softchat/

relay.rs

//! Bounded Nostr relay codecs, filters, authentication plans, and batch results.

use std::collections::{BTreeMap, BTreeSet};
use std::fmt;

use serde::de::{MapAccess, Visitor};
use serde::{Deserialize, Deserializer, Serialize};
use serde_json::Value;
use url::Url;

use crate::{
    LocalIdentity, NostrEventDraft, NostrEventId, NostrEventKind, NostrPublicKey, NostrTag,
    SignedEvent, SignedNostrEvent, SoftchatError,
};

/// Maximum accepted logical relay frame size.
pub const MAX_RELAY_FRAME_BYTES: usize = 512 * 1024;
/// Maximum number of events in the deployed `EVENTS` extension.
pub const MAX_RELAY_BATCH_EVENTS: usize = 256;
/// NIP-01 maximum subscription identifier length in Unicode scalar values.
pub const MAX_SUBSCRIPTION_ID_CHARS: usize = 64;
/// Maximum number of filters in one query.
pub const MAX_RELAY_FILTERS: usize = 64;
/// Maximum values in one filter field or generic-tag constraint.
pub const MAX_RELAY_FILTER_VALUES: usize = 1_024;
/// Maximum bounded diagnostic/challenge string accepted from a relay.
pub const MAX_RELAY_MESSAGE_CHARS: usize = 4_096;
/// Accepted NIP-42 authentication timestamp skew in seconds.
pub const NIP42_AUTH_WINDOW_SECONDS: u64 = 600;

/// A strict NIP-01 filter that retains generic `#<tag>` constraints.
#[derive(Clone, Debug, Default, Eq, PartialEq, Serialize)]
pub struct RelayFilter {
    /// Event ID prefixes.
    #[serde(skip_serializing_if = "Vec::is_empty")]
    pub ids: Vec<String>,
    /// Author public-key prefixes.
    #[serde(skip_serializing_if = "Vec::is_empty")]
    pub authors: Vec<String>,
    /// Exact event kinds.
    #[serde(skip_serializing_if = "Vec::is_empty")]
    pub kinds: Vec<u16>,
    /// Inclusive lower timestamp bound.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub since: Option<u64>,
    /// Inclusive upper timestamp bound.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub until: Option<u64>,
    /// Maximum result count.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub limit: Option<u32>,
    /// Generic tag constraints keyed by the one-character tag name.
    #[serde(flatten)]
    pub generic_tags: BTreeMap<String, Vec<String>>,
}

impl RelayFilter {
    /// Parse one filter while rejecting duplicate JSON fields and unbounded values.
    ///
    /// # Errors
    ///
    /// Returns [`SoftchatError::InvalidRelayFilter`] for malformed or oversized input.
    pub fn from_json(json: &str) -> Result<Self, SoftchatError> {
        if json.len() > MAX_RELAY_FRAME_BYTES {
            return Err(SoftchatError::InvalidRelayFilter);
        }
        let mut deserializer = serde_json::Deserializer::from_str(json);
        let filter =
            Self::deserialize(&mut deserializer).map_err(|_| SoftchatError::InvalidRelayFilter)?;
        deserializer
            .end()
            .map_err(|_| SoftchatError::InvalidRelayFilter)?;
        filter.validate()
    }

    /// Serialize a canonical compact filter object.
    ///
    /// # Errors
    ///
    /// Returns [`SoftchatError::InvalidRelayFilter`] if the value violates bounds.
    pub fn to_json(&self) -> Result<String, SoftchatError> {
        self.clone().validate()?;
        serde_json::to_string(self).map_err(|_| SoftchatError::InvalidRelayFilter)
    }

    fn validate(self) -> Result<Self, SoftchatError> {
        validate_prefixes(&self.ids)?;
        validate_prefixes(&self.authors)?;
        validate_value_count(self.kinds.len())?;
        if self
            .since
            .zip(self.until)
            .is_some_and(|(since, until)| since > until)
        {
            return Err(SoftchatError::InvalidRelayFilter);
        }
        if self.limit == Some(0) {
            return Err(SoftchatError::InvalidRelayFilter);
        }
        for (key, values) in &self.generic_tags {
            if !is_generic_tag_key(key) || values.is_empty() {
                return Err(SoftchatError::InvalidRelayFilter);
            }
            validate_value_count(values.len())?;
            if values
                .iter()
                .any(|value| value.len() > MAX_RELAY_FRAME_BYTES)
            {
                return Err(SoftchatError::InvalidRelayFilter);
            }
        }
        Ok(self)
    }
}

