add(Self::test_accept_event_tagging_repo_announcement(client).await);
+        results.add(Self::test_accept_event_tagged_by_repo(client).await);
+        results.add(Self::test_accept_patch_for_repo(client).await);
+        results.add(Self::test_accept_pull_request_for_repo(client).await);
+        results.add(Self::test_accept_issue_for_repo(client).await);
+        results.add(Self::test_accept_reply_to_issue(client).await);
+        
+        // NIP-11 relay information tests
+        results.add(Self::test_nip11_document_exists(client).await);
+        results.add(Self::test_nip11_supported_grasps_field(client).await);
+        results.add(Self::test_nip11_repo_acceptance_criteria_field(client).await);
+        results.add(Self::test_nip11_curation_field(client).await);
+        
+        // Policy tests (document behavior)
+        results.add(Self::test_custom_rejection_allowed(client).await);
+        results.add(Self::test_spam_prevention_allowed(client).await);
+        
+        results
+    }
+    
+    // =========================================================================
+    // Repository Announcement Acceptance Tests
+    // =========================================================================
+    
+    /// Test: Accept valid repository announcements
+    ///
+    /// Spec: Lines 3-5 of ../grasp/01.md
+    /// Requirement: MUST accept repo announcements listing service in clone & relays tags
+    async fn test_accept_valid_repo_announcement(client: &AuditClient) -> TestResult {
+        TestResult::new(
+            "accept_valid_repo_announcement",
+            "GRASP-01:nostr-relay:3-5",
+            "Accept valid repository announcements with service in clone and relays tags",
+        )
+        .run(|| async {
+            // TODO: Implementation
+            // 1. Get service URL from client config
+            // 2. Create kind 30617 event with:
+            //    - d tag: "test-repo-{timestamp}"
+            //    - name tag: "Test Repository"
+            //    - description tag: "Test repository for GRASP-01 compliance"
+            //    - clone tag: "{service_url}/{npub}/test-repo.git"
+            //    - relays tag: "{service_ws_url}"
+            // 3. Send event to relay
+            // 4. Verify OK response (not rejected)
+            // 5. Query back with filter on kind 30617, author, d tag
+            // 6. Verify event is stored and matches what we sent
+            
+            Err("Not implemented yet".to_string())
+        })
+        .await
+    }
+    
+    /// Test: Reject repo announcements not listing service in clone tag
+    ///
+    /// Spec: Line 5 of ../grasp/01.md
+    /// Requirement: MUST reject announcements not listing service (unless GRASP-05)
+    async fn test_reject_repo_announcement_missing_clone_tag(client: &AuditClient) -> TestResult {
+        TestResult::new(
+            "reject_repo_announcement_missing_clone_tag",
+            "GRASP-01:nostr-relay:5",
+            "Reject repository announcements without service in clone tag",
+        )
+        .run(|| async {
+            // TODO: Implementation
+            // 1. Create kind 30617 event with:
+            //    - d tag: "test-repo-no-clone"
+            //    - clone tag: "https://github.com/user/repo.git" (NOT this service)
+            //    - relays tag: "{service_url}" (correct)
+            // 2. Send event to relay
+            // 3. Verify rejection (error in OK response or event not stored)
+            // 4. Query to confirm event is NOT in relay
+            // 5. Document expected error message if available
+            
+            Err("Not implemented yet".to_string())
+        })
+        .await
+    }
+    
+    /// Test: Reject repo announcements not listing service in relays tag
+    ///
+    /// Spec: Line 5 of ../grasp/01.md
+    /// Requirement: MUST reject announcements not listing service in relays
+    async fn test_reject_repo_announcement_missing_relays_tag(client: &AuditClient) -> TestResult {
+        TestResult::new(
+            "reject_repo_announcement_missing_relays_tag",
+            "GRASP-01:nostr-relay:5",
+            "Reject repository announcements without service in relays tag",
+        )
+        .run(|| async {
+            // TODO: Implementation
+            // 1. Create kind 30617 event with:
+            //    - d tag: "test-repo-no-relays"
+            //    - clone tag: "{service_url}/{npub}/test-repo.git" (correct)
