ssmithx/podsteadr
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(auth): bridge NIP-07 sign-in to Archipelago's identity manager

Browse Source 
Vendors Archipelago's NIP-07 provider shim (neode-ui/public/
nostr-provider.js) and loads it in index.html's <head>. It's a no-op
outside an Archipelago iframe (the shim's own window === window.top
guard), so this is always safe to include.

When podsteadr is opened from the Archipelago dashboard (registered
there as an external identity-aware app — see the companion archy
change on branch feat/podsteadr-external-nostr-identity), the parent
frame lets the user pick one of their node's stored nostr identities
and posts window.nostr signing requests through to it. The shim then
runs the existing NIP-98 flow against our own auth (nip07.ts, auth.ts,
routes/auth.ts) exactly as if a browser extension had signed it —
nothing on the server needed to change.

Configured for our actual auth shape via data-* attrs the shim reads
from its own <script> tag: data-session-url="/api/auth/login" (ours,
not indeedhub's /api/auth/nostr/session), data-session-mode="cookie"
(we set a session cookie via @fastify/cookie rather than returning a
bearer token in JSON — the shim previously only knew the token shape),
data-me-url="/api/auth/me" (skip re-running the handshake if already
signed in), data-health-url="/api/health" (our actual health route).

Not wired through an Archipelago app manifest/hook — podsteadr isn't
an orchestrator-managed package, so this copy of nostr-provider.js
won't auto-update with archy OTA releases. Re-sync by hand from
archy/neode-ui/public/nostr-provider.js if that file changes upstream.

Verified: `npm run build` (vue-tsc + vite) clean, dist/index.html
includes the script tag with all four data-* attrs, dist/
nostr-provider.js present and syntactically valid.
This commit is contained in:
ssmithx
2026-08-02 14:44:00 +00:00
parent eb20e88f58
commit 133558d923
2 changed files with 222 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/index.html
+5
View File
@@ -4,6 +4,11 @@
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>podsteadr</title>
<!-- No-op outside an Archipelago iframe (see nostr-provider.js's own
window === window.top guard) — safe to always include. Provides
window.nostr + auto sign-in via the node's selected nostr identity
when opened inside the Archipelago shell. -->
<script src="/nostr-provider.js" data-session-url="/api/auth/login" data-session-mode="cookie" data-me-url="/api/auth/me" data-health-url="/api/health"></script>
</head>
<body>
<div id="app"></div>