Improve Nostr profile/relay settings forms

* Mark input fields as "added" when values were auto-added
* Add suggested values for existing fields (NIP-05/LUD-16)

.env.example

@@ -87,6 +87,7 @@
 # NOSTR_PRIVATE_KEY='123456abcdef...'
 # NOSTR_PUBLIC_KEY='123456abcdef...'
 # NOSTR_RELAY_URL='wss://nostr.kosmos.org'
+# NOSTR_BLOSSOM_SERVER_URL='https://blossom.kosmos.org'
 
 # RS_STORAGE_URL='https://storage.kosmos.org'
 # RS_REDIS_URL='redis://localhost:6379/2'

AGENTS.md

@@ -7,16 +7,13 @@ ejabberd, Discourse, Mastodon, remoteStorage, Nostr, LNDHub, and BTCPay.
 ## Development environment
 
 Development runs in Docker Compose — run all commands against the `web` container.
-Start services: `docker compose up` (web, ldap, redis, garage, liquor-cabinet, strfry).
+Start services: `docker compose up` (web, ldap, redis, minio, liquor-cabinet, strfry).
 The `web` service runs `bin/dev` (foreman: Puma + Tailwind CSS watcher) and embeds
 Solid Queue workers (`SOLID_QUEUE_IN_PUMA=true`).
 
-First-time LDAP and database setup is automated: the `ldap-init` service
-creates the 389ds back-end, then the `web` entrypoint seeds LDAP and the
-databases on first start and runs `db:prepare` on every boot. Manual
-equivalents: `docker compose exec ldap dsconf localhost backend create
---suffix="dc=kosmos,dc=org" --be-name="dev"` and `docker compose run --rm web
-bin/rails ldap:setup`.
+First-time LDAP setup (after creating the 389ds backend once):
+`docker compose exec ldap dsconf localhost backend create --suffix="dc=kosmos,dc=org" --be_name="dev"`
+then `docker compose run web bin/rails ldap:setup`.
 
 ## Common commands (prefix with `docker compose exec web`)
 

Gemfile

@@ -43,7 +43,6 @@ gem 'flipper-ui'
 gem 'gpgme', '~> 2.0.24'
 gem 'zbase32', '~> 0.1.1'
 gem 'kramdown'
-gem 'device_detector'
 
 # HTTP requests
 gem 'faraday'

Gemfile.lock

@@ -136,7 +136,6 @@ GEM
       database_cleaner-core (~> 2.0.0)
     database_cleaner-core (2.0.1)
     date (3.5.1)
-    device_detector (1.1.3)
     devise (5.0.4)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
@@ -544,7 +543,6 @@ DEPENDENCIES
   capybara
   cssbundling-rails
   database_cleaner
-  device_detector
   devise (~> 5.0)
   devise_ldap_authenticatable
   discourse_api

README.md

@@ -14,14 +14,13 @@ so:
 
 1. Make sure [Docker Compose is installed][1] and Docker is running (included in
    Docker Desktop)
-2. Run `docker compose up --build` and wait until all services have started
+3. Run `docker compose up --build` and wait until all services have started
    (389ds might take an extra minute to be ready). This will take a while when
    running for the first time, so you might want to do something else in the
    meantime.
-
-On the first start, the `ldap-init` service creates the 389ds back-end, and the
-`web` container then seeds the LDAP directory and the databases automatically.
-On every start, `web` also applies any pending database migrations.
+4. `docker-compose exec ldap dsconf localhost backend create --suffix="dc=kosmos,dc=org" --be-name="dev"`
+5. `docker compose run web rails ldap:setup`
+6. `docker compose run web rails db:setup`
 
 After these steps, you should have a working Rails app with a handful of test
 users running on [http://localhost:3000](http://localhost:3000).
@@ -72,12 +71,15 @@ containers you want to run to the `up` command, like so:
 
 #### LDAP server
 
-On first start, the `ldap-init` service creates the dirsrv back-end
-automatically, and the `web` container then seeds it with development entries.
-To do either step manually (for example, after changing the setup), run:
+After creating the Docker container for the first time (or after deleting it),
+you need to run the following command once, in order to create the dirsrv
+back-end:
 
-    docker compose exec ldap dsconf localhost backend create --suffix="dc=kosmos,dc=org" --be-name="dev"
-    docker compose run --rm web bin/rails ldap:setup
+    docker-compose exec ldap dsconf localhost backend create --suffix="dc=kosmos,dc=org" --be-name="dev"
+
+Now you can seed the back-end with data using this Rails task:
+
+    bundle exec rails ldap:setup
 
 The setup task will first delete any existing entries in the directory tree
 ("dc=kosmos,dc=org"), and then create our development entries.
@@ -86,42 +88,20 @@ Note that all 389ds data is stored in the `389ds-data` volume. So if you want
 to start over with a fresh installation, delete both that volume as well as the
 container.
 
-To reset the development environment completely, remove all volumes plus the
-generated database files and the first-run marker, then start over:
+#### Minio / remoteStorage
 
-    docker compose down -v
-    rm -f db/*.sqlite3 tmp/.setup-complete
-    docker compose up --build
+If you want to run remoteStorage accounts locally, you will have to create the
+respective bucket first. With the `minio` container running (run by default
+when using Docker Compose), follow these steps:
 
-#### Garage / remoteStorage
-
-remoteStorage accounts use the `garage` S3-compatible object store. On first
-start, Garage automatically configures a single-node cluster and creates the
-`remotestorage` bucket together with a `dev-key1` access key (secret
-`1234567890123456`), so no manual setup is required.
-
-If you want to run remoteStorage accounts locally, the `garage` container is
-started by default when using Docker Compose. To run just the remoteStorage
-stack:
-
-* `docker compose up web redis garage liquor-cabinet`
-
-The S3 API is available at http://localhost:3900 (region `garage`). If you want
-to start over with a fresh storage, delete the `garage-data` volume as well as
-the container.
-
-#### Accessing remoteStorage from another machine
-
-remoteStorage clients force HTTPS for any host except `localhost`, and browsers
-block plain-HTTP requests to a LAN IP as mixed content. To connect to the dev
-remoteStorage from a browser on another machine (including production apps such
-as Inspektor), forward the ports over SSH and connect as `localhost`:
-
-    ssh -N -L 3000:localhost:3000 -L 4567:localhost:4567 <user>@<dev-host>
-
-Then use `<user>@localhost:3000` as the remoteStorage address in the client.
-WeFinger discovery and storage requests are served through the forwarded ports,
-so no TLS setup is needed.
+* `docker compose up web redis minio liquor-cabinet`
+* Head to http://localhost:9001 and log in with user `minioadmin`, password
+  `minioadmin`
+* Create a new bucket called `remotestorage` (or whatever you
+  change the `S3_BUCKET` config to)
+* Create a new key with ID "dev-key" and secret "123456789" (or whatever you
+  change `S3_ACCESS_KEY` and `S3_SECRET_KEY` to). Leave the policy field empty,
+  as it will automatically allow access to the bucket you created.
 
 ### Adding npm modules to use with Stimulus controllers
 

app/components/form_elements/fieldset_component.html.erb

@@ -12,7 +12,7 @@
     </p>
     <% end %>
 
-    <%= tag.p class: "flex gap-x-1", data: {
+    <%= tag.div class: "flex gap-x-1", data: {
                 controller: @resettable ? "settings--resettable-field" : nil,
               } do %>
       <%= content %>

app/components/rs_auth_component.html.erb

@@ -1,28 +1,27 @@
-<div class="h-full" data-controller="modal" data-action="keydown.esc->modal#close">
-  <button type="button"
-          class="rs-auth-card group flex h-full w-full items-center gap-4 rounded-lg border
-                 border-gray-200 bg-white p-5 text-left transition
-                 hover:border-gray-400 hover:bg-gray-50
-                 focus:outline-none focus-visible:ring-2 focus-visible:ring-blue-500"
-          data-action="click->modal#open">
-    <div class="h-14 w-14 flex-none">
-      <%= render AppCatalog::WebAppIconComponent.new(web_app: @web_app) %>
-    </div>
-
-    <div class="min-w-0 flex-grow">
-      <h4 class="text-lg font-bold truncate"><%= name %></h4>
-      <p class="text-sm text-gray-500 truncate"><%= @auth.client_id %></p>
-      <p class="mt-2 text-sm text-gray-600">
-        <%= device_summary %>
-        <span class="mx-1 text-gray-300">·</span>
-        <%= category_summary %>
-      </p>
-    </div>
-
-    <span class="flex-none text-gray-300 transition group-hover:text-gray-500" aria-hidden="true">
-      <%= render partial: "icons/chevron-right", locals: { custom_class: "h-5 w-5" } %>
-    </span>
-  </button>
-
-  <%= render RsAuthDetailsModalComponent.new(authorizations: @authorizations) %>
+<div class="flex items-center gap-4">
+  <div class="h-16 w-16 flex-none">
+    <%= render AppCatalog::WebAppIconComponent.new(web_app: @web_app) %>
+  </div>
+  <div class="flex-grow">
+    <h4 class="mb-1 text-lg font-bold">
+      <%= @web_app&.name || @auth.app_name %>
+    </h4>
+    <p class="text-sm text-gray-500">
+      <%= @auth.client_id %>
+    </p>
+  </div>
+  <%= render DropdownComponent.new do %>
+    <%= render DropdownLinkComponent.new(
+          href: launch_app_services_storage_rs_auth_url(@auth),
+          open_in_new_tab: true
+        ) do %>
+      Launch app
+    <% end %>
+    <%= render DropdownLinkComponent.new(
+          href: revoke_services_storage_rs_auth_url(@auth),
+          separator: true, add_class: "text-red-700"
+        ) do %>
+      Revoke access
+    <% end %>
+  <% end %>
 </div>

app/components/rs_auth_component.rb

@@ -1,34 +1,8 @@
 # frozen_string_literal: true
 
 class RsAuthComponent < ViewComponent::Base
-  include OauthHelper
-
-  def initialize(authorizations:)
-    @authorizations = authorizations
-    @auth = authorizations.first
-    @web_app = @auth.web_app
-  end
-
-  def name
-    @web_app&.name.presence || @auth.app_name.presence || @auth.client_id
-  end
-
-  def root_access?
-    (@auth.permissions & [":r", ":rw"]).any?
-  end
-
-  def category_summary
-    return "All categories and files" if root_access?
-
-    count = @auth.permissions.size
-    "#{count} #{'category'.pluralize(count)}"
-  end
-
-  def device_count
-    @authorizations.map { |auth| auth.device_name.presence || "Unknown device" }.uniq.size
-  end
-
-  def device_summary
-    "#{device_count} #{'device'.pluralize(device_count)}"
+  def initialize(auth:)
+    @auth = auth
+    @web_app = auth.web_app
   end
 end

app/components/rs_auth_details_modal_component.html.erb

@@ -1,42 +0,0 @@
-<%= render ModalComponent.new do %>
-  <div class="flex items-center gap-4">
-    <div class="h-14 w-14 flex-none">
-      <%= render AppCatalog::WebAppIconComponent.new(web_app: @web_app) %>
-    </div>
-    <div class="min-w-0">
-      <h4 class="text-lg font-bold truncate"><%= name %></h4>
-      <p class="text-sm text-gray-500 truncate"><%= @auth.client_id %></p>
-    </div>
-  </div>
-
-  <h5 class="mt-6 mb-2 text-xs font-semibold uppercase tracking-wide text-gray-500">
-    Access
-  </h5>
-  <%= render RsScopeListComponent.new(scopes: @auth.permissions, root: root_access?) %>
-
-  <h5 class="mt-6 mb-2 text-xs font-semibold uppercase tracking-wide text-gray-500">
-    Connected devices
-  </h5>
-  <ul class="divide-y divide-gray-100 rounded border border-gray-200" data-turbo-prefetch="false">
-    <% @authorizations.each do |auth| %>
-      <li class="flex items-center justify-between gap-4 px-4 py-3">
-        <div class="min-w-0">
-          <p class="truncate text-sm font-medium text-gray-900"><%= device_name(auth) %></p>
-          <p class="truncate text-xs text-gray-500">
-            Connected <%= auth.created_at.strftime('%-d %b %Y') %>
-            <span class="mx-1">&middot;</span>
-            <span class="<%= "text-red-700" if auth.expired? %>"><%= status_label(auth) %></span>
-          </p>
-        </div>
-        <%= button_to "Revoke access", services_storage_rs_auth_path(auth), method: :delete,
-              form: { class: "flex-none" },
-              class: "whitespace-nowrap text-sm text-red-700 hover:underline bg-transparent border-0 p-0 cursor-pointer" %>
-      </li>
-    <% end %>
-  </ul>
-
-  <div class="mt-6 flex flex-col sm:flex-row gap-2 sm:justify-end">
-    <%= link_to "Launch app", launch_app_services_storage_path(@auth.client_id),
-          class: "btn-md btn-blue", target: "_blank", rel: "noopener", data: { turbo: false } %>
-  </div>
-<% end %>

app/components/rs_auth_details_modal_component.rb

@@ -1,30 +0,0 @@
-# frozen_string_literal: true
-
-class RsAuthDetailsModalComponent < ViewComponent::Base
-  include OauthHelper
-
-  def initialize(authorizations:)
-    @authorizations = authorizations
-    @auth = authorizations.first
-    @web_app = @auth.web_app
-  end
-
-  def name
-    @web_app&.name.presence || @auth.app_name.presence || @auth.client_id
-  end
-
-  def root_access?
-    (@auth.permissions & [":r", ":rw"]).any?
-  end
-
-  def device_name(auth)
-    auth.device_name.presence || "Unknown device"
-  end
-
-  def status_label(auth)
-    return "Never expires" if auth.expire_at.blank?
-    return "Expired on #{auth.expire_at.strftime('%-d %b %Y')}" if auth.expired?
-
-    "Expires #{auth.expire_at.strftime('%-d %b %Y')}"
-  end
-end

app/components/rs_scope_list_component.html.erb

@@ -1,25 +0,0 @@
-<% if @root %>
-  <p class="scope text-lg">
-    <span class="text-red-700">
-      <%= render partial: "icons/alert-triangle",
-            locals: { custom_class: "inline-block align-bottom mr-1.5" } %>
-      All categories and files
-    </span>
-    <% if read_only? %>
-      <span class="text-sm text-gray-500">(read only)</span>
-    <% end %>
-  </p>
-<% else %>
-  <% @scopes.each do |scope| %>
-    <p class="scope text-gray-600">
-      <span class="text-lg">
-        <%= render partial: "icons/folder",
-              locals: { custom_class: "inline-block align-bottom mr-1.5" } %>
-        <%= scope_name(scope) %>
-      </span>
-      <% if scope_permissions(scope) == "r" %>
-        <span>(read only)</span>
-      <% end %>
-    </p>
-  <% end %>
-<% end %>

app/components/rs_scope_list_component.rb

@@ -1,14 +0,0 @@
-# frozen_string_literal: true
-
-class RsScopeListComponent < ViewComponent::Base
-  include OauthHelper
-
-  def initialize(scopes:, root: false)
-    @scopes = scopes
-    @root = root
-  end
-
-  def read_only?
-    @scopes.include?(":r")
-  end
-end