impl<'de> Deserialize<'de> for RelayFilter {
    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
    where
        D: Deserializer<'de>,
    {
        struct FilterVisitor;

        impl<'de> Visitor<'de> for FilterVisitor {
            type Value = RelayFilter;

            fn expecting(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
                formatter.write_str("a bounded NIP-01 filter object")
            }

            fn visit_map<A>(self, mut map: A) -> Result<Self::Value, A::Error>
            where
                A: MapAccess<'de>,
            {
                let mut filter = RelayFilter::default();
                let mut seen = BTreeSet::new();
                while let Some(key) = map.next_key::<String>()? {
                    if !seen.insert(key.clone()) {
                        return Err(serde::de::Error::custom("duplicate filter field"));
                    }
                    match key.as_str() {
                        "ids" => filter.ids = map.next_value()?,
                        "authors" => filter.authors = map.next_value()?,
                        "kinds" => filter.kinds = map.next_value()?,
                        "since" => filter.since = Some(map.next_value()?),
                        "until" => filter.until = Some(map.next_value()?),
                        "limit" => filter.limit = Some(map.next_value()?),
                        _ if is_generic_tag_key(&key) => {
                            filter.generic_tags.insert(key, map.next_value()?);
                        }
                        _ => return Err(serde::de::Error::custom("unknown filter field")),
                    }
                }
                filter.validate().map_err(serde::de::Error::custom)
            }
        }

        deserializer.deserialize_map(FilterVisitor)
    }
}

/// A validated client-to-relay frame.
#[derive(Clone, Debug, Eq, PartialEq)]
pub enum ClientRelayFrame {
    /// Publish one event.
    Event(SignedNostrEvent),
    /// Publish a non-empty collection through Softchat's extension.
    Events(Vec<SignedNostrEvent>),
    /// Open or replace one subscription.
    Req {
        /// Bounded subscription identifier.
        subscription_id: String,
        /// One or more strict filters.
        filters: Vec<RelayFilter>,
    },
    /// Close one subscription.
    Close {
        /// Bounded subscription identifier.
        subscription_id: String,
    },
    /// Request a count for one or more filters.
    Count {
        /// Bounded subscription identifier.
        subscription_id: String,
        /// One or more strict filters.
        filters: Vec<RelayFilter>,
    },
    /// Submit one signed NIP-42 authentication event.
    Auth(SignedNostrEvent),
}

impl ClientRelayFrame {
    /// Serialize this frame as compact JSON.
    ///
    /// # Errors
    ///
    /// Returns [`SoftchatError::InvalidRelayFrame`] if serialization exceeds bounds.
    pub fn to_json(&self) -> Result<String, SoftchatError> {
        let mut values = Vec::new();
        match self {
            Self::Event(event) => {
                values.push(Value::String("EVENT".to_owned()));
                values.push(event_value(event)?);
            }
            Self::Events(events) => {
                validate_batch_events(events)?;
                values.push(Value::String("EVENTS".to_owned()));
                for event in events {
                    values.push(event_value(event)?);
                }
            }
            Self::Req {
                subscription_id,
                filters,
            } => {
                validate_subscription_id(subscription_id)?;
                validate_filters(filters)?;
                values.push(Value::String("REQ".to_owned()));
                values.push(Value::String(subscription_id.clone()));
                append_filter_values(&mut values, filters)?;
            }
            Self::Close { subscription_id } => {
                validate_subscription_id(subscription_id)?;
                values.push(Value::String("CLOSE".to_owned()));
                values.push(Value::String(subscription_id.clone()));
            }
            Self::Count {
                subscription_id,
                filters,
            } => {
                validate_subscription_id(subscription_id)?;
                validate_filters(filters)?;
                values.push(Value::String("COUNT".to_owned()));
                values.push(Value::String(subscription_id.clone()));
                append_filter_values(&mut values, filters)?;
            }
            Self::Auth(event) => {
                if event.kind() != NostrEventKind::CLIENT_AUTHENTICATION {
                    return Err(SoftchatError::InvalidRelayAuthentication);
                }
                values.push(Value::String("AUTH".to_owned()));
                values.push(event_value(event)?);
            }
        }
        encode_frame(values)
    }
}

