From f87b082c14869c4934b4e5fc7ff4b8066a84ed8d Mon Sep 17 00:00:00 2001
From: Adam Soltys <asoltys@gmail.com>
Date: Sat, 14 Mar 2026 17:12:37 +0000
Subject: pass bytes for app secret

---
 routes/users.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'routes')

diff --git a/routes/users.ts b/routes/users.ts
index 9820f504..f4076b77 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -16,6 +16,7 @@ import { $ } from "bun";
 import got from "got";
 import jwt from "jsonwebtoken";
 import { getPublicKey, nip19, verifyEvent } from "nostr-tools";
+import { hexToBytes } from "@noble/hashes/utils";
 import { authenticator } from "otplib";
 import { v4 } from "uuid";
 
@@ -996,7 +997,7 @@ export default {
       let app = await g(pubkey);
 
       if (app && uid !== app.uid) fail("Unauthorized");
-      if (secret) pubkey = getPublicKey(secret);
+      if (secret) pubkey = getPublicKey(hexToBytes(secret));
       notify = String(notify) === "true";
 
       app = {
-- 
cgit v1.2.3