users: ignore pubkey on signup, revoke a rekeyed account's nostr key

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01VMan6VN9xvnX1cgvV6hrUV

1 files changed, 4 insertions, 1 deletions

diff --git a/routes/users.ts b/routes/users.ts
index e8fdddd5..9f730b6f 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -313,7 +313,10 @@ export default {
         }
       }
 
-      const fields = ["pubkey", "password", "username", "picture", "fresh"];
+      // No pubkey: nothing here proves the caller holds that key, and register()
+      // points `user:<pubkey>` at the new account. Nostr accounts come from
+      // /nostrAuth, which verifies a signed challenge first.
+      const fields = ["password", "username", "picture", "fresh"];
       user = await register(pick(user, fields), ip);
 
       const payload = { id: user.id };