fix(nip43): enforce membership, validate requests, and invalidate admission cache

Address review findings against the NIP-43 spec:

- Enforce admission for all writes when nip43.enabled, even without
  payments enabled — membership was previously toothless on non-payment
  relays since isUserAdmitted short-circuited when payments were off.
- Invalidate the per-pubkey admission cache on join and leave so
  membership changes take effect immediately instead of after the cache
  TTL (up to 60s of rejections after joining, up to 300s of continued
  access after leaving).
- Validate created_at freshness on join/leave requests (spec MUST,
  same 10-minute tolerance as the NIP-42 auth handler).
- Require the NIP-70 "-" tag on leave requests (spec MUST).
- Use the auth-required: prefix for unauthenticated join/leave so
  NIP-42 clients know to AUTH and retry.
- Revoke admission with a targeted UPDATE instead of a generic upsert
  that clobbered is_vanished on the existing row.
- Emit OK results through createEventCommandResult so join/leave are
  counted in the accepted/rejected event metrics like other strategies.
- Only advertise NIP-43 in the NIP-11 document when the feature is
  enabled (clients MUST key off supported_nips), and report
  restricted_writes accordingly.
- Document the nip43 settings block in default-settings.yaml.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Anshumancanrock

.changeset/nip43-join-leave.md

@@ -2,4 +2,4 @@
 "nostream": minor
 ---
 
-Add NIP-43 join/leave request event strategies (kinds 28934/28936) with NIP-42 auth enforcement, invite code claiming, and admission management. Advertise NIP-43 in NIP-11 document.
+Add NIP-43 join/leave request event strategies (kinds 28934/28936) with NIP-42 auth enforcement, created_at freshness validation, invite code claiming, and admission management. When `nip43.enabled` is set, publishing is restricted to admitted members even without payments enabled, and NIP-43 is advertised in the NIP-11 document (hidden when disabled). Join/leave update the admission cache so membership changes take effect immediately.

resources/default-settings.yaml

@@ -60,6 +60,11 @@ nip05:
   domainWhitelist: []
   # Block authors with NIP-05 at these domains
   domainBlacklist: []
+nip43:
+  # NIP-43: invite-based relay membership. When enabled, only admitted members
+  # (users who claimed an invite code via a kind 28934 join request) may
+  # publish events. Enabling this on an open relay blocks all non-members.
+  enabled: false
 nip45:
   enabled: true
 nip50:

src/@types/repositories.ts

@@ -56,6 +56,7 @@ export interface IUserRepository {
   isVanished(pubkey: Pubkey, client?: DatabaseClient): Promise<boolean>
   setVanished(pubkey: Pubkey, vanished: boolean, client?: DatabaseClient): Promise<number>
   admitUser(pubkey: Pubkey, admittedAt: Date, client?: DatabaseClient): Promise<void>
+  revokeAdmission(pubkey: Pubkey, client?: DatabaseClient): Promise<number>
 }
 
 export interface INip05VerificationRepository {

src/constants/caching.ts

@@ -3,3 +3,5 @@ export enum CacheAdmissionState {
   BLOCKED_NOT_ADMITTED = 'blocked_not_admitted',
   BLOCKED_INSUFFICIENT_BALANCE = 'blocked_insufficient_balance',
 }
+
+export const admissionCacheKey = (pubkey: string): string => `${pubkey}:is-admitted`

