NIP-46-Anmeldung (Remote Signer / Bunker)

[usekaneo]

Angemeldet wird nur über NIP-07 (window.nostr). Das Signer-Interface (src/nostr/signer.ts) wurde ausdrücklich so geschnitten, dass NIP-46 später danebenpasst — gebaut ist es nicht. Ohne Extension gibt es damit keinen Zugang, insbesondere auf Mobilgeräten.

Aufgabe: Zweite Signer-Implementierung gegen NIP-46 (bunker://-URI oder nostrconnect), Verbindungsdialog, Session hält die Verbindung über einen Reload, Timeouts beim Signieren sichtbar machen (Remote-Signieren dauert spürbar länger als eine Extension).

Quelle: docs/10-roadmap.md Phase 6 („Open: NIP-46 sign-in"), docs/03-auth-nip07-nip42.md

---

_{Task: xdwqj3nug85t49w0o50zy76y}

[usekaneo]

CON-16

[usekaneo]

**** commented:

Technical refinement

Ticket CON-16, verified against main (HEAD 5670ad2; the only working-tree change is an uncommitted addition to AGENTS.md about branch cleanup). The ticket has no comments and no branch yet; nothing of NIP-46 is built.

1. Scope

In

• A second Signer implementation against NIP-46, reachable from the sign-in affordance.
• Both entry forms the ticket names: a bunker:// URI (plus the NIP-05 form name@domain that nostr-tools' parseBunkerInput accepts) and the client-initiated nostrconnect:// flow.
• A connection dialog that takes the URI, validates it, and reports connection progress and failure.
• The session survives a reload: the NIP-46 client key and the bunker pointer are persisted, and the remote channel is rebuilt on mount.
• Remote signing is bounded and its slowness is visible: a clear timeout error instead of a write that never settles, and an AUTH budget that fits a phone round trip.

Out

• Bunker discovery beyond parseBunkerInput (no fetchBunkerProviders, no NIP-89 directory).
• A QR code for nostrconnect:// — no QR dependency is in package.json; the URI is shown and copyable.
• Any change to group permissions, to the NIP-29 authority model, or to the app's own event kinds.
• nip04/nip44 on our Signer interface: NIP-46 uses NIP-44 internally for its own channel, but the app has no encrypted content.
• Importing an nsec — docs/00-vision-scope.md:62 keeps that a non-goal.

2. Current state

What exists:

• src/nostr/signer.ts:8 already declares SignerKind = 'nip07' | 'nip46' | 'dev'; the interface is src/nostr/signer.ts:10-16 (kind, getPublicKey, signEvent). The only implementation is createNip07Signer at src/nostr/signer.ts:48-53; detection and polling are getNip07Provider (:30-32) and waitForNip07 (:38-46).
• src/session/session.tsx: STORAGE_KEY = 'nc-pubkey' (:13), readStoredPubkey/storePubkey (:46-62), the Session union (:17-20), the mount effect that detects NIP-07 and resumes (:133-155), the cross-tab handler (:163-191), login() (:193-216), logout() (:218-223), ensureSamePubkey() (:225-258), and the pure tabSync table (:95-111).
• src/nostr/client.ts signs AUTH through the same Signer: signAuth (:180-193) and refreshAuth (:428-454), with a module-private withTimeout (:61-69). The AUTH round trip is bounded at 5000 ms (:442). There is no timeout around any other signEvent call (publish-page.ts:60, publish-comment.ts:38, publish-placement.ts:42, publish-profile.ts:106, moderation.ts:21, blossom.ts:45).
• UI: SignInButton calls login() directly (src/ui/SignInButton.tsx:24-26); SessionNotice tells a user without window.nostr to install an extension (src/ui/SessionNotice.tsx:21-27); ProfileSettings prints session.signer.kind (src/routes/ProfileSettings.tsx:256-257) and its sign-out copy says the key stays in the extension (:281-284).
• Docs: docs/03-auth-nip07-nip42.md:59-64 ("Later: NIP-46"), docs/10-roadmap.md:37 and :192, README.md:20, NOSTR.md:77 and :312, docs/09-security-privacy.md:43.