app/components/settings/nostr_edit_profile_component.html.erb

@@ -0,0 +1,156 @@
+<div class="w-[72vw] md:w-[500px]">
+  <header class="absolute z-10 h-36 sm:h-44 inset-x-1 top-1 rounded-t
+                 bg-cover bg-center bg-gray-50"
+          style="background-image: url('<%= @profile["banner"]%>');">
+    <div class="inline-block z-20 size-28 sm:size-32 ml-4 mt-16 sm:mt-20">
+    <% if @profile["picture"].present? %>
+      <img src="<%= @profile["picture"] %>"
+           class="inline-block size:28 sm:size-32 rounded-full border-2 border-white" />
+    <% else %>
+      <span class="inline-block size:28 sm:size-32 overflow-hidden rounded-full border-2 border-white bg-gray-100">
+        <svg class="size-full text-gray-300" fill="currentColor" viewBox="0 0 24 24">
+          <path d="M24 20.993V24H0v-2.996A14.977 14.977 0 0112.004 15c4.904 0 9.26 2.354 11.996 5.993zM16.002 8.999a4 4 0 11-8 0 4 4 0 018 0z" />
+        </svg>
+      </span>
+    <% end %>
+    </div>
+  </header>
+  <main class="mt-44 sm:mt-52">
+    <%= form_for(@user, url: setting_path(:nostr), html: { :method => :put }) do |f| %>
+      <%= render FormElements::FieldsetComponent.new(tag: "div", title: "Display name") do %>
+        <%= f.text_field :display_name, value: @display_name, class: "w-full sm:w-3/5" %>
+        <% if @validation_errors.present? && @validation_errors[:display_name].present? %>
+          <p class="error-msg mt-2"><%= @validation_errors[:display_name].first %></p>
+        <% end %>
+      <% end %>
+      <%= render FormElements::FieldsetComponent.new(tag: "div", title: "Nostr address (NIP-05)") do %>
+        <% if @nip05_state[:status] == :added %>
+          <div class="w-full sm:w-3/5 flex flex-col" data-controller="field-suggestion"
+               data-field-suggestion-added-value-value="<%= @user.address %>">
+            <div class="relative">
+              <%= f.text_field :nip05_address, value: @nip05_state[:value],
+                    data: {
+                      :'field-suggestion-target' => "input",
+                      action: "input->field-suggestion#checkAdded"
+                    },
+                    class: "w-full pr-16 border-emerald-500 ring-1 ring-emerald-500 focus:border-emerald-500 focus:ring-emerald-500 bg-emerald-50/20" %>
+              <span class="absolute inset-y-0 right-2.5 flex items-center pointer-events-none"
+                    data-field-suggestion-target="badge">
+                <span class="rounded-full bg-emerald-100 px-2 py-0.5 text-xs font-semibold text-emerald-800">
+                  added
+                </span>
+              </span>
+            </div>
+            <div class="mt-1.5 flex items-center justify-between text-xs text-amber-800 bg-amber-50 rounded px-2.5 py-1.5 border border-amber-200 hidden"
+                 data-field-suggestion-target="suggestion">
+              <span>Account address: <strong><%= @user.address %></strong></span>
+              <button type="button" class="font-semibold text-blue-600 hover:text-blue-800 underline ml-2"
+                      data-action="click->field-suggestion#apply"
+                      data-field-suggestion-value-param="<%= @user.address %>">
+                Use this
+              </button>
+            </div>
+          </div>
+        <% elsif @nip05_state[:status] == :different %>
+          <div class="w-full sm:w-3/5 flex flex-col" data-controller="field-suggestion"
+               data-field-suggestion-added-value-value="<%= @nip05_state[:suggested] %>">
+            <div class="relative">
+              <%= f.text_field :nip05_address, value: @nip05_state[:value],
+                    data: {
+                      :'field-suggestion-target' => "input",
+                      action: "input->field-suggestion#checkAdded"
+                    },
+                    class: "w-full pr-20 border-amber-400 ring-1 ring-amber-400 focus:border-amber-400 focus:ring-amber-400" %>
+              <span class="absolute inset-y-0 right-2.5 flex items-center pointer-events-none"
+                    data-field-suggestion-target="badge">
+                <span class="rounded-full bg-amber-100 px-2 py-0.5 text-xs font-semibold text-amber-800">
+                  different
+                </span>
+              </span>
+            </div>
+            <div class="mt-1.5 flex items-center justify-between text-xs text-amber-800 bg-amber-50 rounded px-2.5 py-1.5 border border-amber-200"
+                 data-field-suggestion-target="suggestion">
+              <span>Account address: <strong><%= @nip05_state[:suggested] %></strong></span>
+              <button type="button" class="font-semibold text-blue-600 hover:text-blue-800 underline ml-2"
+                      data-action="click->field-suggestion#apply"
+                      data-field-suggestion-value-param="<%= @nip05_state[:suggested] %>">
+                Use this
+              </button>
+            </div>
+          </div>
+        <% else %>
+          <%= f.text_field :nip05_address, value: @nip05_state[:value], class: "w-full sm:w-3/5" %>
+        <% end %>
+        <% if @validation_errors.present? && @validation_errors[:nip05_address].present? %>
+          <p class="error-msg mt-2"><%= @validation_errors[:nip05_address].first %></p>
+        <% end %>
+      <% end %>
+      <%= render FormElements::FieldsetComponent.new(tag: "div", title: "Lightning address for Zaps") do %>
+        <% if @lud16_state[:status] == :added %>
+          <div class="w-full sm:w-3/5 flex flex-col" data-controller="field-suggestion"
+               data-field-suggestion-added-value-value="<%= @user.address %>">
+            <div class="relative">
+              <%= f.text_field :lud16_address, value: @lud16_state[:value],
+                    data: {
+                      :'field-suggestion-target' => "input",
+                      action: "input->field-suggestion#checkAdded"
+                    },
+                    class: "w-full pr-16 border-emerald-500 ring-1 ring-emerald-500 focus:border-emerald-500 focus:ring-emerald-500 bg-emerald-50/20" %>
+              <span class="absolute inset-y-0 right-2.5 flex items-center pointer-events-none"
+                    data-field-suggestion-target="badge">
+                <span class="rounded-full bg-emerald-100 px-2 py-0.5 text-xs font-semibold text-emerald-800">
+                  added
+                </span>
+              </span>
+            </div>
+            <div class="mt-1.5 flex items-center justify-between text-xs text-amber-800 bg-amber-50 rounded px-2.5 py-1.5 border border-amber-200 hidden"
+                 data-field-suggestion-target="suggestion">
+              <span>Account address: <strong><%= @user.address %></strong></span>
+              <button type="button" class="font-semibold text-blue-600 hover:text-blue-800 underline ml-2"
+                      data-action="click->field-suggestion#apply"
+                      data-field-suggestion-value-param="<%= @user.address %>">
+                Use this
+              </button>
+            </div>
+          </div>
+        <% elsif @lud16_state[:status] == :different %>
+          <div class="w-full sm:w-3/5 flex flex-col" data-controller="field-suggestion"
+               data-field-suggestion-added-value-value="<%= @lud16_state[:suggested] %>">
+            <div class="relative">
+              <%= f.text_field :lud16_address, value: @lud16_state[:value],
+                    data: {
+                      :'field-suggestion-target' => "input",
+                      action: "input->field-suggestion#checkAdded"
+                    },
+                    class: "w-full pr-20 border-amber-400 ring-1 ring-amber-400 focus:border-amber-400 focus:ring-amber-400" %>
+              <span class="absolute inset-y-0 right-2.5 flex items-center pointer-events-none"
+                    data-field-suggestion-target="badge">
+                <span class="rounded-full bg-amber-100 px-2 py-0.5 text-xs font-semibold text-amber-800">
+                  different
+                </span>
+              </span>
+            </div>
+            <div class="mt-1.5 flex items-center justify-between text-xs text-amber-800 bg-amber-50 rounded px-2.5 py-1.5 border border-amber-200"
+                 data-field-suggestion-target="suggestion">
+              <span>Account address: <strong><%= @lud16_state[:suggested] %></strong></span>
+              <button type="button" class="font-semibold text-blue-600 hover:text-blue-800 underline ml-2"
+                      data-action="click->field-suggestion#apply"
+                      data-field-suggestion-value-param="<%= @lud16_state[:suggested] %>">
+                Use this
+              </button>
+            </div>
+          </div>
+        <% else %>
+          <%= f.text_field :lud16_address, value: @lud16_state[:value], class: "w-full sm:w-3/5" %>
+        <% end %>
+        <% if @validation_errors.present? && @validation_errors[:lud16_address].present? %>
+          <p class="error-msg mt-2"><%= @validation_errors[:lud16_address].first %></p>
+        <% end %>
+      <% end %>
+    <% end %>
+  </main>
+  <footer>
+    <%# <%= @profile.inspect %>
+    <%# <%= @profile_event.inspect %>
+  </footer>
+</div>

app/components/settings/nostr_edit_profile_component.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module Settings
+  class NostrEditProfileComponent < ViewComponent::Base
+    attr_reader :user, :profile, :profile_event, :display_name, :nip05_state, :lud16_state
+
+    def initialize(user:, profile_event: nil, validation_errors: nil)
+      @user = user
+      @profile_event = profile_event
+      @validation_errors = validation_errors
+      @profile = {}
+      @display_name = nil
+
+      if profile_event.present? && profile_event["content"].present?
+        @profile = JSON.parse(profile_event["content"]) rescue {}
+        @display_name = @profile["display_name"] || @profile["displayName"]
+      end
+
+      @display_name ||= @user.display_name
+
+      @nip05_state = compute_field_state(@profile["nip05"])
+      @lud16_state = compute_field_state(@profile["lud16"])
+    end
+
+    private
+
+    def compute_field_state(current_value)
+      target_value = @user.address
+
+      if current_value.blank?
+        { status: :added, value: target_value, suggested: nil }
+      elsif current_value == target_value
+        { status: :matched, value: current_value, suggested: nil }
+      else
+        { status: :different, value: current_value, suggested: target_value }
+      end
+    end
+  end
+end

app/components/settings/nostr_edit_relays_component.html.erb

@@ -0,0 +1,62 @@
+<div class="w-[72vw] md:w-[500px]">
+  <h3 class="mb-6">Edit relays</h3>
+  <%= form_with url: "#", local: true,
+        html: { data: { controller: "relay-list-editor" } } do |f| %>
+    <ul data-relay-list-editor-target="list" class="mb-4 space-y-2">
+      <% @relays.each do |relay| %>
+        <li class="flex gap-x-2 items-center">
+          <div class="relative grow">
+            <% if relay[:added] %>
+              <input type="text" name="relay_urls[]" value="<%= relay[:url] %>"
+                     data-added-value="<%= relay[:url] %>"
+                     data-action="input->relay-list-editor#checkAdded"
+                     class="w-full pr-16 border-emerald-500 ring-1 ring-emerald-500 focus:border-emerald-500 focus:ring-emerald-500 bg-emerald-50/20" />
+              <span class="absolute inset-y-0 right-2.5 flex items-center pointer-events-none"
+                    data-relay-list-editor-target="addedBadge">
+                <span class="rounded-full bg-emerald-100 px-2 py-0.5 text-xs font-semibold text-emerald-800">
+                  added
+                </span>
+              </span>
+            <% else %>
+              <input type="text" name="relay_urls[]" value="<%= relay[:url] %>" class="w-full" />
+            <% end %>
+          </div>
+          <select name="relay_markers[]" class="shrink-0 w-36 sm:w-40">
+            <option value=""<%= %( selected="selected") if relay[:marker].nil? %>>Read & write</option>
+            <option value="read"<%= %( selected="selected") if relay[:marker] == "read" %>>Read only</option>
+            <option value="write"<%= %( selected="selected") if relay[:marker] == "write" %>>Write only</option>
+          </select>
+          <button type="button" class="btn-md btn-icon btn-outline text-red-700 shrink-0"
+                  data-action="click->relay-list-editor#remove" title="Remove relay">
+            <%= render partial: "icons/trash-2", locals: { custom_class: "h-4 w-4" } %>
+          </button>
+        </li>
+      <% end %>
+    </ul>
+
+    <template data-relay-list-editor-target="template">
+      <li class="flex gap-x-2 items-center">
+        <div class="relative grow">
+          <input type="text" name="relay_urls[]" value="" class="w-full" />
+        </div>
+        <select name="relay_markers[]" class="shrink-0 w-36 sm:w-40">
+          <option value="">Read & write</option>
+          <option value="read">Read only</option>
+          <option value="write">Write only</option>
+        </select>
+        <button type="button" class="btn-md btn-icon btn-outline text-red-700 shrink-0"
+                data-action="click->relay-list-editor#remove" title="Remove relay">
+          <%= render partial: "icons/trash-2", locals: { custom_class: "h-4 w-4" } %>
+        </button>
+      </li>
+    </template>
+
+    <button type="button" class="btn-md btn-gray w-full mb-6"
+            data-action="click->relay-list-editor#add">
+      <%= render partial: "icons/plus", locals: { custom_class: "h-4 w-4 inline mr-1" } %>
+      Add relay
+    </button>
+
+    <%= f.submit "Save relay list", class: "btn-md btn-blue w-full" %>
+  <% end %>
+</div>

app/components/settings/nostr_edit_relays_component.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module Settings
+  class NostrEditRelaysComponent < ViewComponent::Base
+    def initialize(nip65_event: nil)
+      @nip65_event = nip65_event
+      @relays = build_relays
+    end
+
+    private
+
+    def build_relays
+      site_relay = Setting.nostr_relay_url
+
+      if @nip65_event.blank?
+        relays = Setting.nostr_discovery_relays.map { |url| { url: url, marker: nil, added: true } }
+        if site_relay.present?
+          relays.reject! { |r| r[:url] == site_relay }
+          relays.unshift({ url: site_relay, marker: nil, added: true })
+        end
+        relays
+      else
+        existing = @nip65_event["tags"]
+          .select { |t| t[0] == "r" }
+          .map { |t| { url: t[1], marker: t[2], added: false } }
+
+        if site_relay.present? && existing.none? { |r| r[:url] == site_relay }
+          existing.unshift({ url: site_relay, marker: nil, added: true })
+        end
+        existing
+      end
+    end
+  end
+end

app/components/settings/nostr_profile_status_component.html.erb

@@ -0,0 +1,21 @@
+<% @statuses.each do |status| %>
+  <%= render StatusTextComponent.new(
+    text: status[:text],
+    icon_name: status[:icon_name],
+    icon_color: status[:icon_color]
+  ) %>
+<% end %>
+
+<% if @status == 1 %>
+  <p class="mt-8">
+    <button class="btn-md btn-blue">
+      Edit my profile
+    </button>
+  </p>
+<% elsif @status == 2 %>
+  <p class="mt-8">
+    <button class="btn-md btn-blue">
+      Create my profile
+    </button>
+  </p>
+<% end %>

app/components/settings/nostr_profile_status_component.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+module Settings
+  class NostrProfileStatusComponent < ViewComponent::Base
+    def initialize(profile_event:, user_address:)
+      @statuses = []
+
+      if profile_event.present?
+        profile = JSON.parse(profile_event["content"])
+
+        @statuses.push({
+          text: "You have a public Nostr profile",
+          icon_name: "check-circle",
+          icon_color: "emerald-500"
+        })
+
+        if profile["nip05"].present? && profile["nip05"] == user_address
+          @statuses.push({
+            text: "Your profile's Nostr address is set to <strong>#{ user_address }</strong>",
+            icon_name: "check-circle",
+            icon_color: "emerald-500"
+          })
+        else
+          @statuses.push({
+            text: "Your profile's Nostr address is not set to <strong>#{ user_address }</strong> yet",
+            icon_name: "alert-octagon",
+            icon_color: "amber-500"
+          })
+        end
+
+        if profile["lud16"].present? && profile["lud16"] == user_address
+          @statuses.push({
+            text: "Your profile's Lightning address is set to <strong>#{ user_address }</strong>",
+            icon_name: "check-circle",
+            icon_color: "emerald-500"
+          })
+        else
+          @statuses.push({
+            text: "Your profile's Lightning address is not set to <strong>#{ user_address }</strong> yet",
+            icon_name: "alert-octagon",
+            icon_color: "amber-500"
+          })
+        end
+      else
+        @statuses.push({
+          text: "We could not find a profile for your public key",
+          icon_name: "alert-octagon",
+          icon_color: "amber-500"
+        })
+      end
+    end
+  end
+end

app/components/settings/nostr_relay_status_component.html.erb

@@ -0,0 +1,18 @@
+<% @statuses.each do |status| %>
+  <%= render StatusTextComponent.new(
+    text: status[:text],
+    icon_name: status[:icon_name],
+    icon_color: status[:icon_color]
+  ) %>
+<% end %>
+
+<div class="mt-8" data-controller="modal" data-action="keydown.esc->modal#close">
+  <button data-action="click->modal#open" class="btn-md btn-blue w-full sm:w-auto">
+    <%= @button_text %>
+  </button>
+  <%= render ModalComponent.new(show_close_button: false) do %>
+    <%= render Settings::NostrEditRelaysComponent.new(
+      nip65_event: @nip65_event
+    ) %>
+  <% end %>
+</div>

app/components/settings/nostr_relay_status_component.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module Settings
+  class NostrRelayStatusComponent < ViewComponent::Base
+    def initialize(nip65_event:, relay_url: Setting.nostr_relay_url)
+      @nip65_event = nip65_event
+      @relay_url = relay_url
+      @relay_host = relay_url.present? ? URI.parse(relay_url).host : nil
+      @statuses = []
+
+      if nip65_event.present?
+        @statuses.push({
+          text: "You have a relay list configured",
+          icon_name: "check-circle",
+          icon_color: "emerald-500"
+        })
+
+        if relay_urls(nip65_event).include?(@relay_url)
+          @statuses.push({
+            text: "The <strong>#{@relay_host}</strong> relay is part of your relay list",
+            icon_name: "check-circle",
+            icon_color: "emerald-500"
+          })
+        else
+          @statuses.push({
+            text: "<strong>#{@relay_host}</strong> is missing from your relay list",
+            icon_name: "alert-octagon",
+            icon_color: "amber-500"
+          })
+        end
+      else
+        @statuses.push({
+          text: "We could not find a relay list for your public key",
+          icon_name: "alert-octagon",
+          icon_color: "amber-500"
+        })
+      end
+
+      @button_text = (nip65_event.present? ? "Edit relays" : "Set up relays")
+    end
+
+    private
+
+    def relay_urls(nip65_event)
+      nip65_event["tags"].select { |t| t[0] == "r" }.map { |t| t[1] }
+    end
+  end
+end

app/components/status_text_component.html.erb

@@ -0,0 +1,8 @@
+<p class="flex gap-x-4 items-center">
+  <span class="inline-block h-6 w-6 grow-0 text-<%= @icon_color %>">
+    <%= render "icons/#{@icon_name}" %>
+  </span>
+  <span>
+    <%= raw @text %>
+  </span>
+</p>

app/components/status_text_component.rb

@@ -0,0 +1,7 @@
+class StatusTextComponent < ViewComponent::Base
+  def initialize(text:, icon_name:, icon_color:)
+    @text = text
+    @icon_name = icon_name
+    @icon_color = icon_color
+  end
+end

app/controllers/rs/oauth_controller.rb

@@ -1,10 +1,7 @@
 class Rs::OauthController < ApplicationController
-  skip_before_action :verify_authenticity_token, only: :token
-
   prepend_before_action :assert_redirect_uri, only: [:new, :create]
   before_action :require_signed_in_with_username, only: :new
   before_action :authenticate_user!, only: :create
-  before_action :set_cors_headers, only: :token
 
   def new
     @user          = User.where(cn: params[:username].downcase, ou: Setting.primary_domain).first
@@ -12,12 +9,9 @@ class Rs::OauthController < ApplicationController
     @redirect_uri  = params[:redirect_uri]
     @client_id     = params[:client_id]
     @state         = params[:state]
-    @response_type = params[:response_type].presence || "token"
-    @code_challenge = params[:code_challenge]
-    @code_challenge_method = params[:code_challenge_method].presence || "S256"
     @root_access_requested = (@scopes & [":r",":rw"]).any?
 
