diff options
Diffstat (limited to '46.md')
| -rw-r--r-- | 46.md | 34 |
1 files changed, 22 insertions, 12 deletions
| @@ -45,15 +45,25 @@ _remote-signer_ provides connection token in the form: | |||
| 45 | bunker://<remote-signer-pubkey>?relay=<wss://relay-to-connect-on>&relay=<wss://another-relay-to-connect-on>&secret=<optional-secret-value> | 45 | bunker://<remote-signer-pubkey>?relay=<wss://relay-to-connect-on>&relay=<wss://another-relay-to-connect-on>&secret=<optional-secret-value> |
| 46 | ``` | 46 | ``` |
| 47 | 47 | ||
| 48 | _user_ passes this token to _client_, which then sends `connect` request to _remote-signer_ via the specified relays. Optional secret can be used for single successfully established connection only, _remote-signer_ SHOULD ignore new attempts to establish connection with old secret. | 48 | _user_ passes this token to _client_, which then sends `connect` request to _remote-signer_ via the specified relays. Optional secret can be used for single successfully established connection only, _remote-signer_ SHOULD ignore new attempts to establish connection with old secret. |
| 49 | 49 | ||
| 50 | ### Direct connection initiated by the _client_ | 50 | ### Direct connection initiated by the _client_ |
| 51 | 51 | ||
| 52 | _client_ provides a connection token in the form: | 52 | _client_ provides a connection token using `nostrconnect://` as the protocol, and `client-pubkey` as the origin. Additional information should be passed as query parameters: |
| 53 | |||
| 54 | - `relay` (required) - one or more relay urls on which the _client_ is listening for responses from the _remote-signer_. | ||
| 55 | - `secret` (required) - a short random string that the _remote-signer_ should return as the `result` field of its response. | ||
| 56 | - `perms` (optional) - a comma-separated list of permissions the _client_ is requesting be approved by the _remote-signer_ | ||
| 57 | - `name` (optional) - the name of the _client_ application | ||
| 58 | - `url` (optional) - the canonical url of the _client_ application | ||
| 59 | - `image` (optional) - a small image representing the _client_ application | ||
| 60 | |||
| 61 | Here's an example: | ||
| 53 | 62 | ||
| 54 | ``` | 63 | ``` |
| 55 | nostrconnect://<client-pubkey>?relay=<wss://relay-to-connect-on>&metadata=<json metadata: {"name":"...", "url": "...", "description": "...", "perms": "..."}>&secret=<required-secret-value> | 64 | nostrconnect://83f3b2ae6aa368e8275397b9c26cf550101d63ebaab900d19dd4a4429f5ad8f5?relay=wss%3A%2F%2Frelay1.example.com&perms=nip44_encrypt%2Cnip44_decrypt%2Csign_event%3A13%2Csign_event%3A14%2Csign_event%3A1059&name=My+Client&secret=0s8j2djs&relay=wss%3A%2F%2Frelay2.example2.com |
| 56 | ``` | 65 | ``` |
| 66 | |||
| 57 | _user_ passes this token to _remote-signer_, which then sends `connect` *response* event to the `client-pubkey` via the specified relays. Client discovers `remote-signer-pubkey` from connect response author. `secret` value MUST be provided to avoid connection spoofing, _client_ MUST validate the `secret` returned by `connect` response. | 67 | _user_ passes this token to _remote-signer_, which then sends `connect` *response* event to the `client-pubkey` via the specified relays. Client discovers `remote-signer-pubkey` from connect response author. `secret` value MUST be provided to avoid connection spoofing, _client_ MUST validate the `secret` returned by `connect` response. |
| 58 | 68 | ||
| 59 | ## Request Events `kind: 24133` | 69 | ## Request Events `kind: 24133` |
| @@ -62,12 +72,12 @@ _user_ passes this token to _remote-signer_, which then sends `connect` *respons | |||
| 62 | { | 72 | { |
| 63 | "kind": 24133, | 73 | "kind": 24133, |
| 64 | "pubkey": <local_keypair_pubkey>, | 74 | "pubkey": <local_keypair_pubkey>, |
| 65 | "content": <nip04(<request>)>, | 75 | "content": <nip44(<request>)>, |
| 66 | "tags": [["p", <remote-signer-pubkey>]], | 76 | "tags": [["p", <remote-signer-pubkey>]], |
| 67 | } | 77 | } |
| 68 | ``` | 78 | ``` |
| 69 | 79 | ||
| 70 | The `content` field is a JSON-RPC-like message that is [NIP-04](04.md) encrypted and has the following structure: | 80 | The `content` field is a JSON-RPC-like message that is [NIP-44](44.md) encrypted and has the following structure: |
| 71 | 81 | ||
| 72 | ```jsonc | 82 | ```jsonc |
| 73 | { | 83 | { |
| @@ -99,7 +109,7 @@ Each of the following are methods that the _client_ sends to the _remote-signer_ | |||
| 99 | 109 | ||
| 100 | ### Requested permissions | 110 | ### Requested permissions |
| 101 | 111 | ||
