From f677540cf8548a03fb354536ec70b6186e812eae Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Wed, 18 Mar 2026 01:34:41 -0700
Subject: stop republishing primal events

---
 lib/nostr.ts |  2 --
 lib/nwc.ts   | 15 ++++++++++++++-
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/lib/nostr.ts b/lib/nostr.ts
index 06de5701..064e1952 100644
--- a/lib/nostr.ts
+++ b/lib/nostr.ts
@@ -10,7 +10,6 @@ import { AbstractSimplePool } from "nostr-tools/abstract-pool";
 import { Relay } from "nostr-tools/relay";
 
 export const EX = 60 * 60 * 24;
-const coinos = await Relay.connect(config.nostr);
 
 export const serverSecret = bytesToHex(
   nip19.decode(config.nostrKey).data as Uint8Array,
@@ -234,7 +233,6 @@ export const q = async (f) => {
     pool.subscribeMany(["wss://relay.primal.net"], [f], {
       onevent(e) {
         r.push(e);
-        coinos.publish(e);
       },
       oneose() {
         resolve(r);
diff --git a/lib/nwc.ts b/lib/nwc.ts
index facf9dc8..646ed4b0 100644
--- a/lib/nwc.ts
+++ b/lib/nwc.ts
@@ -42,6 +42,11 @@ const nwcEventMaxAgeSeconds = 5 * 60;
 const handledKey = "handled:nwc";
 const handledMaxSize = 200000;
 
+// Per-pubkey rate limiting for NWC requests
+const nwcRateLimit = 5; // max requests per minute per pubkey
+const nwcRateWindow = 60 * 1000; // 1 minute in ms
+const nwcRequestTimes: Map<string, number[]> = new Map();
+
 export default () => {
   let r: any;
 
@@ -50,7 +55,7 @@ export default () => {
 
     r.on("open", async (_) => {
       l("nwc connected to strfry");
-      r.subscribe("nwc", { kinds: [23194], "#p": [serverPubkey, serverPubkey2] });
+      r.subscribe("nwc", { kinds: [23194], "#p": [serverPubkey, serverPubkey2], since: Math.floor(Date.now() / 1000) - nwcEventMaxAgeSeconds });
       const info = await finalizeEvent(
         {
           created_at: Math.floor(Date.now() / 1000),
@@ -94,6 +99,14 @@ export default () => {
       if (ev.created_at && now - ev.created_at > nwcEventMaxAgeSeconds) return;
       if (await db.zScore(handledKey, ev.id)) return;
 
+      // Per-pubkey rate limiting
+      const times = nwcRequestTimes.get(ev.pubkey) || [];
+      const cutoff = Date.now() - nwcRateWindow;
+      const recent = times.filter((t) => t > cutoff);
+      if (recent.length >= nwcRateLimit) return;
+      recent.push(Date.now());
+      nwcRequestTimes.set(ev.pubkey, recent);
+
       db.zAdd(handledKey, { score: now, value: ev.id });
       db.zRemRangeByScore(handledKey, 0, now - nwcEventMaxAgeSeconds);
       const size = await db.zCard(handledKey);
-- 
cgit v1.2.3