NIP-42 AUTH

khatru supports NIP-42 out of the box. The functionality is exposed in the following ways.

Sending arbitrary AUTH challenges

At any time you can send an AUTH message to a client that is making a request.

It makes sense to give the user the option to authenticate right after they establish a connection, for example, when you have a relay that works differently depending on whether the user is authenticated or not.

relay := khatru.NewRelay()

relay.OnConnect = append(relay.OnConnect, func(ctx context.Context) {
	khatru.RequestAuth(ctx)
})

This will send a NIP-42 AUTH challenge message to the client so it will have the option to authenticate itself whenever it wants to.

Signaling to the client that a specific query requires an authenticated user

If on RejectFilter or RejectEvent you prefix the message with auth-required: , that will automatically send an AUTH message before a CLOSED or OK with that prefix, such that the client will immediately be able to know it must authenticate to proceed and will already have the challenge required for that, so they can immediately replay the request.

relay.RejectFilter = append(relay.RejectFilter, func(ctx context.Context, filter nostr.Filter) (bool, string) {
	return true, "auth-required: this query requires you to be authenticated"
})
relay.RejectEvent = append(relay.RejectEvent, func(ctx context.Context, event *nostr.Event) (bool, string) {
	return true, "auth-required: publishing this event requires authentication"
})

Reading the auth status of a client

After a client is authenticated and opens a new subscription with REQ or sends a new event with EVENT, you'll be able to read the public key they're authenticated with.

relay.RejectFilter = append(relay.RejectFilter, func(ctx context.Context, filter nostr.Filter) (bool, string) {
	authenticatedUser := khatru.GetAuthed(ctx)
})

Telling an authenticated user they're still not allowed to do something

If the user is authenticated but still not allowed (because some specific filters or events are only accessible to some specific users) you can reply on RejectFilter or RejectEvent with a message prefixed with "restricted: " to make that clear to clients.

relay.RejectFilter = append(relay.RejectFilter, func(ctx context.Context, filter nostr.Filter) (bool, string) {
	authenticatedUser := khatru.GetAuthed(ctx)

	if slices.Contain(authorizedUsers, authenticatedUser) {
		return false
	} else {
		return true, "restricted: you're not a member of the privileged group that can read that stuff"
	}
})