src/factories/event-strategy-factory.ts

@@ -1,3 +1,4 @@
+import { ICacheAdapter, IWebSocketAdapter } from '../@types/adapters'
 import { IEventRepository, IInviteCodeRepository, IUserRepository } from '../@types/repositories'
 import {
   isDeleteEvent,
@@ -19,7 +20,6 @@ import { Factory } from '../@types/base'
 import { GiftWrapEventStrategy } from '../handlers/event-strategies/gift-wrap-event-strategy'
 import { GroupEventStrategy } from '../handlers/event-strategies/group-event-strategy'
 import { IEventStrategy } from '../@types/message-handlers'
-import { IWebSocketAdapter } from '../@types/adapters'
 import { JoinRequestEventStrategy } from '../handlers/event-strategies/join-request-event-strategy'
 import { LeaveRequestEventStrategy } from '../handlers/event-strategies/leave-request-event-strategy'
 import { ParameterizedReplaceableEventStrategy } from '../handlers/event-strategies/parameterized-replaceable-event-strategy'
@@ -33,6 +33,7 @@ export const eventStrategyFactory =
     eventRepository: IEventRepository,
     userRepository: IUserRepository,
     inviteCodeRepository: IInviteCodeRepository,
+    cache: ICacheAdapter,
     settings: () => Settings,
   ): Factory<IEventStrategy<Event, Promise<void>>, [Event, IWebSocketAdapter]> =>
   ([event, adapter]: [Event, IWebSocketAdapter]) => {
@@ -49,9 +50,9 @@ export const eventStrategyFactory =
     // NIP-43: Join/Leave requests MUST be checked before the generic ephemeral
     // handler, because kinds 28934/28936 fall in the ephemeral range (20000-29999).
     } else if (isNip43JoinRequest(event)) {
-      return new JoinRequestEventStrategy(adapter, inviteCodeRepository, userRepository, settings)
+      return new JoinRequestEventStrategy(adapter, inviteCodeRepository, userRepository, cache, settings)
     } else if (isNip43LeaveRequest(event)) {
-      return new LeaveRequestEventStrategy(adapter, userRepository, settings)
+      return new LeaveRequestEventStrategy(adapter, userRepository, cache, settings)
     } else if (isEphemeralEvent(event)) {
       return new EphemeralEventStrategy(adapter)
     } else if (isDeleteEvent(event)) {

src/factories/message-handler-factory.ts

@@ -32,7 +32,7 @@ export const messageHandlerFactory =
       case MessageType.EVENT: {
         return new EventMessageHandler(
           adapter,
-          eventStrategyFactory(eventRepository, userRepository, inviteCodeRepository, createSettings),
+          eventStrategyFactory(eventRepository, userRepository, inviteCodeRepository, getCache(), createSettings),
           eventRepository,
           userRepository,
           createSettings,

src/handlers/event-message-handler.ts

@@ -30,7 +30,7 @@ import {
 } from '../utils/event'
 import { IEventRepository, INip05VerificationRepository, IUserRepository } from '../@types/repositories'
 import { IEventStrategy, IMessageHandler } from '../@types/message-handlers'
-import { CacheAdmissionState } from '../constants/caching'
+import { admissionCacheKey, CacheAdmissionState } from '../constants/caching'
 import { createEventCommandResult } from '../telemetry/event-metrics'
 import { createLogger } from '../factories/logger-factory'
 import { Factory } from '../@types/base'
@@ -372,7 +372,10 @@ export class EventMessageHandler implements IMessageHandler {
 
   protected async isUserAdmitted(event: Event): Promise<string | undefined> {
     const currentSettings = this.settings()
-    if (!currentSettings.payments?.enabled) {
+    const paymentsEnabled = currentSettings.payments?.enabled === true
+    // NIP-43: membership mode gates writes on admission even without payments
+    const nip43Enabled = currentSettings.nip43?.enabled === true
+    if (!paymentsEnabled && !nip43Enabled) {
       return
     }
 
@@ -390,12 +393,19 @@ export class EventMessageHandler implements IMessageHandler {
       !feeSchedule.whitelists?.pubkeys?.includes(event.pubkey) &&
       !feeSchedule.whitelists?.event_kinds?.some(isEventKindOrRangeMatch(event))
 
-    const feeSchedules = currentSettings.payments?.feeSchedules?.admission?.filter(isApplicableFee)
-    if (!Array.isArray(feeSchedules) || !feeSchedules.length) {
+    const feeSchedules = paymentsEnabled
+      ? currentSettings.payments?.feeSchedules?.admission?.filter(isApplicableFee)
+      : undefined
+    const admissionFeeRequired = Array.isArray(feeSchedules) && feeSchedules.length > 0
+    if (!admissionFeeRequired && !nip43Enabled) {
       return
     }
 
