beacon: firehose phase 1 — validated profiles hose (kind 0)

Introduce a composable 'hose' seam for the firehose indexer and ship the
first concrete hose: profiles (kind 0).

- src/hoses/profiles.js: declares its kinds, owns its Mongo indexes
  (pubkey, created_at, and the content_text search index so /api/search
  works on a fresh deploy), and verifies each event's schnorr signature
  (NIP-01 id recompute + @noble/curves) before a latest-wins upsert.
  A relay can no longer inject a forged did:nostr profile.
- src/indexer.js: generic hose registry — subscribe to the union of
  registered hoses' kinds and dispatch by kind. Kind 0 routes through the
  profiles hose; kinds 3 and 10002 keep the legacy upsert path until
  their own phases (no behaviour change).
- deps: @noble/curves, @noble/hashes (keeps the no-nostr-tools approach).
- test/profiles-hose.test.js: sign real kind-0 events and assert
  accept/reject (valid, empty content, tampered content/id, forged sig,
  non-hex pubkey, wrong kind, non-JSON content, malformed input).

Closes #7

Author: melvincarvalho

README.md

@@ -39,7 +39,9 @@ npm run serve               # read API only
 
 ## Status
 
-v0 — MVP: indexer + read API + the regression-compatible schema. DID-document resolution endpoint (`/.well-known/did/nostr/:pubkey.json` via jss's `buildDidDocument`) is the next step, per the RFC.
+v0 — MVP: indexer + read API + the regression-compatible schema, plus the DID-document resolution endpoint (`/.well-known/did/nostr/:pubkey.json` via jss's `buildDidDocument`) and a `/relays` health directory.
+
+The indexer is being reworked into composable **hoses** (`src/hoses/`). Phase 1 is the **profiles hose** (kind 0): it schnorr-verifies each event before storing it, so a relay can't inject a forged `did:nostr` profile, and owns its Mongo indexes (incl. the `content_text` search index). Follows (kind 3) and relay lists (kind 10002) still use the raw upsert path until their phases.
 
 ## License
 

package-lock.json

@@ -3,14 +3,18 @@
   "version": "0.0.1",
   "type": "module",
   "description": "did:nostr social-graph indexer (profiles + follows + relay lists) on MongoDB. Same schema as nostr-beacon for regression; DID-doc generation delegates to jss buildDidDocument per RFC.",
-  "bin": { "beacon": "index.js" },
+  "bin": {
+    "beacon": "index.js"
+  },
   "scripts": {
     "test": "node --test",
     "start": "node index.js",
     "index": "node -e \"import('./src/indexer.js').then(m => m.runIndexer())\"",
     "serve": "node -e \"import('./src/server.js').then(m => m.startServer())\""
   },
   "dependencies": {
+    "@noble/curves": "^2.2.0",
+    "@noble/hashes": "^2.2.0",
     "dotenv": "^16.4.5",
     "express": "^4.19.2",
     "mongodb": "^6.8.0"

package.json

@@ -0,0 +1,72 @@
+// The profiles hose — first concrete "hose" on the firehose indexer.
+//
+// A hose is a small, self-contained ingest module: it declares the event
+// `kinds` it wants, ensures its own Mongo indexes, and ingests one raw event
+// at a time. The indexer subscribes to the union of all hoses' kinds and
+// dispatches each event to the matching hose. Later phases add sibling hoses
+// (follows, relay lists, relay health) without touching the indexer's core.
+//
+// This hose handles kind 0 (profile metadata). Unlike a blind upsert, it
+// verifies each event's schnorr signature before trusting it — beacon is an
+// identity/SSO substrate, so a malicious relay must not be able to inject a
+// forged did:nostr profile.
+import { schnorr } from '@noble/curves/secp256k1.js';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { hexToBytes, bytesToHex } from '@noble/hashes/utils.js';
+import { COLLECTIONS } from '../db.js';
+
+const KIND = 0;
+const HEX64 = /^[0-9a-f]{64}$/;
+const HEX128 = /^[0-9a-f]{128}$/;
+const enc = new TextEncoder();
+
+// NIP-01 event id: sha256 of the canonical serialization
+// [0, pubkey, created_at, kind, tags, content].
+function eventId(e) {
+  const serial = JSON.stringify([0, e.pubkey, e.created_at, e.kind, e.tags || [], e.content ?? '']);
+  return bytesToHex(sha256(enc.encode(serial)));
+}
+
+/**
+ * Structural + cryptographic validation of a raw kind-0 event.
+ * Rejects wrong kind, malformed fields, non-JSON content, a tampered `id`,
+ * and any event whose schnorr signature doesn't verify against its pubkey.
+ */
+export function verifyEvent(e) {
+  if (!e || e.kind !== KIND) return false;
+  if (typeof e.pubkey !== 'string' || !HEX64.test(e.pubkey)) return false;
+  if (!Number.isFinite(e.created_at)) return false;
+  if (typeof e.sig !== 'string' || !HEX128.test(e.sig)) return false;
+  // kind-0 content is a JSON object; empty string is allowed (treated as {}).
+  if (e.content) { try { JSON.parse(e.content); } catch { return false; } }
+  const id = eventId(e);
+  if (e.id && e.id !== id) return false; // claimed id must match the content
+  try { return schnorr.verify(hexToBytes(e.sig), hexToBytes(id), hexToBytes(e.pubkey)); }
+  catch { return false; }
+}
+
+export default {
+  name: 'profiles',
+  kinds: [KIND],
+
+  // Own the collection's indexes so a fresh deploy is fully functional:
+  // pubkey (lookup/dedupe), created_at (recency), and the text index that
+  // /api/search relies on. Tolerate a pre-existing index spec (codes 85/86).
+  async ensureIndexes(db) {
+    const col = db.collection(COLLECTIONS[KIND]);
+    const ok = (e) => { if (e?.code !== 85 && e?.code !== 86) throw e; };
+    await col.createIndex({ pubkey: 1 }).catch(ok);
+    await col.createIndex({ created_at: -1 }).catch(ok);
+    await col.createIndex({ content: 'text' }, { name: 'content_text' }).catch(ok);
+  },
+
+  /** Verify, then latest-wins upsert of the raw event. Returns true if stored. */
+  async ingest(event, db) {
+    if (!verifyEvent(event)) return false;
+    const col = db.collection(COLLECTIONS[KIND]);
+    const existing = await col.findOne({ pubkey: event.pubkey }, { projection: { created_at: 1 } });
+    if (existing && existing.created_at >= event.created_at) return false;
+    await col.updateOne({ pubkey: event.pubkey }, { $set: { ...event } }, { upsert: true });
+    return true;
+  },
+};