/// A validated relay-to-client frame.
#[derive(Clone, Debug, Eq, PartialEq)]
pub enum RelayResponseFrame {
    /// One event for a subscription.
    Event {
        /// Bounded subscription identifier.
        subscription_id: String,
        /// Verified signed event.
        event: SignedNostrEvent,
    },
    /// Terminal result for one event publication.
    Ok(BatchAcknowledgement),
    /// Stored history for a subscription is complete.
    Eose {
        /// Bounded subscription identifier.
        subscription_id: String,
    },
    /// Relay closed a subscription.
    Closed {
        /// Bounded subscription identifier.
        subscription_id: String,
        /// Bounded diagnostic text.
        message: String,
    },
    /// Bounded relay notice.
    Notice(String),
    /// NIP-42 challenge.
    Auth(String),
    /// Count result.
    Count {
        /// Bounded subscription identifier.
        subscription_id: String,
        /// Exact non-negative count.
        count: u64,
    },
}

impl RelayResponseFrame {
    /// Serialize this frame as compact JSON.
    ///
    /// # Errors
    ///
    /// Returns [`SoftchatError::InvalidRelayFrame`] for invalid bounds.
    pub fn to_json(&self) -> Result<String, SoftchatError> {
        let values = match self {
            Self::Event {
                subscription_id,
                event,
            } => {
                validate_subscription_id(subscription_id)?;
                vec![
                    Value::String("EVENT".to_owned()),
                    Value::String(subscription_id.clone()),
                    event_value(event)?,
                ]
            }
            Self::Ok(acknowledgement) => {
                acknowledgement.validate()?;
                vec![
                    Value::String("OK".to_owned()),
                    Value::String(acknowledgement.event_id.clone()),
                    Value::Bool(acknowledgement.accepted),
                    Value::String(acknowledgement.message.clone()),
                ]
            }
            Self::Eose { subscription_id } => {
                validate_subscription_id(subscription_id)?;
                vec![
                    Value::String("EOSE".to_owned()),
                    Value::String(subscription_id.clone()),
                ]
            }
            Self::Closed {
                subscription_id,
                message,
            } => {
                validate_subscription_id(subscription_id)?;
                validate_relay_text(message)?;
                vec![
                    Value::String("CLOSED".to_owned()),
                    Value::String(subscription_id.clone()),
                    Value::String(message.clone()),
                ]
            }
            Self::Notice(message) => {
                validate_relay_text(message)?;
                vec![
                    Value::String("NOTICE".to_owned()),
                    Value::String(message.clone()),
                ]
            }
            Self::Auth(challenge) => {
                validate_relay_text(challenge)?;
                if challenge.is_empty() {
                    return Err(SoftchatError::InvalidRelayAuthentication);
                }
                vec![
                    Value::String("AUTH".to_owned()),
                    Value::String(challenge.clone()),
                ]
            }
            Self::Count {
                subscription_id,
                count,
            } => {
                validate_subscription_id(subscription_id)?;
                vec![
                    Value::String("COUNT".to_owned()),
                    Value::String(subscription_id.clone()),
                    serde_json::json!({ "count": count }),
                ]
            }
        };
        encode_frame(values)
    }
}

/// One terminal relay result for a submitted event.
#[derive(Clone, Debug, Eq, PartialEq)]
#[cfg_attr(feature = "native-bindings", derive(uniffi::Record))]
pub struct BatchAcknowledgement {
    /// Canonical event ID.
    pub event_id: String,
    /// Relay acceptance bit.
    pub accepted: bool,
    /// Bounded diagnostic text, never protocol identity.
    pub message: String,
}

impl BatchAcknowledgement {
    fn validate(&self) -> Result<(), SoftchatError> {
        NostrEventId::from_hex(&self.event_id).map_err(|_| SoftchatError::InvalidRelayBatch)?;
        validate_relay_text(&self.message).map_err(|_| SoftchatError::InvalidRelayBatch)
    }
}

/// Terminal state for one event in a batch projection.
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
#[cfg_attr(feature = "native-bindings", derive(uniffi::Enum))]
pub enum BatchEventState {
    /// No terminal `OK` was observed.
    Pending,
    /// A terminal successful `OK` was observed.
    Accepted,
    /// A terminal rejected `OK` was observed.
    Rejected,
}