-    const cacheKey = `${event.pubkey}:is-admitted`
+    const notAdmittedReason = nip43Enabled
+      ? 'restricted: pubkey not admitted; send a join request (kind 28934) with a valid invite code'
+      : 'blocked: pubkey not admitted'
+
+    const cacheKey = admissionCacheKey(event.pubkey)
 
     try {
       const cachedValue = await this.cache.getKey(cacheKey)
@@ -405,7 +415,7 @@ export class EventMessageHandler implements IMessageHandler {
       }
       if (cachedValue === CacheAdmissionState.BLOCKED_NOT_ADMITTED) {
         logger('cache hit for %s admission: blocked', event.pubkey)
-        return 'blocked: pubkey not admitted'
+        return notAdmittedReason
       }
       if (cachedValue === CacheAdmissionState.BLOCKED_INSUFFICIENT_BALANCE) {
         logger('cache hit for %s admission: insufficient balance', event.pubkey)
@@ -418,10 +428,10 @@ export class EventMessageHandler implements IMessageHandler {
     const user = await this.userRepository.findByPubkey(event.pubkey)
     if (!user || !user.isAdmitted) {
       this.cacheSet(cacheKey, CacheAdmissionState.BLOCKED_NOT_ADMITTED, 60)
-      return 'blocked: pubkey not admitted'
+      return notAdmittedReason
     }
 
-    const minBalance = currentSettings.limits?.event?.pubkey?.minBalance ?? 0n
+    const minBalance = paymentsEnabled ? currentSettings.limits?.event?.pubkey?.minBalance ?? 0n : 0n
     if (minBalance > 0n && user.balance < minBalance) {
       this.cacheSet(cacheKey, CacheAdmissionState.BLOCKED_INSUFFICIENT_BALANCE, 60)
       return 'blocked: insufficient balance'

src/handlers/event-strategies/join-request-event-strategy.ts

@@ -1,10 +1,11 @@
+import { getClaimTag, isNip43RequestTimestampValid } from '../../utils/nip43'
+import { ICacheAdapter, IWebSocketAdapter } from '../../@types/adapters'
 import { IInviteCodeRepository, IUserRepository } from '../../@types/repositories'
-import { createCommandResult } from '../../utils/messages'
+import { admissionCacheKey } from '../../constants/caching'
+import { createEventCommandResult } from '../../telemetry/event-metrics'
 import { createLogger } from '../../factories/logger-factory'
 import { Event } from '../../@types/event'
-import { getClaimTag } from '../../utils/nip43'
 import { IEventStrategy } from '../../@types/message-handlers'
-import { IWebSocketAdapter } from '../../@types/adapters'
 import { Settings } from '../../@types/settings'
 import { WebSocketAdapterEvent } from '../../constants/adapter'
 
@@ -15,6 +16,7 @@ export class JoinRequestEventStrategy implements IEventStrategy<Event, Promise<v
     private readonly webSocket: IWebSocketAdapter,
     private readonly inviteCodeRepository: IInviteCodeRepository,
     private readonly userRepository: IUserRepository,
+    private readonly cache: ICacheAdapter,
     private readonly settings: () => Settings,
   ) {}
 
@@ -23,60 +25,64 @@ export class JoinRequestEventStrategy implements IEventStrategy<Event, Promise<v
 
     if (!currentSettings.nip43?.enabled) {
       logger('NIP-43 disabled, rejecting join request from %s', event.pubkey)
-      this.webSocket.emit(
-        WebSocketAdapterEvent.Message,
-        createCommandResult(event.id, false, 'restricted: NIP-43 is not enabled on this relay'),
-      )
+      this.sendResult(event.id, false, 'restricted: NIP-43 is not enabled on this relay')
+      return
+    }
+
+    if (!isNip43RequestTimestampValid(event)) {
+      logger('join request from %s has stale created_at', event.pubkey)
+      this.sendResult(event.id, false, 'invalid: created_at is too far from the current time')
       return
     }
 
     if (!this.webSocket.getAuthenticatedPubkeys().has(event.pubkey)) {
       logger('unauthenticated join request from %s', event.pubkey)
-      this.webSocket.emit(
-        WebSocketAdapterEvent.Message,
-        createCommandResult(event.id, false, 'restricted: authentication required (NIP-42)'),
-      )
+      this.sendResult(event.id, false, 'auth-required: authentication required (NIP-42)')
       return
     }
 