What is missing:

• No createNip46Signer and no reference to nostr-tools/nip46 anywhere in src/ (grep for nip46|bunker|nostrconnect matches only src/nostr/signer.ts:4-8 and a doc string).
• No persistence for anything but nc-pubkey; there is no client key, no bunker pointer, no nostrconnect state.
• No dialog/modal primitive at all: src/ui/controls.tsx has Button/Callout/Card/inputs, and src/ui/CreateSpaceForm.tsx:23,32-49 shows the repo's inline-Card pattern for a "dialog".
• No timeout policy for remote signing.
• No test touches a signer kind other than nip07/dev.

The nostr-tools dependency is sufficient: nostr-tools@2.25.2 ships ./nip46 as its own export (BunkerSigner, parseBunkerInput, createNostrConnectURI, toBunkerURL). BunkerSigner.sendRequest has no timeout of its own — that is exactly the gap the ticket asks to close.

3. Affected files

Code — new

• src/nostr/nip46.ts — BunkerSigner wiring, URI parsing, the Signer adapter and its timeouts, plus disposal.
• src/session/nip46-store.ts — pure persistence of { clientSecret, bunkerPubkey, relays, secret, pubkey } (read/validate/write/clear), so the risky part is testable without React.
• src/ui/ConnectSignerDialog.tsx — the connection dialog (inline Card, following CreateSpaceForm).
• Optional: src/nostr/with-timeout.ts — extract client.ts:61-69 so the adapter and the client share one implementation.

Code — changed

• src/nostr/signer.ts — update the header comment (:3-7) and optionally add an optional close?(): Promise<void> to Signer.
• src/session/session.tsx — split login into NIP-07 and NIP-46 entry points, resume NIP-46 on mount, extend tabSync's provider test, clear the NIP-46 storage on logout.
• src/nostr/client.ts — signer-kind-aware AUTH budget at :442; use the shared timeout helper if extracted.
• src/ui/SignInButton.tsx, src/ui/SessionNotice.tsx, src/routes/ProfileSettings.tsx — offer and describe the second path.

Tests

• New src/nostr/nip46.test.ts and src/session/nip46-store.test.ts.
• Extend src/session/tab-sync.test.ts and src/nostr/client.reconnect.test.ts.
• Optional new src/session/session.nip46.test.tsx.

Docs

• docs/03-auth-nip07-nip42.md (replace the "Later" section), docs/10-roadmap.md:167-192, NOSTR.md:77,312, README.md:20, docs/09-security-privacy.md:43, and the sign-in state row in docs/06-ui-information-architecture.md:269-271.

Shared files a parallel ticket can collide with

src/nostr/signer.ts, src/session/session.tsx and src/nostr/client.ts are the three every signer/AUTH change touches; docs/10-roadmap.md around line 192 is claimed by the real-time-CRDT item as well. Keep the adapter in its own file so signer.ts stays the small, dependency-free interface.