/// Deterministic per-event batch progress in original submission order.
#[derive(Clone, Debug, Eq, PartialEq)]
#[cfg_attr(feature = "native-bindings", derive(uniffi::Record))]
pub struct BatchProgress {
    /// Submitted canonical event IDs.
    pub event_ids: Vec<String>,
    /// State at the same index as `event_ids`.
    pub states: Vec<BatchEventState>,
    /// Bounded terminal messages at the same index; pending entries are empty.
    pub messages: Vec<String>,
    /// Whether every submitted event is terminal.
    pub complete: bool,
}

/// Parse one bounded client-to-relay JSON frame.
///
/// # Errors
///
/// Returns [`SoftchatError::InvalidRelayFrame`] for malformed commands, arity,
/// nested event/filter validation, duplicate batch IDs, or size violations.
pub fn parse_client_relay_frame(json: &str) -> Result<ClientRelayFrame, SoftchatError> {
    let values = parse_frame_array(json)?;
    let command = command(&values)?;
    match command {
        "EVENT" if values.len() == 2 => Ok(ClientRelayFrame::Event(parse_event(&values[1])?)),
        "EVENTS" if values.len() >= 2 => {
            let events = values[1..]
                .iter()
                .map(parse_event)
                .collect::<Result<Vec<_>, _>>()?;
            validate_batch_events(&events)?;
            Ok(ClientRelayFrame::Events(events))
        }
        "REQ" | "COUNT" if values.len() >= 3 => {
            let subscription_id = parse_subscription_id(&values[1])?;
            let filters = values[2..]
                .iter()
                .map(parse_filter_value)
                .collect::<Result<Vec<_>, _>>()?;
            validate_filters(&filters)?;
            if command == "REQ" {
                Ok(ClientRelayFrame::Req {
                    subscription_id,
                    filters,
                })
            } else {
                Ok(ClientRelayFrame::Count {
                    subscription_id,
                    filters,
                })
            }
        }
        "CLOSE" if values.len() == 2 => Ok(ClientRelayFrame::Close {
            subscription_id: parse_subscription_id(&values[1])?,
        }),
        "AUTH" if values.len() == 2 => {
            let event = parse_event(&values[1])?;
            if event.kind() != NostrEventKind::CLIENT_AUTHENTICATION {
                return Err(SoftchatError::InvalidRelayAuthentication);
            }
            Ok(ClientRelayFrame::Auth(event))
        }
        _ => Err(SoftchatError::InvalidRelayFrame),
    }
}

/// Parse one bounded relay-to-client JSON frame.
///
/// # Errors
///
/// Returns [`SoftchatError::InvalidRelayFrame`] for malformed commands,
/// invalid nested events, incorrect arity, or size violations.
pub fn parse_relay_response_frame(json: &str) -> Result<RelayResponseFrame, SoftchatError> {
    let values = parse_frame_array(json)?;
    match command(&values)? {
        "EVENT" if values.len() == 3 => Ok(RelayResponseFrame::Event {
            subscription_id: parse_subscription_id(&values[1])?,
            event: parse_event(&values[2])?,
        }),
        "OK" if values.len() == 4 => {
            let acknowledgement = BatchAcknowledgement {
                event_id: value_string(&values[1])?.to_owned(),
                accepted: values[2]
                    .as_bool()
                    .ok_or(SoftchatError::InvalidRelayFrame)?,
                message: value_string(&values[3])?.to_owned(),
            };
            acknowledgement
                .validate()
                .map_err(|_| SoftchatError::InvalidRelayFrame)?;
            Ok(RelayResponseFrame::Ok(acknowledgement))
        }
        "EOSE" if values.len() == 2 => Ok(RelayResponseFrame::Eose {
            subscription_id: parse_subscription_id(&values[1])?,
        }),
        "CLOSED" if values.len() == 3 => {
            let message = value_string(&values[2])?.to_owned();
            validate_relay_text(&message)?;
            Ok(RelayResponseFrame::Closed {
                subscription_id: parse_subscription_id(&values[1])?,
                message,
            })
        }
        "NOTICE" if values.len() == 2 => {
            let message = value_string(&values[1])?.to_owned();
            validate_relay_text(&message)?;
            Ok(RelayResponseFrame::Notice(message))
        }
        "AUTH" if values.len() == 2 => {
            let challenge = value_string(&values[1])?.to_owned();
            validate_relay_text(&challenge)?;
            if challenge.is_empty() {
                return Err(SoftchatError::InvalidRelayAuthentication);
            }
            Ok(RelayResponseFrame::Auth(challenge))
        }
        "COUNT" if values.len() == 3 => {
            let count = values[2]
                .as_object()
                .filter(|object| object.len() == 1)
                .and_then(|object| object.get("count"))
                .and_then(Value::as_u64)
                .ok_or(SoftchatError::InvalidRelayFrame)?;
            Ok(RelayResponseFrame::Count {
                subscription_id: parse_subscription_id(&values[1])?,
                count,
            })
        }
        _ => Err(SoftchatError::InvalidRelayFrame),
    }
}

