perf: verify Nostr inbound signatures once, off the main actor (#1352)

Moves inbound Nostr Schnorr verification and NIP-17 gift-wrap decryption off the main actor into per-relay bounded AsyncStream pipelines (parallel across relays, ordered per relay), dedups before crypto, and removes the redundant second re-verify in NostrInboundPipeline/GeoPresenceTracker. Adds a panic-wipe generation counter so in-flight decrypts are discarded after a wipe.

Rebased onto main; #1451's 256 KiB pre-parse byte cap and tag limits are preserved and still enforced before any crypto/allocation.

bitchatTests/ChatNostrCoordinatorContextTests.swift

@@ -354,10 +354,12 @@ struct ChatNostrCoordinatorContextTests {
 
         coordinator.inbound.handleGiftWrap(giftWrap, id: recipient)
 
+        // The NIP-17 unwrap runs off the main actor; wait for the hop back.
         let convKey = PeerID(nostr_: sender.publicKeyHex)
+        let routed = await TestHelpers.waitUntil({ context.handledPrivateMessages.count == 1 })
+        #expect(routed)
         #expect(context.recordedNostrEventIDs == [giftWrap.id])
         #expect(context.nostrKeyMapping[convKey] == sender.publicKeyHex)
-        #expect(context.handledPrivateMessages.count == 1)
         #expect(context.handledPrivateMessages.first?.senderPubkey == sender.publicKeyHex)
         #expect(context.handledPrivateMessages.first?.convKey == convKey)
 
@@ -370,30 +372,76 @@ struct ChatNostrCoordinatorContextTests {
 
         // The same gift wrap is dropped on replay.
         coordinator.inbound.handleGiftWrap(giftWrap, id: recipient)
+        await drainMainQueue()
         #expect(context.recordedNostrEventIDs == [giftWrap.id])
         #expect(context.handledPrivateMessages.count == 1)
     }
 
     @Test @MainActor
-    func processNostrMessage_invalidSignatureDoesNotPoisonDedup() async throws {
+    func handleGiftWrap_panicWipeAfterSpawnDropsDecryptedResult() async throws {
         let context = MockChatNostrContext()
         let coordinator = ChatNostrCoordinator(context: context)
 
         let recipient = try NostrIdentity.generate()
         let sender = try NostrIdentity.generate()
+        let embedded = try #require(NostrEmbeddedBitChat.encodePMForNostrNoRecipient(
+            content: "pre-wipe secret",
+            messageID: "gm-wipe-1",
+            senderPeerID: PeerID(str: "aabbccddeeff0011")
+        ))
+        let giftWrap = try NostrProtocol.createPrivateMessage(
+            content: embedded,
+            recipientPubkey: recipient.publicKeyHex,
+            senderIdentity: sender
+        )
+
+        // Spawn the detached decrypt (it strongly captures the pre-wipe
+        // identity), then panic-wipe in the SAME main-actor turn — guaranteed
+        // to land before the task's first main-actor hop.
+        coordinator.inbound.handleGiftWrap(giftWrap, id: recipient)
+        coordinator.inbound.invalidateInFlightDecrypts()
+
+        // Give the detached task ample time to have delivered if the wipe
+        // guard were broken.
+        try? await Task.sleep(nanoseconds: 200_000_000)
+        await drainMainQueue()
+
+        #expect(context.handledPrivateMessages.isEmpty)
+        #expect(context.recordedNostrEventIDs.isEmpty)
+
+        // The pipeline itself stays usable: a gift wrap spawned AFTER the
+        // wipe (new generation) still decrypts and delivers.
+        coordinator.inbound.handleGiftWrap(giftWrap, id: recipient)
+        let delivered = await TestHelpers.waitUntil({ context.handledPrivateMessages.count == 1 })
+        #expect(delivered)
+    }
+
+    // NOTE: Inbound Schnorr signature verification (and the forged-copy
+    // dedup-poisoning invariant) is enforced once, off the main actor, at the
+    // relay boundary — see NostrRelayManagerTests
+    // `test_receiveEvent_invalidSignatureDoesNotPoisonDuplicateCache` and
+    // `test_receiveGiftWrap_tamperedSignatureIsDroppedAndDoesNotPoisonDedup`.
+    // The inbound pipeline only ever sees verified events.
+
+    @Test @MainActor
+    func processNostrMessage_duplicateDeliveryProcessesOnce() async throws {
+        let context = MockChatNostrContext()
+        let coordinator = ChatNostrCoordinator(context: context)
+
+        let recipient = try NostrIdentity.generate()
+        let sender = try NostrIdentity.generate()
+        context.nostrIdentity = recipient
         let giftWrap = try NostrProtocol.createPrivateMessage(
             content: "verify:noop",
             recipientPubkey: recipient.publicKeyHex,
             senderIdentity: sender
         )
-        var invalidGiftWrap = giftWrap
-        invalidGiftWrap.sig = String(repeating: "0", count: 128)
 