     const claimCode = getClaimTag(event)
     if (!claimCode) {
       logger('join request from %s missing claim tag', event.pubkey)
-      this.webSocket.emit(
-        WebSocketAdapterEvent.Message,
-        createCommandResult(event.id, false, 'restricted: missing claim tag'),
-      )
+      this.sendResult(event.id, false, 'invalid: join request requires a claim tag')
       return
     }
 
     const existingUser = await this.userRepository.findByPubkey(event.pubkey)
     if (existingUser?.isAdmitted) {
       logger('join request from %s: already admitted', event.pubkey)
-      this.webSocket.emit(
-        WebSocketAdapterEvent.Message,
-        createCommandResult(event.id, true, 'duplicate: you are already a member of this relay'),
-      )
+      this.sendResult(event.id, true, 'duplicate: you are already a member of this relay')
       return
     }
 
     const claimed = await this.inviteCodeRepository.claimCode(claimCode, event.pubkey)
     if (!claimed) {
       logger('join request from %s: claim failed', event.pubkey)
-      this.webSocket.emit(
-        WebSocketAdapterEvent.Message,
-        createCommandResult(event.id, false, 'restricted: invalid or expired invite code'),
-      )
+      this.sendResult(event.id, false, 'restricted: invalid or expired invite code')
       return
     }
 
-    const now = new Date()
-    await this.userRepository.admitUser(event.pubkey, now)
+    // Not transactional with claimCode: if admitUser throws, one code use is
+    // wasted. Acceptable — the alternative order (admit before claim) could
+    // admit users without a valid code.
+    await this.userRepository.admitUser(event.pubkey, new Date())
+
+    // Drop any cached "not admitted" verdict so the new member's next event
+    // isn't rejected by a stale admission cache entry.
+    try {
+      await this.cache.deleteKey(admissionCacheKey(event.pubkey))
+    } catch (error) {
+      logger('unable to invalidate admission cache for %s: %o', event.pubkey, error)
+    }
 
     const relayUrl = currentSettings.info?.relay_url ?? 'this relay'
     logger('admitted %s via invite code', event.pubkey)
-    this.webSocket.emit(
-      WebSocketAdapterEvent.Message,
-      createCommandResult(event.id, true, `info: welcome to ${relayUrl}!`),
-    )
+    this.sendResult(event.id, true, `info: welcome to ${relayUrl}!`)
+  }
+
+  // Join requests are deliberately not broadcast to subscribers: the claim
+  // tag would leak the invite code to anyone subscribed to kind 28934.
+  private sendResult(eventId: string, successful: boolean, message: string): void {
+    this.webSocket.emit(WebSocketAdapterEvent.Message, createEventCommandResult(eventId, successful, message))
   }
 }

src/handlers/event-strategies/leave-request-event-strategy.ts

@@ -1,9 +1,12 @@
-import { IUserRepository } from '../../@types/repositories'
-import { createCommandResult } from '../../utils/messages'
+import { ICacheAdapter, IWebSocketAdapter } from '../../@types/adapters'
+import { admissionCacheKey } from '../../constants/caching'
+import { createEventCommandResult } from '../../telemetry/event-metrics'
 import { createLogger } from '../../factories/logger-factory'
 import { Event } from '../../@types/event'
 import { IEventStrategy } from '../../@types/message-handlers'
-import { IWebSocketAdapter } from '../../@types/adapters'
+import { isNip43RequestTimestampValid } from '../../utils/nip43'
+import { isProtectedEvent } from '../../utils/event'
+import { IUserRepository } from '../../@types/repositories'
 import { Settings } from '../../@types/settings'
 import { WebSocketAdapterEvent } from '../../constants/adapter'
 
@@ -13,6 +16,7 @@ export class LeaveRequestEventStrategy implements IEventStrategy<Event, Promise<
   public constructor(
     private readonly webSocket: IWebSocketAdapter,
     private readonly userRepository: IUserRepository,
+    private readonly cache: ICacheAdapter,
     private readonly settings: () => Settings,
   ) {}
 
