From 8c22f68085eab269d4d1ad220c9d5b2db3096fb1 Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Sat, 28 Feb 2026 15:24:38 -0800
Subject: hash pins

---
 src/components/Balance.svelte                   | 2 +-
 src/components/Pin.svelte                       | 9 +++++----
 src/lib/utils.ts                                | 5 ++++-
 src/routes/(app)/send/+layout.svelte            | 2 +-
 src/routes/(app)/settings/+layout.svelte        | 2 +-
 src/routes/(app)/settings/security/+page.svelte | 6 +++---
 6 files changed, 15 insertions(+), 11 deletions(-)

(limited to 'src')

diff --git a/src/components/Balance.svelte b/src/components/Balance.svelte
index 6abb1449..33cb7b39 100644
--- a/src/components/Balance.svelte
+++ b/src/components/Balance.svelte
@@ -17,7 +17,7 @@
   };
 </script>
 
-{#if show && user.haspin && $pin?.length !== 6}
+{#if show && user.haspin && !$pin}
   <Pin
     cancel={() => {
       show = false;
diff --git a/src/components/Pin.svelte b/src/components/Pin.svelte
index 72bbf78d..da0c6aeb 100644
--- a/src/components/Pin.svelte
+++ b/src/components/Pin.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
   import { t } from "$lib/translations";
-  import { post, success, fail, focus, setCookie } from "$lib/utils";
+  import { post, success, fail, focus, setCookie, hashPin } from "$lib/utils";
   import Pinpad from "$comp/Pinpad.svelte";
   import { pin } from "$lib/store";
   import { onMount } from "svelte";
@@ -27,18 +27,19 @@
     if (p?.length !== 6) return;
     let result;
     try {
-      result = await post("/pin", { pin: p });
+      result = await post("/pin", { pin: hashPin(p) });
     } catch (e) {
       console.log("Pin check failed", e);
     }
 
     if (result) {
       if (notify) success("Pin confirmed");
+      const hashed = hashPin(p);
       if (locktime) {
-        setCookie("pin", p, locktime);
+        setCookie("pin", hashed, locktime);
         setTimeout(() => ($pin = undefined), locktime * 1000);
       }
-      $pin = p;
+      $pin = hashed;
     } else {
       fail("Invalid pin");
       value = "";
diff --git a/src/lib/utils.ts b/src/lib/utils.ts
index e37556e3..7a4030d5 100644
--- a/src/lib/utils.ts
+++ b/src/lib/utils.ts
@@ -2,7 +2,8 @@ import { browser } from "$app/environment";
 import { goto } from "$app/navigation";
 import { page } from "$app/stores";
 import { PUBLIC_COINOS_NETWORK, PUBLIC_COINOS_URL } from "$env/static/public";
-import { bytesToHex } from "@noble/hashes/utils.js";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { bytesToHex, utf8ToBytes } from "@noble/hashes/utils.js";
 import { fail as svelteFail, redirect } from "@sveltejs/kit";
 import { toast } from "@zerodevx/svelte-toast";
 import {
@@ -31,6 +32,8 @@ const ipHeaders = (): Record<string, string> => {
   return ip ? { "cf-connecting-ip": ip } : {};
 };
 
+export const hashPin = (pin: string) => bytesToHex(sha256(utf8ToBytes(pin)));
+
 export const punk = (k: string) => `${Math.floor((parseInt(k.slice(-2), 16) / 256) * 64) + 1}.webp`;
 
 export const g = (url: string, fetch: any, headers: object) =>
diff --git a/src/routes/(app)/send/+layout.svelte b/src/routes/(app)/send/+layout.svelte
index 1475e4cf..086eec54 100644
--- a/src/routes/(app)/send/+layout.svelte
+++ b/src/routes/(app)/send/+layout.svelte
@@ -9,7 +9,7 @@
   let cancel: any = () => goto(`/${user.username}`);
 </script>
 
-{#if user?.haspin && (!$pin || $pin?.length !== 6)}
+{#if user?.haspin && !$pin}
   <Pin bind:value={$pin} {cancel} />
 {/if}
 
diff --git a/src/routes/(app)/settings/+layout.svelte b/src/routes/(app)/settings/+layout.svelte
index 29e9489c..1af541a6 100644
--- a/src/routes/(app)/settings/+layout.svelte
+++ b/src/routes/(app)/settings/+layout.svelte
@@ -265,7 +265,7 @@
   });
 </script>
 
-{#if user?.haspin && $pin?.length !== 6}
+{#if user?.haspin && !$pin}
   <Pin />
 {/if}
 
diff --git a/src/routes/(app)/settings/security/+page.svelte b/src/routes/(app)/settings/security/+page.svelte
index 9ab16ded..68d3423a 100644
--- a/src/routes/(app)/settings/security/+page.svelte
+++ b/src/routes/(app)/settings/security/+page.svelte
@@ -5,7 +5,7 @@
   import Pin from "$comp/Pin.svelte";
   import Qr from "$comp/Qr.svelte";
   import Spinner from "$comp/Spinner.svelte";
-  import { copy, post, success, fail } from "$lib/utils";
+  import { copy, post, success, fail, hashPin } from "$lib/utils";
   import { save, pin as current } from "$lib/store";
   import { getNsec } from "$lib/nostr";
   import { registerPasskey } from "$lib/passkey";
@@ -63,7 +63,7 @@
   let checkPin = async (_?: any) => {
     try {
       if (pin && pin.length > 5 && pin === verify) {
-        $current = pin;
+        $current = hashPin(pin);
         pin = "";
         verify = "";
         ($save as any).click();
@@ -192,7 +192,7 @@
   });
 </script>
 
-<input type="hidden" name="newpin" value={disablingPin ? "delete" : pin} />
+<input type="hidden" name="newpin" value={disablingPin ? "delete" : pin ? hashPin(pin) : ""} />
 
 <div>
   <span class="font-bold mb-1">
-- 
cgit v1.2.3