-        // A forged-signature copy is rejected WITHOUT entering the dedup set...
-        await coordinator.inbound.processNostrMessage(invalidGiftWrap)
-        #expect(context.recordedNostrEventIDs.isEmpty)
+        // Fan-in of the same (already verified) gift wrap from several relays
+        // records and processes exactly once.
+        await coordinator.inbound.processNostrMessage(giftWrap)
+        #expect(context.recordedNostrEventIDs == [giftWrap.id])
 
-        // ...so the genuine event with the same ID still processes and records.
         await coordinator.inbound.processNostrMessage(giftWrap)
         #expect(context.recordedNostrEventIDs == [giftWrap.id])
     }

bitchatTests/ChatViewModelExtensionsTests.swift

@@ -366,31 +366,11 @@ struct ChatViewModelNostrExtensionTests {
         #expect(!viewModel.messages.contains { $0.content == "Blocked" })
     }
 
-    @Test @MainActor
-    func handleNostrEvent_rejectsInvalidSignature() async throws {
-        let (viewModel, _) = makeTestableViewModel()
-        let geohash = "u4pruydq"
-        let identity = try NostrIdentity.generate()
-
-        viewModel.switchLocationChannel(to: .location(GeohashChannel(level: .city, geohash: geohash)))
-
-        let event = NostrEvent(
-            pubkey: identity.publicKeyHex,
-            createdAt: Date(),
-            kind: .ephemeralEvent,
-            tags: [["g", geohash]],
-            content: "Valid"
-        )
-        var signed = try event.sign(with: identity.schnorrSigningKey())
-        signed.id = "deadbeef"
-
-        viewModel.handleNostrEvent(signed)
-
-        try? await Task.sleep(nanoseconds: 100_000_000)
-        viewModel.publicMessagePipeline.flushIfNeeded()
-
-        #expect(!viewModel.messages.contains { $0.content == "Tampered" })
-    }
+    // NOTE: Tampered-signature rejection is enforced once, off the main
+    // actor, at the relay boundary (events only reach the inbound pipeline
+    // after verification) — see NostrRelayManagerTests
+    // `test_receiveEvent_invalidSignatureDoesNotPoisonDuplicateCache` and
+    // `test_receiveGiftWrap_tamperedSignatureIsDroppedAndDoesNotPoisonDedup`.
 
     @Test @MainActor
     func subscribeGiftWrap_rejectsOversizedEmbeddedPacket() async throws {
@@ -579,9 +559,14 @@ struct ChatViewModelNostrExtensionTests {
 
         viewModel.handleGiftWrap(giftWrap, id: recipient)
 
-        try? await Task.sleep(nanoseconds: 50_000_000)
+        // Gift-wrap decryption runs off the main actor; wait for the ack
+        // (sent even for blocked senders) to know processing finished.
+        let didAck = await TestHelpers.waitUntil(
+            { viewModel.sentGeoDeliveryAcks.contains(messageID) },
+            timeout: 5.0
+        )
+        #expect(didAck)
         #expect(viewModel.privateChats[convKey] == nil)
-        #expect(viewModel.sentGeoDeliveryAcks.contains(messageID))
     }
 