-    @denial_url = error_url(@redirect_uri, "error=access_denied", @state)
+    @denial_url = url_with_state("#{@redirect_uri}#error=access_denied", @state)
 
     @expire_at_dates = [["Never", nil],
                         ["In 1 month", 1.month.from_now],
@@ -26,41 +20,35 @@ class Rs::OauthController < ApplicationController
     unless current_user == @user
       sign_out :user
 
-      redirect_params = {
-        scope: params[:scope],
-        redirect_uri: params[:redirect_uri],
-        client_id: params[:client_id],
-        state: params[:state]
-      }
-
-      if @response_type == "code"
-        redirect_params[:response_type] = "code"
-        redirect_params[:code_challenge] = @code_challenge
-        redirect_params[:code_challenge_method] = @code_challenge_method
-      end
-
-      redirect_to new_rs_oauth_url(@user.cn, redirect_params)
+      redirect_to new_rs_oauth_url(@user.cn,
+                                   scope: params[:scope],
+                                   redirect_uri: params[:redirect_uri],
+                                   client_id: params[:client_id],
+                                   state: params[:state])
       return
     end
 
     unless @client_id.present?
-      error_redirect(@redirect_uri, "error=invalid_request", @state) and return
+      redirect_to(url_with_state("#{@redirect_uri}#error=invalid_request", @state),
+                  allow_other_host: true) and return
     end
 
     if @scopes.empty?
-      error_redirect(@redirect_uri, "error=invalid_scope", @state) and return
+      redirect_to(url_with_state("#{@redirect_uri}#error=invalid_scope", @state),
+                  allow_other_host: true) and return
     end
 
     unless hostname_of(@client_id) == hostname_of(@redirect_uri)
-      error_redirect(@redirect_uri, "error=invalid_client", @state) and return
-    end
-
-    if @response_type == "code" &&
-       (@code_challenge.blank? || @code_challenge_method != "S256")
-      error_redirect(@redirect_uri, "error=invalid_request", @state) and return
+      redirect_to(url_with_state("#{@redirect_uri}#error=invalid_client", @state),
+                  allow_other_host: true) and return
     end
 
     @client_id.gsub!(/http(s)?:\/\//, "")
+
+    if auth = current_user.remote_storage_authorizations.valid.where(permissions: @scopes, client_id: @client_id).first
+      redirect_to(url_with_state("#{@redirect_uri}#access_token=#{auth.token}", @state),
+                  allow_other_host: true) and return
+    end
   end
 
   def create
@@ -69,7 +57,6 @@ class Rs::OauthController < ApplicationController
       http_status :forbidden and return
     end
 
-    response_type = params[:response_type].presence || "token"
     permissions  = parse_scopes params[:scope]
     redirect_uri = params[:redirect_uri].presence
     client_id    = params[:client_id].presence
@@ -77,73 +64,32 @@ class Rs::OauthController < ApplicationController
     expire_at    = params[:expire_at].presence
 
     if permissions.empty?
-      error_redirect(redirect_uri, "error=invalid_scope", state, response_type) and return
+      redirect_to(url_with_state("#{redirect_uri}#error=invalid_scope", state),
+                  allow_other_host: true) and return
     end
 
     unless client_id.present?
-      error_redirect(redirect_uri, "error=invalid_request", state, response_type) and return
+      redirect_to(url_with_state("#{redirect_uri}#error=invalid_request", state),
+                  allow_other_host: true) and return
     end
 
     unless hostname_of(client_id) == hostname_of(redirect_uri)
-      error_redirect(redirect_uri, "error=invalid_client", state, response_type) and return
+      redirect_to(url_with_state("#{redirect_uri}#error=invalid_client", state),
+                  allow_other_host: true) and return
     end
 
     client_id.gsub!(/http(s)?:\/\//, "")
 
-    if response_type == "code"
-      challenge = params[:code_challenge].presence
-      method = params[:code_challenge_method].presence || "S256"
-
-      if challenge.blank? || method != "S256"
-        error_redirect(redirect_uri, "error=invalid_request", state, response_type) and return
-      end
-
-      code = RsOauthManager::IssueCode.call(
-        user: current_user,
-        client_id: client_id,
-        redirect_uri: redirect_uri,
-        permissions: permissions,
-        expire_at: expire_at,
-        user_agent: request.user_agent,
-        code_challenge: challenge,
-        code_challenge_method: method
-      )
-
-      redirect_to url_with_state("#{redirect_uri}?code=#{CGI.escape(code.code)}", state),
-                  allow_other_host: true
-    else
-      auth = current_user.remote_storage_authorizations.create!(
-        permissions: permissions,
-        client_id: client_id,
-        redirect_uri: redirect_uri,
-        app_name: client_id,
-        expire_at: expire_at,
-        user_agent: request.user_agent
-      )
-
-      redirect_to url_with_state("#{redirect_uri}#access_token=#{auth.token}", state),
-                  allow_other_host: true
-    end
-  end
-
-  def token
-    return head :ok if request.options?
-
-    unless params[:grant_type] == "authorization_code"
-      return render json: { error: "unsupported_grant_type" }, status: :bad_request
-    end
-
-    auth = RsOauthManager::ExchangeCode.call(
-      code: params[:code],
-      client_id: params[:client_id],
-      redirect_uri: params[:redirect_uri],
-      code_verifier: params[:code_verifier]
+    auth = current_user.remote_storage_authorizations.create!(
+      permissions: permissions,
+      client_id: client_id,
+      redirect_uri: redirect_uri,
+      app_name: client_id,
+      expire_at: expire_at
     )
 
-    response.headers["Cache-Control"] = "no-store"
-    render json: token_response(auth)
-  rescue RsOauthManagerService::InvalidGrant
-    render json: { error: "invalid_grant" }, status: :bad_request
+    redirect_to url_with_state("#{redirect_uri}#access_token=#{auth.token}", state),
+                allow_other_host: true
   end
 
   private
@@ -159,42 +105,24 @@ class Rs::OauthController < ApplicationController
     end
   end
 
-  def set_cors_headers
-    headers["Access-Control-Allow-Origin"] = "*"
-    headers["Access-Control-Allow-Methods"] = "POST, OPTIONS"
-    headers["Access-Control-Allow-Headers"] = "Content-Type"
-  end
-
-  def token_response(auth)
-    body = {
-      access_token: auth.token,
-      token_type: "bearer",
-      scope: auth.permissions.join(" ")
-    }
-
-    if auth.expire_at.present?
-      body[:expires_in] = (auth.expire_at - Time.current).to_i
-    end
-
-    body
-  end
-
   def hostname_of(uri)
-    RsOauthManagerService.hostname_of(uri)
+    uri.gsub(/http(s)?:\/\//, "").split(":")[0].split("/")[0]
   end
 
   def parse_scopes(scope_string)
-    RsOauthManagerService.parse_scopes(scope_string)
-  end
+    return [] if scope_string.blank?
 
-  def error_redirect(redirect_uri, error, state, response_type = @response_type)
-    redirect_to error_url(redirect_uri, error, state, response_type),
-                allow_other_host: true
-  end
+    scopes = scope_string.
+      gsub(/\[|\]/, "").
+      gsub(/\,/, " ").
+      gsub(/\/:/, ":").
+      split(/\s/).map(&:strip).
+      reject(&:empty?)
 
-  def error_url(redirect_uri, error, state, response_type = @response_type)
-    separator = response_type == "code" ? "?" : "#"
-    url_with_state("#{redirect_uri}#{separator}#{error}", state)
+    scopes = [":r"] if scopes.include?("*:r")
+    scopes = [":rw"] if scopes.include?("*:rw")
+
+    scopes
   end
 
   def url_with_state(url, state)

app/controllers/services/remotestorage_controller.rb

@@ -1,7 +1,7 @@
 class Services::RemotestorageController < Services::BaseController
   before_action :authenticate_user!
   before_action :require_service_available
-  before_action :require_service_enabled
+  before_action :require_feature_enabled
 
   # Dashboard
   def show
@@ -17,8 +17,8 @@ class Services::RemotestorageController < Services::BaseController
       http_status :not_found unless Setting.remotestorage_enabled?
     end
 
-    def require_service_enabled
-      unless current_user.service_enabled?(:remotestorage)
+    def require_feature_enabled
+      unless Flipper.enabled?(:remotestorage, current_user)
         http_status :forbidden
       end
     end

app/controllers/services/rs_auths_controller.rb

@@ -1,16 +1,13 @@
 class Services::RsAuthsController < Services::BaseController
   before_action :authenticate_user!
-  before_action :require_service_enabled
+  before_action :require_feature_enabled
   before_action :require_service_available
-  before_action :find_rs_auth, only: [:destroy]
+  # before_action :require_service_enabled
+  before_action :find_rs_auth, only: [:destroy, :launch_app]
 
   def index
-    @rs_apps = current_user.remote_storage_authorizations
-                           .includes(:web_app)
-                           .group_by(&:client_id)
-                           .values
-                           .map { |auths| auths.sort_by(&:created_at).reverse }
-                           .sort_by { |auths| app_name_for(auths.first).downcase }
+    @rs_auths = current_user.remote_storage_authorizations
+    # TODO sort by app name?
   end
 
   def destroy
@@ -26,34 +23,19 @@ class Services::RsAuthsController < Services::BaseController
   end
 
   def launch_app
-    auth = current_user.remote_storage_authorizations
-                       .where(client_id: params[:client_id])
-                       .order(created_at: :desc)
-                       .first
-    http_status(:not_found) and return unless auth
+    user_address = Rails.env.development? ?
+      "#{current_user.cn}@localhost:3000" :
+      current_user.address
 
-    user_address =
-      if Rails.env.development?
-        "#{current_user.cn}@#{request.host_with_port}"
-      else
-        current_user.address
-      end
-
-    # Storage-first bearer token issuance (remoteStorage spec §11): the app
-    # receives the address and runs the application-first flow itself.
-    launch_url = "#{auth.launch_url}#remotestorage=#{user_address}"
+    launch_url = "#{@auth.launch_url}#remotestorage=#{user_address}"
 
     redirect_to launch_url, allow_other_host: true
   end
 
   private
 
-    def app_name_for(auth)
-      auth.web_app&.name.presence || auth.app_name.presence || auth.client_id
-    end
-
-    def require_service_enabled
-      unless current_user.service_enabled?(:remotestorage)
+    def require_feature_enabled
+      unless Flipper.enabled?(:remotestorage, current_user)
         http_status :forbidden
       end
     end
@@ -63,7 +45,7 @@ class Services::RsAuthsController < Services::BaseController
     end
 
     def find_rs_auth
-      @auth = current_user.remote_storage_authorizations.find_by(id: params[:id])
-      http_status :not_found unless @auth
+      @auth = current_user.remote_storage_authorizations.find(params[:id])
+      http_status :not_found unless @auth.present?
     end
 end

app/controllers/settings_controller.rb

@@ -4,8 +4,13 @@ require "bcrypt"
 class SettingsController < ApplicationController
   before_action :authenticate_user!
   before_action :set_main_nav_section
-  before_action :set_settings_section, only: [:show, :update, :update_email, :reset_email_password]
-  before_action :set_user, only: [:show, :update, :update_email, :reset_email_password]
+  before_action :set_settings_section, only: [
+    :show, :update, :update_email, :reset_email_password
+  ]
+  before_action :set_user, only: [
+    :show, :update, :update_email, :reset_email_password,
+    :fetch_nostr_metadata
+  ]
 
   def index
     redirect_to setting_path(:profile)
@@ -143,12 +148,63 @@ class SettingsController < ApplicationController
     }
   end
 
+  def fetch_nostr_metadata
+    return render plain: "no pubkey", status: :bad_request if @user.nostr_pubkey.blank?
+
+    cache_key = "nostr_metadata:#{@user.id}"
+
+    case params[:step]
+    when "relays"
+      nip65_event = NostrManager::DiscoverUserRelays.call(pubkey: @user.nostr_pubkey)
+      write_relays = nip65_event ? extract_write_relays(nip65_event) : []
+
+      if nip65_event && write_relays.any? && stale?(nip65_event)
+        auth_event = NostrManager::DiscoverUserRelays.call(
+          pubkey: @user.nostr_pubkey, relays: write_relays
+        )
+        nip65_event = auth_event if auth_event
+        write_relays = extract_write_relays(nip65_event) if auth_event
+      end
+
+      Rails.cache.write("#{cache_key}:nip65", nip65_event, expires_in: 5.minutes)
+      Rails.cache.write("#{cache_key}:write_relays", write_relays, expires_in: 5.minutes)
+      render json: { next: "profile" }
+
+    when "profile"
+      write_relays = Rails.cache.read("#{cache_key}:write_relays") || []
+      relays = write_relays.any? ? write_relays : nil
+      profile = NostrManager::DiscoverUserProfile.call(
+        pubkey: @user.nostr_pubkey, relays: relays
+      )
+      Rails.cache.write("#{cache_key}:profile", profile, expires_in: 5.minutes)
+      render json: { next: "render" }
+
+    when "render", nil
+      @nip65_event = Rails.cache.read("#{cache_key}:nip65")
+      @profile     = Rails.cache.read("#{cache_key}:profile")
+      render partial: "nostr_metadata", formats: :html
+
+    else
+      render plain: "invalid step", status: :bad_request
+    end
+  end
+
   private
 
     def set_main_nav_section
       @current_section = :settings
     end
 
+    def extract_write_relays(nip65_event)
+      nip65_event["tags"]
+        .select { |t| t[0] == "r" && t[2] != "read" }
+        .map { |t| t[1] }
+    end
+
+    def stale?(event, threshold = 30.minutes)
+      Time.at(event["created_at"]) < threshold.ago
+    end
+
     def set_settings_section
       @settings_section = params[:section]
       allowed_sections = [

app/controllers/webfinger_controller.rb

@@ -88,42 +88,19 @@ class WebfingerController < WellKnownController
   end
 
   def remotestorage_link
-    auth_url =
-      if Rails.env.development?
-        new_rs_oauth_url(@username)
-      else
-        new_rs_oauth_url(@username, host: Setting.rs_accounts_domain)
-      end
-
-    storage_url = "#{remotestorage_storage_base_url}/#{@username}"
+    auth_url = new_rs_oauth_url(@username, host: Setting.rs_accounts_domain)
+    storage_url = "#{Setting.rs_storage_url}/#{@username}"
 