4. Approach

1. Persistence — src/session/nip46-store.ts. One key nc-nip46, JSON with a version: 1, validated the way readStoredPubkey validates (session.tsx:46-53): try/catch around localStorage, /^[0-9a-f]{64}$/ on pubkey and bunkerPubkey, non-empty relays; a broken or older value returns null rather than throwing in the mount effect. Keep nc-pubkey as the single statement of which npub is signed in so tab-sync and the space stores keep working; nc-nip46 only carries how to reach the signer. Sign-out clears both.
2. Adapter — src/nostr/nip46.ts.
   • connectBunker(input): const { BunkerSigner, parseBunkerInput } = await import('nostr-tools/nip46') (dynamic, like src/main.tsx:14), parseBunkerInput → reject with a readable error when it returns null or when relays is empty (BunkerSigner.fromBunker throws on an empty relay list, nip46.js:1366). Reuse a stored client secret or generateSecretKey().
   • One dedicated SimplePool per session with pool.idleTimeout = 0, the same trick as client.ts:98-104, passed as BunkerSignerParams.pool.
   • signer.connect({ name: 'Akasha', url: window.location.origin }) on first login only, then getPublicKey(); on resume, rebuild fromBunker and use the stored pubkey without a remote call.
   • createNip46Signer(remote, { timeoutMs }) returns our Signer: kind: 'nip46', getPublicKey/signEvent each wrapped in a timeout, event verified with verifyEvent before it leaves the adapter, and a close() that calls BunkerSigner.close().
   • createConnectURI() wraps createNostrConnectURI; connectNostrConnect(uri, signal) wraps BunkerSigner.fromURI and passes an AbortSignal (its default wait is 300 000 ms, nip46.js:1375 — never leave that unbounded).
3. Timeouts. Defaults as constants: SIGNER_TIMEOUT_MS = 60_000 for signEvent, CONNECT_TIMEOUT_MS = 120_000 for connect/getPublicKey. A timeout rejects with a message naming the limit ("the remote signer did not answer within 60s" ) so it lands verbatim in the existing error surfaces (PageEditor.tsx:249,297-299, WriteCheck.tsx:71-75, MemberAdmin.tsx:72-73). In client.ts, make the AUTH budget depend on the signer: this.signer?.kind === 'nip46' ? 60_000 : 5000 at :442. Extract withTimeout (:61-69) into src/nostr/with-timeout.ts if the duplication is not wanted.
4. Session — src/session/session.tsx. Add loginWithBunker(input) and loginWithNostrConnect() next to the existing login() (rename it loginWithNip07 for clarity); each validates the returned pubkey the same way session.tsx:207 does, persists nc-nip46, then reuses switchIdentity (:76-79). The mount effect (:133-155) gets a second branch: a stored nc-nip46 rebuilds the signer and sets the session from nc-pubkey without touching the remote (the NIP-07 branch deliberately avoids getPublicKey for the same reason, :130-132). logout() clears nc-nip46 and best-effort closes the remote. Replace tabSync's hasProvider boolean with "can this tab sign as the stored npub" = getNip07Provider() !== null || readNip46Session() !== null; update the pure table and its tests.
5. UI. SignInButton no longer calls login() blindly: it opens ConnectSignerDialog with the two paths (extension / remote signer). The extension path keeps today's behaviour; the remote path takes the bunker:// or name@domain input, or switches to the nostrconnect:// URI with a copy button and a cancel that aborts fromURI. SessionNotice gets the second sentence ("or connect a remote signer"). ProfileSettings keeps printing signer.kind and gains the remote signer's relays; its sign-out copy is adjusted, since for NIP-46 the local client key is forgotten.
6. Kinds and tags: nothing to add. The NIP-46 RPC rides kind 24133, but BunkerSigner constructs it internally; we never write that event ourselves, so src/nostr/kinds.ts gains no entry. If a later ticket hand-rolls the channel, 24133 (and the p tag it uses) must be added to KINDS/TAGS there and nowhere else.
7. Docs as listed in §3, including a security-doc amendment that the stored NIP-46 client key is a communication key, never the identity key.

5. Alternatives considered

• Hand-roll NIP-46 on top of NostrClient vs use nostr-tools/nip46. Recommendation: BunkerSigner. It already handles NIP-44, both factory methods (bunker and nostrconnect), switch_relays and the 24133 subscribe/publish dance; hand-rolling means re-implementing all of that and owning 24133. Cost: it brings its own pool and subscription, which we wrap and bound (§4.2, §6) rather than fight.
• Where the client secret lives: localStorage vs sessionStorage vs memory vs IndexedDB. Recommendation localStorage, because the ticket requires surviving a reload and because tab-sync, SpaceStore and nc-pubkey are all localStorage-shaped; sessionStorage survives a reload too but breaks the multi-tab adopt path, and memory forfeits the requirement. The tradeoff is real: an XSS can read the NIP-46 client key and request signatures — no worse than an installed extension's session, but it contradicts the current wording in docs/09-security-privacy.md:43 and must be documented. Flagged as open question 1.
• Timeout mechanism: adapter-enforced default (recommended) vs adding timeoutMs/AbortSignal parameters to Signer vs a global signer-status store. The interface is deliberately three members; keeping the bound in the adapter touches no call site and no other signer kind. A per-call override can be added later without breaking callers.
• nostrconnect:// presentation: URI + copy (recommended, no dependency) vs QR (needs a new dependency) vs dropping it this ticket. The ticket says "bunker URI oder nostrconnect", so both flows should exist; QR is a UI follow-up.
• Resume behaviour: rebuild fromBunker on mount and trust the stored pubkey (recommended) vs send connect/a ping on every load. The latter turns every page load into a remote prompt. connect belongs on the first login, not on resume.
• Remote logout: local clear only vs best-effort BunkerSigner.logout(). Recommend local clear plus a fire-and-forget close(); logout RPC support differs between bunkers and must never block sign-out.

