mirror of
https://github.com/PR0M3TH3AN/bitlogin.git
synced 2026-10-27 08:31:21 +00:00
thePR0M3TH3ANandClaude Fable 5
bb9788588f
BL-21 (medium): untrusted relays and crafted bunker URIs can no longer buy CPU, memory, or sockets. Frames over 256K chars are dropped before JSON.parse; buffered queries run every cheap check (id shape, replay dedup, capacity) BEFORE Schnorr verification and carry a per-query verification budget (3x limit, floor 50) so distinct forged events exhaust the budget rather than the CPU; bunker URIs are deduplicated and capped at 8 relays. The audit's exact probe -- thousands of replayed copies against limit 1 -- now costs one verification, bounded by test. Documented trade: a relay that sprays forgeries past the budget forfeits the query. BL-22 (low): pending nostrconnect attempts now have a real lifecycle. Superseding or abandoning an attempt aborts its 180s listener (new AbortSignal support) and wipes its ephemeral key; on success the key's ownership transfers into the adopted client, which wipes on close. Per-candidate conversation keys in the listen loop are wiped in a finally instead of left to GC. BL-23 (low): the named local gate no longer skips static analysis -- security:ci runs the custom Semgrep rules via security:semgrep (same config and pin as the hosted workflow). BL-24 (informational): the courtesy protocol logout defined by current NIP-46 is sent on every teardown path (disconnect, supersession), bounded at 2s and never allowed to block closing; TODO's outdated 'no stable method name' note is corrected. switch_relays remains the one deferred interop item. 6 new adversarial tests; 262 total, all green; semgrep gate exit 0. Co-Authored-By: Claude Fable 5 <[email protected]>
29 lines
1.0 KiB
JSON
29 lines
1.0 KiB
JSON
{
|
|
"name": "bitlogin-monorepo",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"license": "MIT",
|
|
"description": "BitLogin — static, relay-backed portable Nostr account protocol and embeddable login widget",
|
|
"workspaces": [
|
|
"packages/core",
|
|
"packages/widget",
|
|
"packages/demo"
|
|
],
|
|
"scripts": {
|
|
"build": "npm run build -w @bitlogin/core && npm run build -w @bitlogin/widget",
|
|
"build:demo": "npm run build && npm run build -w @bitlogin/demo",
|
|
"dev:demo": "npm run dev -w @bitlogin/demo",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"typecheck": "npm run typecheck -w @bitlogin/core && npm run typecheck -w @bitlogin/widget",
|
|
"security:audit": "npm audit --audit-level=high && npm audit signatures",
|
|
"security:semgrep": "semgrep scan --config .semgrep.yml --error --timeout 0 packages",
|
|
"security:ci": "npm run build:demo && npm run typecheck && npm test && npm run security:audit && npm run security:semgrep"
|
|
},
|
|
"devDependencies": {
|
|
"typescript": "^5.7.3",
|
|
"vite": "^6.1.0",
|
|
"vitest": "^3.0.5"
|
|
}
|
|
}
|