src/hoses/profiles.js

@@ -5,12 +5,17 @@
 // Subscribes to kind 0 (profile), 3 (follows / social graph), 10002 (relay
 // list) and upserts each raw event into Mongo.
 import { upsertEvent, connect } from './db.js';
+import profilesHose from './hoses/profiles.js';
 import 'dotenv/config';
 
 const RELAYS = (process.env.RELAYS || 'wss://relay.damus.io,wss://nos.lol,wss://relay.primal.net')
   .split(',').map((s) => s.trim()).filter(Boolean);
 
-const KINDS = [0, 3, 10002];
+// Registered hoses (phase 1: profiles only). Each owns its kinds + ingest.
+// Kinds with no hose fall back to the legacy raw upsert until their own phase.
+const HOSES = [profilesHose];
+const hoseFor = (kind) => HOSES.find((h) => h.kinds.includes(kind));
+const KINDS = [...new Set([...HOSES.flatMap((h) => h.kinds), 3, 10002])];
 const SUB_ID = 'beacon';
 const RECONNECT_MS = 3000;
 
@@ -34,13 +39,16 @@ function connectRelay(url, onEvent) {
 }
 
 export async function runIndexer() {
-  await connect();
+  const db = await connect();
+  for (const h of HOSES) await h.ensureIndexes(db);
   console.log(`[beacon] indexing kinds ${KINDS.join(',')} from ${RELAYS.length} relays`);
   const onEvent = async (event) => {
     try {
-      if (await upsertEvent(event)) console.log(`[beacon] kind ${event.kind}  ${String(event.pubkey).slice(0, 12)}…`);
+      const hose = hoseFor(event.kind);
+      const stored = hose ? await hose.ingest(event, db) : await upsertEvent(event);
+      if (stored) console.log(`[beacon] kind ${event.kind}  ${String(event.pubkey).slice(0, 12)}…`);
     } catch (e) {
-      console.error('[beacon] upsert error:', e.message);
+      console.error('[beacon] ingest error:', e.message);
     }
   };
   const stoppers = RELAYS.map((url) => connectRelay(url, onEvent));

src/indexer.js

@@ -0,0 +1,68 @@
+// Profiles hose: validation + signature verification.
+// We sign real kind-0 events with a known key, then assert accept/reject.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { schnorr } from '@noble/curves/secp256k1.js';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { hexToBytes, bytesToHex } from '@noble/hashes/utils.js';
+import { verifyEvent } from '../src/hoses/profiles.js';
+
+const enc = new TextEncoder();
+const PRIV = hexToBytes('0000000000000000000000000000000000000000000000000000000000000001');
+const PUBKEY = bytesToHex(schnorr.getPublicKey(PRIV));
+
+// Build a properly-signed kind-0 event.
+function signed({ content = '{"name":"alice"}', created_at = 1000, kind = 0 } = {}) {
+  const base = { pubkey: PUBKEY, created_at, kind, tags: [], content };
+  const id = bytesToHex(sha256(enc.encode(JSON.stringify([0, base.pubkey, base.created_at, base.kind, base.tags, base.content]))));
+  const sig = bytesToHex(schnorr.sign(hexToBytes(id), PRIV));
+  return { ...base, id, sig };
+}
+
+test('accepts a validly-signed kind-0 event', () => {
+  assert.equal(verifyEvent(signed()), true);
+});
+
+test('accepts empty content (treated as {})', () => {
+  assert.equal(verifyEvent(signed({ content: '' })), true);
+});
+
+test('rejects tampered content (sig no longer matches)', () => {
+  const e = signed();
+  e.content = '{"name":"mallory"}';
+  assert.equal(verifyEvent(e), false);
+});
+
+test('rejects a tampered id', () => {
+  const e = signed();
+  e.id = 'ff' + e.id.slice(2);
+  assert.equal(verifyEvent(e), false);
+});
+
+test('rejects a forged/garbage signature', () => {
+  const e = signed();
+  e.sig = 'f'.repeat(128);
+  assert.equal(verifyEvent(e), false);
+});
+
+test('rejects non-hex pubkey', () => {
+  const e = signed();
+  e.pubkey = 'npub1xxx';
+  assert.equal(verifyEvent(e), false);
+});
+
+test('rejects the wrong kind', () => {
+  assert.equal(verifyEvent(signed({ kind: 3 })), false);
+});
+
+test('rejects non-JSON content', () => {
+  // Re-sign so the sig is valid but content is not JSON — must still reject.
+  const e = signed({ content: 'not json{' });
+  assert.equal(verifyEvent(e), false);
+});
+
+test('rejects malformed input without throwing', () => {
+  for (const bad of [null, undefined, {}, { kind: 0 }, 42, 'x']) {
+    assert.equal(verifyEvent(bad), false);
+  }
+});