feat(relay): NIP-98 admin auth with Operator/Moderator roles and NIP-11 discovery

[wpfleger96]

Replaces the BUZZ_ADMIN_INSECURE_NO_AUTH insecure-flag model with a two-tier principal model (Operator/Moderator) backed by a config-union-plus-DB roster and gated by NIP-98 HTTP auth, and adds NIP-11 auto-discovery so clients never have to type the admin URL by hand.

Authentication (BUZZ_ADMIN_AUTH)

Replaces the deleted BUZZ_ADMIN_INSECURE_NO_AUTH=true variable with BUZZ_ADMIN_AUTH accepting token (default), disabled, or nip98. Startup fails closed on missing or malformed configuration; any unrecognized value or conflicting combination aborts startup. Host/Origin matching is retained in all modes as defense-in-depth.

Principal resolution (NIP-98 mode)

resolve_admin_principal() returns AdminPrincipal { pubkey, role, source }:

• Operator/Config — pubkey is in RELAY_OPERATOR_PUBKEYS
• Operator/OwnerFallback — pubkey equals RELAY_OWNER_PUBKEY and RELAY_OPERATOR_PUBKEYS is empty (config-evaluated, never from runtime DB rows)
• Operator or Moderator / Db — row in the relay_operators table
• No match → 403

Config always outranks DB, and None never falls through as a role. A malformed RELAY_OWNER_PUBKEY alongside nip98 is a startup error, since the owner key can be a break-glass root and silently discarding it would be a lockout.

Token and disabled modes

Read routes work in all modes. Mutation and staffing routes require nip98; token and disabled modes receive 403 from require_mutation_principal. disabled mode logs a WARN on every boot and relies entirely on network-layer controls.

Report resolution and feedback

POST /reports/{id}/resolve is an enforcement state machine with idempotency:

• Decision-only (dismiss/escalate): CAS open→terminal plus an audit row in one transaction.
• Enforcement (delete/kick/ban/timeout): claims the report (open→processing), runs the durable mutation, then finalizes to resolved. Crash-safe — re-drive resumes at the step marker and converges to exactly-one enforcement, fenced by a lease and a claim token on the outbox.

PATCH /feedback/{id} updates product_feedback.status (new/reviewed/archived); requires nip98.

Staffing endpoints

GET/PUT/DELETE /operators/{pubkey} are Operator-only. PUT/DELETE against a config-backed pubkey returns 409 Conflict. GET /operators returns the union of config and DB principals with per-entry source attribution.

Probe endpoint

GET /probe reports auth mode, role, source, canAct, and canStaff for the desktop console.

NIP-11 admin-API auto-discovery

The NIP-11 relay-information document gains an optional admin_api field carrying the canonical admin origin (scheme://host[:port], no path), present iff the admin surface is configured (BUZZ_ADMIN_HOST set) and omitted entirely otherwise. The scheme follows the same loopback rule as NIP-98 u-tag verification (http for localhost/127.x/::1, else https), extracted into a shared scheme_for_host helper so the advertised origin and the origin the relay verifies against can never diverge. Clients read this to auto-discover the admin console instead of requiring manual URL entry.

Loopback example:

{ "admin_api": "http://127.0.0.1:3000" }

Operator API origin decoupling

RELAY_OPERATOR_API_ORIGIN is no longer required at boot when RELAY_OPERATOR_PUBKEYS is set. The allowlist is shared by the NIP-98 admin console (which needs no origin) and the community-provisioning endpoints (which do). Configuring the admin console no longer drags in an origin the operator does not use: the relay logs a WARN naming the affected feature, and the provisioning endpoints (POST /operator/communities) fail closed at request time — authorize_operator_request rejects with a clean 500 before any replay or DB access — until RELAY_OPERATOR_API_ORIGIN is set.

Migrations

• 0029_relay_operators.sql — relay_operators table (deployment-global; registered in _operator_global_tables), actor_authority on moderation_actions, processing status plus active_action_id on moderation_reports, status on product_feedback.
• 0030_relay_admin_actions.sql — relay_admin_actions enforcement-action table with a request_id idempotency key and a step_marker for crash recovery.
• 0031_relay_admin_action_lease.sql — lease fencing for the action worker.
• 0032_relay_admin_outbox_claim_token.sql — fenced claim token on the outbox worker.

Documentation

docs/admin/README.md documents the full principal model, NIP-98 event requirements (query string, method tag, payload tag for body mutations), owner-fallback semantics, role/source table, capabilities by role, roster management, the startup error matrix, the NIP-11 auto-discovery field, and the origin decoupling. .env.example and deploy/compose/.env.example describe RELAY_OPERATOR_API_ORIGIN and the admin console/provisioning split.

---

Related: block/buzz#4768 (desktop admin console consuming the admin_api field), squareup/bb-public#339 (Phase 4 rollout config)

[kalvinnchau]

Re-reviewed at d014e40. The fail-closed config contract, constant-time bearer validation, host/origin ordering, insecure network-boundary mode, dashboard token lifecycle, authenticated attachment fetches, and CSP/static routing are coherent and covered. Deployment dependency is external: land bb-public#339 and wait for Argo rollout before deploying this relay image.