     {
       rel: "http://tools.ietf.org/id/draft-dejong-remotestorage",
       href: storage_url,
       properties: {
-        "http://remotestorage.io/spec/version" => "draft-dejong-remotestorage-27",
+        "http://remotestorage.io/spec/version" => "draft-dejong-remotestorage-13",
         "http://tools.ietf.org/html/rfc6749#section-4.2" => auth_url,
-        "http://tools.ietf.org/html/rfc6749#section-3.1" => auth_url,
-        "http://tools.ietf.org/html/rfc6749#section-3.2" => token_endpoint_url,
-        "http://tools.ietf.org/html/rfc7636" => "S256",
         "http://tools.ietf.org/html/rfc6750#section-2.3" => nil, # access token via a HTTP query parameter
         "http://tools.ietf.org/html/rfc7233": "GET", # content range requests
         "http://remotestorage.io/spec/web-authoring": nil
       }
     }
   end
-
-  def token_endpoint_url
-    return rs_oauth_token_url if Rails.env.development?
-
-    rs_oauth_token_url(host: Setting.rs_accounts_domain)
-  end
-
-  def remotestorage_storage_base_url
-    return Setting.rs_storage_url unless Rails.env.development?
-
-    uri = URI.parse(Setting.rs_storage_url)
-    uri.host = request.host
-    uri.to_s
-  end
 end

app/javascript/controllers/field_suggestion_controller.js

@@ -0,0 +1,63 @@
+import { Controller } from "@hotwired/stimulus"
+
+export default class extends Controller {
+  static targets = [ "input", "badge", "suggestion" ]
+  static values  = { addedValue: String }
+
+  apply (event) {
+    event.preventDefault()
+    const value = event.params.value ?? this.addedValueValue
+
+    if (this.hasInputTarget && value !== undefined) {
+      this.inputTarget.value = value
+      this.checkAdded()
+    }
+  }
+
+  checkAdded () {
+    if (!this.hasInputTarget) return
+
+    const addedValue = this.hasAddedValueValue ? this.addedValueValue : null
+    if (!addedValue) return
+
+    const isMatch = (this.inputTarget.value.trim() === addedValue.trim())
+
+    const emeraldClasses = [
+      "border-emerald-500", "ring-1", "ring-emerald-500",
+      "focus:border-emerald-500", "focus:ring-emerald-500",
+      "bg-emerald-50/20"
+    ]
+    const amberClasses = [
+      "border-amber-400", "ring-1", "ring-amber-400",
+      "focus:border-amber-400", "focus:ring-amber-400"
+    ]
+
+    if (isMatch) {
+      this.inputTarget.classList.remove(...amberClasses)
+      this.inputTarget.classList.add(...emeraldClasses)
+
+      if (this.hasBadgeTarget) {
+        this.badgeTarget.innerHTML = `
+          <span class="rounded-full bg-emerald-100 px-2 py-0.5 text-xs font-semibold text-emerald-800">
+            added
+          </span>
+        `.trim()
+        this.badgeTarget.classList.remove("hidden")
+      }
+
+      if (this.hasSuggestionTarget) {
+        this.suggestionTarget.classList.add("hidden")
+      }
+    } else {
+      this.inputTarget.classList.remove(...emeraldClasses)
+
+      if (this.hasBadgeTarget) {
+        this.badgeTarget.classList.add("hidden")
+      }
+
+      if (this.hasSuggestionTarget) {
+        this.suggestionTarget.classList.remove("hidden")
+      }
+    }
+  }
+}

app/javascript/controllers/nostr_metadata_controller.js

@@ -0,0 +1,50 @@
+import { Controller } from "@hotwired/stimulus"
+
+export default class extends Controller {
+  static targets = [ "status", "loading", "content" ]
+  static values  = { url: String }
+
+  connect () {
+    this.runStep("relays")
+  }
+
+  async runStep (step) {
+    const messages = {
+      relays:  "Looking up your relay list…",
+      profile: "Fetching your profile…",
+      blossom: "Fetching your media server list…",
+      render:  null
+    }
+
+    if (messages[step]) {
+      this.statusTarget.textContent = messages[step]
+    }
+
+    try {
+      const headers = (step === "render")
+        ? { "Accept": "text/html" }
+        : { "Accept": "application/json" }
+
+      const res = await fetch(`${this.urlValue}?step=${step}`, { headers })
+
+      if (!res.ok) {
+        throw new Error(`HTTP ${res.status}`)
+      }
+
+      if (step === "render") {
+        const html = await res.text()
+        this.loadingTarget.classList.add("hidden")
+        this.contentTarget.classList.remove("hidden")
+        this.contentTarget.innerHTML = html
+      } else {
+        const data = await res.json()
+        if (data.next) {
+          this.runStep(data.next)
+        }
+      }
+    } catch (error) {
+      console.warn("Nostr metadata fetch failed:", error.message)
+      this.statusTarget.textContent = "Something went wrong. Please reload."
+    }
+  }
+}

app/javascript/controllers/relay_list_editor_controller.js

@@ -0,0 +1,40 @@
+import { Controller } from "@hotwired/stimulus"
+
+export default class extends Controller {
+  static targets = [ "list", "template", "addedBadge" ]
+
+  add (event) {
+    event.preventDefault()
+    const row = this.templateTarget.content.cloneNode(true)
+    this.listTarget.appendChild(row)
+  }
+
+  remove (event) {
+    event.preventDefault()
+    const row = event.target.closest("li")
+    row.remove()
+  }
+
+  checkAdded (event) {
+    const input = event.target
+    const addedValue = input.dataset.addedValue
+    if (!addedValue) return
+
+    const container = input.closest(".relative")
+    const badge = container?.querySelector("[data-relay-list-editor-target='addedBadge']")
+
+    const addedClasses = [
+      "border-emerald-500", "ring-1", "ring-emerald-500",
+      "focus:border-emerald-500", "focus:ring-emerald-500",
+      "bg-emerald-50/20"
+    ]
+
+    if (input.value.trim() === addedValue.trim()) {
+      input.classList.add(...addedClasses)
+      if (badge) badge.classList.remove("hidden")
+    } else {
+      input.classList.remove(...addedClasses)
+      if (badge) badge.classList.add("hidden")
+    }
+  }
+}

app/mailers/notification_mailer.rb

@@ -11,7 +11,7 @@ class NotificationMailer < ApplicationMailer
     @auth = params[:auth]
     @permissions = @auth.permissions.map do |p|
       access = p.split(":")[1] == 'r' ? 'read' : 'read/write'
-      directory = p.split(':')[0] == '' ? 'all categories and files' : p.split(':')[0]
+      directory = p.split(':')[0] == '' ? 'all folders and files' : p.split(':')[0]
       "#{access} #{directory}"
     end
     @subject = "New app connected to your storage"

app/models/concerns/settings/nostr_settings.rb

@@ -18,8 +18,24 @@ module Settings
       field :nostr_relay_url, type: :string,
         default: ENV["NOSTR_RELAY_URL"].presence
 
+      field :nostr_blossom_server_url, type: :string,
+        default: ENV["NOSTR_BLOSSOM_SERVER_URL"].presence
+
       field :nostr_zaps_relay_limit, type: :integer,
         default: 12
+
+      field :nostr_discovery_relays, type: :array, default: %w[
+        wss://nostr.kosmos.org
+        wss://nos.lol
+        wss://relay.snort.social
+        wss://relay.primal.net
+        wss://relay.damus.io
+      ]
+
+      def self.nostr_relay_url_http
+        self.nostr_relay_url.gsub(/^ws:/, "http:")
+                            .gsub(/^wss:/, "https:")
+      end
     end
   end
 end

app/models/remote_storage_authorization.rb

@@ -40,26 +40,6 @@ class RemoteStorageAuthorization < ApplicationRecord
     end
   end
 
-  def expired?
-    expire_at.present? && expire_at.past?
-  end
-
-  def device_name
-    return nil if user_agent.blank?
-
-    client = DeviceDetector.new(user_agent)
-    name = client.name.presence
-    os = client.os_name.presence
-    os = "Linux" if os == "GNU/Linux"
-    os = "macOS" if os == "Mac"
-
-    # Safari never runs on Linux. A WebKit "Safari" user agent on Linux is a
-    # WebKitGTK browser (e.g. GNOME Web), which sends a Safari-compatible UA.
-    name = "WebKit" if name == "Safari" && os == "Linux"
-
-    [name, os].compact.join(" on ").presence
-  end
-
   def delete_token_from_redis
     key = "authorizations:#{user.cn}:#{token}"
     redis.srem? key, redis.smembers(key)

app/models/rs_authorization_code.rb

@@ -1,37 +0,0 @@
-class RsAuthorizationCode < ApplicationRecord
-  belongs_to :user
-
-  CODE_TTL = 60.seconds
-
-  serialize :permissions, coder: YAML
-
-  attr_accessor :code
-
-  before_validation :generate_code
-
-  scope :active, -> { where(expires_at: Time.current..) }
-
-  def self.find_by_code(raw_code)
-    return nil if raw_code.blank?
-
-    find_by(code_digest: Digest::SHA256.hexdigest(raw_code))
-  end
-
-  def expired?
-    expires_at <= Time.current
-  end
-
-  def consume!
-    destroy!
-  end
-
-  private
-
-    def generate_code
-      return if code_digest.present?
-
-      self.code = SecureRandom.urlsafe_base64(32)
-      self.code_digest = Digest::SHA256.hexdigest(code)
-      self.expires_at ||= CODE_TTL.from_now
-    end
-end

app/services/nostr_manager/discover_user_profile.rb

@@ -0,0 +1,21 @@
+module NostrManager
+  class DiscoverUserProfile < NostrManagerService
+    def initialize(pubkey:, relays: nil)
+      @pubkey = pubkey
+      @relays = relays.present? ? relays : Setting.nostr_discovery_relays
+    end
+
+    def call
+      filter = Nostr::Filter.new(
+        authors: [@pubkey],
+        kinds: [0],
+        limit: 1,
+      )
+
+      NostrManager::FetchLatestEvent.call(
+        relays: @relays,
+        filter: filter
+      )
+    end
+  end
+end

app/services/nostr_manager/discover_user_relays.rb

@@ -0,0 +1,21 @@
+module NostrManager
+  class DiscoverUserRelays < NostrManagerService
+    def initialize(pubkey:, relays: nil)
+      @pubkey = pubkey
+      @relays = relays.present? ? relays : Setting.nostr_discovery_relays
+    end
+
+    def call
+      filter = Nostr::Filter.new(
+        authors: [@pubkey],
+        kinds: [10002],
+        limit: 1,
+      )
+
+      NostrManager::FetchLatestEvent.call(
+        relays: @relays,
+        filter: filter
+      )
+    end
+  end
+end

app/services/nostr_manager/fetch_event.rb

@@ -0,0 +1,61 @@
+module NostrManager
+  class FetchEvent < NostrManagerService
+    TIMEOUT = 10
+
+    def initialize(filter:, relay_url:)
+      @filter = filter
+      @relay = new_relay(relay_url)
+      @client = Nostr::Client.new
+    end
+
+    def call
+      filter, client, relay = @filter, @client, @relay
+      event = nil
+      mutex = Mutex.new
+      received_event = ConditionVariable.new
+      log_prefix = "[nostr][#{@relay.name}]"
+
+      thread = Thread.new do
+        client.on :connect do
+          client.subscribe(filter: filter)
+        end
+
+        client.on :error do |e|
+          Rails.logger.info "#{log_prefix} Error: #{e}"
+          Thread.current.exit
+        end
+
+        client.on :message do |m|
+          msg = JSON.parse(m) rescue nil
+          if msg && msg[0] == "EVENT" && msg[2]
+            Rails.logger.debug "#{log_prefix} Event received: #{msg[2]["id"]}"
+            mutex.synchronize do
+              event = msg[2]
+              received_event.signal
+            end
+          elsif msg && msg[0] == "EOSE"
+            mutex.synchronize do
+              received_event.signal
+            end
+          end
+        end
+
+        client.connect relay
+      end
+
+      begin
+        Timeout.timeout(TIMEOUT) do
+          mutex.synchronize do
+            received_event.wait(mutex) if event.nil?
+          end
+        end
+      rescue Timeout::Error
+        Rails.logger.debug "#{log_prefix} Timeout: No event received within #{TIMEOUT} seconds"
+      ensure
+        thread.exit
+      end
+
+      event
+    end
+  end
+end

app/services/nostr_manager/fetch_latest_event.rb

@@ -0,0 +1,32 @@
+module NostrManager
+  class FetchLatestEvent < NostrManagerService
+    TIMEOUT = 20
+
+    def initialize(relays:, filter:, max_events: 2)
+      @relays = relays
+      @filter = filter
+      @max_events = max_events
+    end
+
+    def call
+      events = []
+
+      begin
+        Timeout.timeout(TIMEOUT) do
+          @relays.each do |url|
+            event = NostrManager::FetchEvent.call(filter: @filter, relay_url: url)
+
+            if event.present? && events.none? { |e| e["id"] == event["id"] }
+              events << event
+              break if events.size >= @max_events
+            end
+          end
+        end
+      rescue Timeout::Error
+        Rails.logger.debug "[nostr] Timeout after #{TIMEOUT}s, found #{events.size} events"
+      end
+
+      events.max_by { |e| e["created_at"] }
+    end
+  end
+end

app/services/nostr_manager/publish_event.rb

@@ -19,28 +19,28 @@ module NostrManager
 
       thread = Thread.new do
         client.on :connect do
-          puts "#{log_prefix} Publishing #{event.id}..."
+          Rails.logger.debug "#{log_prefix} Publishing #{event.id}..."
           client.publish event
         end
 
         client.on :error do |e|
-          puts "#{log_prefix} Error: #{e}"
-          puts "#{log_prefix} Closing thread..."
+          Rails.logger.debug "#{log_prefix} Error: #{e}"
+          Rails.logger.debug "#{log_prefix} Closing thread..."
           thread.exit
         end
 
         client.on :message do |m|
-          puts "#{log_prefix} Message: #{m}"
+          Rails.logger.debug "#{log_prefix} Message: #{m}"
           msg = JSON.parse(m) rescue []
           if msg[0] == "OK" && msg[1] == event.id && msg[2]
-            puts "#{log_prefix} Event published. Closing thread..."
+            Rails.logger.debug "#{log_prefix} Event published. Closing thread..."
           else
-            puts "#{log_prefix} Unexpected message from relay. Closing thread..."
+            Rails.logger.debug "#{log_prefix} Unexpected message from relay. Closing thread..."
           end
           thread.exit
         end
 
-        puts "#{log_prefix} Connecting to #{relay.url}..."
+        Rails.logger.debug "#{log_prefix} Connecting to #{relay.url}..."
         client.connect relay
       end
 

app/services/nostr_manager_service.rb

@@ -3,6 +3,7 @@ require "nostr"
 class NostrManagerService < ApplicationService
   def parse_tags(tags)
     out = {}
+    # TODO support more than 1 item for each tag type
     tags.each do |tag|
       out[tag[0].to_sym] = tag[1, tag.length]
     end
@@ -19,4 +20,8 @@ class NostrManagerService < ApplicationService
   def site_user
     Nostr::User.new(keypair: site_keypair)
   end
+
+  def new_relay(url)
+    Nostr::Relay.new(url: url, name: URI.parse(url).host)
+  end
 end

app/services/rs_oauth_manager/exchange_code.rb

@@ -1,36 +0,0 @@
-module RsOauthManager
-  class ExchangeCode < RsOauthManagerService
-    def initialize(code:, client_id:, redirect_uri:, code_verifier:)
-      @code = code
-      @client_id = client_id
-      @redirect_uri = redirect_uri
-      @code_verifier = code_verifier
-    end
-
-    def call
-      auth_code = RsAuthorizationCode.find_by_code(@code)
-      raise InvalidGrant if auth_code.nil? || auth_code.expired?
-
-      raise InvalidGrant unless hostname_of(@client_id) == hostname_of(@redirect_uri)
-      raise InvalidGrant unless @redirect_uri == auth_code.redirect_uri
-
-      raise InvalidGrant unless VerifyPkce.call(
-        code_challenge: auth_code.code_challenge,
-        code_challenge_method: auth_code.code_challenge_method,
-        code_verifier: @code_verifier
-      )
-
-      auth = auth_code.user.remote_storage_authorizations.create!(
-        permissions: auth_code.permissions,
-        client_id: auth_code.client_id,
-        redirect_uri: auth_code.redirect_uri,
-        app_name: auth_code.client_id,
-        expire_at: auth_code.permission_expire_at,
-        user_agent: auth_code.user_agent
-      )
-
-      auth_code.consume!
-      auth
-    end
-  end
-end

app/services/rs_oauth_manager/issue_code.rb

@@ -1,29 +0,0 @@
-module RsOauthManager
-  class IssueCode < RsOauthManagerService
-    def initialize(user:, client_id:, redirect_uri:, permissions:,
-                   code_challenge:, code_challenge_method: "S256",
-                   expire_at: nil, user_agent: nil)
-      @user = user
-      @client_id = client_id
-      @redirect_uri = redirect_uri
-      @permissions = permissions
-      @code_challenge = code_challenge
-      @code_challenge_method = code_challenge_method
-      @expire_at = expire_at
-      @user_agent = user_agent
-    end
-
-    def call
-      RsAuthorizationCode.create!(
-        user: @user,
-        client_id: @client_id,
-        redirect_uri: @redirect_uri,
-        permissions: @permissions,
-        permission_expire_at: @expire_at,
-        user_agent: @user_agent,
-        code_challenge: @code_challenge,
-        code_challenge_method: @code_challenge_method
-      )
-    end
-  end
-end

app/services/rs_oauth_manager/verify_pkce.rb

@@ -1,21 +0,0 @@
-module RsOauthManager
-  class VerifyPkce < RsOauthManagerService
-    def initialize(code_challenge:, code_challenge_method:, code_verifier:)
-      @code_challenge = code_challenge
-      @code_challenge_method = code_challenge_method
-      @code_verifier = code_verifier.to_s
-    end
-
-    def call
-      return false unless @code_challenge_method == "S256"
-
-      expected = Base64.urlsafe_encode64(
-        Digest::SHA256.digest(@code_verifier), padding: false
-      )
-
-      ActiveSupport::SecurityUtils.secure_compare(
-        expected, @code_challenge.to_s
-      )
-    end
-  end
-end

