test: add poll-responses, NIP-98, and bot-auth test suites

- poll-responses.test.ts: 10 tests covering lifecycle, timeout, duplicate rejection
- nip98.test.ts: 7 tests covering valid token, expiry, method, signature, tags
- bot-auth.test.ts: 5 tests covering header auth, query params, invalid credentials

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/middleware/nip98.test.ts

@@ -0,0 +1,123 @@
+import { describe, it, expect, vi, afterEach } from 'vitest'
+import { verifyNip98Token } from './nip98.js'
+import { generateSecretKey, getPublicKey, finalizeEvent } from 'nostr-tools'
+
+function createNip98Event(
+  sk: Uint8Array,
+  url: string,
+  method: string,
+  overrides: Record<string, unknown> = {},
+) {
+  const event = {
+    kind: 27235,
+    created_at: Math.floor(Date.now() / 1000),
+    tags: [
+      ['u', url],
+      ['method', method],
+    ],
+    content: '',
+    ...overrides,
+  }
+  return finalizeEvent(event, sk)
+}
+
+function toAuthHeader(event: object): string {
+  return `Nostr ${Buffer.from(JSON.stringify(event)).toString('base64')}`
+}
+
+describe('verifyNip98Token', () => {
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('accepts a valid NIP-98 token', () => {
+    const sk = generateSecretKey()
+    const pk = getPublicKey(sk)
+    const event = createNip98Event(sk, 'https://example.com/api/auth/nostr/session', 'POST')
+    const header = toAuthHeader(event)
+
+    const result = verifyNip98Token(header, '/api/auth/nostr/session', 'POST')
+    expect(result.valid).toBe(true)
+    expect(result.pubkey).toBe(pk)
+  })
+
+  it('rejects expired token (>120s)', () => {
+    const sk = generateSecretKey()
+    const event = createNip98Event(sk, 'https://example.com/api/auth', 'POST', {
+      created_at: Math.floor(Date.now() / 1000) - 200,
+    })
+    // Need to re-finalize with the old created_at
+    // Actually createNip98Event's overrides merge before finalize, but created_at gets set by finalizeEvent
+    // Let me build manually
+    const rawEvent = {
+      kind: 27235,
+      created_at: Math.floor(Date.now() / 1000) - 200,
+      tags: [['u', 'https://example.com/api/auth'], ['method', 'POST']],
+      content: '',
+    }
+    const signed = finalizeEvent(rawEvent, sk)
+    const header = toAuthHeader(signed)
+
+    const result = verifyNip98Token(header, '/api/auth', 'POST')
+    expect(result.valid).toBe(false)
+    expect(result.error).toContain('expired')
+  })
+
+  it('rejects wrong method', () => {
+    const sk = generateSecretKey()
+    const event = createNip98Event(sk, 'https://example.com/api/auth', 'POST')
+    const header = toAuthHeader(event)
+
+    const result = verifyNip98Token(header, '/api/auth', 'GET')
+    expect(result.valid).toBe(false)
+    expect(result.error).toContain('Method mismatch')
+  })
+
+  it('rejects invalid signature (tampered event)', () => {
+    const sk = generateSecretKey()
+    const event = createNip98Event(sk, 'https://example.com/api/auth', 'POST')
+    // Tamper with pubkey
+    const tampered = { ...event, pubkey: '0'.repeat(64) }
+    const header = toAuthHeader(tampered)
+
+    const result = verifyNip98Token(header, '/api/auth', 'POST')
+    expect(result.valid).toBe(false)
+    expect(result.error).toContain('Invalid signature')
+  })
+
+  it('rejects missing URL tag', () => {
+    const sk = generateSecretKey()
+    const event = finalizeEvent({
+      kind: 27235,
+      created_at: Math.floor(Date.now() / 1000),
+      tags: [['method', 'POST']],
+      content: '',
+    }, sk)
+    const header = toAuthHeader(event)
+
+    const result = verifyNip98Token(header, '/api/auth', 'POST')
+    expect(result.valid).toBe(false)
+    expect(result.error).toContain('Missing URL tag')
+  })
+
+  it('rejects invalid auth header format', () => {
+    const result = verifyNip98Token('Bearer xyz123', '/api/auth', 'POST')
+    expect(result.valid).toBe(false)
+    expect(result.error).toContain('Invalid auth header format')
+  })
+
+  it('rejects wrong event kind', () => {
+    const sk = generateSecretKey()
+    const event = finalizeEvent({
+      kind: 1, // Regular note, not 27235
+      created_at: Math.floor(Date.now() / 1000),
+      tags: [['u', 'https://example.com/api/auth'], ['method', 'POST']],
+      content: '',
+    }, sk)
+    const header = toAuthHeader(event)
+
+    const result = verifyNip98Token(header, '/api/auth', 'POST')
+    expect(result.valid).toBe(false)
+    expect(result.error).toContain('Wrong event kind')
+  })
+})