From 133cf91d2f0836b58c10efc8c05b8004bcc68799 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Thu, 5 Mar 2026 22:20:51 -0800 Subject: check for server generated key --- routes/users.ts | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/routes/users.ts b/routes/users.ts index 8dc384af..999a6d05 100644 --- a/routes/users.ts +++ b/routes/users.ts @@ -260,8 +260,9 @@ export default { else fail("Key in use by another account"); } - // Allow initial pubkey setting without signed event (e.g. during registration) - if (user.pubkey && body.event) { + // Require signed event to change pubkey, unless it's a server-generated key + // (user.nsec exists means server generated the key during registration) + if (body.event) { const event = JSON.parse(body.event); const challenge = event.tags.find((t) => t[0] === "challenge")[1]; const ch = await g(`challenge:${challenge}`); @@ -269,7 +270,7 @@ export default { if (!verifyEvent(event) || event.pubkey !== pubkey) fail("Invalid signature or challenge mismatch."); - } else if (user.pubkey) { + } else if (user.pubkey && !user.nsec) { fail("Signed event required to change pubkey"); } -- cgit v1.2.3