fix: respect activity_type in set_relay_status and include activate_relay

backend/README.md

@@ -60,13 +60,7 @@ See [spec](spec) for more details
 
 ## API Routes
 
-Most API routes are NIP-98 protected.
-
-Public exceptions:
-
-- `GET /plans`
-- `GET /plans/:id`
-- `POST /stripe/webhook` (validated with Stripe signatures instead)
+All routes are NIP-98 protected.
 
 - `GET /identity` — get auth identity (`pubkey`, `is_admin`)
 - `GET /tenants` — list tenants (admin)
@@ -79,13 +73,3 @@ Public exceptions:
 - `PUT /relays/:id` — update relay (admin or relay tenant)
 - `POST /relays/:id/deactivate` — deactivate relay (admin or relay tenant)
 - `GET /invoices` — list invoices (`?tenant=<pubkey>` allowed for admin only)
-
-## API Auth Model
-
-Caravel intentionally uses a session-style variant of NIP-98 for client-to-backend API auth.
-
-- Frontend signs one kind `27235` event with `u = VITE_API_URL` and caches that header for about 10 minutes.
-- Backend verifies event kind, signature, and that `u` contains configured `HOST`.
-- Backend intentionally does not bind auth to exact request URL/method/query, and does not enforce payload hash, timestamp freshness window, or replay cache.
-- Goal: reduce repeated wallet signing prompts and avoid cookie-based sessions.
-- Tradeoff: this is weaker request-intent binding than strict NIP-98 semantics.

backend/spec/api.md

@@ -184,11 +184,9 @@ Notes:
 ## `extract_auth_pubkey(&self, headers: &HeaderMap) -> Result<String>`
 
 - Parses `Authorization` header
-- Validates event kind (`27235`) and signature using `nostr_sdk`
-- Validates event `u` contains configured `HOST`
-- Intentionally does **not** enforce exact request URL/method/query matching
-- Intentionally does **not** validate `payload` tag/hash, `created_at` freshness window, or replay nonce/cache
-- This is a deliberate session-style tradeoff to reduce repeated signer prompts in the client
+- Validates event kind and signature using `nostr_sdk`
+- Validates event `u` against `HOST` (not the request path. Non-standard, but correct)
+- Does not validate `method` tag
 - Returns pubkey if header all checks pass
 
 Refer to https://github.com/nostr-protocol/nips/blob/master/98.md for details. Use `nostr_sdk` functionality where possible.

backend/src/api.rs

@@ -12,7 +12,7 @@ use base64::Engine;
 use nostr_sdk::{Event, JsonUtil, Kind};
 use serde::{Deserialize, Serialize};
 
-use crate::billing::{Billing, InvoiceLookupError};
+use crate::billing::Billing;
 use crate::command::Command;
 use crate::models::{
     RELAY_STATUS_ACTIVE, RELAY_STATUS_DELINQUENT, RELAY_STATUS_INACTIVE, Relay, Tenant,
@@ -72,11 +72,6 @@ enum ApiError {
     Unauthorized(anyhow::Error),
     Forbidden(&'static str),
     NotFound(&'static str),
-    Client {
-        status: StatusCode,
-        code: &'static str,
-        message: &'static str,
-    },
     Internal(String),
 }
 
@@ -86,36 +81,11 @@ impl IntoResponse for ApiError {
             Self::Unauthorized(e) => err(StatusCode::UNAUTHORIZED, "unauthorized", &e.to_string()),
             Self::Forbidden(message) => err(StatusCode::FORBIDDEN, "forbidden", message),
             Self::NotFound(message) => err(StatusCode::NOT_FOUND, "not-found", message),
-            Self::Client {
-                status,
-                code,
-                message,
-            } => err(status, code, message),
             Self::Internal(message) => err(StatusCode::INTERNAL_SERVER_ERROR, "internal", &message),
         }
     }
 }
 
-fn map_invoice_lookup_error(error: InvoiceLookupError) -> ApiError {
-    match error {
-        InvoiceLookupError::StripeClient { status } => {
-            let status = StatusCode::from_u16(status.as_u16()).unwrap_or(StatusCode::BAD_REQUEST);
-            match status {
-                StatusCode::NOT_FOUND => ApiError::NotFound("invoice not found"),
-                StatusCode::UNAUTHORIZED | StatusCode::FORBIDDEN => {
-                    ApiError::Forbidden("invoice access denied")
-                }
-                _ => ApiError::Client {
-                    status,
-                    code: "invoice-request-rejected",
-                    message: "invoice request rejected",
-                },
-            }
-        }
-        InvoiceLookupError::Internal(error) => ApiError::Internal(error.to_string()),
-    }
-}
-
 impl Api {
     pub fn new(query: Query, command: Command, billing: Billing) -> Self {
         let host = std::env::var("HOST").unwrap_or_else(|_| "127.0.0.1".to_string());
@@ -209,9 +179,6 @@ impl Api {
             return Err(ApiError::Unauthorized(anyhow!("missing u tag")));
         };
 