     @Test @MainActor

bitchatTests/GeohashPresenceTests.swift

@@ -326,26 +326,11 @@ struct ChatViewModelPresenceHandlingTests {
         #expect(viewModel.geohashParticipantCount(for: activeGeohash) >= 1)
     }
 
-    @Test func subscribeNostrEvent_samplingInvalidSignatureDoesNotPoisonDedup() async throws {
-        let (viewModel, _) = makeTestableViewModel()
-        let sampleGeohash = "u4pru"
-        let identity = try NostrIdentity.generate()
-        let event = NostrEvent(
-            pubkey: identity.publicKeyHex,
-            createdAt: Date(),
-            kind: .geohashPresence,
-            tags: [["g", sampleGeohash]],
-            content: ""
-        )
-        let signed = try event.sign(with: identity.schnorrSigningKey())
-        var invalid = signed
-        invalid.sig = String(repeating: "0", count: 128)
-
-        viewModel.subscribeNostrEvent(invalid, gh: sampleGeohash)
-        viewModel.subscribeNostrEvent(signed, gh: sampleGeohash)
-
-        #expect(viewModel.geohashParticipantCount(for: sampleGeohash) == 1)
-    }
+    // NOTE: Tampered-signature rejection (and the forged-copy dedup-poisoning
+    // invariant) is enforced once, off the main actor, at the relay boundary —
+    // the sampling path only ever sees verified events. See
+    // NostrRelayManagerTests
+    // `test_receiveEvent_invalidSignatureDoesNotPoisonDuplicateCache`.
 
     // MARK: - Test Helper
 

bitchatTests/Performance/PerformanceBaselineTests.swift

@@ -77,8 +77,10 @@ final class PerformanceBaselineTests: XCTestCase {
     // MARK: - 1a. Nostr inbound event handling (fresh events)
 
     /// `NostrInboundPipeline.handleNostrEvent` for never-seen geo events
-    /// (kind 20000): signature verification, dedup record, presence/nickname
-    /// bookkeeping, and public-message ingest scheduling.
+    /// (kind 20000): dedup record, presence/nickname bookkeeping, and
+    /// public-message ingest scheduling. Schnorr signature verification is
+    /// NOT part of this path anymore — it runs exactly once, off the main
+    /// actor, in `NostrRelayManager` before delivery.
     func testNostrInboundEventHandling_freshEvents() throws {
         let events = try Self.makeSignedGeohashEvents(count: 500)
         // A fresh context per measure pass so every event takes the
@@ -106,8 +108,9 @@ final class PerformanceBaselineTests: XCTestCase {
 
     /// The dedup-hit path: identical events replayed. Duplicates dominate
     /// real relay traffic (the same event arrives from several relays), so
-    /// this path runs hundreds of times a minute in busy geohashes. Note it
-    /// still pays full Schnorr signature verification before the dedup check.
+    /// this path runs hundreds of times a minute in busy geohashes. It is a
+    /// pure dedup lookup: no crypto (verification happens upstream in
+    /// `NostrRelayManager`, and only for the first-seen copy).
     func testNostrInboundEventHandling_duplicateEvents() throws {
         let events = try Self.makeSignedGeohashEvents(count: 500)
         let context = PerfNostrContext()

bitchatTests/Services/NostrRelayManagerTests.swift

@@ -754,11 +754,15 @@ final class NostrRelayManagerTests: XCTestCase {
         try context.sessionFactory.latestConnection(for: firstRelayURL)?.emitEventMessage(subscriptionID: "events", event: event)
         try context.sessionFactory.latestConnection(for: secondRelayURL)?.emitEventMessage(subscriptionID: "events", event: event)
 