+            //    - relays tag: "wss://relay.damus.io" (NOT this service)
+            // 2. Send event to relay
+            // 3. Verify rejection
+            // 4. Query to confirm event is NOT in relay
+            
+            Err("Not implemented yet".to_string())
+        })
+        .await
+    }
+    
+    // =========================================================================
+    // Repository State Announcement Tests
+    // =========================================================================
+    
+    /// Test: Accept valid repository state announcements
+    ///
+    /// Spec: Line 3 of ../grasp/01.md
+    /// Requirement: MUST accept repo state announcements
+    async fn test_accept_valid_repo_state_announcement(client: &AuditClient) -> TestResult {
+        TestResult::new(
+            "accept_valid_repo_state_announcement",
+            "GRASP-01:nostr-relay:3",
+            "Accept valid repository state announcements",
+        )
+        .run(|| async {
+            // TODO: Implementation
+            // 1. First send valid kind 30617 (repo announcement) - prerequisite
+            // 2. Create kind 30618 event with:
+            //    - d tag: same as repo announcement
+            //    - refs/heads/main tag: "{commit-sha}"
+            //    - HEAD tag: "ref: refs/heads/main"
+            // 3. Send state announcement
+            // 4. Verify acceptance
+            // 5. Query back to confirm stored
+            // 6. Verify all tags are preserved
+            
+            Err("Not implemented yet".to_string())
+        })
+        .await
+    }
+    
+    /// Test: Accept state announcement with multiple refs
+    ///
+    /// Spec: Line 3 of ../grasp/01.md
+    /// Requirement: MUST accept state announcements with multiple refs
+    async fn test_accept_state_announcement_multiple_refs(client: &AuditClient) -> TestResult {
+        TestResult::new(
+            "accept_state_announcement_multiple_refs",
+            "GRASP-01:nostr-relay:3",
+            "Accept state announcements with multiple branch and tag refs",
+        )
+        .run(|| async {
+            // TODO: Implementation
+            // 1. Send valid kind 30617 repo announcement
+            // 2. Create kind 30618 with multiple refs:
+            //    - refs/heads/main: "{commit-sha-1}"
+            //    - refs/heads/develop: "{commit-sha-2}"
+            //    - refs/tags/v1.0.0: "{commit-sha-3}"
+            //    - refs/tags/v2.0.0: "{commit-sha-4}"
+            //    - HEAD: "ref: refs/heads/main"
+            // 3. Send and verify acceptance
+            // 4. Query back and verify all refs are stored
+            
+            Err("Not implemented yet".to_string())
+        })
+        .await
+    }
+    
+    /// Test: Accept state announcement with no refs (stop tracking)
+    ///
+    /// Spec: NIP-34 repository state announcements
+    /// Requirement: Support stopping state tracking by sending event with no refs
+    async fn test_accept_state_announcement_no_refs(client: &AuditClient) -> TestResult {
+        TestResult::new(
+            "accept_state_announcement_no_refs",
+            "GRASP-01:nostr-relay:3",
+            "Accept state announcements with no refs (stop tracking)",
+        )
+        .run(|| async {
+            // TODO: Implementation
+            // 1. Send valid kind 30617 repo announcement
+            // 2. Send kind 30618 with refs (establish state)
+            // 3. Send kind 30618 with ONLY d tag (no refs)
+            // 4. Verify acceptance (allows author to stop tracking)
+            // 5. Query to confirm latest state has no refs
+            
+            Err("Not implemented yet".to_string())
+        })
+        .await
+    }
+    
+    // =========================================================================
+    // Related Event Acceptance Tests
+    // =========================================================================
+    
+    /// Test: Accept events tagging accepted repo announcements
+    ///
+    /// Spec: Lines 7-9 of ../grasp/01.md
+    /// Requirement: MUST accept events that tag accepted repo announcements
+    async fn test_accept_event_tagging_repo_announcement(client: &AuditClient) -> TestResult {
+        TestResult::new(
+            "accept_event_tagging_repo_announcement",
+            "GRASP-01:nostr-relay:7-9",
+            "Accept events that tag accepted repository announcements",
+        )
+        .run(|| async {
+            // TODO: Implementation
