NIP-29
======

Relay-based Groups
------------------

`draft` `optional` `author:fiatjaf`

This NIP defines a standard for groups that are only writable by a closed set of users. They can be public for reading by external users or not.

Groups are identified by a random string of any length that serves as an _id_.

There is no way to create a group, what happens is just that relays (most likely when asked by users) create rules around some specific ids so these ids can serve as an actual group, henceforth messages sent to that group will be subject to these rules.

Normally a group will originally belong to one specific relay, but the community may choose to move the group to other relays or even fork the group so it exists in different forms -- still using the same _id_ -- across different relays.

## Relay-generated events

Relays are supposed to generate the events that describe group metadata and group admins. These are parameterized replaceable events signed by the relay keypair directly, with the group _id_ as the `d` tag.

## The `h` tag

Events sent by users to groups (chat messages, text notes, moderation events etc) must have an `h` tag with the value set to the group _id_.

## Timeline references

In order to not be used out of context, events sent to these groups may contain references to previous events seen from the same relay in the `previous` tag. The choice of which previous events to pick belongs to the clients.

This is a hack to prevent messages from being broadcasted to external relays that have forks of one group out of context. Relays are expected to reject any events that contain timeline references to events not found in their own database. Clients must also check these to keep relays honest about them.

## Late publication

Relays should prevent late publication (messages published now with a timestamp from days or even hours ago) unless they are open to receive a group forked or moved from another relay.

## Trimmed signatures

Relays must strip the signature of messages in groups that are `private` so they do not leak.

### Event definitions

- *text note* (`kind:11`)

This is the basic unit of a "microblog" text note sent to a group.

```js
  "kind": 11,
  "content": "hello my friends lovers of pizza",
  "tags": [
    ["h", "<group-id>"],
    ["previous", "<event-id>", "<event-id>", ...]
  ]
  ...
```

- *chat message* (`kind:9`)

Similar to `kind:11`, this is the basic unit of a chat message sent to a group.

```js
  "kind": 9,
  "content": "hello my friends lovers of pizza",
  "tags": [
    ["h", "<group-id>"],
    ["previous", "<event-id>", "<event-id>", ...]
  ]
  ...
```

- *moderation events* (`kinds:5;9000-9020`) (optional)

Clients can send these events to a relay in order to accomplish a moderation action. Relays must check if the pubkey sending the event is capable of performing the given action. The relay may discard the event after taking action or keep it as a moderation log.

```js
{
  "kind": 90xx,
  "content": "",
  "tags": [
    ["h", "<group-id>"],
    ["alt", "optional action description and/or reason"],
    ["previous", ...]
  ]
}
```

Each moderation action uses a different kind and requires different arguments, which are given as tags. These are defined in the following table:

| kind | name                | tags                                |
| ---  | ---                 | ---                                 |
| 5    | `delete-event`      | `e` (id hex)                        |
| 9000 | `add-user`          | `p` (pubkey hex)                    |
| 9001 | `remove-user`       | `p` (pubkey hex)                    |
| 9002 | `edit-metadata`     | `name`, `about`, `picture` (string) |
| 9003 | `add-permission`    | `p` (pubkey), `permission` (name)   |
| 9004 | `remove-permission` | `p` (pubkey), `permission` (name)   |

- *group metadata* (`kind:39000`) (optional)

If this event does not exist, the group should be identified in the client UI by its identifier (i.e. "/flavors" or "pizza.com/flavors"). All tags are optional. Having the `"private"` tag means the group cannot be read and relays will use [NIP-42](42.md) `AUTH` messages to control who can read from it. The `"closed"` tag means the group can be read by anyone but only explicitly whitelisted pubkeys are allowed to post, again these enforcements happen at the relay level.

```js
{
  "kind": 39000,
  "content": "a nip-29 chat group for debating pizza flavors and other topics",
  "tags": [
    ["d", "<group-id>"],
    ["name", "Pizza Lovers"],
    ["picture", "https://pizza.com/pizza.png"],
    ["private"],
    ["closed"]
  ]
  ...
}
```

The [NIP-19](19.md) `naddr` pointer for this event including with a mandatory relay can be used as the canonical group identifier.

- *group admins* (`kind:39001`) (optional)

Each admin gets a label that is only used for display purposes, and a list of permissions it has are listed afterwards. These permissions can inform client building UI, but ultimately are evaluated by the relay in order to become effective.

The list of capabilities, as defined by this NIP, for now, is the following:

- `add-user`
- `edit-metadata`
- `delete-event`
- `remove-user`
- `add-permission`
- `remove-permission`

```js
{
  "kind": 39001,
  "content": "list of admins for the pizza lovers group",
  "tags": [
    ["d", "<group-id>"],
    ["<pubkey1-as-hex>", "ceo", "add-user", "edit-metadata", "delete-event", "remove-user"],
    ["<pubkey2-as-hex>", "secretary", "add-user", "delete-event"]
  ]
  ...
}
```