Implement relay naughty list feature

Add naughty list tracking for relays with persistent infrastructure issues
(DNS failures, TLS certificate errors, protocol violations) to reduce log
noise and provide better visibility via metrics.

Key features:
- Classify errors into naughty (persistent) vs transient (temporary)
- Track naughty relays with category, reason, and occurrence count
- Log WARN on first naughty occurrence, DEBUG on repeats
- Automatic expiration after 12 hours (configurable)
- Prometheus metrics for monitoring naughty relays by category
- Periodic cleanup task integrated with health checker

Components added:
- src/sync/naughty_list.rs: Core naughty list tracker with error classification
- NaughtyListTracker integration in RelayHealthTracker
- Connection error handling updates in sync manager
- Naughty list metrics (total by category, detailed info per relay)
- Config option for naughty_list_expiration_hours (default: 12)

Closes DNS lookup failures and TLS certificate errors tracking issues.

1 files changed, 546 insertions, 0 deletions

diff --git a/src/sync/naughty_list.rs b/src/sync/naughty_list.rs
new file mode 100644
index 0000000..311b9bb
--- /dev/null
+++ b/src/sync/naughty_list.rs
@@ -0,0 +1,546 @@
+//! Naughty List Tracker for Relays with Persistent Infrastructure Issues
+//!
+//! This module tracks relays with persistent configuration/infrastructure problems
+//! (DNS failures, TLS certificate errors, protocol violations) separately from
+//! transient network issues (timeouts, connection refused).
+//!
+//! ## Failure Classification
+//!
+//! **Naughty List (12-hour expiration, log WARN on first occurrence, DEBUG on repeat):**
+//! - `DnsLookupFailed`: Domain doesn't resolve or DNS errors
+//! - `TlsCertificateInvalid`: Certificate errors (expired, mismatch, self-signed)
+//! - `ProtocolError`: WebSocket/Nostr protocol violations
+//!
+//! **NOT Naughty (use existing HealthTracker backoff):**
+//! - Connection timeouts (could be network congestion)
+//! - Connection refused (could be temporary maintenance)
+//!
+//! ## Automatic Expiration
+//!
+//! Entries expire after 12 hours (configurable) to allow relays to recover from
+//! infrastructure issues. After expiration, the relay is automatically retried.
+
+use dashmap::DashMap;
+use std::time::Instant;
+
+/// Category of persistent relay failure that qualifies for the naughty list
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum NaughtyCategory {
+    /// DNS lookup failures (domain doesn't resolve)
+    DnsLookupFailed,
+    /// TLS certificate errors (expired, invalid, mismatch)
+    TlsCertificateInvalid,
+    /// WebSocket or Nostr protocol violations
+    ProtocolError,
+}
+
+impl NaughtyCategory {
+    /// Get string representation for metrics labels
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            NaughtyCategory::DnsLookupFailed => "dns_lookup_failed",
+            NaughtyCategory::TlsCertificateInvalid => "tls_certificate_invalid",
+            NaughtyCategory::ProtocolError => "protocol_error",
+        }
+    }
+}
+
+impl std::fmt::Display for NaughtyCategory {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}", self.as_str())
+    }
+}
+
+/// Naughty list entry for a relay with persistent issues
+#[derive(Debug, Clone)]
+pub struct NaughtyEntry {
+    /// Category of the persistent failure
+    pub category: NaughtyCategory,
+    /// Full error message
+    pub reason: String,
+    /// When this relay was first added to the naughty list
+    pub first_seen: Instant,
+    /// Most recent occurrence of the issue
+    pub last_seen: Instant,
+    /// Number of times we've seen this issue
+    pub occurrence_count: u32,
+}
+
+/// Tracks relays with persistent infrastructure/configuration issues
+///
+/// Separate from HealthTracker's backoff logic - this is specifically for
+/// relays with configuration problems that are unlikely to be fixed quickly.
