Start upload functionality

IMPLEMENTATION.md

@@ -36,6 +36,8 @@ This document outlines the implementation plan for ginxsom, a FastCGI-based Blos
   - [x] Handle 404s gracefully when blob doesn't exist
   - [x] Configure FastCGI pass-through for HEAD and non-GET requests
 
+**Future Enhancement Note**: Consider implementing nginx Lua extension for true Blossom compliance with dynamic file discovery. The current approach uses explicit extension lists in `try_files`, which works well for common extensions but may not serve files with unusual extensions. Lua module would allow runtime directory scanning for hash-matching files regardless of extension.
+
 ### 1.4 Basic HEAD Endpoint
 - [x] Implement FastCGI handler for `HEAD /<sha256>`
   - [x] Query database for blob metadata (single source of truth)
@@ -58,12 +60,32 @@ This document outlines the implementation plan for ginxsom, a FastCGI-based Blos
 
 ### 2.1 Nostr Authentication Setup
 - [ ] Integrate nostr_core_lib submodule
-- [ ] Implement nostr event validation
-  - [ ] Verify event signature (schnorr)
-  - [ ] Validate event structure (kind 24242)
-  - [ ] Check required fields (t, expiration, x tags)
-  - [ ] Implement expiration checking
-- [ ] Create authentication middleware
+  - [ ] Update Makefile to include nostr_core_lib paths and static library
+  - [ ] Build libnostr_core_x64.a using provided build.sh script
+  - [ ] Add system dependencies: -lsecp256k1 -lssl -lcrypto -lcurl -lz -ldl -lpthread -lm
+
+- [ ] Implement authentication functions in main.c (BUD-02 section):
+  - [ ] `parse_authorization_header()` - Extract JSON from "Nostr base64(event)" header
+  - [ ] `validate_blossom_event()` - Validate Blossom-specific requirements (kind 24242, content hash, method, expiration)
+  - [ ] `authenticate_request()` - Main orchestrator function
+
+- [ ] Leverage existing nostr_core_lib functions:
+  - [ ] Use `nostr_validate_event()` for structure + signature validation (from nip001.h)
+  - [ ] Use standardized error codes from nostr_common.h (NOSTR_SUCCESS, NOSTR_ERROR_EVENT_INVALID_SIGNATURE, etc.)
+  - [ ] Use `nostr_strerror()` for error message translation
+
+**Function Specifications:**
+```c
+// Custom functions to implement:
+int parse_authorization_header(const char* auth_header, char* event_json, size_t json_size);
+int validate_blossom_event(struct cJSON* event, const char* expected_hash, const char* method);
+int authenticate_request(const char* auth_header, const char* method, const char* file_hash);
+
+// Existing nostr_core_lib functions to use directly:
+// - nostr_validate_event(cJSON* event) - handles structure + signature validation
+// - nostr_validate_event_structure(cJSON* event) - if separate validation needed
+// - nostr_verify_event_signature(cJSON* event) - if separate signature check needed
+```
 
 ### 2.2 Upload Endpoint Implementation
 - [ ] Implement `PUT /upload` endpoint