From 558a7c5a08cb172dbe229675a6b330611000d3fc Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Tue, 13 Oct 2026 16:23:39 -0700
Subject: nostr: fetch the encrypted key with the password when there's no
 session key

Without the sk cookie from a password login (nostr logins, older
sessions) the reveal button was hidden and signing failed. Ask for the
password and get the key from /nsec instead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UjHzoBmW1iPpEe5qC2LDYB
---
 src/lib/nostr.ts                             | 7 ++++++-
 src/routes/(app)/nsec/+server.ts             | 7 +++++++
 src/routes/(app)/settings/nostr/+page.svelte | 2 +-
 3 files changed, 14 insertions(+), 2 deletions(-)
 create mode 100644 src/routes/(app)/nsec/+server.ts

(limited to 'src')

diff --git a/src/lib/nostr.ts b/src/lib/nostr.ts
index 69e21286..2e993f9d 100644
--- a/src/lib/nostr.ts
+++ b/src/lib/nostr.ts
@@ -75,8 +75,13 @@ export const getPrivateKey = async (user: User): Promise<Uint8Array> => {
 
 	// /me no longer returns the encrypted key; /login decrypts it into the
 	// sk cookie instead. user.nsec is only present on a fresh login response.
+	// Sessions without either (nostr or older logins) fetch it with the
+	// password.
 	const sk = browser && cookies.get("sk");
-	const { nsec } = user;
+	let { nsec } = user;
+
+	if (!sk && !nsec && user.hasnsec)
+		({ nsec } = await post("/nsec", { password: await getPassword() }));
 
 	if (sk) {
 		k = hexToBytes(sk);
diff --git a/src/routes/(app)/nsec/+server.ts b/src/routes/(app)/nsec/+server.ts
new file mode 100644
index 00000000..ceead0d5
--- /dev/null
+++ b/src/routes/(app)/nsec/+server.ts
@@ -0,0 +1,7 @@
+import { json } from "@sveltejs/kit";
+import { auth, post } from "$lib/utils";
+
+export async function POST({ cookies, request }) {
+	const result = await post("/nsec", await request.json(), auth(cookies));
+	return json(result);
+}
diff --git a/src/routes/(app)/settings/nostr/+page.svelte b/src/routes/(app)/settings/nostr/+page.svelte
index 4ce153e4..3fe6e445 100644
--- a/src/routes/(app)/settings/nostr/+page.svelte
+++ b/src/routes/(app)/settings/nostr/+page.svelte
@@ -268,7 +268,7 @@
   {/if}
 </div>
 
-{#if user.hasnsec}
+{#if user.hasnsec || user.nsec}
   <div class="space-y-2">
     <label for="seedphrase" class="font-bold"
       >{$t("user.settings.nostrKeys")}</label
-- 
cgit v1.2.3