app/services/rs_oauth_manager_service.rb

@@ -1,27 +0,0 @@
-class RsOauthManagerService < ApplicationService
-  InvalidGrant = Class.new(StandardError)
-
-  def self.parse_scopes(scope_string)
-    return [] if scope_string.blank?
-
-    scopes = scope_string.
-      gsub(/\[|\]/, "").
-      gsub(/\,/, " ").
-      gsub(/\/:/, ":").
-      split(/\s/).map(&:strip).
-      reject(&:empty?)
-
-    scopes = [":r"] if scopes.include?("*:r")
-    scopes = [":rw"] if scopes.include?("*:rw")
-
-    scopes
-  end
-
-  def self.hostname_of(uri)
-    uri.to_s.gsub(/http(s)?:\/\//, "").split(":")[0].split("/")[0]
-  end
-
-  def hostname_of(uri)
-    self.class.hostname_of(uri)
-  end
-end

app/views/admin/settings/services/_nostr.html.erb

@@ -29,15 +29,35 @@
         title: "Relay URL",
         description: "Websockets URL of a relay associated with #{Setting.primary_domain}"
       ) %>
+  <%= render FormElements::FieldsetResettableSettingComponent.new(
+        key: :nostr_blossom_server_url,
+        title: "Blossom server URL",
+        description: "HTTP URL of the Blossom media server to add to users' server lists during onboarding"
+      ) %>
 </ul>
 </section>
+
 <section>
 <h3>Zaps</h3>
 <ul role="list">
   <%= render FormElements::FieldsetResettableSettingComponent.new(
         key: :nostr_zaps_relay_limit,
         title: "Relay limit",
-        description: "The maximum number of relays to publish zap receipts to"
+        description: "The maximum number of sender-defined relays to try to publish zap receipts to"
       ) %>
 </ul>
+</section>
+
+<section>
+<h3>Onboarding</h3>
+<ul role="list">
+  <%= render FormElements::FieldsetComponent.new(
+        title: "Discovery relays",
+        description: "Used to discover a user's published relay list and/or profile"
+      ) do %>
+    <%= f.text_area :nostr_discovery_relays,
+      value: Setting.nostr_discovery_relays.join("\n"),
+      class: "h-44 w-80" %>
+  <% end %>
+</ul>
 <% end %>

app/views/admin/users/show.html.erb

@@ -305,7 +305,7 @@
           <td>remoteStorage</td>
           <td>
             <%= render FormElements::ToggleComponent.new(
-              enabled: @services_enabled.include?("remotestorage"),
+              enabled: Flipper.enabled?(:remotestorage, current_user) && @services_enabled.include?("remotestorage"),
               input_enabled: false
             ) %>
           </td>

app/views/dashboard/index.html.erb

@@ -43,7 +43,8 @@
           <% end %>
         </div>
       <% end %>
-      <% if Setting.remotestorage_enabled? %>
+      <% if Setting.remotestorage_enabled? &&
+            Flipper.enabled?(:remotestorage, current_user) %>
         <div class="border border-gray-300 rounded-md hover:border-gray-400
                     bg-[length:80%] bg-[center_top_-156px] bg-no-repeat
                     bg-[url(/img/logos/icon_remotestorage.svg)]">

app/views/rs/oauth/new.html.erb

@@ -5,10 +5,34 @@
     <p class="mb-8">
       The app on
       <%= link_to @client_id, "https://#{@client_id}" %>
-      is asking for access to these categories:
+      is asking for access to these folders:
     </p>
 
-    <%= render RsScopeListComponent.new(scopes: @scopes, root: @root_access_requested) %>
+    <% if @root_access_requested %>
+    <p class="scope text-lg">
+      <span class="text-red-700">
+        <%= render partial: "icons/alert-triangle",
+              locals: { custom_class: "inline-block align-bottom mr-1.5" } %>
+        All files and directories
+      </span>
+      <% if (@scopes & [":r"]).any? %>
+        <span class="text-sm text-gray-500">(read only)</span>
+      <% end %>
+    </p>
+    <% else %>
+      <% @scopes.each do |scope| %>
+      <p class="scope text-gray-600">
+        <span class="text-lg">
+          <%= render partial: "icons/folder",
+            locals: { custom_class: "inline-block align-bottom mr-1.5" } %>
+          <%= scope_name(scope) %>
+        </span>
+        <% if scope_permissions(scope) == "r" %>
+          <span>(read only)</span>
+        <% end %>
+      </p>
+      <% end %>
+    <% end %>
 
     <%= form_with(url: rs_oauth_path, method: :post, data: { turbo: false }) do |f| %>
       <%= f.hidden_field :redirect_uri, value: @redirect_uri %>
@@ -16,9 +40,6 @@
       <%= f.hidden_field :user_id, value: @user.id %>
       <%= f.hidden_field :client_id, value: @client_id %>
       <%= f.hidden_field :state, value: @state %>
-      <%= f.hidden_field :response_type, value: @response_type %>
-      <%= f.hidden_field :code_challenge, value: @code_challenge %>
-      <%= f.hidden_field :code_challenge_method, value: @code_challenge_method %>
       <p class="mt-8 mb-6">
         <%= f.label :expire_at, "Permission expires:", class: "mr-1.5" %>
         <%= f.select :expire_at, options_for_select(@expire_at_dates) %>

app/views/services/rs_auths/index.html.erb

@@ -10,10 +10,10 @@
   <%= render partial: "shared/tabnav_remotestorage" %>
 
   <section>
-    <% if @rs_apps.any? %>
-      <div class="w-full grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 gap-6 mt-4">
-      <% @rs_apps.each do |authorizations| %>
-        <%= render RsAuthComponent.new(authorizations: authorizations) %>
+    <% if @rs_auths.any? %>
+      <div class="w-full grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 gap-y-10 gap-x-12 mt-4">
+      <% @rs_auths.each do |auth| %>
+        <%= render RsAuthComponent.new(auth: auth) %>
       <% end %>
     </div>
     <% else %>

app/views/settings/_nostr.html.erb

@@ -1,47 +1,46 @@
-<section>
-  <h3>Nostr</h3>
-  <h4 class="mb-0">Public Key</h4>
-  <div data-controller="settings--nostr-pubkey"
-       data-settings--nostr-pubkey-user-address-value="<%= current_user.address %>"
-       data-settings--nostr-pubkey-site-value="<%= Setting.accounts_domain %>"
-       data-settings--nostr-pubkey-shared-secret-value="<%= session[:shared_secret] %>"
-       data-settings--nostr-pubkey-pubkey-hex-value="<%= current_user.nostr_pubkey %>">
-
-    <p class="<%= current_user.nostr_pubkey.present? ? '' : 'hidden' %> mt-2 flex gap-1">
+<div data-controller="settings--nostr-pubkey"
+     data-settings--nostr-pubkey-user-address-value="<%= current_user.address %>"
+     data-settings--nostr-pubkey-site-value="<%= Setting.accounts_domain %>"
+     data-settings--nostr-pubkey-shared-secret-value="<%= session[:shared_secret] %>"
+     data-settings--nostr-pubkey-pubkey-hex-value="<%= current_user.nostr_pubkey %>">
+  <section class="mb-8 sm:mb-12">
+    <h3>Nostr</h3>
+    <h4 class="mb-0">
+      Public Key
+    </h4>
+    <p class="<%= current_user.nostr_pubkey.present? ? '' : 'hidden' %> mt-2 flex gap-x-1">
       <input type="text" value="<%= current_user.nostr_pubkey_bech32 %>" disabled
              data-settings--nostr-pubkey-target="pubkeyBech32Input"
-             name="nostr_public_key" class="relative grow" />
+             name="nostr_public_key" class="w-full" />
       <%= link_to nostr_pubkey_settings_path,
-            class: 'btn-md btn-outline text-red-700 relative shrink-0',
+            class: 'btn-md btn-outline relative grow-0 shrink-0 text-red-700',
             data: { turbo_method: :delete, turbo_confirm: 'Are you sure?' } do %>
         Remove
       <% end %>
     </p>
 
     <% if current_user.nostr_pubkey.present? %>
-    <div class="rounded-md bg-blue-50 p-4">
-      <div class="flex">
-        <div class="flex-shrink-0">
-          <svg class="h-5 w-5 text-blue-400" viewBox="0 0 20 20" fill="currentColor" aria-hidden="true">
-            <path fill-rule="evenodd" d="M18 10a8 8 0 11-16 0 8 8 0 0116 0zm-7-4a1 1 0 11-2 0 1 1 0 012 0zM9 9a.75.75 0 000 1.5h.253a.25.25 0 01.244.304l-.459 2.066A1.75 1.75 0 0010.747 15H11a.75.75 0 000-1.5h-.253a.25.25 0 01-.244-.304l.459-2.066A1.75 1.75 0 009.253 9H9z" clip-rule="evenodd" />
-          </svg>
-        </div>
-        <div class="ml-3 flex-1">
-          <p class="text-sm text-blue-800">
-            Your user address <strong><%= current_user.address %></strong> is
-            also a Nostr address now. Use your favorite Nostr app, or for
-            example <a href="http://metadata.nostr.com" target="_blank"
-              class="underline">metadata.nostr.com</a>, to add this
-            <strong>NIP-05</strong> address to your public profile.
-          </p>
-        </div>
-      </div>
-    </div>
+    <!-- <div> -->
+    <!--   Pubkey present -->
+    <!-- </div> -->
     <% else %>
     <p class="my-4">
-      If you use any apps on the Nostr network, you can verify your public key
-      with us in order to enable Nostr-specific features for your account.
+      Verify your Nostr public key with us in order to enable Nostr-specific
+      features for your account:
     </p>
+    <ul class="list-disc list-inside">
+      <li>Log in with Nostr (no password needed)</li>
+      <li>Verified Nostr address</li>
+      <% if Setting.lndhub_enabled? %>
+      <li>Receive zaps in your Lightning account</li>
+      <% end %>
+      <% if Setting.nostr_relay_url.present? %>
+      <li>Publish notes and other stuff on our Nostr relay</li>
+      <% end %>
+      <% if Setting.nostr_blossom_server_url.present? %>
+      <li>Publish media files on our Nostr media server</li>
+      <% end %>
+    </ul>
     <% end %>
 
     <div data-settings--nostr-pubkey-target="noExtension"
@@ -58,8 +57,8 @@
           </h3>
           <div class="mt-2 mb-0 text-sm text-blue-800">
             <p>
-              We recommend Alby, which you can also use for your Lightning
-              Wallet.
+              We recommend Alby, which you can also use a wallet for your
+              Lightning account.
             </p>
           </div>
           <div class="mt-4">
@@ -86,5 +85,18 @@
       </button>
     </p>
     <% end %>
-  </div>
-</section>
+  </section>
+
+  <% if current_user.nostr_pubkey.present? %>
+    <div data-controller="nostr-metadata"
+         data-nostr-metadata-url-value="<%= nostr_metadata_settings_path %>">
+      <div data-nostr-metadata-target="loading"
+           class="flex flex-col items-center justify-center py-16">
+        <div class="mb-4 h-12 w-12"></div>
+        <p data-nostr-metadata-target="status"
+           class="text-gray-500 animate-pulse">Loading…</p>
+      </div>
+      <div data-nostr-metadata-target="content" class="hidden"></div>
+    </div>
+  <% end %>
+</div>

app/views/settings/_nostr_metadata.html.erb

@@ -0,0 +1,25 @@
+<section class="">
+  <h3>Profile</h3>
+  <%= render Settings::NostrProfileStatusComponent.new(
+    profile_event: @profile,
+    user_address: current_user.address
+  ) %>
+  <div class="mt-8" data-controller="modal" data-action="keydown.esc->modal#close">
+    <button data-action="click->modal#open" class="btn-md btn-blue w-full sm:w-auto">
+      Edit profile
+    </button>
+    <%= render ModalComponent.new(show_close_button: false) do %>
+      <%= render Settings::NostrEditProfileComponent.new(
+        user: current_user,
+        profile_event: @profile
+      ) %>
+    <% end %>
+  </div>
+</section>
+
+<section class="mb-8 sm:mb-12">
+  <h3>Relays</h3>
+  <%= render Settings::NostrRelayStatusComponent.new(
+    nip65_event: @nip65_event
+  ) %>
+</section>

app/views/shared/_sidenav_settings.html.erb

@@ -19,18 +19,19 @@
   active: @settings_section.to_s == "email"
 ) %>
 <% end %>
+<% if Setting.remotestorage_enabled? &&
+      Flipper.enabled?(:remotestorage, current_user) %>
+<%= render SidenavLinkComponent.new(
+  name: "Storage", path: setting_path(:remotestorage), icon: "remotestorage",
+  active: @settings_section.to_s == "remotestorage"
+) %>
+<% end %>
 <% if Setting.lndhub_enabled %>
 <%= render SidenavLinkComponent.new(
   name: "Lightning", path: setting_path(:lightning), icon: "zap",
   active: @settings_section.to_s == "lightning"
 ) %>
 <% end %>
-<% if Setting.remotestorage_enabled? %>
-<%= render SidenavLinkComponent.new(
-  name: "Storage", path: setting_path(:remotestorage), icon: "remotestorage",
-  active: @settings_section.to_s == "remotestorage"
-) %>
-<% end %>
 <% if Setting.nostr_enabled %>
 <%= render SidenavLinkComponent.new(
   name: "Nostr", path: setting_path(:nostr), icon: "nostrich-head",

app/views/shared/nostr/_edit_user_profile.html.erb

@@ -0,0 +1,3 @@
+<div>
+  <%= profile.inspect %>
+</div>

config/environments/development.rb

@@ -24,7 +24,7 @@ Rails.application.configure do
   else
     config.action_controller.perform_caching = false
 
-    config.cache_store = :null_store
+    config.cache_store = :memory_store
   end
 
   # Don't care if the mailer can't send.

config/routes.rb

@@ -52,9 +52,12 @@ Rails.application.routes.draw do
 
     resource :storage, controller: 'remotestorage', only: [:show] do
       get :apps, to: "rs_auths#index"
-      get "apps/:client_id/launch", to: "rs_auths#launch_app", as: :launch_app,
-          constraints: { client_id: /[^\/]+/ }
-      resources :rs_auths, only: [:index, :destroy]
+      resources :rs_auths, only: [:index, :destroy] do
+        member do
+          get :revoke, to: 'rs_auths#destroy'
+          get :launch_app
+        end
+      end
     end
   end
 
@@ -65,6 +68,7 @@ Rails.application.routes.draw do
       post 'reset_email_password'
       post 'set_nostr_pubkey'
       delete 'nostr_pubkey', to: 'settings#remove_nostr_pubkey'
+      get 'fetch_nostr_metadata', as: 'nostr_metadata'
     end
   end
 
@@ -112,8 +116,6 @@ Rails.application.routes.draw do
   end
 
   namespace :rs do
-    post  'oauth/token', to: 'oauth#token', as: :oauth_token
-    match 'oauth/token', to: 'oauth#token', via: :options
     resource :oauth, only: [:new, :create], path_names: {
       new: ':username', create: ':username'
     }, controller: 'oauth'

db/migrate/20261102120000_create_rs_authorization_codes.rb

@@ -1,19 +0,0 @@
-class CreateRsAuthorizationCodes < ActiveRecord::Migration[8.1]
-  def change
-    create_table :rs_authorization_codes do |t|
-      t.references :user, null: false, foreign_key: true
-      t.string   :client_id,             null: false
-      t.string   :redirect_uri,          null: false
-      t.text     :permissions,           default: [].to_yaml
-      t.datetime :permission_expire_at
-      t.string   :code_digest,           null: false
-      t.string   :code_challenge,        null: false
-      t.string   :code_challenge_method, null: false, default: "S256"
-      t.datetime :expires_at,            null: false
-
-      t.timestamps
-    end
-
-    add_index :rs_authorization_codes, :code_digest, unique: true
-  end
-end

db/migrate/20261102130000_add_user_agent_to_rs_authorizations.rb

@@ -1,6 +0,0 @@
-class AddUserAgentToRsAuthorizations < ActiveRecord::Migration[8.1]
-  def change
-    add_column :remote_storage_authorizations, :user_agent, :string
-    add_column :rs_authorization_codes, :user_agent, :string
-  end
-end

db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[8.1].define(version: 2026_11_02_130000) do
+ActiveRecord::Schema[8.1].define(version: 2025_05_28_092931) do
   create_table "active_storage_attachments", force: :cascade do |t|
     t.bigint "blob_id", null: false
     t.datetime "created_at", null: false
@@ -110,7 +110,6 @@ ActiveRecord::Schema[8.1].define(version: 2026_11_02_130000) do
     t.string "redirect_uri"
     t.string "token"
     t.datetime "updated_at", null: false
-    t.string "user_agent"
     t.integer "user_id", null: false
     t.integer "web_app_id"
     t.index ["permissions"], name: "index_remote_storage_authorizations_on_permissions"
@@ -118,23 +117,6 @@ ActiveRecord::Schema[8.1].define(version: 2026_11_02_130000) do
     t.index ["web_app_id"], name: "index_remote_storage_authorizations_on_web_app_id"
   end
 