+            // 1. Create and send kind 30617 repo announcement
+            // 2. Create kind 1621 (issue) event with:
+            //    - a tag: "30617:{pubkey}:{d-tag}"
+            //    - p tag: repo owner pubkey
+            //    - subject tag: "Test Issue"
+            //    - content: "This is a test issue"
+            // 3. Send issue event
+            // 4. Verify acceptance
+            // 5. Query to confirm issue is stored
+            
+            Err("Not implemented yet".to_string())
+        })
+        .await
+    }
+    
+    /// Test: Accept events tagged by repo announcements
+    ///
+    /// Spec: Lines 7-9 of ../grasp/01.md
+    /// Requirement: MUST accept events tagged by accepted announcements
+    async fn test_accept_event_tagged_by_repo(client: &AuditClient) -> TestResult {
+        TestResult::new(
+            "accept_event_tagged_by_repo",
+            "GRASP-01:nostr-relay:7-9",
+            "Accept events that are tagged by accepted repository announcements",
+        )
+        .run(|| async {
+            // TODO: Implementation
+            // 1. Create kind 1 note event (regular note)
+            // 2. Send the note
+            // 3. Create kind 30617 repo announcement that tags the note
+            //    - Include e tag pointing to note event ID
+            // 4. Send repo announcement
+            // 5. Verify both events are stored
+            // 6. This tests that related events are retained
+            
+            Err("Not implemented yet".to_string())
+        })
+        .await
+    }
+    
+    /// Test: Accept patches (kind 1617) for accepted repos
+    ///
+    /// Spec: Lines 8-9 of ../grasp/01.md
+    /// Requirement: MUST accept patches for accepted repos
+    async fn test_accept_patch_for_repo(client: &AuditClient) -> TestResult {
+        TestResult::new(
+            "accept_patch_for_repo",
+            "GRASP-01:nostr-relay:8-9",
+            "Accept patch events (kind 1617) for accepted repositories",
+        )
+        .run(|| async {
+            // TODO: Implementation
+            // 1. Create and send kind 30617 repo announcement
+            // 2. Create kind 1617 patch event with:
+            //    - a tag: "30617:{pubkey}:{d-tag}"
+            //    - p tag: repo owner
+            //    - r tag: earliest-unique-commit-id
+            //    - t tag: "root" (first patch in series)
+            //    - content: actual git format-patch output
+            // 3. Send patch event
+            // 4. Verify acceptance
+            // 5. Query to confirm patch is stored
+            
+            Err("Not implemented yet".to_string())
+        })
+        .await
+    }
+    
+    /// Test: Accept pull requests (kind 1618) for accepted repos
+    ///
+    /// Spec: Lines 8-9 of ../grasp/01.md
+    /// Requirement: MUST accept PRs for accepted repos
+    async fn test_accept_pull_request_for_repo(client: &AuditClient) -> TestResult {
+        TestResult::new(
+            "accept_pull_request_for_repo",
+            "GRASP-01:nostr-relay:8-9",
+            "Accept pull request events (kind 1618) for accepted repositories",
+        )
+        .run(|| async {
+            // TODO: Implementation
+            // 1. Create and send kind 30617 repo announcement
+            // 2. Create kind 1618 PR event with:
+            //    - a tag: "30617:{pubkey}:{d-tag}"
+            //    - p tag: repo owner
+            //    - r tag: earliest-unique-commit-id
+            //    - subject tag: "Add feature X"
+            //    - c tag: commit SHA of PR tip
+            //    - clone tag: URL where commit can be fetched
+            //    - content: PR description
+            // 3. Send PR event
+            // 4. Verify acceptance
+            // 5. Query to confirm PR is stored
+            
+            Err("Not implemented yet".to_string())
+        })
+        .await
+    }
+    
+    /// Test: Accept issues (kind 1621) for accepted repos
+    ///
+    /// Spec: Lines 8-9 of ../grasp/01.md
+    /// Requirement: MUST accept issues for accepted repos
+    async fn test_accept_issue_for_repo(client: &AuditClient) -> TestResult {
+        TestResult::new(
+            "accept_issue_for_repo",
+            "GRASP-01:nostr-relay:8-9",
+            "Accept issue events (kind 1621) for accepted repositories",
+        )
+        .run(|| async {
+            // TODO: Implementation
+            // 1. Create and send kind 30617 repo announcement