/// Encode the deployed flat, non-empty `EVENTS` extension.
///
/// # Errors
///
/// Returns [`SoftchatError::InvalidRelayBatch`] for empty, oversized, or
/// duplicate-ID batches.
#[cfg_attr(feature = "native-bindings", uniffi::export)]
pub fn encode_events_frame(events: Vec<SignedEvent>) -> Result<String, SoftchatError> {
    let events = events
        .into_iter()
        .map(SignedNostrEvent::try_from)
        .collect::<Result<Vec<_>, _>>()
        .map_err(|_| SoftchatError::InvalidRelayBatch)?;
    ClientRelayFrame::Events(events)
        .to_json()
        .map_err(|_| SoftchatError::InvalidRelayBatch)
}

/// Project unordered and repeated `OK` results onto one submitted batch.
///
/// Identical duplicate terminal results are idempotent. A conflicting
/// duplicate, unknown event ID, duplicate submitted ID, or malformed value is
/// a protocol error.
///
/// # Errors
///
/// Returns [`SoftchatError::InvalidRelayBatch`] for any ambiguous result set.
#[cfg_attr(feature = "native-bindings", uniffi::export)]
pub fn track_batch_acknowledgements(
    event_ids: Vec<String>,
    acknowledgements: Vec<BatchAcknowledgement>,
) -> Result<BatchProgress, SoftchatError> {
    if event_ids.is_empty() || event_ids.len() > MAX_RELAY_BATCH_EVENTS {
        return Err(SoftchatError::InvalidRelayBatch);
    }

    let mut indexes = BTreeMap::new();
    for (index, event_id) in event_ids.iter().enumerate() {
        NostrEventId::from_hex(event_id).map_err(|_| SoftchatError::InvalidRelayBatch)?;
        if indexes.insert(event_id.clone(), index).is_some() {
            return Err(SoftchatError::InvalidRelayBatch);
        }
    }

    let mut states = vec![BatchEventState::Pending; event_ids.len()];
    let mut messages = vec![String::new(); event_ids.len()];
    for acknowledgement in acknowledgements {
        acknowledgement.validate()?;
        let index = *indexes
            .get(&acknowledgement.event_id)
            .ok_or(SoftchatError::InvalidRelayBatch)?;
        let state = if acknowledgement.accepted {
            BatchEventState::Accepted
        } else {
            BatchEventState::Rejected
        };
        match states[index] {
            BatchEventState::Pending => {
                states[index] = state;
                messages[index] = acknowledgement.message;
            }
            current if current == state && messages[index] == acknowledgement.message => {}
            _ => return Err(SoftchatError::InvalidRelayBatch),
        }
    }

    let complete = states
        .iter()
        .all(|state| *state != BatchEventState::Pending);
    Ok(BatchProgress {
        event_ids,
        states,
        messages,
        complete,
    })
}

/// Create a signed NIP-42 authentication event for one challenge and relay.
///
/// # Errors
///
/// Returns [`SoftchatError::InvalidRelayAuthentication`] for invalid context
/// or a signing failure.
pub fn plan_nip42_authentication(
    identity: &LocalIdentity,
    challenge: &str,
    relay_url: &str,
    created_at: u64,
) -> Result<SignedNostrEvent, SoftchatError> {
    validate_challenge(challenge)?;
    validate_relay_url(relay_url)?;
    let tags = vec![
        NostrTag::new(vec!["relay", relay_url])
            .map_err(|_| SoftchatError::InvalidRelayAuthentication)?,
        NostrTag::new(vec!["challenge", challenge])
            .map_err(|_| SoftchatError::InvalidRelayAuthentication)?,
    ];
    let draft = NostrEventDraft::new(created_at, NostrEventKind::CLIENT_AUTHENTICATION, tags, "")
        .map_err(|_| SoftchatError::InvalidRelayAuthentication)?;
    identity
        .sign_event(draft)
        .map_err(|_| SoftchatError::InvalidRelayAuthentication)
}