6. Risks and traps

• AGENTS.md "nostr-tools closes an idle relay by itself" applies to the bunker pool too. BunkerSigner constructs a SimplePool with the default 20 s idleTimeout (nip46.js:1357); between two sign requests the bunker subscription can be closed, and a response that races the re-subscribe is lost — the request then hangs until our timeout. Passing our own pool with idleTimeout = 0 (client.ts:98-104 is the precedent) is the fix, and it is what the idle-timeout test must pin.
• AGENTS.md "pool.close(url) during an in-flight ensureRelay" . The bunker pool must stay separate from NostrClient's: wanted/want refcounts and setSigner's pool.close (client.ts:467-481) only know app relays. Never pool.close the bunker pool while a request is in flight; dispose through BunkerSigner.close().
• AGENTS.md "The signer changed is not the relay reconnected" / synchronous auth: 'none' patch. Logging in with NIP-46 calls setSigner (session.tsx:77 → client.ts:467), which immediately starts open() → refreshAuth → a remote signature for the AUTH event. The relay badge therefore shows AUTH pending for the length of a phone prompt. That is fine, but the 5000 ms bound at client.ts:442 will declare it failed, which is a concrete, user-visible failure mode: red relay indicator on a sign-in that actually worked. Fix in §4.3.
• Dangling signer promise. signAuth awaits signer.signEvent unbounded (client.ts:186) while the only bound is the outer withTimeout(relay.auth(sign), 5000). When it expires, the remote request lives on; if it later resolves, nostr-tools may publish an AUTH event for a challenge on a connection that has since been replaced. connGeneration (client.ts:443,446) discards the stale state, but not the extra remote prompt. Bounding inside the adapter fixes the cause, not just the symptom.
• Verification. BunkerSigner.signEvent already verifies, and client.ts:187 verifies AUTH events; publish-page.ts:67 verifies revisions. The adapter must not add a path that skips verifyEvent for a hostile or buggy bunker response, and must reject a getPublicKey that is not 64 hex chars before it reaches localStorage.
• ensureSamePubkey changes meaning. BunkerSigner.getPublicKey caches its answer (nip46.js:1541-1546), so the NIP-07 safety net "the user switched accounts in the extension" has no NIP-46 equivalent — the bunker decides which key signs. Say so in docs/03, and make the NIP-46 branch compare the cached pubkey with the stored one and fail loudly on an error rather than treat "cached" as "unchanged".
• Two tabs, one client secret. The adopt path can rebuild a second BunkerSigner from the same stored secret. Request ids carry a random prefix (nip46.js:1360), so collisions are unlikely, but two subscriptions exist; acceptable, and worth a comment.
• Input shape. parseBunkerInput returns null for garbage and for a NIP-05 without a nip46 section; fromBunker throws synchronously on an empty relay list. The dialog has to turn all three into one readable message instead of an uncaught throw.
• Bundle. nostr-tools/nip46 pulls NIP-44 machinery; import it dynamically (the src/main.tsx:14 pattern) so the initial chunk does not grow for NIP-07 users.
• Storage failure. localStorage can throw (private window, quota); readStoredPubkey already tolerates it. The NIP-46 store must do the same or the mount effect breaks sign-in entirely.
• Docs drift. docs/09-security-privacy.md:43 ("No handling of nsec at all") and README.md ("The client never holds a private key") are still true for the identity key but not for the NIP-46 client key; both need the qualification.

7. Test plan

There is no vitest.config; the environment is chosen per file with // @vitest-environment jsdom (e.g. src/nostr/my-spaces.test.tsx:1). React tests use createRoot + act, not a testing library.

