refactor(buzz-relay): share NIP-FI assertion evaluation across adapters

[wpfleger96]

🤖 Stack: #7990 → #8028

The three production NIP-FI assertion-verification sites (the HTTP assertion guard in router.rs, check_nip_fi_at_upgrade in nip_fi_upgrade.rs, and admit_nip_fi_http in nip_fi_http.rs) each carried their own extract → verify → map-to-denial sequence, and HTTP admission and enforce_nip_fi_key_pairing each carried their own key-equality check. The admin disconnect route (POST /api/nip-fi/disconnect) kept a second copy of the header parser and hand-typed its denial bodies. Community binding and shadow mode both need to change exactly those decisions, so they now live in one place.

No behavior change. Every denial class, status code, body, header and log line is preserved, including deny_protected (503), the startup-race 503, transport-before-verifier precedence, NIP-98-before-assertion ordering, and guard + handler double verification.

• New relay-private nip_fi_core owns extract_bearer_token and http_denial (moved from nip_fi_http), evaluate_attached_assertion (the single verify_assertion call for all three adapters, returning a typed AssertionRejection), and asserted_key_matches (the pairing predicate; a claimless assertion never matches). http_denial and the disconnect route's plain-text renderer fall back to the bare denial status instead of panicking or answering an empty 200; both fallbacks are unreachable because every status and header value is a constant.
• Adapters keep their own mode short-circuits, exemptions, ordering, metrics and code() debug logs; the guard still logs nothing.
• The disconnect route parses its header with extract_bearer_token, renders header failures with http_denial, and renders every other rejection (malformed body, bad pubkey, no command verifier, every CommandError) through CommandError::http_status()/response_body(). Its check order (header → body → pubkey → verifier present → verify), DenySetFull warning and metric, success body and cross-pod publish are unchanged. The old Unicode whitespace check and the shared ASCII one agree on every reachable input, because HeaderValue::to_str only admits visible ASCII and tab.
• The 12 HTTP admission callers, 3 WS upgrade placements, deny-map checks, expected-URL constructors and the command/admin proof path are untouched.
• Characterization tests land before each refactor, green against the unmodified code, and pass unchanged after it. A routed test counts both verifications on one request (guard, then handler admission) and shows admission's own failure decides the response. Disconnect-route tests pin exact status, content type, challenge and body for every rejection, the observable check order, and that only DenySetFull increments buzz_nip_fi_disconnect_capacity_rejections_total. The test modules share one counting ScriptedVerifier from nip_fi_core::tests, and the session tests build connections through connection::tests::test_conn. nip_fi_core::tests:: is added to the unit selectors in Justfile and scripts/run-tests.sh.

🤖 Implemented by Hayt.

[github-actions]

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

• Exact PR diff: 15772c54f36d1ed68c9c77ffb63235acb5ee8a64...0211525d23d9edab2ee52542ed4d84e172abf03d
• Model: gpt-5.6-sol

💡 Click "edited" above to see earlier reviews for this PR.

---

Review Summary

Overall Risk: NONE

No concrete security, correctness, or reliability regressions were found in the authorized PR range. The NIP-FI refactor preserves transport validation, cryptographic verification, key pairing, denial mapping, and fail-closed behavior across HTTP, WebSocket, and command paths.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

• No additional limitations were reported.

---

_{Generated by Codex Security Review |
Requested by: @wpfleger96 |
Workflow run}