feat(auth): add NIP-FI canonical assertion verifier and contracts

Cargo.toml

@@ -100,6 +100,9 @@ anyhow    = "1"
 uuid    = { version = "1", features = ["v4", "serde"] }
 chrono  = { version = "0.4", features = ["serde"] }
 
+# JWT / JWS verification (NIP-FI federated identity assertions)
+jsonwebtoken = { version = "10.4.0", default-features = false, features = ["aws_lc_rs"] }
+
 # HTTP client (webhook delivery)
 reqwest = { version = "0.13", features = ["json", "rustls"], default-features = false }
 

Justfile

@@ -311,6 +311,13 @@ test-unit:
     ./scripts/test-ensure-local-relay-key.sh
     if command -v cargo-nextest &>/dev/null; then
         cargo nextest run -p buzz-core -p buzz-auth --lib
+        # buzz-auth NIP-FI verifier doctests. The sealed-authority
+        # `compile_fail` doctests prove the default-feature public API alone
+        # cannot forge the issuer→JWKS authority; nextest does not run
+        # doctests, hence this separate step. The verifier's regression suite
+        # lives in the in-crate `#[cfg(test)] mod tests`, so `--lib` above
+        # already runs it.
+        cargo test -p buzz-auth --doc
         cargo nextest run -p buzz-voice --lib
         cargo nextest run -p buzz-cli
         # buzz-db migrator/lint tests: pure SQL-parsing unit tests (no infra).

crates/buzz-auth/Cargo.toml

@@ -11,8 +11,15 @@ description = "Authentication and authorization for Buzz"
 test-utils = []
 dev = []
 
+[dev-dependencies]
+# `use_pem` enables EncodingKey::from_ec_pem for minting ES256 test assertions.
+jsonwebtoken = { version = "10.4.0", default-features = false, features = ["aws_lc_rs", "use_pem"] }
+
 [dependencies]
 buzz-core = { workspace = true }
+base64       = { workspace = true }
+chrono       = { workspace = true }
+jsonwebtoken = { workspace = true }
 nostr        = { workspace = true }
 serde        = { workspace = true }
 serde_json   = { workspace = true }

crates/buzz-auth/src/lib.rs

@@ -25,6 +25,8 @@ pub mod nip42;
 pub mod nip98;
 /// NIP-98 replay protection — shared, community-scoped, atomic seen-set.
 pub mod nip98_replay;
+/// NIP-FI federated-identity assertion verifier and contracts.
+pub mod nip_fi;
 /// Per-connection rate limiting.
 pub mod rate_limit;
 /// OAuth scope parsing and enforcement.
@@ -43,6 +45,14 @@ pub use rate_limit::{
 };
 pub use scope::{parse_scopes, Scope};
 
+pub use nip_fi::{
+    AssertionKeySet, AssertionPolicyId, CanonicalCapabilities, ClientSubjectPosture, DenialClass,
+    FederatedAssertionVerifier, FederatedIdentity, FreshnessClass, IssuerKeySource, IssuerPolicy,
+    IssuerPolicyError, IssuerRegistry, RevalidationDependencies, SubjectClass,
+    SubjectClassContract, TokenClass, TransportContractId, VerifiedAssertion, VerifierError,
+    CLIENT_ATTACHED_HEADER, NOSTR_PUBKEY_CLAIM, OAUTH_CLIENT_ID_CLAIM,
+};
+
 #[cfg(any(test, feature = "test-utils"))]
 pub use access::MockAccessChecker;
 #[cfg(any(test, feature = "test-utils"))]