lfg2025/botfights
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: polling API, HMAC webhook signing, session-only keys, prod audio fix

Browse Source 
- Add polling API (GET/POST /api/fights/poll) so bots don't need public URLs
- Add HMAC-SHA256 webhook signing (X-Botfights-Signature header)
- Stop auto-persisting nsec keys — session-only by default with opt-in "Remember on this device"
- Fix production TTS: add wav/mp3/ogg MIME types, /audio/* route, SPA blocklist
- Overhaul docs: mode selector (poll vs webhook), AI-first bot examples, security tab
- Fix duplicate sign-in buttons, login flow bugs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Dorian
2026-03-09 18:34:22 +00:00
co-authored by Claude Opus 4.6
parent 150ce7447d
commit 95ed80335a
12 changed files with 1143 additions and 433 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/src/lib/constants.ts
+3
View File
@@ -85,3 +85,6 @@ const CREATOR_PUBKEY = 'da5e0c1b646bdb13c2300f805b0ca3e5afe5b052c594ce78bac8978d
export function isCreatorPubkey(pubkey: string | undefined | null): boolean {
return !!pubkey && pubkey === CREATOR_PUBKEY
}
// --- Polling bot ---
export const POLL_GRACE_MS = 10_000 // Extra time for polling bots to discover + respond