nostr: sign with the session key instead of the encrypted key from /me

Co-Authored-By: Claude Opus 5.5 <[email protected]>

1 files changed, 9 insertions, 3 deletions

diff --git a/src/lib/nostr.ts b/src/lib/nostr.ts
index df67bf6b..69e21286 100644
--- a/src/lib/nostr.ts
+++ b/src/lib/nostr.ts
@@ -20,6 +20,7 @@ import {
 import { decrypt as nip44decrypt, getConversationKey } from "nostr-tools/nip44";
 import { Relay } from "nostr-tools/relay";
 import { get } from "svelte/store";
+import cookies from "js-cookie";
 
 import {
 	decrypt as nip49decrypt,
@@ -72,12 +73,17 @@ export const getPrivateKey = async (user: User): Promise<Uint8Array> => {
 		}
 	}
 
+	// /me no longer returns the encrypted key; /login decrypts it into the
+	// sk cookie instead. user.nsec is only present on a fresh login response.
+	const sk = browser && cookies.get("sk");
 	const { nsec } = user;
 
-	if (nsec) {
+	if (sk) {
+		k = hexToBytes(sk);
+	} else if (nsec) {
 		k = nip49decrypt(nsec, await getPassword());
 	} else {
-		throw new Error("nsec not available");
+		throw new Error("Log in again with your password to unlock your nostr key");
 	}
 
 	localStorage.setItem("nsec", nip19.nsecEncode(k));
@@ -105,7 +111,7 @@ export const encryptNsec = async (nsec: string) => {
 };
 
 export const sign = async (event, user) => {
-	if (user?.nsec && !get($signer)?.ready) {
+	if ((user?.hasnsec || user?.nsec) && !get($signer)?.ready) {
 		const sk = await getPrivateKey(user);
 
 		$signer.set({