/// Validate a NIP-42 authentication event against its exact connection context.
///
/// # Errors
///
/// Returns [`SoftchatError::InvalidRelayAuthentication`] for wrong kind,
/// content, challenge, relay, duplicated tags, or timestamp window.
pub fn validate_nip42_authentication(
    event: &SignedNostrEvent,
    expected_author: &NostrPublicKey,
    challenge: &str,
    relay_url: &str,
    now: u64,
) -> Result<(), SoftchatError> {
    validate_challenge(challenge)?;
    validate_relay_url(relay_url)?;
    if event.kind() != NostrEventKind::CLIENT_AUTHENTICATION
        || event.public_key() != *expected_author
        || !event.content().is_empty()
        || event.created_at().abs_diff(now) > NIP42_AUTH_WINDOW_SECONDS
    {
        return Err(SoftchatError::InvalidRelayAuthentication);
    }

    let mut found_relay = false;
    let mut found_challenge = false;
    for tag in event.tags() {
        match tag.first().map(String::as_str) {
            Some("relay") if !found_relay && tag.len() == 2 && tag[1] == relay_url => {
                found_relay = true;
            }
            Some("challenge") if !found_challenge && tag.len() == 2 && tag[1] == challenge => {
                found_challenge = true;
            }
            Some("relay" | "challenge") => {
                return Err(SoftchatError::InvalidRelayAuthentication);
            }
            _ => {}
        }
    }
    if found_relay && found_challenge {
        Ok(())
    } else {
        Err(SoftchatError::InvalidRelayAuthentication)
    }
}

fn parse_frame_array(json: &str) -> Result<Vec<Value>, SoftchatError> {
    if json.is_empty() || json.len() > MAX_RELAY_FRAME_BYTES {
        return Err(SoftchatError::InvalidRelayFrame);
    }
    let value: Value = serde_json::from_str(json).map_err(|_| SoftchatError::InvalidRelayFrame)?;
    value
        .as_array()
        .filter(|values| !values.is_empty())
        .cloned()
        .ok_or(SoftchatError::InvalidRelayFrame)
}

fn command(values: &[Value]) -> Result<&str, SoftchatError> {
    values
        .first()
        .and_then(Value::as_str)
        .ok_or(SoftchatError::InvalidRelayFrame)
}

fn value_string(value: &Value) -> Result<&str, SoftchatError> {
    value.as_str().ok_or(SoftchatError::InvalidRelayFrame)
}

fn parse_event(value: &Value) -> Result<SignedNostrEvent, SoftchatError> {
    let json = serde_json::to_string(value).map_err(|_| SoftchatError::InvalidRelayFrame)?;
    SignedNostrEvent::from_json(&json).map_err(|_| SoftchatError::InvalidRelayFrame)
}

fn event_value(event: &SignedNostrEvent) -> Result<Value, SoftchatError> {
    serde_json::from_str(&event.to_json()?).map_err(|_| SoftchatError::InvalidRelayFrame)
}

fn parse_filter_value(value: &Value) -> Result<RelayFilter, SoftchatError> {
    RelayFilter::from_json(
        &serde_json::to_string(value).map_err(|_| SoftchatError::InvalidRelayFilter)?,
    )
}

fn append_filter_values(
    values: &mut Vec<Value>,
    filters: &[RelayFilter],
) -> Result<(), SoftchatError> {
    for filter in filters {
        values.push(
            serde_json::to_value(filter.clone().validate()?)
                .map_err(|_| SoftchatError::InvalidRelayFilter)?,
        );
    }
    Ok(())
}

fn encode_frame(values: Vec<Value>) -> Result<String, SoftchatError> {
    let json = serde_json::to_string(&values).map_err(|_| SoftchatError::InvalidRelayFrame)?;
    if json.len() > MAX_RELAY_FRAME_BYTES {
        return Err(SoftchatError::InvalidRelayFrame);
    }
    Ok(json)
}

fn parse_subscription_id(value: &Value) -> Result<String, SoftchatError> {
    let subscription_id = value_string(value)?.to_owned();
    validate_subscription_id(&subscription_id)?;
    Ok(subscription_id)
}