-  create_table "rs_authorization_codes", force: :cascade do |t|
-    t.string "client_id", null: false
-    t.string "code_challenge", null: false
-    t.string "code_challenge_method", default: "S256", null: false
-    t.string "code_digest", null: false
-    t.datetime "created_at", null: false
-    t.datetime "expires_at", null: false
-    t.datetime "permission_expire_at"
-    t.text "permissions", default: "--- []\n"
-    t.string "redirect_uri", null: false
-    t.datetime "updated_at", null: false
-    t.string "user_agent"
-    t.integer "user_id", null: false
-    t.index ["code_digest"], name: "index_rs_authorization_codes_on_code_digest", unique: true
-    t.index ["user_id"], name: "index_rs_authorization_codes_on_user_id"
-  end
-
   create_table "settings", force: :cascade do |t|
     t.datetime "created_at", null: false
     t.datetime "updated_at", null: false
@@ -182,6 +164,5 @@ ActiveRecord::Schema[8.1].define(version: 2026_11_02_130000) do
   add_foreign_key "active_storage_variant_records", "active_storage_blobs", column: "blob_id"
   add_foreign_key "remote_storage_authorizations", "app_catalog_web_apps", column: "web_app_id"
   add_foreign_key "remote_storage_authorizations", "users"
-  add_foreign_key "rs_authorization_codes", "users"
   add_foreign_key "zaps", "users"
 end

db/seeds.rb

@@ -1,9 +1,8 @@
+require 'sidekiq/testing'
+
 ldap = LdapService.new
 
-original_queue_adapter = ActiveJob::Base.queue_adapter
-ActiveJob::Base.queue_adapter = :inline
-
-begin
+Sidekiq::Testing.inline! do
   ldap.delete_all_users!
 
   puts "Create user: admin"
@@ -26,6 +25,4 @@ begin
       password: "user is user", confirmed: true
     })
   end
-ensure
-  ActiveJob::Base.queue_adapter = original_queue_adapter
 end

docker-compose.yml

@@ -1,7 +1,6 @@
 services:
   ldap:
     image: 4teamwork/389ds:latest
-    platform: linux/amd64
     volumes:
       - 389ds-data:/data
     networks:
@@ -13,21 +12,6 @@ services:
       DS_DM_PASSWORD: passthebutter
       SUFFIX_NAME: "dc=kosmos,dc=org"
 
-  ldap-init:
-    image: 4teamwork/389ds:latest
-    platform: linux/amd64
-    networks:
-      - internal_network
-    volumes:
-      - ./docker/ldap-init.sh:/ldap-init.sh:ro
-    environment:
-      LDAP_ADMIN_PASSWORD: passthebutter
-      LDAP_SUFFIX: "dc=kosmos,dc=org"
-    depends_on:
-      ldap:
-        condition: service_healthy
-    command: ["/bin/sh", "/ldap-init.sh"]
-
   redis:
     restart: always
     image: redis:7-alpine
@@ -42,7 +26,7 @@ services:
   web:
     build: .
     tty: true
-    command: ["bash", "docker/web-entrypoint.sh"]
+    command: bash -c "rm -f /akkounts/tmp/pids/server.pid; bin/dev"
     volumes:
       - .:/akkounts
       - /akkounts/node_modules
@@ -73,28 +57,20 @@ services:
       NOSTR_PRIVATE_KEY: 7c3ef7e448505f0615137af38569d01807d3b05b5005d5ecf8aaafcd40323cea
       NOSTR_RELAY_URL: ws://strfry:7777
     depends_on:
-      ldap:
-        condition: service_started
-      ldap-init:
-        condition: service_completed_successfully
-      redis:
-        condition: service_started
+      - ldap
+      - redis
 
-  garage:
-    image: dxflrs/garage:v2.4.1
-    command: ["/garage", "server", "--single-node", "--default-bucket"]
+  minio:
+    image: quay.io/minio/minio:latest
+    command: "server /data --console-address ':9001'"
     networks:
       - external_network
       - internal_network
     ports:
-      - "3900:3900"
+      - "9000:9000"
+      - "9001:9001"
     volumes:
-      - ./docker/garage/garage.toml:/etc/garage.toml:ro
-      - garage-data:/var/lib/garage
-    environment:
-      GARAGE_DEFAULT_ACCESS_KEY: dev-key1
-      GARAGE_DEFAULT_SECRET_KEY: "1234567890123456"
-      GARAGE_DEFAULT_BUCKET: remotestorage
+      - minio-data:/data
 
   liquor-cabinet:
     image: gitea.kosmos.org/5apps/liquor-cabinet:2.0.0-rc.1
@@ -103,21 +79,17 @@ services:
       - internal_network
     ports:
       - "4567:4567"
-    volumes:
-      - ./docker/liquor-cabinet/rainbows.conf.rb:/etc/liquor-cabinet/rainbows.conf.rb:ro
-    command: ["bundle", "exec", "rainbows", "-c", "/etc/liquor-cabinet/rainbows.conf.rb", "--listen", "0.0.0.0:4567"]
     environment:
       RACK_ENV: staging
       REDIS_HOST: redis
       REDIS_PORT: 6379
       REDIS_DB: 1
-      S3_ENDPOINT: http://garage:3900
-      S3_REGION: garage
-      S3_ACCESS_KEY: dev-key1
-      S3_SECRET_KEY: "1234567890123456"
+      S3_ENDPOINT: http://minio:9000
+      S3_ACCESS_KEY: dev-key
+      S3_SECRET_KEY: 123456789
       S3_BUCKET: remotestorage
     depends_on:
-      - garage
+      - minio
       - redis
 
   strfry:
@@ -155,7 +127,7 @@ networks:
 volumes:
   389ds-data:
     driver: local
-  garage-data:
+  minio-data:
     driver: local
   redis-data:
     driver: local

docker/garage/garage.toml

@@ -1,14 +0,0 @@
-metadata_dir = "/var/lib/garage/meta"
-data_dir = "/var/lib/garage/data"
-db_engine = "sqlite"
-
-replication_factor = 1
-
-rpc_bind_addr = "[::]:3901"
-rpc_public_addr = "127.0.0.1:3901"
-rpc_secret = "1799bccfd7411eddcf9ebd316bc1f5287ad12a68094e1c6ac6abde7e6feae1ec"
-
-[s3_api]
-s3_region = "garage"
-api_bind_addr = "[::]:3900"
-root_domain = ".s3.garage.localhost"

docker/ldap-init.sh

@@ -1,14 +0,0 @@
-#!/bin/sh
-set -e
-
-SUFFIX="${LDAP_SUFFIX:-dc=kosmos,dc=org}"
-URI="ldap://ldap:3389"
-
-if dsconf -D "cn=Directory Manager" -w "$LDAP_ADMIN_PASSWORD" "$URI" \
-     backend suffix list --suffix 2>/dev/null | grep -Fqx "$SUFFIX"; then
-  echo "LDAP backend for $SUFFIX already exists, skipping."
-else
-  echo "Creating LDAP backend for $SUFFIX..."
-  dsconf -D "cn=Directory Manager" -w "$LDAP_ADMIN_PASSWORD" "$URI" \
-    backend create --suffix "$SUFFIX" --be-name dev
-fi

docker/liquor-cabinet/rainbows.conf.rb

@@ -1,5 +0,0 @@
-Rainbows! do
-  use :ThreadPool
-  worker_connections 16
-  client_max_body_size 100 * 1024 * 1024
-end

docker/web-entrypoint.sh

@@ -1,14 +0,0 @@
-#!/usr/bin/env bash
-set -e
-
-if [ ! -f tmp/.setup-complete ]; then
-  echo "First start: setting up LDAP entries and databases..."
-  bin/rails ldap:setup
-  bin/rails db:setup
-  touch tmp/.setup-complete
-else
-  bin/rails db:prepare
-fi
-
-rm -f tmp/pids/server.pid
-exec bin/dev

spec/components/form_elements/fieldset_component_spec.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe FormElements::FieldsetComponent, type: :component do
+  it "renders a div with flex gap-x-1 for vertical positioning" do
+    rendered = render_inline(described_class.new(title: "Username")) do
+      "<input type='text' name='username' />".html_safe
+    end
+
+    expect(rendered.css("label.block > div.flex.gap-x-1")).to be_present
+    expect(rendered.css("label.block > p.flex")).not_to be_present
+  end
+
+  it "renders a div for horizontal positioning" do
+    rendered = render_inline(described_class.new(positioning: :horizontal, title: "Enable notifications")) do
+      "<input type='checkbox' />".html_safe
+    end
+
+    expect(rendered.css("label.block > div.relative")).to be_present
+  end
+end

spec/components/settings/nostr_edit_profile_component_spec.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe Settings::NostrEditProfileComponent, type: :component do
+  let(:user) { build(:user, cn: "alice") }
+
+  before do
+    allow(user).to receive(:address).and_return("alice@kosmos.org")
+    allow(user).to receive(:display_name).and_return("Alice Wonderland")
+  end
+
+  describe "when profile event is missing or fields are empty" do
+    it "prefills NIP-05 and Lightning addresses with user address and marks them as added" do
+      rendered = render_inline(described_class.new(user: user, profile_event: nil))
+
+      nip05_input = rendered.css("input[name='user[nip05_address]']").first
+      expect(nip05_input["value"]).to eq("alice@kosmos.org")
+      expect(nip05_input["class"]).to include("border-emerald-500")
+      expect(nip05_input["data-action"]).to include("input->field-suggestion#checkAdded")
+
+      lud16_input = rendered.css("input[name='user[lud16_address]']").first
+      expect(lud16_input["value"]).to eq("alice@kosmos.org")
+      expect(lud16_input["class"]).to include("border-emerald-500")
+      expect(lud16_input["data-action"]).to include("input->field-suggestion#checkAdded")
+
+      badges = rendered.css("span.rounded-full").select { |el| el.text.strip == "added" }
+      expect(badges.size).to eq(2)
+    end
+  end
+
+  describe "when profile has different NIP-05 and Lightning addresses" do
+    let(:profile_event) do
+      {
+        "content" => {
+          "nip05" => "alice@other.org",
+          "lud16" => "alice@getalby.com",
+          "display_name" => "Alice External"
+        }.to_json
+      }
+    end
+
+    it "shows current values with different badges and suggestion strips" do
+      rendered = render_inline(described_class.new(user: user, profile_event: profile_event))
+
+      nip05_input = rendered.css("input[name='user[nip05_address]']").first
+      expect(nip05_input["value"]).to eq("alice@other.org")
+      expect(nip05_input["class"]).to include("border-amber-400")
+
+      lud16_input = rendered.css("input[name='user[lud16_address]']").first
+      expect(lud16_input["value"]).to eq("alice@getalby.com")
+      expect(lud16_input["class"]).to include("border-amber-400")
+
+      different_badges = rendered.css("span.rounded-full").select { |el| el.text.strip == "different" }
+      expect(different_badges.size).to eq(2)
+
+      suggestion_buttons = rendered.css("button[data-action='click->field-suggestion#apply']")
+      expect(suggestion_buttons.size).to eq(2)
+      expect(suggestion_buttons.first["data-field-suggestion-value-param"]).to eq("alice@kosmos.org")
+    end
+  end
+
+  describe "when profile addresses match user address" do
+    let(:profile_event) do
+      {
+        "content" => {
+          "nip05" => "alice@kosmos.org",
+          "lud16" => "alice@kosmos.org",
+          "display_name" => "Alice Wonderland"
+        }.to_json
+      }
+    end
+
+    it "renders standard inputs without added or different badges" do
+      rendered = render_inline(described_class.new(user: user, profile_event: profile_event))
+
+      nip05_input = rendered.css("input[name='user[nip05_address]']").first
+      expect(nip05_input["value"]).to eq("alice@kosmos.org")
+      expect(nip05_input["class"]).not_to include("border-emerald-500")
+      expect(nip05_input["class"]).not_to include("border-amber-400")
+
+      badges = rendered.css("span.rounded-full").select { |el| %w[added different].include?(el.text.strip) }
+      expect(badges).to be_empty
+    end
+  end
+end

spec/components/settings/nostr_edit_relays_component_spec.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe Settings::NostrEditRelaysComponent, type: :component do
+  before do
+    allow(Setting).to receive(:nostr_relay_url).and_return("wss://nostr.kosmos.org")
+    allow(Setting).to receive(:nostr_discovery_relays).and_return([
+      "wss://nos.lol",
+      "wss://relay.damus.io"
+    ])
+  end
+
+  describe "when user has no relay list (nip65_event is nil)" do
+    it "renders all relays with added status and badges" do
+      rendered = render_inline(described_class.new(nip65_event: nil))
+
+      expect(rendered.css("input[value='wss://nostr.kosmos.org']")).to be_present
+      expect(rendered.css("input[value='wss://nos.lol']")).to be_present
+      expect(rendered.css("input[value='wss://relay.damus.io']")).to be_present
+
+      badges = rendered.css("span.rounded-full").select { |el| el.text.strip == "added" }
+      expect(badges.size).to eq(3)
+    end
+  end
+
+  describe "when user has an existing relay list without site relay" do
+    let(:nip65_event) do
+      {
+        "kind" => 10002,
+        "tags" => [
+          ["r", "wss://nos.lol"],
+          ["r", "wss://relay.damus.io", "read"]
+        ]
+      }
+    end
+
+    it "prepends the site relay marked as added, while existing relays are not added" do
+      rendered = render_inline(described_class.new(nip65_event: nip65_event))
+
+      relay_inputs = rendered.css("input[name='relay_urls[]']").map { |el| el["value"] }
+      expect(relay_inputs.first).to eq("wss://nostr.kosmos.org")
+
+      badges = rendered.css("span.rounded-full").select { |el| el.text.strip == "added" }
+      expect(badges.size).to eq(1)
+
+      site_input = rendered.css("input[value='wss://nostr.kosmos.org']").first
+      expect(site_input["class"]).to include("border-emerald-500")
+      expect(site_input["data-added-value"]).to eq("wss://nostr.kosmos.org")
+      expect(site_input["data-action"]).to include("input->relay-list-editor#checkAdded")
+
+      other_input = rendered.css("input[value='wss://nos.lol']").first
+      expect(other_input["class"]).not_to include("border-emerald-500")
+      expect(other_input["data-added-value"]).to be_nil
+
+      select = rendered.css("select[name='relay_markers[]']").first
+      expect(select["class"]).to include("w-36")
+    end
+  end
+
+  describe "when user already has site relay in their relay list" do
+    let(:nip65_event) do
+      {
+        "kind" => 10002,
+        "tags" => [
+          ["r", "wss://nostr.kosmos.org"],
+          ["r", "wss://nos.lol"]
+        ]
+      }
+    end
+
+    it "renders relays without any added badges" do
+      rendered = render_inline(described_class.new(nip65_event: nip65_event))
+
+      badges = rendered.css("span.rounded-full").select { |el| el.text.strip == "added" }
+      expect(badges).to be_empty
+    end
+  end
+end

spec/controllers/rs/oauth_controller_spec.rb

@@ -128,8 +128,8 @@ RSpec.describe Rs::OauthController, type: :controller do
             }
           end
 
-          it "does not reuse the existing token (renders the consent dialog)" do
-            expect(response.response_code).to eq(200)
+          it "redirects to the redirect_uri with the existing token" do
+            expect(response).to redirect_to("https://example.com#access_token=#{@auth.token}")
           end
         end
 
@@ -147,66 +147,36 @@ RSpec.describe Rs::OauthController, type: :controller do
             expect(response).to redirect_to("https://app.example.com#error=invalid_client")
           end
         end
-      end
 
-      context "when response_type is code" do
-        before do
-          get :new, params: {
-            username: user.cn,
-            redirect_uri: "https://example.com",
-            client_id: "example.com",
-            scope: "documents",
-            response_type: "code",
-            code_challenge: "challenge123",
-            code_challenge_method: "S256",
-            state: "foobar123"
-          }
+        context "with different redirect_uri" do
+          before do
+            get :new, params: {
+              username: user.cn,
+              scope: "documents,[photos], contacts:rw videos:r tasks/work/:r",
+              redirect_uri: "https://example.com/a_new_route",
+              client_id: "https://example.com"
+            }
+          end
+
+          it "redirects to the new redirect_uri" do
+            expect(response).to redirect_to("https://example.com/a_new_route#access_token=#{@auth.token}")
+          end
         end
 
-        it "renders the consent dialog and exposes the code challenge" do
-          expect(response.response_code).to eq(200)
-          expect(assigns["response_type"]).to eq("code")
-          expect(assigns["code_challenge"]).to eq("challenge123")
-          expect(assigns["code_challenge_method"]).to eq("S256")
-        end
+        context "with state param given" do
+          before do
+            get :new, params: {
+              username: user.cn,
+              scope: "documents,[photos], contacts:rw videos:r tasks/work/:r",
+              redirect_uri: "https://example.com",
+              client_id: "https://example.com",
+              state: "foobar123"
+            }
+          end
 
