feat: import Chinese-localized Buzz source snapshot

Signed-off-by: cls_宁波本机 <908705107@qq.com>

migrations/0015_push_gateway_authority.sql

@@ -0,0 +1,74 @@
+-- Durable, deployment-global authority for the public NIP-PL push gateway.
+-- This state is intentionally outside relay community tenancy: installations
+-- delegate to relay signing keys and may authorize multiple relay deployments.
+CREATE TABLE push_gateway_challenges (
+    id UUID PRIMARY KEY,
+    challenge_hash BYTEA NOT NULL CHECK (length(challenge_hash) = 32),
+    expires_at TIMESTAMPTZ NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+CREATE INDEX push_gateway_challenges_expiry ON push_gateway_challenges (expires_at);
+
+CREATE TABLE push_gateway_installations (
+    id UUID PRIMARY KEY,
+    app_attest_key_id BYTEA NOT NULL UNIQUE CHECK (octet_length(app_attest_key_id) BETWEEN 1 AND 128),
+    app_attest_public_key BYTEA NOT NULL CHECK (octet_length(app_attest_public_key) BETWEEN 33 AND 256),
+    assertion_counter BIGINT NOT NULL CHECK (assertion_counter BETWEEN 0 AND 4294967295),
+    app_profile TEXT NOT NULL CHECK (app_profile IN ('buzz-ios-production','buzz-ios-sandbox')),
+    token_ciphertext BYTEA NOT NULL CHECK (octet_length(token_ciphertext) BETWEEN 1 AND 2048),
+    token_fingerprint BYTEA NOT NULL CHECK (length(token_fingerprint) = 32),
+    endpoint_epoch BIGINT NOT NULL CHECK (endpoint_epoch > 0),
+    expires_at TIMESTAMPTZ NOT NULL,
+    revoked_at TIMESTAMPTZ,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    UNIQUE (app_profile, token_fingerprint)
+);
+CREATE INDEX push_gateway_installations_expiry ON push_gateway_installations (expires_at) WHERE revoked_at IS NULL;
+
+CREATE TABLE push_gateway_delegations (
+    id UUID PRIMARY KEY,
+    installation_id UUID NOT NULL REFERENCES push_gateway_installations(id),
+    relay_pubkey BYTEA NOT NULL CHECK (length(relay_pubkey) = 32),
+    endpoint_epoch BIGINT NOT NULL CHECK (endpoint_epoch > 0),
+    generation BIGINT NOT NULL CHECK (generation > 0),
+    not_before TIMESTAMPTZ NOT NULL,
+    expires_at TIMESTAMPTZ NOT NULL,
+    revoked_at TIMESTAMPTZ,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    UNIQUE (installation_id, relay_pubkey),
+    CHECK (not_before < expires_at)
+);
+CREATE INDEX push_gateway_delegations_expiry ON push_gateway_delegations (expires_at) WHERE revoked_at IS NULL;
+
+CREATE TABLE push_gateway_endpoint_quotas (
+    token_fingerprint BYTEA PRIMARY KEY CHECK (length(token_fingerprint) = 32),
+    window_started_at TIMESTAMPTZ NOT NULL,
+    admitted BIGINT NOT NULL CHECK (admitted >= 0),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+CREATE INDEX push_gateway_endpoint_quotas_updated ON push_gateway_endpoint_quotas (updated_at);
+
+CREATE TABLE push_gateway_delivery_auth_replays (
+    relay_pubkey BYTEA NOT NULL CHECK (length(relay_pubkey) = 32),
+    auth_event_id BYTEA NOT NULL CHECK (length(auth_event_id) = 32),
+    expires_at TIMESTAMPTZ NOT NULL,
+    PRIMARY KEY (relay_pubkey, auth_event_id)
+);
+CREATE INDEX push_gateway_delivery_auth_replays_expiry ON push_gateway_delivery_auth_replays (expires_at);
+
+CREATE TABLE push_gateway_delivery_request_replays (
+    relay_pubkey BYTEA NOT NULL CHECK (length(relay_pubkey) = 32),
+    request_id UUID NOT NULL,
+    expires_at TIMESTAMPTZ NOT NULL,
+    PRIMARY KEY (relay_pubkey, request_id)
+);
+CREATE INDEX push_gateway_delivery_request_replays_expiry ON push_gateway_delivery_request_replays (expires_at);
+
+INSERT INTO _operator_global_tables (table_name, reason) VALUES
+    ('push_gateway_challenges', 'public gateway one-time challenges span relay communities'),
+    ('push_gateway_installations', 'public gateway installation authority spans relay communities'),
+    ('push_gateway_delegations', 'public gateway relay delegations span relay communities'),
+    ('push_gateway_endpoint_quotas', 'public gateway endpoint abuse ceilings span relay communities'),
+    ('push_gateway_delivery_auth_replays', 'public gateway signed-event replay admission spans relay communities'),
+    ('push_gateway_delivery_request_replays', 'public gateway stable request-id admission spans relay communities');