users: let a password unlock the encrypted nostr key for any sessionHEADmaster

/me only reports hasnsec now, so sessions that didn't start with a
password login had no way to reveal or sign with their key. POST /nsec
returns it after re-checking the password, under the login per-IP
failure limit.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01UjHzoBmW1iPpEe5qC2LDYB

1 files changed, 1 insertions, 0 deletions

diff --git a/index.ts b/index.ts
index 22854661..17f776ec 100644
--- a/index.ts
+++ b/index.ts
@@ -183,6 +183,7 @@ app.get("/subscriptions", auth, users.subscriptions);
 app.post("/subscription", auth, users.subscription);
 app.post("/subscription/delete", auth, users.deleteSubscription);
 app.post("/password", auth, users.password);
+app.post("/nsec", auth, users.nsec);
 app.post("/pin", auth, users.pin);
 app.post("/otpsecret", auth, users.otpsecret);
 app.get("/contacts/:limit?", auth, users.contacts);