-        it "uses a query-based denial url" do
-          expect(assigns["denial_url"]).to eq("https://example.com?error=access_denied&state=foobar123")
-        end
-      end
-
-      context "when response_type is code without a code_challenge" do
-        before do
-          get :new, params: {
-            username: user.cn,
-            redirect_uri: "https://example.com",
-            client_id: "example.com",
-            scope: "documents",
-            response_type: "code",
-            state: "foobar123"
-          }
-        end
-
-        it "redirects with invalid_request using a query param" do
-          expect(response).to redirect_to("https://example.com?error=invalid_request&state=foobar123")
-        end
-      end
-
-      context "when response_type is code with the plain method" do
-        before do
-          get :new, params: {
-            username: user.cn,
-            redirect_uri: "https://example.com",
-            client_id: "example.com",
-            scope: "documents",
-            response_type: "code",
-            code_challenge: "challenge123",
-            code_challenge_method: "plain"
-          }
-        end
-
-        it "redirects with invalid_request" do
-          expect(response).to redirect_to("https://example.com?error=invalid_request")
+          it "redirects to the redirect_uri with token and state" do
+            expect(response).to redirect_to("https://example.com#access_token=#{@auth.token}&state=foobar123")
+          end
         end
       end
 
@@ -310,12 +280,10 @@ RSpec.describe Rs::OauthController, type: :controller do
     context "when user is signed in" do
       before do
         sign_in user
-        request.user_agent = "RSpec Device"
       end
 
       after do
         user.remote_storage_authorizations.destroy_all
-        RsAuthorizationCode.destroy_all
       end
 
       context "when no valid token exists" do
@@ -335,10 +303,6 @@ RSpec.describe Rs::OauthController, type: :controller do
           expect(@auth.permissions).to eq(%w(documents photos contacts:rw videos:r tasks/work:r))
         end
 
-        it "stores the device's user agent" do
-          expect(@auth.user_agent).to eq("RSpec Device")
-        end
-
         it "redirects to the redirect_uri" do
           expect(response).to redirect_to("https://example.com#access_token=#{@auth.token}&state=foobar123")
         end
@@ -448,64 +412,6 @@ RSpec.describe Rs::OauthController, type: :controller do
         end
       end
 
-      context "with response_type=code" do
-        before do
-          post :create, params: {
-            user_id: user.id,
-            scope: "documents,[photos], contacts:rw",
-            redirect_uri: "https://example.com",
-            client_id: "example.com",
-            state: "foobar123",
-            response_type: "code",
-            code_challenge: "challenge123",
-            code_challenge_method: "S256",
-            expire_at: 1.month.from_now
-          }
-          @code = RsAuthorizationCode.last
-        end
-
-        it "creates an authorization code" do
-          expect(@code.permissions).to eq(%w(documents photos contacts:rw))
-          expect(@code.code_challenge).to eq("challenge123")
-          expect(@code.code_challenge_method).to eq("S256")
-          expect(@code.user_agent).to eq("RSpec Device")
-        end
-
-        it "does not create a remote storage authorization" do
-          expect(user.reload.remote_storage_authorizations.count).to eq(0)
-        end
-
-        it "redirects with the code in the query string" do
-          location = response.location
-          expect(location).to match(%r{\Ahttps://example\.com\?code=.+&state=foobar123\z})
-
-          raw_code = CGI.parse(URI.parse(location).query)["code"].first
-          expect(RsAuthorizationCode.find_by_code(raw_code)).to eq(@code)
-        end
-      end
-
-      context "with response_type=code but no code_challenge" do
-        before do
-          post :create, params: {
-            user_id: user.id,
-            scope: "documents",
-            redirect_uri: "https://example.com",
-            client_id: "example.com",
-            state: "foobar123",
-            response_type: "code",
-            expire_at: 1.month.from_now
-          }
-        end
-
-        it "redirects with invalid_request using a query param" do
-          expect(response).to redirect_to("https://example.com?error=invalid_request&state=foobar123")
-        end
-
-        it "does not create an authorization code" do
-          expect(RsAuthorizationCode.count).to eq(0)
-        end
-      end
-
       context "when the user_id is different from the signed in user" do
         before do
           post :create, params: {
@@ -545,81 +451,4 @@ RSpec.describe Rs::OauthController, type: :controller do
       end
     end
   end
-
-  describe "POST /rs/oauth/token" do
-    # Example values from RFC 7636, Appendix B
-    let(:code_verifier)  { "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk" }
-    let(:code_challenge) { "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM" }
-
-    def issue_code
-      RsOauthManager::IssueCode.call(
-        user: user,
-        client_id: "example.com",
-        redirect_uri: "https://example.com",
-        permissions: %w(documents:rw),
-        code_challenge: code_challenge,
-        code_challenge_method: "S256"
-      )
-    end
-
-    def token_params(code, **overrides)
-      {
-        grant_type: "authorization_code",
-        code: code.code,
-        client_id: "https://example.com",
-        redirect_uri: "https://example.com",
-        code_verifier: code_verifier
-      }.merge(overrides)
-    end
-
-    after do
-      user.remote_storage_authorizations.destroy_all
-      RsAuthorizationCode.destroy_all
-    end
-
-    context "with a valid code" do
-      before do
-        @code = issue_code
-        post :token, params: token_params(@code)
-      end
-
-      it "returns an access token" do
-        expect(response.response_code).to eq(200)
-
-        json = JSON.parse(response.body)
-        expect(json["access_token"]).to be_present
-        expect(json["token_type"]).to eq("bearer")
-        expect(json["scope"]).to eq("documents:rw")
-      end
-
-      it "does not cache the response" do
-        expect(response.headers["Cache-Control"]).to eq("no-store")
-      end
-
-      it "sets CORS headers" do
-        expect(response.headers["Access-Control-Allow-Origin"]).to eq("*")
-      end
-    end
-
-    context "with a bad code_verifier" do
-      before do
-        @code = issue_code
-        post :token, params: token_params(@code, code_verifier: "wrong-verifier")
-      end
-
-      it "returns invalid_grant" do
-        expect(response.response_code).to eq(400)
-        expect(JSON.parse(response.body)["error"]).to eq("invalid_grant")
-      end
-    end
-
-    context "with an unsupported grant_type" do
-      before { post :token, params: { grant_type: "password" } }
-
-      it "returns unsupported_grant_type" do
-        expect(response.response_code).to eq(400)
-        expect(JSON.parse(response.body)["error"]).to eq("unsupported_grant_type")
-      end
-    end
-  end
 end

spec/controllers/services/rs_auths_controller_spec.rb

@@ -6,18 +6,16 @@ RSpec.describe Services::RsAuthsController, type: :controller do
   before do
     allow_any_instance_of(AppCatalog::WebApp).to receive(:update_metadata).and_return(true)
     allow_any_instance_of(RemoteStorageAuthorization).to receive(:remove_token_expiry_job).and_return(nil)
-    allow_any_instance_of(LdapService).to receive(:fetch_users).and_return([
-      { services_enabled: ["remotestorage"] }
-    ])
+    allow_any_instance_of(Flipper).to receive(:enabled?).and_return(true)
   end
 
-  describe "GET /services/storage/apps/:client_id/launch (storage-first)" do
+  describe "GET /services/storage/rs_auths/:id/launch_app" do
     context "when user is signed in" do
       before do
         sign_in user
       end
 
-      context "authorization exists" do
+      context "token exists" do
         before do
           @auth = user.remote_storage_authorizations.create!(
             permissions: %w(documents), client_id: "app.example.com",
@@ -25,83 +23,17 @@ RSpec.describe Services::RsAuthsController, type: :controller do
             expire_at: 2.days.from_now
           )
 
-          get :launch_app, params: { client_id: @auth.client_id }
+          get :launch_app, params: { id: @auth.id }
         end
 
         after do
           @auth.destroy
         end
 
-        it "hands the app the user address in the URL fragment" do
+        it "redirects to the given URL with the correct RS URL fragment params" do
           launch_url = "https://app.example.com#remotestorage=#{user.address}"
           expect(response).to redirect_to(launch_url)
         end
-
-        it "does not hand over an access token" do
-          expect(response.location).not_to include("access_token")
-        end
-      end
-
-      context "when remoteStorage is not enabled for the user" do
-        before do
-          allow_any_instance_of(LdapService).to receive(:fetch_users).and_return([
-            { services_enabled: [] }
-          ])
-
-          get :launch_app, params: { client_id: "app.example.com" }
-        end
-
-        it "responds with forbidden" do
-          expect(response).to have_http_status(:forbidden)
-        end
-      end
-    end
-  end
-
-  describe "GET /services/storage/apps/:client_id/launch for an unknown app" do
-    before { sign_in user }
-
-    it "returns 404 instead of raising" do
-      get :launch_app, params: { client_id: "nonexistent.example.com" }
-
-      expect(response).to have_http_status(:not_found)
-    end
-  end
-
-  describe "DELETE /services/storage/rs_auths/:id" do
-    context "when user is signed in" do
-      before { sign_in user }
-
-      it "revokes the authorization" do
-        auth = user.remote_storage_authorizations.create!(
-          permissions: %w(documents), client_id: "app.example.com",
-          redirect_uri: "https://app.example.com", expire_at: 2.days.from_now
-        )
-
-        expect {
-          delete :destroy, params: { id: auth.id }
-        }.to change(RemoteStorageAuthorization, :count).by(-1)
-
-        expect(response).to redirect_to(apps_services_storage_url)
-      end
-
-      it "returns 404 for an unknown authorization" do
-        delete :destroy, params: { id: 0 }
-
-        expect(response).to have_http_status(:not_found)
-      end
-
-      it "returns 404 for another user's authorization" do
-        other = create :user, id: 99, cn: "otheruser", email: "other@example.com"
-        auth = other.remote_storage_authorizations.create!(
-          permissions: %w(documents), client_id: "app.example.com",
-          redirect_uri: "https://app.example.com"
-        )
-
-        delete :destroy, params: { id: auth.id }
-
-        expect(response).to have_http_status(:not_found)
-        expect(RemoteStorageAuthorization.exists?(auth.id)).to be(true)
       end
     end
   end

spec/features/rs/oauth_spec.rb

@@ -44,29 +44,11 @@ RSpec.describe 'remoteStorage OAuth Dialog', type: :feature do
 
         it "shows a special permission for all files and dirs" do
           within ".scope" do
-            expect(page).to have_content("All categories and files")
+            expect(page).to have_content("All files and directories")
           end
         end
       end
     end
-
-    context "with PKCE parameters" do
-      before do
-        visit new_rs_oauth_path(username: user.cn,
-                                redirect_uri: "http://example.com",
-                                client_id: "http://example.com",
-                                scope: "documents:rw",
-                                response_type: "code",
-                                code_challenge: "challenge123",
-                                code_challenge_method: "S256")
-      end
-
-      it "includes the PKCE parameters in the consent form" do
-        expect(page).to have_selector("input[name='response_type'][value='code']", visible: false)
-        expect(page).to have_selector("input[name='code_challenge'][value='challenge123']", visible: false)
-        expect(page).to have_selector("input[name='code_challenge_method'][value='S256']", visible: false)
-      end
-    end
   end
 
   context "when signed out" do

spec/features/services/rs_auths_spec.rb

@@ -1,122 +0,0 @@
-require 'rails_helper'
-
-RSpec.describe "Storage connected apps", type: :feature do
-  let(:user) { create :user }
-
-  let(:firefox_ua) do
-    "Mozilla/5.0 (X11; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0"
-  end
-
-  let(:chrome_ua) do
-    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 " \
-    "(KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
-  end
-
-  before do
-    allow_any_instance_of(AppCatalog::WebApp).to receive(:update_metadata).and_return(true)
-    allow_any_instance_of(RemoteStorageAuthorization).to receive(:remove_token_expiry_job).and_return(nil)
-    allow_any_instance_of(User).to receive(:ldap_entry).and_return(
-      uid: user.cn, ou: user.ou, mail: user.email, admin: nil,
-      services_enabled: ["remotestorage"]
-    )
-    login_as user, scope: :user
-  end
-
-  def create_auth(client:, device:, permissions: %w(documents:rw))
-    user.remote_storage_authorizations.create!(
-      permissions: permissions,
-      client_id: client,
-      redirect_uri: "https://#{client}",
-      expire_at: 1.month.from_now,
-      user_agent: device
-    )
-  end
-
-  context "with a connected app" do
-    before do
-      AppCatalog::WebApp.create!(url: "https://notes.example.com", name: "Notes", metadata: {})
-    end
-
-    let!(:auth) do
-      create_auth(client: "notes.example.com", device: firefox_ua,
-                  permissions: %w(documents:rw photos:r))
-    end
-
-    after { auth.destroy }
-
-    it "shows the app with device and category counts" do
-      visit apps_services_storage_path
-
-      within ".rs-auth-card" do
-        expect(page).to have_content("Notes")
-        expect(page).to have_content("notes.example.com")
-        expect(page).to have_content("1 device")
-        expect(page).to have_content("2 categories")
-      end
-    end
-
-    it "does not show the permission expiry on the card" do
-      visit apps_services_storage_path
-
-      within ".rs-auth-card" do
-        expect(page).not_to have_content("Expires")
-      end
-    end
-
-    it "renders access and per-token details in the modal" do
-      visit apps_services_storage_path
-
-      expect(page).to have_selector("p.scope", text: "documents", visible: false)
-      expect(page).to have_selector("p.scope", text: "photos", visible: false)
-      expect(page).to have_selector("h5", text: "Connected devices", visible: false)
-      expect(page).to have_selector("p", text: "Firefox on Linux", visible: false)
-      expect(page).to have_selector("p", text: /Expires/, visible: false)
-      expect(page).to have_button("Revoke access", visible: false)
-      expect(page).to have_link("Launch app", visible: false)
-    end
-  end
-
-  context "with multiple apps" do
-    let!(:notes)  { create_auth(client: "notes.example.com", device: firefox_ua) }
-    let!(:photos) { create_auth(client: "photos.example.com", device: firefox_ua) }
-
-    after do
-      notes.destroy
-      photos.destroy
-    end
-
-    it "shows one card per app" do
-      visit apps_services_storage_path
-
-      expect(page).to have_selector(".rs-auth-card", count: 2)
-    end
-  end
-
-  context "with one app on multiple devices" do
-    let!(:laptop) { create_auth(client: "notes.example.com", device: firefox_ua) }
-    let!(:phone)  { create_auth(client: "notes.example.com", device: chrome_ua) }
-
-    after do
-      laptop.destroy
-      phone.destroy
-    end
-
-    it "shows a single card with the device count" do
-      visit apps_services_storage_path
-
-      expect(page).to have_selector(".rs-auth-card", count: 1)
-
-      within ".rs-auth-card" do
-        expect(page).to have_content("2 devices")
-      end
-    end
-  end
-
-  context "without connected apps" do
-    it "shows the empty state" do
-      visit apps_services_storage_path
-
-      expect(page).to have_content("No apps connected")
-    end
-  end
-end

spec/models/remote_storage_authorization_spec.rb

@@ -12,6 +12,7 @@ RSpec.describe RemoteStorageAuthorization, type: :model do
 
   describe "#create" do
     after(:each) { clear_enqueued_jobs }
+    after(:all)  { redis_rs_delete_keys("authorizations:*") }
 
     let(:auth) do
       user.remote_storage_authorizations.create!(
@@ -26,9 +27,10 @@ RSpec.describe RemoteStorageAuthorization, type: :model do
     end
 
     it "stores a token in redis" do
-      auth
+      user_auth_keys = redis_rs.keys("authorizations:#{user.cn}:*")
+      expect(user_auth_keys.length).to eq(1)
 
-      authorizations = redis_rs.smembers("authorizations:#{user.cn}:#{auth.token}")
+      authorizations = redis_rs.smembers(user_auth_keys.first)
       expect(authorizations.sort).to eq(%w(documents photos contacts:rw videos:r tasks/work:r).sort)
     end
 
@@ -47,6 +49,7 @@ RSpec.describe RemoteStorageAuthorization, type: :model do
 
   describe "#destroy" do
     after(:each) { clear_enqueued_jobs }
+    after(:all)  { redis_rs_delete_keys("authorizations:*") }
 
     it "removes the token from redis" do
       auth = user.remote_storage_authorizations.create!(
@@ -56,7 +59,7 @@ RSpec.describe RemoteStorageAuthorization, type: :model do
              )
       auth.destroy!
 
