decent-newsroom / signing-bundle

v0.1.0 2026-09-08 13:43 UTC

Requires

• php: >=8.3
• ext-ctype: *
• ext-gmp: *
• ext-json: *
• ext-openssl: *
• ext-sodium: *
• decent-newsroom/nostr-client-bundle: ^0.1.0
• endroid/qr-code: ^6.0
• innis/nostr-core: ^0.3.17
• psr/log: ^3.0
• symfony/config: ^7.4
• symfony/dependency-injection: ^7.4
• symfony/framework-bundle: ^7.4
• symfony/http-foundation: ^7.4
• symfony/routing: ^7.4
• symfony/uid: ^7.4

Requires (Dev)

• phpunit/phpunit: ^9.6

MIT

• symfony
• signing
• nostr
• nip46

Published on Packagist.org on 2026-09-08 13:44 UTC

README

A Symfony bundle for Nostr Connect, NIP-46 remote signing, and NIP-42 relay AUTH signing.

Requirements

• PHP 8.3 or later
• ext-ctype, ext-gmp, ext-intl, ext-json, ext-openssl, and ext-sodium
• A host implementation of RemoteSignerSessionStoreInterface

The host store must encrypt client private keys at rest, scope each session to its subject pubkey, enforce the requested TTL, remove sessions on logout, and never log private key material.

Installation

composer require decent-newsroom/signing-bundle:^0.1

Register the bundle in config/bundles.php:

DecentNewsroom\SigningBundle\SigningBundle::class => ['all' => true],

Import its routes:

# config/routes/signing_bundle.yaml
signing_bundle:
    resource: '@SigningBundle/Resources/config/routes.yaml'

Configuration

# config/packages/signing.yaml
signing:
    app_name: 'Example app'
    app_url: 'https://example.test'
    nostr_connect:
        requested_permissions:
            - 'sign_event:27235'
            - 'sign_event:22242'
            - 'get_public_key'
    nip46:
        session_ttl_seconds: 28800
        request_timeout_seconds: 15

Required host services

DecentNewsroom\SigningBundle\Contract\SignerRelayProviderInterface:
    alias: App\Nostr\SignerRelayProvider

DecentNewsroom\SigningBundle\Contract\CurrentSubjectPubkeyResolverInterface:
    alias: App\Nostr\CurrentSubjectPubkeyResolver

DecentNewsroom\SigningBundle\Contract\RemoteSignerSessionStoreInterface:
    alias: App\Nostr\RemoteSignerSessionStore

RemoteSignerSessionStoreInterface is intentionally storage-agnostic, so the host can use its chosen cache or persistence system.

Supported flows

• NIP-07 extension publishing: the host accepts and verifies already-signed events.
• NIP-46 bunker signing: the bundle stores a host-owned remote signer session after pairing, sends encrypted sign_event requests, and validates responses.
• NIP-42 relay AUTH: the host can use RelayAuthSignerInterface for signed kind 22242 events, with any browser fallback remaining host-owned.

Testing

composer install
vendor/bin/phpunit tests

Docker

The committed Dockerfile provides an isolated PHP 8.3 test environment with the required GMP and Intl extensions. It resolves package dependencies for the supported PHP version and runs the test suite during the image build:

docker build --tag signing-bundle-test .

Run the tests again from the built image with:

docker run --rm signing-bundle-test vendor/bin/phpunit tests

License

MIT. See LICENSE.