From 0d0054458af8f9bc7018f85bc241da31bb1f54ed Mon Sep 17 00:00:00 2001
From: Adam Soltys <asoltys@gmail.com>
Date: Mon, 17 Nov 2025 05:23:37 +0000
Subject: check app ownership

---
 routes/users.ts | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/routes/users.ts b/routes/users.ts
index 4c466529..7c6d0938 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -993,8 +993,11 @@ export default {
       const { user } = req;
       const uid = user.id;
       const { pubkey } = req.body;
-      const app = await g(pubkey);
-      if (app && uid !== app.uid) fail("Unauthorized");
+      const app = await g(`app:${pubkey}`);
+      if (app && uid !== app.uid) {
+        warn(app.uid, uid);
+        fail("Unauthorized");
+      }
       await db.sRem(`${uid}:apps`, pubkey);
       await db.del(`app:${pubkey}`);
       res.send({});
-- 
cgit v1.2.3