+            // 2. Create kind 1621 issue event with:
+            //    - a tag: "30617:{pubkey}:{d-tag}"
+            //    - p tag: repo owner
+            //    - subject tag: "Bug: Something is broken"
+            //    - t tag: "bug" (label)
+            //    - content: issue description
+            // 3. Send issue event
+            // 4. Verify acceptance
+            // 5. Query to confirm issue is stored
+            
+            Err("Not implemented yet".to_string())
+        })
+        .await
+    }
+    
+    /// Test: Accept replies to accepted patches/PRs/issues
+    ///
+    /// Spec: Lines 8-9 of ../grasp/01.md
+    /// Requirement: MUST accept replies to accepted events
+    async fn test_accept_reply_to_issue(client: &AuditClient) -> TestResult {
+        TestResult::new(
+            "accept_reply_to_issue",
+            "GRASP-01:nostr-relay:8-9",
+            "Accept reply events to accepted issues/patches/PRs",
+        )
+        .run(|| async {
+            // TODO: Implementation
+            // 1. Create and send kind 30617 repo announcement
+            // 2. Create and send kind 1621 issue
+            // 3. Create NIP-22 comment (kind 1111) replying to issue:
+            //    - E tag: issue event ID
+            //    - P tag: issue author
+            //    - content: reply text
+            // 4. Send reply event
+            // 5. Verify acceptance
+            // 6. Query to confirm reply is stored
+            
+            Err("Not implemented yet".to_string())
+        })
+        .await
+    }
+    
+    // =========================================================================
+    // NIP-11 Relay Information Tests
+    // =========================================================================
+    
+    /// Test: Serve NIP-11 document
+    ///
+    /// Spec: Line 11 of ../grasp/01.md
+    /// Requirement: MUST serve NIP-11 document
+    async fn test_nip11_document_exists(client: &AuditClient) -> TestResult {
+        TestResult::new(
+            "nip11_document_exists",
+            "GRASP-01:nostr-relay:11",
+            "Serve NIP-11 relay information document",
+        )
+        .run(|| async {
+            // TODO: Implementation
+            // 1. Extract HTTP(S) URL from client's WebSocket URL
+            //    - ws://localhost:8081 -> http://localhost:8081
+            //    - wss://relay.example.com -> https://relay.example.com
+            // 2. HTTP GET to base URL with header:
+            //    - Accept: application/nostr+json
+            // 3. Verify 200 OK response
+            // 4. Verify response is valid JSON
+            // 5. Parse as NIP-11 document
+            // 6. Verify has required fields (name, description, etc.)
+            
+            Err("Not implemented yet".to_string())
+        })
+        .await
+    }
+    
+    /// Test: NIP-11 includes supported_grasps field
+    ///
+    /// Spec: Line 12 of ../grasp/01.md
+    /// Requirement: MUST list supported GRASPs as string array
+    async fn test_nip11_supported_grasps_field(client: &AuditClient) -> TestResult {
+        TestResult::new(
+            "nip11_supported_grasps_field",
+            "GRASP-01:nostr-relay:12",
+            "NIP-11 document includes supported_grasps field with GRASP-01",
+        )
+        .run(|| async {
+            // TODO: Implementation
+            // 1. Fetch NIP-11 document (same as above)
+            // 2. Verify `supported_grasps` field exists
+            // 3. Verify it's a JSON array of strings
+            // 4. Verify array includes "GRASP-01"
+            // 5. Verify format: each entry matches pattern "GRASP-\d{2}"
+            // 6. Document other GRASPs found (for info)
+            
+            Err("Not implemented yet".to_string())
+        })
+        .await
+    }
+    
+    /// Test: NIP-11 includes repo_acceptance_criteria field
+    ///
+    /// Spec: Line 13 of ../grasp/01.md
+    /// Requirement: MUST list repository acceptance criteria
+    async fn test_nip11_repo_acceptance_criteria_field(client: &AuditClient) -> TestResult {
+        TestResult::new(
+            "nip11_repo_acceptance_criteria_field",
+            "GRASP-01:nostr-relay:13",
+            "NIP-11 document includes repo_acceptance_criteria field",
+        )
+        .run(|| async {
+            // TODO: Implementation
+            // 1. Fetch NIP-11 document
+            // 2. Verify `repo_acceptance_criteria` field exists