+#[derive(Debug)]
+pub struct NaughtyListTracker {
+    /// Map of relay URL to naughty entry
+    entries: DashMap<String, NaughtyEntry>,
+    /// How many hours before removing a relay from the naughty list
+    expiration_hours: u64,
+}
+
+impl NaughtyListTracker {
+    /// Create a new NaughtyListTracker with the specified expiration time
+    ///
+    /// # Arguments
+    ///
+    /// * `expiration_hours` - Hours before a naughty entry expires (default: 12)
+    pub fn new(expiration_hours: u64) -> Self {
+        Self {
+            entries: DashMap::new(),
+            expiration_hours,
+        }
+    }
+
+    /// Create a new NaughtyListTracker with default 12-hour expiration
+    pub fn with_defaults() -> Self {
+        Self::new(12)
+    }
+
+    /// Classify an error string into a naughty category or return None for transient errors
+    ///
+    /// # Arguments
+    ///
+    /// * `error` - The error message string to classify
+    ///
+    /// # Returns
+    ///
+    /// - `Some(NaughtyCategory)` if the error indicates a persistent infrastructure issue
+    /// - `None` if the error is a transient network issue (use HealthTracker backoff)
+    pub fn classify_error(error: &str) -> Option<NaughtyCategory> {
+        let error_lower = error.to_lowercase();
+
+        // DNS lookup failures
+        if error_lower.contains("failed to lookup address")
+            || error_lower.contains("name or service not known")
+            || error_lower.contains("nodename nor servname provided")
+            || (error_lower.contains("dns") && !error_lower.contains("timeout"))
+        {
+            return Some(NaughtyCategory::DnsLookupFailed);
+        }
+
+        // TLS certificate errors
+        if error_lower.contains("certificate")
+            || error_lower.contains("ssl")
+            || error_lower.contains("tls")
+        {
+            // Exclude timeout errors that mention TLS
+            if !error_lower.contains("timeout") && !error_lower.contains("timed out") {
+                return Some(NaughtyCategory::TlsCertificateInvalid);
+            }
+        }
+
+        // Protocol errors
+        if error_lower.contains("websocket")
+            || error_lower.contains("protocol")
+            || error_lower.contains("invalid frame")
+        {
+            // Exclude connection errors
+            if !error_lower.contains("connection")
+                && !error_lower.contains("timeout")
+                && !error_lower.contains("refused")
+            {
+                return Some(NaughtyCategory::ProtocolError);
+            }
+        }
+
+        // Everything else is transient (timeouts, refused, etc.)
+        None
+    }
+
+    /// Record a naughty relay (adds new entry or updates existing)
+    ///
+    /// # Arguments
+    ///
+    /// * `relay_url` - The relay URL
+    /// * `category` - The naughty category
+    /// * `reason` - The full error message
+    ///
+    /// # Returns
+    ///
+    /// `true` if this is a new naughty entry (first occurrence), `false` if updating existing
+    pub fn record(&self, relay_url: &str, category: NaughtyCategory, reason: String) -> bool {
+        let now = Instant::now();
+
+        if let Some(mut entry) = self.entries.get_mut(relay_url) {
+            // Update existing entry
+            entry.last_seen = now;
+            entry.occurrence_count = entry.occurrence_count.saturating_add(1);
+            entry.reason = reason; // Update with latest error message
+            false
+        } else {
+            // Create new entry
+            self.entries.insert(
+                relay_url.to_string(),
+                NaughtyEntry {
+                    category,
+                    reason,
+                    first_seen: now,
+                    last_seen: now,
+                    occurrence_count: 1,
+                },
+            );
+            true
+        }
+    }
+
+    /// Check if a relay is on the naughty list (not expired)
+    ///
+    /// # Arguments
+    ///
+    /// * `relay_url` - The relay URL to check
+    ///
+    /// # Returns
+    ///
+    /// `true` if the relay is currently on the naughty list
+    pub fn is_naughty(&self, relay_url: &str) -> bool {
+        if let Some(entry) = self.entries.get(relay_url) {
+            let age = Instant::now().duration_since(entry.first_seen);
+            let expiration = std::time::Duration::from_secs(self.expiration_hours * 3600);
+            age < expiration
+        } else {
+            false
+        }
+    }
+
+    /// Get a naughty entry if it exists and hasn't expired
+    ///
+    /// # Arguments
+    ///
+    /// * `relay_url` - The relay URL to look up
+    ///
+    /// # Returns
+    ///
+    /// A cloned `NaughtyEntry` if the relay is on the naughty list and not expired
+    pub fn get_entry(&self, relay_url: &str) -> Option<NaughtyEntry> {
+        self.entries.get(relay_url).map(|e| e.clone())
+    }
+
+    /// Remove expired entries from the naughty list
+    ///
+    /// Entries older than `expiration_hours` are removed to allow relays
+    /// to be retried after infrastructure issues are potentially fixed.