-        let countedOnBothRelays = await waitUntil {
+        // Wait on the DELIVERY-side state: handler dispatch and the duplicate
+        // drop both land on the second main hop, after off-main verification.
+        let settled = await waitUntil {
             context.manager.relays.first(where: { $0.url == firstRelayURL })?.messagesReceived == 1 &&
-            context.manager.relays.first(where: { $0.url == secondRelayURL })?.messagesReceived == 1
+            context.manager.relays.first(where: { $0.url == secondRelayURL })?.messagesReceived == 1 &&
+            receivedIDs == [event.id] &&
+            context.manager.debugDuplicateInboundEventDropCount == 1
         }
-        XCTAssertTrue(countedOnBothRelays)
+        XCTAssertTrue(settled)
         XCTAssertEqual(receivedIDs, [event.id])
         XCTAssertEqual(context.manager.debugDuplicateInboundEventDropCount, 1)
         XCTAssertEqual(context.manager.debugDuplicateInboundEventDropCount(forSubscriptionID: "events"), 1)
@@ -791,12 +795,17 @@ final class NostrRelayManagerTests: XCTestCase {
             )
         }
 
-        let countedOnEveryRelay = await waitUntil {
+        // Wait on the DELIVERY-side state: the winner's handler dispatch and
+        // the losers' duplicate drops both land on the second main hop, after
+        // off-main verification — messagesReceived (first hop) settles sooner.
+        let settled = await waitUntil {
             relayURLs.allSatisfy { relayURL in
                 context.manager.relays.first(where: { $0.url == relayURL })?.messagesReceived == 1
-            }
+            } &&
+            receivedIDs == [event.id] &&
+            context.manager.debugDuplicateInboundEventDropCount == relayURLs.count - 1
         }
-        XCTAssertTrue(countedOnEveryRelay)
+        XCTAssertTrue(settled)
         XCTAssertEqual(receivedIDs, [event.id])
         XCTAssertEqual(context.manager.debugDuplicateInboundEventDropCount, relayURLs.count - 1)
         XCTAssertEqual(
@@ -829,16 +838,153 @@ final class NostrRelayManagerTests: XCTestCase {
         try context.sessionFactory.latestConnection(for: firstRelayURL)?.emitEventMessage(subscriptionID: "events", event: invalidEvent)
         try context.sessionFactory.latestConnection(for: secondRelayURL)?.emitEventMessage(subscriptionID: "events", event: event)
 
-        let countedOnBothRelays = await waitUntil {
+        // Wait on the DELIVERY-side state (second main hop, after off-main
+        // verification), not just messagesReceived (first main hop) — the
+        // handler only fires after verify + a second hop.
+        let genuineDelivered = await waitUntil {
             context.manager.relays.first(where: { $0.url == firstRelayURL })?.messagesReceived == 1 &&
-            context.manager.relays.first(where: { $0.url == secondRelayURL })?.messagesReceived == 1
+            context.manager.relays.first(where: { $0.url == secondRelayURL })?.messagesReceived == 1 &&
+            receivedIDs == [event.id]
         }
-        XCTAssertTrue(countedOnBothRelays)
+        XCTAssertTrue(genuineDelivered)
         XCTAssertEqual(receivedIDs, [event.id])
         XCTAssertEqual(context.manager.debugDuplicateInboundEventDropCount, 0)
         XCTAssertEqual(context.manager.debugDuplicateInboundEventDropCount(forSubscriptionID: "events"), 0)
     }
 