+            // 3. Verify it's a string (human-readable)
+            // 4. Verify non-empty
+            // 5. Document the criteria (for info)
+            // Examples: "Must list this relay in clone and relays tags"
+            //           "Pre-payment required via Lightning invoice"
+            
+            Err("Not implemented yet".to_string())
+        })
+        .await
+    }
+    
+    /// Test: NIP-11 curation field handling
+    ///
+    /// Spec: Line 14 of ../grasp/01.md
+    /// Requirement: MUST include curation if curated, omit otherwise
+    async fn test_nip11_curation_field(client: &AuditClient) -> TestResult {
+        TestResult::new(
+            "nip11_curation_field",
+            "GRASP-01:nostr-relay:14",
+            "NIP-11 curation field present if curated, absent otherwise",
+        )
+        .run(|| async {
+            // TODO: Implementation
+            // 1. Fetch NIP-11 document
+            // 2. Check if `curation` field exists
+            // 3. If present:
+            //    - Verify it's a non-empty string
+            //    - Document the curation policy
+            // 4. If absent:
+            //    - Document that no curation beyond SPAM prevention
+            // 5. Both cases are valid per spec
+            
+            Err("Not implemented yet".to_string())
+        })
+        .await
+    }
+    
+    // =========================================================================
+    // Policy Tests (Document Allowed Behavior)
+    // =========================================================================
+    
+    /// Test: Custom rejection criteria allowed
+    ///
+    /// Spec: Line 6 of ../grasp/01.md
+    /// Requirement: MAY reject based on custom criteria (document behavior)
+    async fn test_custom_rejection_allowed(client: &AuditClient) -> TestResult {
+        TestResult::new(
+            "custom_rejection_allowed",
+            "GRASP-01:nostr-relay:6",
+            "Document that custom rejection criteria are allowed",
+        )
+        .run(|| async {
+            // TODO: Implementation
+            // This is a policy test, not a functional test
+            // 
+            // The spec says relay MAY reject based on:
+            // - Pre-payment
+            // - Quotas
+            // - WoT (Web of Trust)
+            // - Whitelist
+            // - SPAM prevention
+            // - etc.
+            //
+            // This test should:
+            // 1. Document that such rejections are allowed
+            // 2. Check NIP-11 repo_acceptance_criteria for policy
+            // 3. Optionally test if relay enforces any criteria
+            // 4. Mark as PASS (this is permissive, not mandatory)
+            
+            Ok(())  // This is always allowed
+        })
+        .await
+    }
+    
+    /// Test: SPAM prevention allowed
+    ///
+    /// Spec: Line 10 of ../grasp/01.md
+    /// Requirement: MAY reject/delete for SPAM prevention
+    async fn test_spam_prevention_allowed(client: &AuditClient) -> TestResult {
+        TestResult::new(
+            "spam_prevention_allowed",
+            "GRASP-01:nostr-relay:10",
+            "Document that SPAM prevention is allowed",
+        )
+        .run(|| async {
+            // TODO: Implementation
+            // Similar to above - this is permissive
+            //
+            // The spec says relay MAY reject or delete events for:
+            // - Generic SPAM prevention
+            // - Curation (WoT, whitelist, user bans, banned topics)
+            //
+            // This test should:
+            // 1. Document that SPAM prevention is allowed
+            // 2. Check NIP-11 curation field for policy
+            // 3. Mark as PASS (this is implementation-specific)
+            
+            Ok(())  // This is always allowed
+        })
+        .await
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::AuditConfig;
+    
+    #[tokio::test]
+    #[ignore] // Requires running relay
+    async fn test_grasp01_nostr_relay_against_relay() {
+        let config = AuditConfig::ci();
+        let client = AuditClient::new("ws://localhost:8081", config)
+            .await
+            .expect("Failed to connect to relay");
+        
+        let results = Grasp01NostrRelayTests::run_all(&client).await;
+        results.print_report();
+        
+        // Don't assert all passed yet - tests not implemented
+        // assert!(results.all_passed(), "Some GRASP-01 Nostr relay tests failed");
+    }
+}