Add public GET /v1/whitelist/pubkeys for active subscriber pubkeys

Expose JSON array of hex pubkeys backed by ListActivePubkeys query.
Includes OpenAPI documentation and integration tests.

Made-with: Love

internal/http/server_test.go

@@ -162,6 +162,53 @@ func TestNostrJSON_EmptyAndPopulated(t *testing.T) {
 	}
 }
 
+func TestWhitelistPubkeys(t *testing.T) {
+	f := newFixture(t)
+
+	resp, body := f.get(t, "/v1/whitelist/pubkeys")
+	if resp.StatusCode != 200 {
+		t.Fatalf("empty list status %d: %s", resp.StatusCode, body)
+	}
+	var empty []string
+	if err := json.Unmarshal(body, &empty); err != nil {
+		t.Fatal(err)
+	}
+	if len(empty) != 0 {
+		t.Errorf("expected empty array: %s", body)
+	}
+
+	f.admin(t, "POST", "/v1/admin/users", map[string]any{
+		"pubkey": testHex, "username": "alice",
+		"subscription_type": "yearly", "years": 1,
+	})
+
+	inactiveHex := "1f8c41ebcd55a8d8db2e0a8c3a4b9c5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1d"
+	_, err := f.db.ExecContext(context.Background(),
+		`INSERT INTO users (pubkey, username, subscription_type, expires_at, is_active, manual_username, created_at)
+		 VALUES (?, 'bob', 'yearly', NULL, 0, 1, datetime('now'))`,
+		inactiveHex)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	resp, body = f.get(t, "/v1/whitelist/pubkeys")
+	if resp.StatusCode != 200 {
+		t.Fatalf("status %d: %s", resp.StatusCode, body)
+	}
+	var pubkeys []string
+	if err := json.Unmarshal(body, &pubkeys); err != nil {
+		t.Fatal(err)
+	}
+	if len(pubkeys) != 1 || pubkeys[0] != testHex {
+		t.Errorf("want [%s], got %v (body %s)", testHex, pubkeys, body)
+	}
+	for _, pk := range pubkeys {
+		if pk == inactiveHex {
+			t.Errorf("inactive pubkey should not appear: %v", pubkeys)
+		}
+	}
+}
+
 func TestUsernameAvailability(t *testing.T) {
 	f := newFixture(t)
 	resp, body := f.get(t, "/v1/usernames/alice/available")