Fix nip98 signing (validate proof), skip validating payload for media requests

src/middleware/auth98.ts

@@ -1,6 +1,11 @@
 import { type AppContext, type AppMiddleware } from '@/app.ts';
 import { HTTPException } from '@/deps.ts';
-import { buildAuthEventTemplate, parseAuthRequest, type ParseAuthRequestOpts } from '@/utils/nip98.ts';
+import {
+  buildAuthEventTemplate,
+  parseAuthRequest,
+  type ParseAuthRequestOpts,
+  validateAuthEvent,
+} from '@/utils/nip98.ts';
 import { localRequest } from '@/utils/web.ts';
 import { signNostrConnect } from '@/sign.ts';
 import { findUser, User } from '@/db/users.ts';
@@ -26,10 +31,10 @@ function auth98(opts: ParseAuthRequestOpts = {}): AppMiddleware {
 type UserRole = 'user' | 'admin';
 
 /** Require the user to prove their role before invoking the controller. */
-function requireRole(role: UserRole): AppMiddleware {
+function requireRole(role: UserRole, opts?: ParseAuthRequestOpts): AppMiddleware {
   return async (c, next) => {
     const header = c.req.headers.get('x-nostr-sign');
-    const proof = c.get('proof') || header ? await obtainProof(c) : undefined;
+    const proof = c.get('proof') || header ? await obtainProof(c, opts) : undefined;
     const user = proof ? await findUser({ pubkey: proof.pubkey }) : undefined;
 
     if (proof && user && matchesRole(user, role)) {
@@ -55,10 +60,15 @@ function matchesRole(user: User, role: UserRole): boolean {
 }
 
 /** Get the proof over Nostr Connect. */
-async function obtainProof(c: AppContext) {
+async function obtainProof(c: AppContext, opts?: ParseAuthRequestOpts) {
   const req = localRequest(c);
-  const event = await buildAuthEventTemplate(req);
-  return signNostrConnect(event, c);
+  const reqEvent = await buildAuthEventTemplate(req, opts);
+  const resEvent = await signNostrConnect(reqEvent, c);
+  const result = await validateAuthEvent(req, resEvent, opts);
+
+  if (result.success) {
+    return result.data;
+  }
 }
 
 export { auth98, requireRole };