fn validate_subscription_id(subscription_id: &str) -> Result<(), SoftchatError> {
    let length = subscription_id.chars().count();
    if length == 0 || length > MAX_SUBSCRIPTION_ID_CHARS {
        return Err(SoftchatError::InvalidRelayFrame);
    }
    Ok(())
}

fn validate_relay_text(value: &str) -> Result<(), SoftchatError> {
    if value.chars().count() > MAX_RELAY_MESSAGE_CHARS {
        return Err(SoftchatError::InvalidRelayFrame);
    }
    Ok(())
}

fn validate_challenge(challenge: &str) -> Result<(), SoftchatError> {
    validate_relay_text(challenge).map_err(|_| SoftchatError::InvalidRelayAuthentication)?;
    if challenge.is_empty() {
        return Err(SoftchatError::InvalidRelayAuthentication);
    }
    Ok(())
}

fn validate_relay_url(relay_url: &str) -> Result<(), SoftchatError> {
    let url = Url::parse(relay_url).map_err(|_| SoftchatError::InvalidRelayAuthentication)?;
    if !matches!(url.scheme(), "ws" | "wss") || url.host_str().is_none() || url.fragment().is_some()
    {
        return Err(SoftchatError::InvalidRelayAuthentication);
    }
    Ok(())
}

fn validate_prefixes(values: &[String]) -> Result<(), SoftchatError> {
    validate_value_count(values.len())?;
    for value in values {
        if value.is_empty()
            || value.len() > 64
            || !value
                .bytes()
                .all(|byte| byte.is_ascii_hexdigit() && !byte.is_ascii_uppercase())
        {
            return Err(SoftchatError::InvalidRelayFilter);
        }
    }
    Ok(())
}

fn validate_value_count(count: usize) -> Result<(), SoftchatError> {
    if count > MAX_RELAY_FILTER_VALUES {
        return Err(SoftchatError::InvalidRelayFilter);
    }
    Ok(())
}

fn is_generic_tag_key(key: &str) -> bool {
    let bytes = key.as_bytes();
    bytes.len() == 2 && bytes[0] == b'#' && bytes[1].is_ascii_alphabetic()
}

fn validate_filters(filters: &[RelayFilter]) -> Result<(), SoftchatError> {
    if filters.is_empty() || filters.len() > MAX_RELAY_FILTERS {
        return Err(SoftchatError::InvalidRelayFrame);
    }
    for filter in filters {
        filter
            .clone()
            .validate()
            .map_err(|_| SoftchatError::InvalidRelayFrame)?;
    }
    Ok(())
}

fn validate_batch_events(events: &[SignedNostrEvent]) -> Result<(), SoftchatError> {
    if events.is_empty() || events.len() > MAX_RELAY_BATCH_EVENTS {
        return Err(SoftchatError::InvalidRelayBatch);
    }
    let mut ids = BTreeSet::new();
    if events.iter().any(|event| !ids.insert(event.id())) {
        return Err(SoftchatError::InvalidRelayBatch);
    }
    Ok(())
}

#[cfg(test)]
mod tests {
    use super::*;

    const ALICE_SECRET: &str = "5c0c523f52a5b6fad39ed2403092df8cebc36318b39383bca6c00808626fab3a";

    fn event(kind: NostrEventKind, created_at: u64) -> Result<SignedNostrEvent, SoftchatError> {
        let identity = LocalIdentity::from_secret_hex(ALICE_SECRET)?;
        identity.sign_event(NostrEventDraft::new(created_at, kind, Vec::new(), "test")?)
    }

    #[test]
    fn filters_round_trip_generic_tags_and_reject_duplicate_fields() -> Result<(), SoftchatError> {
        let filter = RelayFilter::from_json(
            r##"{"ids":["ab"],"authors":["cd"],"kinds":[14],"since":1,"until":2,"limit":3,"#p":["ef"]}"##,
        )?;
        assert_eq!(RelayFilter::from_json(&filter.to_json()?)?, filter);
        assert!(RelayFilter::from_json(r#"{"limit":1,"limit":2}"#).is_err());
        assert!(RelayFilter::from_json(r#"{"unknown":[]}"#).is_err());
        assert!(RelayFilter::from_json(r#"{"since":2,"until":1}"#).is_err());
        Ok(())
    }