@@ -21,42 +25,52 @@ export class LeaveRequestEventStrategy implements IEventStrategy<Event, Promise<
 
     if (!currentSettings.nip43?.enabled) {
       logger('NIP-43 disabled, rejecting leave request from %s', event.pubkey)
-      this.webSocket.emit(
-        WebSocketAdapterEvent.Message,
-        createCommandResult(event.id, false, 'restricted: NIP-43 is not enabled on this relay'),
-      )
+      this.sendResult(event.id, false, 'restricted: NIP-43 is not enabled on this relay')
+      return
+    }
+
+    // NIP-43 requires leave requests to carry a NIP-70 "-" tag
+    if (!isProtectedEvent(event)) {
+      logger('leave request from %s missing "-" tag', event.pubkey)
+      this.sendResult(event.id, false, 'invalid: leave request requires a NIP-70 "-" tag')
+      return
+    }
+
+    if (!isNip43RequestTimestampValid(event)) {
+      logger('leave request from %s has stale created_at', event.pubkey)
+      this.sendResult(event.id, false, 'invalid: created_at is too far from the current time')
       return
     }
 
     if (!this.webSocket.getAuthenticatedPubkeys().has(event.pubkey)) {
       logger('unauthenticated leave request from %s', event.pubkey)
-      this.webSocket.emit(
-        WebSocketAdapterEvent.Message,
-        createCommandResult(event.id, false, 'restricted: authentication required (NIP-42)'),
-      )
+      this.sendResult(event.id, false, 'auth-required: authentication required (NIP-42)')
       return
     }
 
     // Avoids creating phantom user rows for non-members.
     const existingUser = await this.userRepository.findByPubkey(event.pubkey)
     if (!existingUser?.isAdmitted) {
       logger('leave request from %s: not currently admitted', event.pubkey)
-      this.webSocket.emit(
-        WebSocketAdapterEvent.Message,
-        createCommandResult(event.id, true, ''),
-      )
+      this.sendResult(event.id, true, '')
       return
     }
 
-    await this.userRepository.upsert({
-      pubkey: event.pubkey,
-      isAdmitted: false,
-    })
+    await this.userRepository.revokeAdmission(event.pubkey)
+
+    // Drop any cached "admitted" verdict so the departed member can't keep
+    // publishing on a stale admission cache entry.
+    try {
+      await this.cache.deleteKey(admissionCacheKey(event.pubkey))
+    } catch (error) {
+      logger('unable to invalidate admission cache for %s: %o', event.pubkey, error)
+    }
 
     logger('revoked admission for %s', event.pubkey)
-    this.webSocket.emit(
-      WebSocketAdapterEvent.Message,
-      createCommandResult(event.id, true, ''),
-    )
+    this.sendResult(event.id, true, '')
+  }
+
+  private sendResult(eventId: string, successful: boolean, message: string): void {
+    this.webSocket.emit(WebSocketAdapterEvent.Message, createEventCommandResult(eventId, successful, message))
   }
 }

src/handlers/request-handlers/root-request-handler.ts

@@ -60,6 +60,7 @@ export const rootRequestHandler = (request: Request, response: Response, next: N
       Boolean(settings.payments?.feeSchedules?.admission?.some((feeSchedule) => feeSchedule.enabled))
     const hasWriteRestriction =
       hasAdmissionRestriction ||
+      settings.nip43?.enabled === true ||
       (eventLimits?.eventId?.minLeadingZeroBits ?? 0) > 0 ||
       (eventLimits?.pubkey?.minLeadingZeroBits ?? 0) > 0 ||
       (eventLimits?.pubkey?.whitelist?.length ?? 0) > 0 ||
@@ -78,7 +79,11 @@ export const rootRequestHandler = (request: Request, response: Response, next: N
       pubkey,
       ...(self !== undefined ? { self } : {}),
       contact,
-      supported_nips: packageJson.supportedNips,
+      // NIP-43: clients MUST only send join requests to relays advertising 43,
+      // so only advertise it when the feature is actually enabled
+      supported_nips: settings.nip43?.enabled === true
+        ? packageJson.supportedNips
+        : packageJson.supportedNips.filter((nip: number) => nip !== 43),
       supported_nip_extensions: packageJson.supportedNipExtensions,
       supported_mips: packageJson.supportedMips,
       software: packageJson.repository.url,