| 102 | The `connect` method may be provided with `optional_requested_permissions` for user convenience. The permissions are a comma-separated list of `method[:params]`, i.e. `nip04_encrypt,sign_event:4` meaning permissions to call `nip04_encrypt` and to call `sign_event` with `kind:4`. Optional parameter for `sign_event` is the kind number, parameters for other methods are to be defined later. Same permission format may be used for `perms` field of `metadata` in `nostrconnect://` string. | 112 | The `connect` method may be provided with `optional_requested_permissions` for user convenience. The permissions are a comma-separated list of `method[:params]`, i.e. `nip44_encrypt,sign_event:4` meaning permissions to call `nip44_encrypt` and to call `sign_event` with `kind:4`. Optional parameter for `sign_event` is the kind number, parameters for other methods are to be defined later. Same permission format may be used for `perms` field of `metadata` in `nostrconnect://` string. |
| 103 | 113 | ||
| 104 | ## Response Events `kind:24133` | 114 | ## Response Events `kind:24133` |
| 105 | 115 | ||
| @@ -108,13 +118,13 @@ The `connect` method may be provided with `optional_requested_permissions` for u | |||
| 108 | "id": <id>, | 118 | "id": <id>, |
| 109 | "kind": 24133, | 119 | "kind": 24133, |
| 110 | "pubkey": <remote-signer-pubkey>, | 120 | "pubkey": <remote-signer-pubkey>, |
| 111 | "content": <nip04(<response>)>, | 121 | "content": <nip44(<response>)>, |
| 112 | "tags": [["p", <client-pubkey>]], | 122 | "tags": [["p", <client-pubkey>]], |
| 113 | "created_at": <unix timestamp in seconds> | 123 | "created_at": <unix timestamp in seconds> |
| 114 | } | 124 | } |
| 115 | ``` | 125 | ``` |
| 116 | 126 | ||
| 117 | The `content` field is a JSON-RPC-like message that is [NIP-04](04.md) encrypted and has the following structure: | 127 | The `content` field is a JSON-RPC-like message that is [NIP-44](44.md) encrypted and has the following structure: |
| 118 | 128 | ||
| 119 | ```json | 129 | ```json |
| 120 | { | 130 | { |
| @@ -140,7 +150,7 @@ The `content` field is a JSON-RPC-like message that is [NIP-04](04.md) encrypted | |||
| 140 | { | 150 | { |
| 141 | "kind": 24133, | 151 | "kind": 24133, |
| 142 | "pubkey": "eff37350d839ce3707332348af4549a96051bd695d3223af4aabce4993531d86", | 152 | "pubkey": "eff37350d839ce3707332348af4549a96051bd695d3223af4aabce4993531d86", |
| 143 | "content": nip04({ | 153 | "content": nip44({ |
| 144 | "id": <random_string>, | 154 | "id": <random_string>, |
| 145 | "method": "sign_event", | 155 | "method": "sign_event", |
| 146 | "params": [json_stringified(<{ | 156 | "params": [json_stringified(<{ |
| @@ -160,7 +170,7 @@ The `content` field is a JSON-RPC-like message that is [NIP-04](04.md) encrypted | |||
| 160 | { | 170 | { |
| 161 | "kind": 24133, | 171 | "kind": 24133, |
| 162 | "pubkey": "fa984bd7dbb282f07e16e7ae87b26a2a7b9b90b7246a44771f0cf5ae58018f52", | 172 | "pubkey": "fa984bd7dbb282f07e16e7ae87b26a2a7b9b90b7246a44771f0cf5ae58018f52", |
| 163 | "content": nip04({ | 173 | "content": nip44({ |
| 164 | "id": <random_string>, | 174 | "id": <random_string>, |
| 165 | "result": json_stringified(<signed-event>) | 175 | "result": json_stringified(<signed-event>) |
| 166 | }), | 176 | }), |
| @@ -203,7 +213,7 @@ _remote-signer_ MAY publish it's metadata by using [NIP-05](05.md) and [NIP-89]( | |||
| 203 | }, | 213 | }, |
| 204 | "nip46": { | 214 | "nip46": { |
| 205 | "relays": ["wss://relay1","wss://relay2"...], | 215 | "relays": ["wss://relay1","wss://relay2"...], |
| 206 | "nostrconnect_url": "https://remote-signer-domain.com/<nostrconnect>" | 216 | "nostrconnect_url": "https://remote-signer-domain.example/<nostrconnect>" |
| 207 | } | 217 | } |
| 208 | } | 218 | } |
| 209 | ``` | 219 | ``` |
| @@ -214,4 +224,4 @@ The `<remote-signer-app-pubkey>` MAY be used to verify the domain from _remote-s | |||
| 214 | 224 | ||
| 215 | _remote-signer_ MAY publish a NIP-89 `kind: 31990` event with `k` tag of `24133`, which MAY also include one or more `relay` tags and MAY include `nostrconnect_url` tag. The semantics of `relay` and `nostrconnect_url` tags are the same as in the section above. | 225 | _remote-signer_ MAY publish a NIP-89 `kind: 31990` event with `k` tag of `24133`, which MAY also include one or more `relay` tags and MAY include `nostrconnect_url` tag. The semantics of `relay` and `nostrconnect_url` tags are the same as in the section above. |
| 216 | 226 | ||
| 217 | _client_ MAY improve UX by discovering _remote-signers_ using their `kind: 31990` events. _client_ MAY then pre-generate `nostrconnect://` strings for the _remote-signers_, and SHOULD in that case verify that `kind: 31990` event's author is mentioned in signer's `nostr.json?name=_` file as `<remote-signer-app-pubkey>`. | 227 | _client_ MAY improve UX by discovering _remote-signers_ using their `kind: 31990` events. _client_ MAY then pre-generate `nostrconnect://` strings for the _remote-signers_, and SHOULD in that case verify that `kind: 31990` event's author is mentioned in signer's `nostr.json?name=_` file as `<remote-signer-app-pubkey>`. |