+    /// The relay boundary is the single signature-verification point for the
+    /// whole inbound path (downstream pipelines no longer re-verify), so a
+    /// tampered gift wrap (kind 1059, the DM/mailbox path) must be dropped
+    /// here — and must not poison the dedup cache against the genuine copy.
+    func test_receiveGiftWrap_tamperedSignatureIsDroppedAndDoesNotPoisonDedup() async throws {
+        let firstRelayURL = "wss://giftwrap-one.example"
+        let secondRelayURL = "wss://giftwrap-two.example"
+        let context = makeContext(permission: .denied)
+        let sender = try NostrIdentity.generate()
+        let recipient = try NostrIdentity.generate()
+        let giftWrap = try NostrProtocol.createPrivateMessage(
+            content: "psst",
+            recipientPubkey: recipient.publicKeyHex,
+            senderIdentity: sender
+        )
+        let tampered = invalidSignatureCopy(of: giftWrap)
+        var receivedIDs: [String] = []
+
+        context.manager.subscribe(
+            filter: makeFilter(),
+            id: "gift-wraps",
+            relayUrls: [firstRelayURL, secondRelayURL]
+        ) { event in
+            receivedIDs.append(event.id)
+        }
+        let subscriptionsSent = await waitUntil {
+            context.sessionFactory.latestConnection(for: firstRelayURL)?.sentStrings.count == 1 &&
+            context.sessionFactory.latestConnection(for: secondRelayURL)?.sentStrings.count == 1
+        }
+        XCTAssertTrue(subscriptionsSent)
+
+        try context.sessionFactory.latestConnection(for: firstRelayURL)?.emitEventMessage(subscriptionID: "gift-wraps", event: tampered)
+        try context.sessionFactory.latestConnection(for: secondRelayURL)?.emitEventMessage(subscriptionID: "gift-wraps", event: giftWrap)
+
+        // Wait on the DELIVERY-side state (second main hop, after off-main
+        // verification), not just messagesReceived (first main hop) — the
+        // handler only fires after verify + a second hop.
+        let genuineDelivered = await waitUntil {
+            context.manager.relays.first(where: { $0.url == firstRelayURL })?.messagesReceived == 1 &&
+            context.manager.relays.first(where: { $0.url == secondRelayURL })?.messagesReceived == 1 &&
+            receivedIDs == [giftWrap.id]
+        }
+        XCTAssertTrue(genuineDelivered)
+        XCTAssertEqual(receivedIDs, [giftWrap.id])
+        XCTAssertEqual(context.manager.debugDuplicateInboundEventDropCount, 0)
+    }
+
+    /// Signature verification runs off-main in a per-relay serial consumer;
+    /// several frames buffered on one socket must still be delivered to the
+    /// handler in that relay's arrival order.
+    func test_receiveEvent_deliversBackToBackEventsInArrivalOrder() async throws {
+        let relayURL = "wss://ordered.example"
+        let context = makeContext(permission: .denied)
+        let events = try (0..<12).map { try makeSignedEvent(content: "ordered-\($0)") }
+        var receivedIDs: [String] = []
+
+        context.manager.subscribe(filter: makeFilter(), id: "ordered", relayUrls: [relayURL]) { event in
+            receivedIDs.append(event.id)
+        }
+        let subscriptionSent = await waitUntil {
+            context.sessionFactory.latestConnection(for: relayURL)?.sentStrings.count == 1
+        }
+        XCTAssertTrue(subscriptionSent)
+
+        for event in events {
+            try context.sessionFactory.latestConnection(for: relayURL)?.emitEventMessage(subscriptionID: "ordered", event: event)
+        }
+
+        let allDelivered = await waitUntil(timeout: 5.0) {
+            receivedIDs.count == events.count
+        }
+        XCTAssertTrue(allDelivered)
+        XCTAssertEqual(receivedIDs, events.map(\.id))
+    }
+
+    /// Each relay owns its own off-main verify pipeline, so a large backlog of
+    /// EVENT frames on one relay must NOT head-of-line-block a frame that
+    /// arrives on a different relay. Under the previous single global consumer,
+    /// relay B's single event (emitted after relay A's whole burst) could only
+    /// be delivered once every frame in A's backlog had been Schnorr-verified;
+    /// with per-relay pipelines B verifies concurrently and lands before A's
+    /// backlog drains.
+    func test_receiveEvent_busyRelayDoesNotBlockOtherRelayDelivery() async throws {
+        let busyRelayURL = "wss://busy-relay.example"
+        let quietRelayURL = "wss://quiet-relay.example"
+        let context = makeContext(permission: .denied)
+
+        // Distinct subscriptions per relay so dedup never coalesces A vs. B.
+        let busyEvents = try (0..<200).map { try makeSignedEvent(content: "busy-\($0)") }
+        let quietEvent = try makeSignedEvent(content: "quiet")
+
+        var busyDeliveredCount = 0
+        var quietDeliveredAfterBusyCount = -1 // busy-count observed when B lands
+
+        context.manager.subscribe(filter: makeFilter(), id: "busy", relayUrls: [busyRelayURL]) { _ in
+            busyDeliveredCount += 1
+        }
+        context.manager.subscribe(filter: makeFilter(), id: "quiet", relayUrls: [quietRelayURL]) { _ in
+            if quietDeliveredAfterBusyCount < 0 {
+                quietDeliveredAfterBusyCount = busyDeliveredCount
+            }
+        }
+        let subscribed = await waitUntil {
+            context.sessionFactory.latestConnection(for: busyRelayURL)?.sentStrings.count == 1 &&
+            context.sessionFactory.latestConnection(for: quietRelayURL)?.sentStrings.count == 1
+        }
+        XCTAssertTrue(subscribed)
+
+        // Flood relay A first, then emit a single frame on relay B.
+        for event in busyEvents {
+            try context.sessionFactory.latestConnection(for: busyRelayURL)?.emitEventMessage(subscriptionID: "busy", event: event)
+        }
+        try context.sessionFactory.latestConnection(for: quietRelayURL)?.emitEventMessage(subscriptionID: "quiet", event: quietEvent)
+
+        let quietDelivered = await waitUntil(timeout: 5.0) { quietDeliveredAfterBusyCount >= 0 }
+        XCTAssertTrue(quietDelivered, "relay B's event was never delivered")
+
+        // The signal: B did not have to wait for A's entire backlog. If the two
+        // pipelines were globally serialized, B could only land after all 200 of
+        // A's frames, so busyDeliveredCount would be 200 when B arrived.
+        XCTAssertLessThan(
+            quietDeliveredAfterBusyCount,
+            busyEvents.count,
+            "relay B was head-of-line blocked behind relay A's backlog"
+        )
+
+        // Both relays still drain fully and in order.
+        let allDelivered = await waitUntil(timeout: 5.0) {
+            busyDeliveredCount == busyEvents.count
+        }
+        XCTAssertTrue(allDelivered)
+    }
+
     func test_receiveEvent_withoutHandlerStillTracksReceivedCount() async throws {
         let relayURL = "wss://missing-handler.example"
         let context = makeContext(permission: .denied)
@@ -1840,7 +1986,11 @@ private final class MockRelayConnection: NostrRelayConnectionProtocol {
     }
 