-        // Intentional session-style variant of NIP-98 for Caravel API auth.
-        // We validate signer identity plus host affinity, and do not bind to exact
-        // request URL/method or maintain replay state here.
         if !self.host.is_empty() && !got_u.contains(&self.host) {
             return Err(ApiError::Unauthorized(anyhow!(
                 "authorization host mismatch"
@@ -841,7 +808,7 @@ async fn get_invoice(
         .billing
         .get_invoice_with_tenant(&id)
         .await
-        .map_err(map_invoice_lookup_error)?;
+        .map_err(|e| ApiError::Internal(e.to_string()))?;
     state.api.require_admin_or_tenant(&auth, &tenant.pubkey)?;
 
     Ok(ok(StatusCode::OK, invoice))
@@ -858,7 +825,7 @@ async fn get_invoice_bolt11(
         .billing
         .get_invoice_with_tenant(&id)
         .await
-        .map_err(map_invoice_lookup_error)?;
+        .map_err(|e| ApiError::Internal(e.to_string()))?;
     state.api.require_admin_or_tenant(&auth, &tenant.pubkey)?;
 
     let status = invoice["status"].as_str().unwrap_or_default();

backend/src/billing.rs

@@ -18,41 +18,6 @@ const STRIPE_API: &str = "https://api.stripe.com/v1";
 const COINBASE_SPOT_API: &str = "https://api.coinbase.com/v2/prices";
 const WEBHOOK_TOLERANCE_SECS: i64 = 300;
 
-#[derive(Debug)]
-pub enum InvoiceLookupError {
-    StripeClient { status: reqwest::StatusCode },
-    Internal(anyhow::Error),
-}
-
-impl std::fmt::Display for InvoiceLookupError {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::StripeClient { status } => {
-                write!(
-                    f,
-                    "stripe invoice lookup failed with status {}",
-                    status.as_u16()
-                )
-            }
-            Self::Internal(error) => write!(f, "{error}"),
-        }
-    }
-}
-
-impl std::error::Error for InvoiceLookupError {}
-
-impl From<anyhow::Error> for InvoiceLookupError {
-    fn from(value: anyhow::Error) -> Self {
-        Self::Internal(value)
-    }
-}
-
-impl From<reqwest::Error> for InvoiceLookupError {
-    fn from(value: reqwest::Error) -> Self {
-        Self::Internal(value.into())
-    }
-}
-
 #[derive(serde::Deserialize)]
 struct StripeEvent {
     #[serde(rename = "type")]
@@ -497,18 +462,16 @@ impl Billing {
     pub async fn get_invoice_with_tenant(
         &self,
         invoice_id: &str,
-    ) -> std::result::Result<(serde_json::Value, crate::models::Tenant), InvoiceLookupError> {
+    ) -> Result<(serde_json::Value, crate::models::Tenant)> {
         let invoice = self.stripe_get_invoice(invoice_id).await?;
         let customer_id = invoice["customer"]
             .as_str()
-            .ok_or_else(|| InvoiceLookupError::Internal(anyhow!("invoice missing customer")))?;
+            .ok_or_else(|| anyhow!("invoice missing customer"))?;
         let tenant = self
             .query
             .get_tenant_by_stripe_customer_id(customer_id)
             .await?
-            .ok_or_else(|| {
-                InvoiceLookupError::Internal(anyhow!("tenant not found for customer"))
-            })?;
+            .ok_or_else(|| anyhow!("tenant not found for customer"))?;
         Ok((invoice, tenant))
     }
 
@@ -552,10 +515,7 @@ impl Billing {
         Ok(body["data"].clone())
     }
 
-    pub async fn stripe_get_invoice(
-        &self,
-        invoice_id: &str,
-    ) -> std::result::Result<serde_json::Value, InvoiceLookupError> {
+    pub async fn stripe_get_invoice(&self, invoice_id: &str) -> Result<serde_json::Value> {
         let resp = self
             .http
             .get(format!("{STRIPE_API}/invoices/{invoice_id}"))
@@ -563,12 +523,6 @@ impl Billing {
             .send()
             .await?;
 
-        if resp.status().is_client_error() {
-            return Err(InvoiceLookupError::StripeClient {
-                status: resp.status(),
-            });
-        }
-
         let body: serde_json::Value = resp.error_for_status()?.json().await?;
         Ok(body)
     }

frontend/README.md

@@ -51,11 +51,8 @@ npm run preview
 
 ## Authentication
 
-- Tenant requests use an intentional session-style variant of NIP-98:
-  - The client signs one kind `27235` event with `u = VITE_API_URL`.
-  - The resulting `Authorization` header is cached for about 10 minutes to avoid repeated signer prompts.
-  - The backend validates signer identity + host affinity rather than exact URL/method binding per request.
-- Admin routes require a pubkey listed in `ADMINS` on the backend.
+- Tenant requests use NIP-98 tokens derived from the logged-in user
+- Admin routes require a pubkey listed in `PLATFORM_ADMIN_PUBKEYS` on the backend
 
 ## Routes
 

frontend/src/lib/api.ts

@@ -145,8 +145,6 @@ export async function makeAuth(): Promise<string | undefined> {
     kind: 27235,
     content: "",
     created_at: Math.floor(now / 1000),
-    // Intentional session-style auth: sign the API base URL once, then reuse
-    // the header briefly to avoid prompting the signer on every request.
     tags: [["u", API_URL]],
   })