nipIC: Identity Connection package + nipAZ Identity refactor - #4
Merged
Conversation
Implements attestation (Kind 35522) and identity connection (Kind 35521) construction/parsing/validation, the npv1 cross-IA challenge token, and the nconnection bech32 profile-link encoding — extracted so nipAZ (and any other consumer) can depend on it instead of every caller hand-rolling its own copy. Refs #3
Breaking: - AltZapRequestParams/AltZapReceiptParams no longer take raw Recipient/Sender/*Provider strings — Recipient and Sender are now Identity, built via Pubkey(hex), Connection(platform, externalID), or ResolvedConnection(key, platform). WebIdentity and ConnectionKey are re-exported from nipIC under nipAZ's own names. - All New* constructors (NewAltZapRequest, NewAltZapOnBehalfRequest, NewAltZapReceipt) now sign internally via a required PrivateKey param and return (*nip01.Event, error) — callers no longer call .Sign() themselves. - NewAltZapOnBehalfRequest now takes sender as a required positional Identity argument instead of an optional params field, so an invalid 5523 (missing P tag) can't be constructed. Security fix: - NewAltZapReceipt no longer silently re-derives its p/P tags by parsing the embedded request's description JSON — it only ever uses the Identity values the caller explicitly passed. The old behavior let a tampered embedded request redirect a receipt's attribution. Refs #3
README: add nipIC to Implemented NIPs, add a combined nipAZ+nipIC example (zapping a Web Identity recipient via nipAZ.Connection), fix the existing nipAZ example which still showed the old construct-then-.Sign() pattern. Link both NIP entries at the zapf-nips GitHub repo instead of docs.zapf.app. CHANGELOG: open the 0.2.7 entry for this work. Refs #3
naliyi
marked this pull request as ready for review
September 3, 2026 05:27
naliyi
added a commit
that referenced
this pull request
Sep 3, 2026
The 0.2.7 entry was missing the Changed/Breaking section entirely (the Identity type + internal-signing API changes weren't called out at all) and none of its bullets had a PR backreference — matching 0.2.6's established pattern of a (#N) tag on every bullet, filled in once the PR number is known, so the eventual release notes stay traceable.
This was referenced Sep 3, 2026
naliyi
added a commit
that referenced
this pull request
Sep 3, 2026
changelog: add (#4) PR backreferences, document breaking nipAZ changes
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #3
Summary
nipICpackage implementing NIP-IC (Identity Connection): attestation (Kind 35522), identity connection (Kind 35521), npv1 cross-IA challenge binding, nconnection bech32 encoding.nipAZnow depends onnipICand gains anIdentitytype (Pubkey/Connection/ResolvedConnection) replacing raw stringRecipient/Sender/*Providerparams — breaking.nipAZ.New*constructors sign internally now and return(*nip01.Event, error)— breaking.NewAltZapReceiptno longer silently re-derivesp/Ptags from the embedded request'sdescriptionJSON.nipIC.NewChallengeentropy fixed to 16 bytes to match its real caller.fa48c46(LIDP→Web Identity terminology cleanup), already on this branch from a previous push but never merged.Test plan
go build ./...,go vet ./...,go test ./...clean (verified both after thenipIC-only commit in isolation, and after the full stack)nipICtest files cover attestation, identity connection, nconnection encoding, challenge token