From 10218ae86b464b8e3d29c27513eb5cc0554d044b Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Mon, 2 Nov 2026 13:19:16 -0700
Subject: users: ignore pubkey on signup, revoke a rekeyed account's nostr key

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VMan6VN9xvnX1cgvV6hrUV
---
 routes/users.ts | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'routes/users.ts')

diff --git a/routes/users.ts b/routes/users.ts
index e8fdddd5..9f730b6f 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -313,7 +313,10 @@ export default {
         }
       }
 
-      const fields = ["pubkey", "password", "username", "picture", "fresh"];
+      // No pubkey: nothing here proves the caller holds that key, and register()
+      // points `user:<pubkey>` at the new account. Nostr accounts come from
+      // /nostrAuth, which verifies a signed challenge first.
+      const fields = ["password", "username", "picture", "fresh"];
       user = await register(pick(user, fields), ip);
 
       const payload = { id: user.id };
-- 
cgit v1.2.3