From 8c22f68085eab269d4d1ad220c9d5b2db3096fb1 Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Sat, 28 Feb 2026 15:24:38 -0800
Subject: hash pins

---
 src/components/Balance.svelte | 2 +-
 src/components/Pin.svelte     | 9 +++++----
 2 files changed, 6 insertions(+), 5 deletions(-)

(limited to 'src/components')

diff --git a/src/components/Balance.svelte b/src/components/Balance.svelte
index 6abb1449..33cb7b39 100644
--- a/src/components/Balance.svelte
+++ b/src/components/Balance.svelte
@@ -17,7 +17,7 @@
   };
 </script>
 
-{#if show && user.haspin && $pin?.length !== 6}
+{#if show && user.haspin && !$pin}
   <Pin
     cancel={() => {
       show = false;
diff --git a/src/components/Pin.svelte b/src/components/Pin.svelte
index 72bbf78d..da0c6aeb 100644
--- a/src/components/Pin.svelte
+++ b/src/components/Pin.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
   import { t } from "$lib/translations";
-  import { post, success, fail, focus, setCookie } from "$lib/utils";
+  import { post, success, fail, focus, setCookie, hashPin } from "$lib/utils";
   import Pinpad from "$comp/Pinpad.svelte";
   import { pin } from "$lib/store";
   import { onMount } from "svelte";
@@ -27,18 +27,19 @@
     if (p?.length !== 6) return;
     let result;
     try {
-      result = await post("/pin", { pin: p });
+      result = await post("/pin", { pin: hashPin(p) });
     } catch (e) {
       console.log("Pin check failed", e);
     }
 
     if (result) {
       if (notify) success("Pin confirmed");
+      const hashed = hashPin(p);
       if (locktime) {
-        setCookie("pin", p, locktime);
+        setCookie("pin", hashed, locktime);
         setTimeout(() => ($pin = undefined), locktime * 1000);
       }
-      $pin = p;
+      $pin = hashed;
     } else {
       fail("Invalid pin");
       value = "";
-- 
cgit v1.2.3