-      expect(redis_rs.exists?("authorizations:#{user.cn}:#{auth.token}")).to be(false)
+      expect(redis_rs.keys("authorizations:#{user.address}:*")).to be_empty
     end
 
     context "with expiry set" do
@@ -76,6 +79,8 @@ RSpec.describe RemoteStorageAuthorization, type: :model do
 
   describe "#find_or_create_web_app" do
     context "with origin that looks hosted" do
+      after(:all)  { redis_rs_delete_keys("authorizations:*") }
+
       let(:auth) do
         user.remote_storage_authorizations.create!(
           permissions: %w(documents:rw),
@@ -168,6 +173,8 @@ RSpec.describe RemoteStorageAuthorization, type: :model do
   end
 
   describe "#launch_url" do
+    after(:all) { redis_rs_delete_keys("authorizations:*") }
+
     context "without start URL" do
       before do
         AppCatalog::WebApp.create!(
@@ -243,6 +250,7 @@ RSpec.describe RemoteStorageAuthorization, type: :model do
     include ActiveJob::TestHelper
 
     after(:each) { clear_enqueued_jobs }
+    after(:all)  { redis_rs_delete_keys("authorizations:*") }
 
     before { allow(user).to receive(:display_name).and_return("Jimmy") }
 
@@ -303,73 +311,4 @@ RSpec.describe RemoteStorageAuthorization, type: :model do
       end
     end
   end
-  describe "#expired?" do
-    def auth_with_expiry(expire_at)
-      RemoteStorageAuthorization.new(
-        user: user, permissions: %w(documents:rw), client_id: "example.com",
-        redirect_uri: "https://example.com", expire_at: expire_at
-      )
-    end
-
-    it "is false without an expiry" do
-      expect(auth_with_expiry(nil)).not_to be_expired
-    end
-
-    it "is false before the expiry" do
-      expect(auth_with_expiry(1.day.from_now)).not_to be_expired
-    end
-
-    it "is true after the expiry" do
-      expect(auth_with_expiry(1.day.ago)).to be_expired
-    end
-  end
-
-  describe "#device_name" do
-    def auth_with_user_agent(user_agent)
-      RemoteStorageAuthorization.new(user: user, user_agent: user_agent)
-    end
-
-    it "returns nil without a user agent" do
-      expect(auth_with_user_agent(nil).device_name).to be_nil
-    end
-
-    it "recognizes Firefox on Linux" do
-      ua = "Mozilla/5.0 (X11; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0"
-      expect(auth_with_user_agent(ua).device_name).to eq("Firefox on Linux")
-    end
-
-    it "recognizes Chrome on macOS" do
-      ua = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 " \
-           "(KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
-      expect(auth_with_user_agent(ua).device_name).to eq("Chrome on macOS")
-    end
-
-    it "recognizes Mobile Safari on iOS" do
-      ua = "Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) " \
-           "AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1"
-      expect(auth_with_user_agent(ua).device_name).to eq("Mobile Safari on iOS")
-    end
-
-    it "recognizes GNOME Web on Linux (Epiphany's Safari-like user agent)" do
-      ua = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/605.1.15 (KHTML, like Gecko) " \
-           "Version/16.0 Safari/605.1.15 Epiphany/45.0"
-      expect(auth_with_user_agent(ua).device_name).to eq("GNOME Web on Linux")
-    end
-
-    it "treats a WebKit Safari user agent on Linux as WebKit (WebKitGTK)" do
-      ua = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/605.1.15 (KHTML, like Gecko) " \
-           "Version/60.5 Safari/605.1.15"
-      expect(auth_with_user_agent(ua).device_name).to eq("WebKit on Linux")
-    end
-
-    it "keeps Safari on macOS as Safari" do
-      ua = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 " \
-           "(KHTML, like Gecko) Version/17.1 Safari/605.1.15"
-      expect(auth_with_user_agent(ua).device_name).to eq("Safari on macOS")
-    end
-
-    it "falls back to the browser when the OS is unknown" do
-      expect(auth_with_user_agent("Firefox/120.0").device_name).to eq("Firefox")
-    end
-  end
 end

spec/models/rs_authorization_code_spec.rb

@@ -1,65 +0,0 @@
-require 'rails_helper'
-
-RSpec.describe RsAuthorizationCode, type: :model do
-  let(:user) { create :user }
-
-  def build_code(**attrs)
-    RsAuthorizationCode.create!(
-      user: user,
-      client_id: "example.com",
-      redirect_uri: "https://example.com",
-      permissions: %w(documents:rw),
-      code_challenge: "challenge",
-      **attrs
-    )
-  end
-
-  describe "#create" do
-    it "generates a raw code and stores only its digest" do
-      code = build_code
-
-      expect(code.code).to be_present
-      expect(code.code_digest).to eq(Digest::SHA256.hexdigest(code.code))
-    end
-
-    it "sets a short expiry" do
-      code = build_code
-
-      expect(code.expires_at).to be_within(5.seconds).of(60.seconds.from_now)
-    end
-  end
-
-  describe ".find_by_code" do
-    it "finds a code by its raw value" do
-      code = build_code
-
-      expect(RsAuthorizationCode.find_by_code(code.code)).to eq(code)
-    end
-
-    it "returns nil for an unknown code" do
-      expect(RsAuthorizationCode.find_by_code("does-not-exist")).to be_nil
-    end
-
-    it "returns nil for a blank code" do
-      expect(RsAuthorizationCode.find_by_code(nil)).to be_nil
-    end
-  end
-
-  describe "#expired?" do
-    it "is false before the expiry" do
-      expect(build_code).not_to be_expired
-    end
-
-    it "is true after the expiry" do
-      expect(build_code(expires_at: 1.minute.ago)).to be_expired
-    end
-  end
-
-  describe "#consume!" do
-    it "destroys the record" do
-      code = build_code
-
-      expect { code.consume! }.to change(RsAuthorizationCode, :count).by(-1)
-    end
-  end
-end

spec/requests/rs/oauth_spec.rb

@@ -1,57 +0,0 @@
-require 'rails_helper'
-
-RSpec.describe "remoteStorage OAuth token endpoint", type: :request do
-  let(:user) { create :user }
-
-  # Example values from RFC 7636, Appendix B
-  let(:code_verifier)  { "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk" }
-  let(:code_challenge) { "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM" }
-
-  before do
-    allow_any_instance_of(AppCatalog::WebApp).to receive(:update_metadata).and_return(true)
-    allow_any_instance_of(RemoteStorageAuthorization).to receive(:remove_token_expiry_job).and_return(nil)
-  end
-
-  after do
-    user.remote_storage_authorizations.destroy_all
-    RsAuthorizationCode.destroy_all
-  end
-
-  def issue_code
-    RsOauthManager::IssueCode.call(
-      user: user,
-      client_id: "example.com",
-      redirect_uri: "https://example.com",
-      permissions: %w(documents:rw),
-      code_challenge: code_challenge,
-      code_challenge_method: "S256"
-    )
-  end
-
-  it "exchanges a code for an access token without a session" do
-    code = issue_code
-
-    post "/rs/oauth/token", params: {
-      grant_type: "authorization_code",
-      code: code.code,
-      client_id: "https://example.com",
-      redirect_uri: "https://example.com",
-      code_verifier: code_verifier
-    }
-
-    expect(response).to have_http_status(:ok)
-    expect(response.media_type).to eq("application/json")
-
-    json = JSON.parse(response.body)
-    expect(json["access_token"]).to be_present
-    expect(json["token_type"]).to eq("bearer")
-    expect(response.headers["Access-Control-Allow-Origin"]).to eq("*")
-  end
-
-  it "answers CORS preflight requests" do
-    options "/rs/oauth/token"
-
-    expect(response).to have_http_status(:ok)
-    expect(response.headers["Access-Control-Allow-Methods"]).to include("POST")
-  end
-end

spec/requests/webfinger_spec.rb

@@ -133,15 +133,6 @@ RSpec.describe "WebFinger", type: :request do
 
           oauth_url = rs_link["properties"]["http://tools.ietf.org/html/rfc6749#section-4.2"]
           expect(oauth_url).to eql("http://localhost/rs/oauth/tony")
-
-          authorization_url = rs_link["properties"]["http://tools.ietf.org/html/rfc6749#section-3.1"]
-          expect(authorization_url).to eql("http://localhost/rs/oauth/tony")
-
-          token_url = rs_link["properties"]["http://tools.ietf.org/html/rfc6749#section-3.2"]
-          expect(token_url).to eql("http://localhost/rs/oauth/token")
-
-          expect(rs_link["properties"]["http://tools.ietf.org/html/rfc7636"]).to eql("S256")
-          expect(rs_link["properties"]["http://remotestorage.io/spec/version"]).to eql("draft-dejong-remotestorage-27")
         end
 
         it "returns CORS headers" do

spec/services/nostr_manager/fetch_latest_event_spec.rb

@@ -0,0 +1,88 @@
+require 'rails_helper'
+
+RSpec.describe NostrManager::FetchLatestEvent, type: :model do
+  let(:filter) { Nostr::Filter.new(authors: ["pubkey"], kinds: [0], limit: 1) }
+  let(:event_v1) { { "id" => "aaa", "created_at" => 1000, "content" => "v1" } }
+  let(:event_v2) { { "id" => "bbb", "created_at" => 2000, "content" => "v2" } }
+
+  describe "with no events found" do
+    it "returns nil" do
+      allow(NostrManager::FetchEvent).to receive(:call).and_return(nil)
+
+      result = described_class.call(relays: ["wss://a", "wss://b"], filter: filter)
+      expect(result).to be_nil
+    end
+  end
+
+  describe "with event on 1 relay only" do
+    it "returns the event" do
+      allow(NostrManager::FetchEvent).to receive(:call) do |args|
+        case args[:relay_url]
+        when "wss://a" then event_v1
+        else nil
+        end
+      end
+
+      result = described_class.call(
+        relays: ["wss://a", "wss://b", "wss://c"], filter: filter
+      )
+      expect(result).to eq(event_v1)
+    end
+  end
+
+  describe "with events on 2 relays, different versions" do
+    it "returns the latest event (max created_at)" do
+      allow(NostrManager::FetchEvent).to receive(:call) do |args|
+        case args[:relay_url]
+        when "wss://a" then event_v1
+        when "wss://b" then event_v2
+        end
+      end
+
+      result = described_class.call(relays: ["wss://a", "wss://b"], filter: filter)
+      expect(result).to eq(event_v2)
+    end
+  end
+
+  describe "with duplicate events (same ID) on 2 relays" do
+    it "returns the single event without double-counting" do
+      allow(NostrManager::FetchEvent).to receive(:call).and_return(event_v1)
+
+      result = described_class.call(relays: ["wss://a", "wss://b"], filter: filter)
+      expect(result).to eq(event_v1)
+    end
+  end
+
+  describe "with timeout after finding 1 event" do
+    it "still returns the found event" do
+      allow(NostrManager::FetchEvent).to receive(:call) do |args|
+        case args[:relay_url]
+        when "wss://a" then event_v1
+        when "wss://b" then raise Timeout::Error
+        end
+      end
+
+      result = described_class.call(relays: ["wss://a", "wss://b"], filter: filter)
+      expect(result).to eq(event_v1)
+    end
+  end
+
+  describe "with max_events reached" do
+    it "stops querying further relays" do
+      call_count = 0
+      allow(NostrManager::FetchEvent).to receive(:call) do |args|
+        call_count += 1
+        raise "should not query wss://c" if args[:relay_url] == "wss://c"
+        case args[:relay_url]
+        when "wss://a" then event_v1
+        when "wss://b" then event_v2
+        end
+      end
+
+      described_class.call(
+        relays: ["wss://a", "wss://b", "wss://c"], filter: filter
+      )
+      expect(call_count).to eq(2)
+    end
+  end
+end

spec/services/rs_oauth_manager/exchange_code_spec.rb

@@ -1,105 +0,0 @@
-require 'rails_helper'
-
-RSpec.describe RsOauthManager::ExchangeCode do
-  let(:user) { create :user }
-
-  # Example values from RFC 7636, Appendix B
-  let(:code_verifier)  { "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk" }
-  let(:code_challenge) { "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM" }
-
-  before do
-    allow_any_instance_of(AppCatalog::WebApp).to receive(:update_metadata).and_return(true)
-    allow_any_instance_of(RemoteStorageAuthorization).to receive(:remove_token_expiry_job).and_return(nil)
-  end
-
-  def issue_code(**overrides)
-    RsOauthManager::IssueCode.call(
-      user: user,
-      client_id: "example.com",
-      redirect_uri: "https://example.com",
-      permissions: %w(documents:rw),
-      code_challenge: code_challenge,
-      code_challenge_method: "S256",
-      user_agent: "RSpec Device",
-      **overrides
-    )
-  end
-
-  def exchange(code, **overrides)
-    described_class.call(
-      code: code.code,
-      client_id: "https://example.com",
-      redirect_uri: "https://example.com",
-      code_verifier: code_verifier,
-      **overrides
-    )
-  end
-
-  it "creates an authorization and consumes the code" do
-    code = issue_code
-    auth = nil
-
-    expect { auth = exchange(code) }.to change(RemoteStorageAuthorization, :count).by(1)
-
-    expect(auth.permissions).to eq(%w(documents:rw))
-    expect(auth.client_id).to eq("example.com")
-    expect(auth.token).to be_present
-    expect(auth.user_agent).to eq("RSpec Device")
-    expect(RsAuthorizationCode.exists?(code.id)).to be(false)
-  end
-
-  it "carries over the permission expiry" do
-    expire_at = 1.month.from_now
-    code = issue_code(expire_at: expire_at)
-
-    auth = exchange(code)
-
-    expect(auth.expire_at).to be_within(1.second).of(expire_at)
-  end
-
-  it "rejects an unknown code" do
-    expect do
-      described_class.call(
-        code: "unknown",
-        client_id: "https://example.com",
-        redirect_uri: "https://example.com",
-        code_verifier: code_verifier
-      )
-    end.to raise_error(RsOauthManagerService::InvalidGrant)
-  end
-
-  it "rejects a reused code" do
-    code = issue_code
-    exchange(code)
-
-    expect { exchange(code) }.to raise_error(RsOauthManagerService::InvalidGrant)
-  end
-
-  it "rejects an expired code" do
-    code = issue_code
-    code.update_columns(expires_at: 1.minute.ago)
-
-    expect { exchange(code) }.to raise_error(RsOauthManagerService::InvalidGrant)
-  end
-
-  it "rejects a mismatching redirect_uri" do
-    code = issue_code
-
-    expect { exchange(code, redirect_uri: "https://example.com/other") }
-      .to raise_error(RsOauthManagerService::InvalidGrant)
-  end
-
-  it "rejects a mismatching client_id host" do
-    code = issue_code
-
-    expect { exchange(code, client_id: "https://evil.example.org") }
-      .to raise_error(RsOauthManagerService::InvalidGrant)
-  end
-
-  it "rejects a bad code_verifier" do
-    code = issue_code
-
-    expect { exchange(code, code_verifier: "wrong-verifier") }
-      .to raise_error(RsOauthManagerService::InvalidGrant)
-  end
-end

spec/services/rs_oauth_manager/issue_code_spec.rb

@@ -1,31 +0,0 @@
-require 'rails_helper'
-
-RSpec.describe RsOauthManager::IssueCode do
-  let(:user) { create :user }
-
-  subject do
-    described_class.call(
-      user: user,
-      client_id: "example.com",
-      redirect_uri: "https://example.com",
-      permissions: %w(documents:rw),
-      code_challenge: "challenge",
-      code_challenge_method: "S256",
-      expire_at: 1.month.from_now,
-      user_agent: "RSpec Device"
-    )
-  end
-
-  it "creates a short-lived authorization code" do
-    expect { subject }.to change(RsAuthorizationCode, :count).by(1)
-    expect(subject.code).to be_present
-    expect(subject.client_id).to eq("example.com")
-    expect(subject.permissions).to eq(%w(documents:rw))
-    expect(subject.code_challenge).to eq("challenge")
-    expect(subject.user_agent).to eq("RSpec Device")
-  end
-
-  it "does not create a remote storage authorization" do
-    expect { subject }.not_to change(RemoteStorageAuthorization, :count)
-  end
-end

spec/services/rs_oauth_manager/verify_pkce_spec.rb

@@ -1,41 +0,0 @@
-require 'rails_helper'
-
-RSpec.describe RsOauthManager::VerifyPkce do
-  # Example values from RFC 7636, Appendix B
-  let(:code_verifier)  { "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk" }
-  let(:code_challenge) { "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM" }
-
-  subject do
-    described_class.call(
-      code_challenge: code_challenge,
-      code_challenge_method: code_challenge_method,
-      code_verifier: code_verifier
-    )
-  end
-
-  context "with the S256 method" do
-    let(:code_challenge_method) { "S256" }
-
-    it "accepts a matching verifier" do
-      expect(subject).to be(true)
-    end
-
-    it "rejects a non-matching verifier" do
-      expect(
-        described_class.call(
-          code_challenge: code_challenge,
-          code_challenge_method: "S256",
-          code_verifier: "wrong-verifier"
-        )
-      ).to be(false)
-    end
-  end
-
-  context "with an unsupported method" do
-    let(:code_challenge_method) { "plain" }
-
-    it "rejects the verifier" do
-      expect(subject).to be(false)
-    end
-  end
-end

spec/support/helpers/redis_helper.rb

@@ -1,3 +1,8 @@
 def redis_rs
   @redis_rs ||= Redis.new(url: Setting.rs_redis_url)
 end
+
+def redis_rs_delete_keys(pattern)
+  keys = redis_rs.keys(pattern)
+  redis_rs.del(*keys)
+end