+    ///
+    /// # Returns
+    ///
+    /// Vector of relay URLs that were removed from the naughty list
+    pub fn expire_old_entries(&self) -> Vec<String> {
+        let now = Instant::now();
+        let expiration = std::time::Duration::from_secs(self.expiration_hours * 3600);
+        let mut expired = Vec::new();
+
+        // Collect expired relay URLs
+        self.entries.retain(|url, entry| {
+            let age = now.duration_since(entry.first_seen);
+            if age >= expiration {
+                expired.push(url.clone());
+                false // Remove this entry
+            } else {
+                true // Keep this entry
+            }
+        });
+
+        expired
+    }
+
+    /// Get all naughty relays (for metrics and monitoring)
+    ///
+    /// # Returns
+    ///
+    /// Vector of (relay_url, entry) tuples for all relays currently on the naughty list
+    pub fn get_all(&self) -> Vec<(String, NaughtyEntry)> {
+        self.entries
+            .iter()
+            .map(|entry| (entry.key().clone(), entry.value().clone()))
+            .collect()
+    }
+
+    /// Get the count of relays in a specific category
+    ///
+    /// # Arguments
+    ///
+    /// * `category` - The category to count
+    ///
+    /// # Returns
+    ///
+    /// Number of relays in the specified category
+    pub fn count_by_category(&self, category: NaughtyCategory) -> usize {
+        self.entries
+            .iter()
+            .filter(|entry| entry.value().category == category)
+            .count()
+    }
+
+    /// Get total number of relays on the naughty list
+    pub fn total_count(&self) -> usize {
+        self.entries.len()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_classify_dns_errors() {
+        assert_eq!(
+            NaughtyListTracker::classify_error("failed to lookup address information"),
+            Some(NaughtyCategory::DnsLookupFailed)
+        );
+        assert_eq!(
+            NaughtyListTracker::classify_error("Name or service not known"),
+            Some(NaughtyCategory::DnsLookupFailed)
+        );
+        assert_eq!(
+            NaughtyListTracker::classify_error("nodename nor servname provided"),
+            Some(NaughtyCategory::DnsLookupFailed)
+        );
+        assert_eq!(
+            NaughtyListTracker::classify_error("dns error: NXDOMAIN"),
+            Some(NaughtyCategory::DnsLookupFailed)
+        );
+    }
+
+    #[test]
+    fn test_classify_tls_errors() {
+        assert_eq!(
+            NaughtyListTracker::classify_error("certificate not valid for 'example.com'"),
+            Some(NaughtyCategory::TlsCertificateInvalid)
+        );
+        assert_eq!(
+            NaughtyListTracker::classify_error("SSL certificate problem"),
+            Some(NaughtyCategory::TlsCertificateInvalid)
+        );
+        assert_eq!(
+            NaughtyListTracker::classify_error("TLS handshake failed"),
+            Some(NaughtyCategory::TlsCertificateInvalid)
+        );
+
+        // TLS timeout should NOT be classified as naughty
+        assert_eq!(
+            NaughtyListTracker::classify_error("TLS connection timed out"),
+            None
+        );
+    }
+
+    #[test]
+    fn test_classify_protocol_errors() {
+        assert_eq!(
+            NaughtyListTracker::classify_error("websocket protocol error"),
+            Some(NaughtyCategory::ProtocolError)
+        );
+        assert_eq!(
+            NaughtyListTracker::classify_error("invalid frame header"),
+            Some(NaughtyCategory::ProtocolError)
+        );
+
+        // WebSocket connection errors should NOT be classified as naughty
+        assert_eq!(
+            NaughtyListTracker::classify_error("websocket connection refused"),
+            None
+        );
+    }
+
+    #[test]
+    fn test_classify_transient_errors() {
+        // Timeouts are transient
+        assert_eq!(
+            NaughtyListTracker::classify_error("connection timed out"),
+            None
+        );
+        assert_eq!(
+            NaughtyListTracker::classify_error("operation timed out"),
+            None
+        );
+
+        // Connection refused is transient
+        assert_eq!(
+            NaughtyListTracker::classify_error("connection refused"),
+            None
+        );
+
+        // Generic network errors are transient
+        assert_eq!(
+            NaughtyListTracker::classify_error("network unreachable"),
+            None
+        );
+    }
+
+    #[test]
+    fn test_record_new_entry() {
+        let tracker = NaughtyListTracker::with_defaults();
+        let url = "wss://bad-relay.example.com";
+
+        let is_new = tracker.record(
+            url,
+            NaughtyCategory::DnsLookupFailed,
+            "failed to lookup address".to_string(),
+        );
+
+        assert!(is_new);
+        assert!(tracker.is_naughty(url));
+
+        let entry = tracker.get_entry(url).unwrap();
+        assert_eq!(entry.category, NaughtyCategory::DnsLookupFailed);
