live: /live/turn — ICE servers for the app's calls (Cloudflare TURN credentials good for 4 h, to a NIP-98-signed ask; 30 an hour per key, 60 per IP; STUN alone if TURN can't be had). The key comes from $STATE/live/config.json.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_013ZDf1cyCQLkfjftYhymZAg

1 files changed, 8 insertions, 0 deletions

diff --git a/tools/live-ingest-test.js b/tools/live-ingest-test.js
index 2d57d74..7bb2489 100644
--- a/tools/live-ingest-test.js
+++ b/tools/live-ingest-test.js
@@ -51,6 +51,14 @@ try {
   check('...as is a name nobody owns', (await connect(`auth=${auth(SK)}&name=bob`)).error === true);
   check('...and a forged auth', (await connect(`auth=${auth(SK).slice(0, -8)}AAAAAAAA&name=alice`)).error === true);
 
+  console.log('\n[TURN for calls]');
+  const turnAuth = (sk, path = '/live/turn') => 'Nostr ' + Buffer.from(JSON.stringify(finalizeEvent({ kind: 27235, created_at: Math.floor(Date.now() / 1000), content: '',
+    tags: [['u', 'https://v3.coinos.io' + path], ['method', 'GET']] }, sk))).toString('base64');
+  check('ICE servers need a signed ask', (await fetch(`${HTTP}/turn`)).status === 401);
+  check('...one signed for this address', (await fetch(`${HTTP}/turn`, { headers: { authorization: turnAuth(OTHER, '/live/ingest') } })).status === 401);
+  const ice = await (await fetch(`${HTTP}/turn`, { headers: { authorization: turnAuth(OTHER) } })).json();
+  check('...anyone signed gets them (STUN alone with no TURN key configured)', Array.isArray(ice.iceServers) && /^stun:/.test(ice.iceServers[0].urls[0]), JSON.stringify(ice));
+
   console.log('\n[sending]');
   const a = await connect(`auth=${auth(SK)}&name=alice`);
   check('the owner is let in and told where the stream is', !!a.hello?.id && /\/live\/[0-9a-f]{16}\/live\.m3u8$/.test(a.hello.live) && /index\.m3u8$/.test(a.hello.recording), JSON.stringify(a.hello));