     func receive(completionHandler: @escaping (Result<URLSessionWebSocketTask.Message, Error>) -> Void) {
-        receiveHandler = completionHandler
+        if !pendingResults.isEmpty {
+            completionHandler(pendingResults.removeFirst())
+        } else {
+            receiveHandler = completionHandler
+        }
     }
 
     func sendPing(pongReceiveHandler: @escaping (Error?) -> Void) {
@@ -1873,15 +2023,24 @@ private final class MockRelayConnection: NostrRelayConnectionProtocol {
     }
 
     func emitRawString(_ string: String) throws {
-        let handler = receiveHandler
-        receiveHandler = nil
-        handler?(.success(.string(string)))
+        deliver(.success(.string(string)))
     }
 
     private func emit(jsonObject: Any) throws {
         let data = try JSONSerialization.data(withJSONObject: jsonObject)
-        let handler = receiveHandler
-        receiveHandler = nil
-        handler?(.success(.data(data)))
+        deliver(.success(.data(data)))
+    }
+
+    // Frames emitted before the manager re-arms `receive` are queued so
+    // back-to-back emissions model a socket with several buffered frames.
+    private var pendingResults: [Result<URLSessionWebSocketTask.Message, Error>] = []
+
+    private func deliver(_ result: Result<URLSessionWebSocketTask.Message, Error>) {
+        if let handler = receiveHandler {
+            receiveHandler = nil
+            handler(result)
+        } else {
+            pendingResults.append(result)
+        }
     }
 }