Merge branch 'main' into poc-zombie-leak

Author: YashIIT0909

.gitignore

@@ -43,4 +43,6 @@ dist
 .nostr
 
 # Docker Compose overrides
-docker-compose.overrides.yml
+docker-compose.overrides.yml
+# Export output
+*.jsonl

.nycrc.json

@@ -1,26 +1,26 @@
 {
   "all": true,
   "cache": true,
-  "branches": 80,
-  "lines": 80,
-  "functions": 80,
-  "statements": 80,
+  "branches": 47,
+  "lines": 54,
+  "functions": 48,
+  "statements": 55,
   "watermarks": {
     "lines": [
-      80,
-      95
+      54,
+      80
     ],
     "functions": [
-      80,
-      95
+      48,
+      80
     ],
     "branches": [
-      80,
-      95
+      47,
+      80
     ],
     "statements": [
-      80,
-      95
+      55,
+      80
     ]
   },
   "extension": [

CONFIGURATION.md

@@ -119,4 +119,10 @@ Running `nostream` for the first time creates the settings file in `<project_roo
 | limits.message.ipWhitelist                  | List of IPs (IPv4 or IPv6) to ignore rate limits. |
 | limits.admissionCheck.rateLimits[].period          | Rate limit period in milliseconds. |
 | limits.admissionCheck.rateLimits[].rate            | Maximum number of admission checks during period. |
-| limits.admissionCheck.ipWhitelist                  | List of IPs (IPv4 or IPv6) to ignore rate limits. |
+| limits.admissionCheck.ipWhitelist                  | List of IPs (IPv4 or IPv6) to ignore rate limits. |
+| nip05.mode                                  | NIP-05 verification mode: `enabled` requires verification, `passive` verifies without blocking, `disabled` does nothing. Defaults to `disabled`. |
+| nip05.verifyExpiration                      | Time in milliseconds before a successful NIP-05 verification expires and needs re-checking. Defaults to 604800000 (1 week). |
+| nip05.verifyUpdateFrequency                 | Minimum interval in milliseconds between re-verification attempts for a given author. Defaults to 86400000 (24 hours). |
+| nip05.maxConsecutiveFailures                | Number of consecutive verification failures before giving up on an author. Defaults to 20. |
+| nip05.domainWhitelist                       | List of domains allowed for NIP-05 verification. If set, only authors verified at these domains can publish. |
+| nip05.domainBlacklist                       | List of domains blocked from NIP-05 verification. Authors with NIP-05 at these domains will be rejected. |

README.md

@@ -570,6 +570,7 @@ To see the integration test coverage report open `.coverage/integration/lcov-rep
   open .coverage/integration/lcov-report/index.html
   ```
 
+
 ## Security & Load Testing
 
 Nostream includes a specialized security tester to simulate Slowloris-style connection holding and event flood (spam) attacks. This is used to verify relay resilience and prevent memory leaks.
@@ -614,6 +615,55 @@ To observe client and subscription counts in real-time during a test, you can in
    ```bash
    docker compose logs -f nostream
    ```
+=======
+## Export Events
+
+Export all stored events to a [JSON Lines](https://jsonlines.org/) (`.jsonl`) file. Each line is a valid NIP-01 Nostr event JSON object. The export streams rows from the database using cursors, so it works safely on relays with millions of events without loading them into memory.
+
+```
+npm run export                            # writes to events.jsonl
+npm run export -- backup-2024-01-01.jsonl # custom filename
+```
+
+The script reads the same `DB_*` environment variables used by the relay (see [CONFIGURATION.md](CONFIGURATION.md)).
+## Relay Maintenance
+
+Use `clean-db` to wipe or prune `events` table data. This also removes
+corresponding data from the derived `event_tags` table when present.
+
+Dry run (no deletion):
+
+  ```
+  npm run clean-db -- --all --dry-run
+  ```
+
+Full wipe:
+
+  ```
+  npm run clean-db -- --all --force
+  ```
+
+Delete events older than N days:
+
+  ```
+  npm run clean-db -- --older-than=30 --force
+  ```
+
+Delete only selected kinds:
+
+  ```
+  npm run clean-db -- --kinds=1,7,4 --force
+  ```
+
+Delete only selected kinds older than N days:
+
+  ```
+  npm run clean-db -- --older-than=30 --kinds=1,7,4 --force
+  ```
+
+By default, the script asks for explicit confirmation (`Type 'DELETE' to confirm`).
+Use `--force` to skip the prompt.
+
 
 ## Configuration
 

migrations/20260409201624_admit_user_func.js

@@ -0,0 +1,27 @@
+exports.up = async function (knex) {
+  return knex.schema
+    .raw(
+      `CREATE OR REPLACE FUNCTION admit_user(user_pubkey BYTEA, tos_accepted TIMESTAMP WITHOUT TIME ZONE)
+RETURNS INTEGER
+LANGUAGE plpgsql
+AS $$
+BEGIN
+    PERFORM ASSERT_SERIALIZED();
+
+    INSERT INTO "users" ("pubkey", "is_admitted", "tos_accepted_at", "created_at", "updated_at")
+    VALUES (user_pubkey, true, tos_accepted, now_utc(), now_utc())
+    ON CONFLICT ("pubkey")
+    DO UPDATE SET
+      "is_admitted" = true,
+      "tos_accepted_at" = tos_accepted,
+      "updated_at" = now_utc();
+
+    RETURN 0;
+END;
+$$;`)
+}
+
+exports.down = function (knex) {
+  return knex.schema
+    .raw('DROP FUNCTION IF EXISTS admit_user(BYTEA, TIMESTAMP WITHOUT TIME ZONE);')
+}

migrations/20260409_120000_create_nip05_verifications_table.js

@@ -0,0 +1,21 @@
+exports.up = function (knex) {
+  return knex.schema.createTable('nip05_verifications', function (table) {
+    table.binary('pubkey').notNullable().primary()
+    table.text('nip05').notNullable()
+    table.text('domain').notNullable()
+    table.boolean('is_verified').notNullable().defaultTo(false)
+    table.timestamp('last_verified_at', { useTz: true }).nullable()
+    table.timestamp('last_checked_at', { useTz: true }).notNullable().defaultTo(knex.fn.now())
+    table.integer('failure_count').notNullable().defaultTo(0)
+    table.timestamp('created_at', { useTz: true }).notNullable().defaultTo(knex.fn.now())
+    table.timestamp('updated_at', { useTz: true }).notNullable().defaultTo(knex.fn.now())
+
+    table.index(['domain'], 'idx_nip05_verifications_domain')
+    table.index(['is_verified'], 'idx_nip05_verifications_is_verified')
+    table.index(['last_checked_at'], 'idx_nip05_verifications_last_checked_at')
+  })
+}
+
+exports.down = function (knex) {
+  return knex.schema.dropTable('nip05_verifications')
+}

migrations/20260410_230000_add_is_vanished_to_users_table.js

@@ -0,0 +1,22 @@
+exports.up = async function (knex) {
+  await knex.schema.alterTable('users', (table) => {
+    table.boolean('is_vanished').notNullable().defaultTo(false)
+  })
+
+  await knex.raw(`
+    UPDATE users u
+    SET is_vanished = true
+    WHERE EXISTS (
+      SELECT 1 FROM events e
+      WHERE e.event_pubkey = u.pubkey
+        AND e.event_kind = 62
+        AND e.deleted_at IS NULL
+    )
+  `)
+}
+
+exports.down = function (knex) {
+  return knex.schema.alterTable('users', (table) => {
+    table.dropColumn('is_vanished')
+  })
+}