    #[test]
    fn client_and_relay_frames_round_trip_and_reject_trailing_items() -> Result<(), SoftchatError> {
        let authored = event(NostrEventKind::SHORT_TEXT_NOTE, 1)?;
        for frame in [
            ClientRelayFrame::Event(authored.clone()),
            ClientRelayFrame::Req {
                subscription_id: "sub".to_owned(),
                filters: vec![RelayFilter::default()],
            },
            ClientRelayFrame::Close {
                subscription_id: "sub".to_owned(),
            },
            ClientRelayFrame::Count {
                subscription_id: "sub".to_owned(),
                filters: vec![RelayFilter::default()],
            },
        ] {
            let encoded = frame.to_json()?;
            assert_eq!(parse_client_relay_frame(&encoded)?, frame);
        }

        let response = RelayResponseFrame::Event {
            subscription_id: "sub".to_owned(),
            event: authored,
        };
        assert_eq!(parse_relay_response_frame(&response.to_json()?)?, response);
        assert!(parse_relay_response_frame(r#"["EOSE","sub","trailing"]"#).is_err());
        assert!(parse_client_relay_frame(r#"["UNKNOWN"]"#).is_err());
        Ok(())
    }

    #[test]
    fn events_batch_is_flat_non_empty_unique_and_bounded() -> Result<(), SoftchatError> {
        let first = event(NostrEventKind::SHORT_TEXT_NOTE, 1)?;
        let second = event(NostrEventKind::SHORT_TEXT_NOTE, 2)?;
        let frame = ClientRelayFrame::Events(vec![first.clone(), second.clone()]);
        let json = frame.to_json()?;
        assert_eq!(parse_client_relay_frame(&json)?, frame);
        assert!(json.starts_with("[\"EVENTS\",{"));
        assert!(ClientRelayFrame::Events(Vec::new()).to_json().is_err());
        assert!(
            ClientRelayFrame::Events(vec![first.clone(), first])
                .to_json()
                .is_err()
        );
        Ok(())
    }

    #[test]
    fn batch_tracker_is_per_event_idempotent_and_conflict_strict() -> Result<(), SoftchatError> {
        let first = event(NostrEventKind::SHORT_TEXT_NOTE, 1)?.id().to_hex();
        let second = event(NostrEventKind::SHORT_TEXT_NOTE, 2)?.id().to_hex();
        let accepted = BatchAcknowledgement {
            event_id: first.clone(),
            accepted: true,
            message: String::new(),
        };
        let rejected = BatchAcknowledgement {
            event_id: second.clone(),
            accepted: false,
            message: "blocked".to_owned(),
        };
        let progress = track_batch_acknowledgements(
            vec![first.clone(), second.clone()],
            vec![rejected.clone(), accepted.clone(), accepted.clone()],
        )?;
        assert_eq!(
            progress.states,
            vec![BatchEventState::Accepted, BatchEventState::Rejected]
        );
        assert!(progress.complete);

        let conflict = BatchAcknowledgement {
            accepted: false,
            ..accepted
        };
        assert!(
            track_batch_acknowledgements(vec![first, second], vec![conflict, rejected]).is_ok()
        );
        let event_id = progress.event_ids[0].clone();
        assert!(
            track_batch_acknowledgements(
                progress.event_ids,
                vec![
                    BatchAcknowledgement {
                        event_id: event_id.clone(),
                        accepted: true,
                        message: String::new(),
                    },
                    BatchAcknowledgement {
                        event_id,
                        accepted: false,
                        message: String::new(),
                    },
                ],
            )
            .is_err()
        );
        Ok(())
    }

    #[test]
    fn nip42_plan_binds_challenge_relay_author_and_time() -> Result<(), SoftchatError> {
        let identity = LocalIdentity::from_secret_hex(ALICE_SECRET)?;
        let event =
            plan_nip42_authentication(&identity, "challenge", "wss://relay.example", 1_000)?;
        validate_nip42_authentication(
            &event,
            &identity.public_key(),
            "challenge",
            "wss://relay.example",
            1_500,
        )?;
        assert!(
            validate_nip42_authentication(
                &event,
                &identity.public_key(),
                "wrong",
                "wss://relay.example",
                1_500,
            )
            .is_err()
        );
        assert!(
            validate_nip42_authentication(
                &event,
                &identity.public_key(),
                "challenge",
                "wss://relay.example",
                1_601,
            )
            .is_err()
        );
        Ok(())
    }
}