• src/nostr/nip46.test.ts (node), vi.mock('nostr-tools/nip46'):
  • connectBunker rejects on unparsable input and on a relay-less pointer. Mutation: remove the guard → an unhandled throw escapes instead of a message.
  • createNip46Signer reports kind: 'nip46', forwards getPublicKey/signEvent, and rejects with the timeout message when the fake BunkerSigner never settles (fake timers). Mutation: drop the wrapper → the test never resolves, which is precisely the bug.
  • a forged/badly-signed event returned by the fake bunker is rejected. Mutation: drop verifyEvent → the test turns green on a bad event.
  • the pool handed to BunkerSigner has idleTimeout === 0. Mutation: leave the default → fails.
  • connectNostrConnect aborts and leaves no subscription when the signal fires. Mutation: omit the signal → the fake subscription stays open.
• src/session/nip46-store.test.ts (node): round-trip; rejects malformed JSON, a non-hex pubkey, and an empty relay list; clear removes it. Mutation: drop the hex check → a malformed key survives into the session.
• Extend src/session/tab-sync.test.ts: the hasProvider argument becomes "can sign as the stored npub"; add the case stored NIP-46 present → adopt, and keep the neither-present → sign-out case (tab-sync.test.ts:43-45).
• Extend src/nostr/client.reconnect.test.ts: a fake signer that takes ~6 s to sign; assert auth does not flip to failed and that the AUTH budget is signer-kind aware. Mutation: hardcode 5000 at client.ts:442 → the test fails.
• Optional src/session/session.nip46.test.tsx (jsdom): mount SessionProvider with a stored nc-nip46 and no window.nostr; assert the session resumes as signed-in without a remote call, and that logout clears nc-pubkey and nc-nip46. Mutation: mount effect only checks NIP-07 → it stays anonymous.
• Gate: npm run typecheck && npm run lint && npm test && npm run build. The lint step matters here: react-hooks/exhaustive-deps is the class that keeps biting this repo, and the new mount branch and dialog callbacks are exactly its shape.
• E2E: not warranted. There is no Playwright in the repo (docs/10-roadmap.md:224 lists it as a gap), and NIP-46 needs a live bunker. The honest substitute is a manual pass against a real signer (Amber / nsec.app on a phone over the LAN, port 5273) plus, optionally, a scripts/dev-bunker.mjs that answers 24133 with a fixed key over a local relay, so the round trip is reproducible without a phone.

8. Acceptance criteria

• With no window.nostr, the sign-in affordance offers a remote signer and connects with a valid bunker:// URI, a name@domain NIP-05, or a nostrconnect:// URI.
• After connecting, the app signs in (pubkey, npub, profile) and a write on a group goes through — AUTH included — while the relay indicator never shows a spurious failed.
• A reload keeps the session signed in without a new prompt; a tab that did not initiate the sign-in adopts it.
• A signer that never answers produces a readable timeout message in the existing error surfaces, within the documented limit; no spinner runs forever.
• Sign-out clears the stored NIP-46 state; no client secret or bunker pointer is left behind in localStorage.
• src/nostr/kinds.ts is unchanged (the 24133 channel stays inside nostr-tools).
• The gate passes; the new tests fail without their respective fixes.
• Docs updated, including the security wording about the stored client key.

9. Open questions

1. Where may the NIP-46 client secret be persisted? localStorage (survives reload/restart, matches nc-pubkey, weaker against XSS) or sessionStorage (survives reload only, breaks the multi-tab adopt path)? Recommend localStorage with an explicit note in docs/09; this is a product/security call.
2. What are the default limits? 60 s per signature and 120 s for connect are guesses; on a phone with manual approval they can be too short. Do we want an explicit "waiting for your signer…" indicator with a manual cancel, or only the timeout?
3. Is NIP-46 a fallback or a peer? Only offered when no extension is detected, or always visible as an equal choice in the dialog? This decides SignInButton/SessionNotice.
4. Both flows in one ticket? The wording allows "or". Sequence bunker:// paste first and nostrconnect:// second if the ticket should stay small, but the deliverable should say which one it finished.
5. Remote sign-out: fire the logout RPC best-effort or keep sign-out purely local? Bunker behaviour differs.

10. Size

Roughly 6 code files (2 new: src/nostr/nip46.ts, src/session/nip46-store.ts; 4 changed: src/session/session.tsx, src/nostr/client.ts, src/ui/SignInButton.tsx, plus the dialog and the two copy-only UI files), 2–3 test files (2 new, 2 extended), and 4–6 doc edits. Order of 500–700 lines including tests. It can ship as one PR, but it splits cleanly: (a) adapter + persistence + login/resume + tests, (b) dialog, nostrconnect:// and docs. If it is split, open question 4 answers itself. Branch name per the repo convention: con-16-nip46-signer.