+        assert_eq!(entry.occurrence_count, 1);
+    }
+
+    #[test]
+    fn test_record_updates_existing() {
+        let tracker = NaughtyListTracker::with_defaults();
+        let url = "wss://bad-relay.example.com";
+
+        // First occurrence
+        let is_new1 = tracker.record(url, NaughtyCategory::DnsLookupFailed, "error 1".to_string());
+        assert!(is_new1);
+
+        // Second occurrence
+        let is_new2 = tracker.record(url, NaughtyCategory::DnsLookupFailed, "error 2".to_string());
+        assert!(!is_new2);
+
+        let entry = tracker.get_entry(url).unwrap();
+        assert_eq!(entry.occurrence_count, 2);
+        assert_eq!(entry.reason, "error 2"); // Updated to latest
+    }
+
+    #[test]
+    fn test_is_naughty() {
+        let tracker = NaughtyListTracker::with_defaults();
+        let url = "wss://bad-relay.example.com";
+
+        assert!(!tracker.is_naughty(url));
+
+        tracker.record(
+            url,
+            NaughtyCategory::TlsCertificateInvalid,
+            "cert error".to_string(),
+        );
+
+        assert!(tracker.is_naughty(url));
+    }
+
+    #[test]
+    fn test_get_all() {
+        let tracker = NaughtyListTracker::with_defaults();
+
+        tracker.record(
+            "wss://relay1.example.com",
+            NaughtyCategory::DnsLookupFailed,
+            "dns error".to_string(),
+        );
+        tracker.record(
+            "wss://relay2.example.com",
+            NaughtyCategory::TlsCertificateInvalid,
+            "tls error".to_string(),
+        );
+
+        let all = tracker.get_all();
+        assert_eq!(all.len(), 2);
+    }
+
+    #[test]
+    fn test_count_by_category() {
+        let tracker = NaughtyListTracker::with_defaults();
+
+        tracker.record(
+            "wss://relay1.example.com",
+            NaughtyCategory::DnsLookupFailed,
+            "error".to_string(),
+        );
+        tracker.record(
+            "wss://relay2.example.com",
+            NaughtyCategory::DnsLookupFailed,
+            "error".to_string(),
+        );
+        tracker.record(
+            "wss://relay3.example.com",
+            NaughtyCategory::TlsCertificateInvalid,
+            "error".to_string(),
+        );
+
+        assert_eq!(
+            tracker.count_by_category(NaughtyCategory::DnsLookupFailed),
+            2
+        );
+        assert_eq!(
+            tracker.count_by_category(NaughtyCategory::TlsCertificateInvalid),
+            1
+        );
+        assert_eq!(tracker.count_by_category(NaughtyCategory::ProtocolError), 0);
+    }
+
+    #[test]
+    fn test_total_count() {
+        let tracker = NaughtyListTracker::with_defaults();
+        assert_eq!(tracker.total_count(), 0);
+
+        tracker.record(
+            "wss://relay1.example.com",
+            NaughtyCategory::DnsLookupFailed,
+            "error".to_string(),
+        );
+        assert_eq!(tracker.total_count(), 1);
+
+        tracker.record(
+            "wss://relay2.example.com",
+            NaughtyCategory::TlsCertificateInvalid,
+            "error".to_string(),
+        );
+        assert_eq!(tracker.total_count(), 2);
+    }
+
+    #[test]
+    fn test_expire_old_entries() {
+        // Use very short expiration for testing
+        let tracker = NaughtyListTracker::new(0); // Expire immediately (0 hours)
+
+        tracker.record(
+            "wss://relay1.example.com",
+            NaughtyCategory::DnsLookupFailed,
+            "error".to_string(),
+        );
+
+        // Entry should exist in the map
+        assert_eq!(tracker.total_count(), 1);
+
+        // But is_naughty should return false since it's already expired (0 hours)
+        assert!(!tracker.is_naughty("wss://relay1.example.com"));
+
+        // Sleep to ensure time passes
+        std::thread::sleep(std::time::Duration::from_millis(10));
+
+        // Expire old entries (should remove the 0-hour expired entry)
+        let expired = tracker.expire_old_entries();
+        assert_eq!(expired.len(), 1);
+        assert_eq!(expired[0], "wss://relay1.example.com");
+
+        // Entry should be gone
+        assert!(!tracker.is_naughty("wss://relay1.example.com"));
+        assert_eq!(tracker.total_count(), 0);
+    }
+
+    #[test]
+    fn test_category_display() {
+        assert_eq!(
+            NaughtyCategory::DnsLookupFailed.to_string(),
+            "dns_lookup_failed"
+        );
+        assert_eq!(
+            NaughtyCategory::TlsCertificateInvalid.to_string(),
+            "tls_certificate_invalid"
+        );
+        assert_eq!(NaughtyCategory::ProtocolError.to_string(), "protocol_error");
+    }
+
+    #[test]
+    fn test_category_as_str() {
+        assert_eq!(
+            NaughtyCategory::DnsLookupFailed.as_str(),
+            "dns_lookup_failed"
+        );
+        assert_eq!(
+            NaughtyCategory::TlsCertificateInvalid.as_str(),
+            "tls_certificate_invalid"
+        );
+        assert_eq!(NaughtyCategory::ProtocolError.as_str(), "protocol_error");
+    }
+}