Zaps are signed as the person zapping: the login identity (extension, bunker, passkey, Google) when there is one, else the wallet's key. They were always signed by the wallet's own key, so a signed-in person's zaps showed in stream chats and streamers' overlays under a stranger npub. Zap requests also carry created_at now (a real signer refused them without it).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_013ZDf1cyCQLkfjftYhymZAg

3 files changed, 60 insertions, 5 deletions

diff --git a/src/features/zaps.js b/src/features/zaps.js
index b501c76..76296cf 100644
--- a/src/features/zaps.js
+++ b/src/features/zaps.js
@@ -196,6 +196,16 @@ export function zapsFeature(ctx) {
     render();
   }
 
+  // A zap request is signed as the person zapping: the login identity when
+  // there is one (the face their chat line and the streamer's overlay
+  // show), else the wallet's own key. It used to be the wallet key always,
+  // and a signed-in person's zaps showed under a stranger's npub.
+  async function zapSigner() {
+    const id = hook('nostrLoginIdentity');
+    const signer = id && (id.signer || await Promise.resolve(hook('nostrLoginResume')).catch(() => null));
+    return signer ? (e) => signer.signEvent(e) : (e) => wallet.nostrSign(e);
+  }
+
   // One-tap zap at the user's default amount: resolve, invoice, pay through
   // the ark seam (its quote + retries included), and report by toast — the
   // whole flow without a single screen.
@@ -214,10 +224,11 @@ export function zapsFeature(ctx) {
     }
     let zapRequest = null;
     if (p.allowsNostr && t2.pk && wallet.nostrSign) {
-      zapRequest = buildZapRequest({
+      const sign = await zapSigner();
+      zapRequest = await buildZapRequest({
         amountMsat: msat, relays: wallet.nostrRelays(), lnurlBech32: t2.lnurlBech32,
         recipientPk: t2.pk, eventId: t2.eventId || null, moment: t2.moment, comment: '',
-        signFn: (partial) => wallet.nostrSign(partial),
+        signFn: sign,
       });
     }
     const invoice = await requestInvoice(p, { amountMsat: msat, zapRequest, lnurlBech32: t2.lnurlBech32 });
@@ -272,10 +283,11 @@ export function zapsFeature(ctx) {
       let zapRequest = null;
       const canZap = p.allowsNostr && z.target.pk && wallet.nostrSign;
       if (canZap) {
-        zapRequest = buildZapRequest({
+        const sign = await zapSigner();
+        zapRequest = await buildZapRequest({
           amountMsat: msat, relays: wallet.nostrRelays(), lnurlBech32: z.target.lnurlBech32,
           recipientPk: z.target.pk, eventId: z.target.eventId || null, moment: z.target.moment, comment: z.comment,
-          signFn: (partial) => wallet.nostrSign(partial),
+          signFn: sign,
         });
       }
       const invoice = await requestInvoice(p, { amountMsat: msat, zapRequest, lnurlBech32: z.target.lnurlBech32, comment: z.comment });
diff --git a/src/lnurl.js b/src/lnurl.js
index 592d143..134edcf 100644
--- a/src/lnurl.js
+++ b/src/lnurl.js
@@ -132,7 +132,7 @@ export function buildZapRequest({ amountMsat, relays, lnurlBech32, recipientPk,
   const addr = zapAddrOf(eventId);
   if (addr) tags.push(['a', addr]);
   tags.push(...momentTags(moment));
-  return signFn({ kind: 9734, content: comment || '', tags });
+  return signFn({ kind: 9734, created_at: Math.floor(Date.now() / 1000), content: comment || '', tags });
 }
 
 // GET the callback for a bolt11. When zapRequest is present this is a real zap;
diff --git a/tools/zap-signer-test.js b/tools/zap-signer-test.js
new file mode 100644
index 0000000..13f6008
--- /dev/null
+++ b/tools/zap-signer-test.js
@@ -0,0 +1,43 @@
+// A zap is signed as the person zapping: with a login identity (extension,
+// bunker, passkey…) the zap request's pubkey is that identity, not the
+// wallet's own key — a signed-in person's zaps showed in stream chats (and
+// streamers' overlays) under the wallet key's stranger npub. Without a
+// login, the wallet key signs as before.
+// Run: bun tools/zap-signer-test.js
+import assert from 'node:assert/strict';
+import { finalizeEvent, generateSecretKey, getPublicKey } from 'nostr-tools/pure';
+import { zapsFeature } from '../src/features/zaps.js';
+
+const check = (name, ok, detail = '') => { assert(ok, name + (detail ? ' — ' + detail : '')); console.log(' ✓ ' + name); };
+const walletSk = generateSecretKey(), loginSk = generateSecretKey(), host = getPublicKey(generateSecretKey());
+let asked = null;
+globalThis.fetch = async (url) => {
+  const u = new URL(url);
+  if (u.pathname.startsWith('/.well-known/lnurlp/')) return Response.json({ tag: 'payRequest', callback: 'https://ln.example/cb', minSendable: 1000, maxSendable: 1e9, allowsNostr: true, nostrPubkey: host });
+  if (u.pathname === '/cb') { asked = JSON.parse(u.searchParams.get('nostr')); return Response.json({ pr: 'lnbc210n1fake' }); }
+  return new Response('no', { status: 404 });
+};
+async function zapWith(login) {
+  asked = null;
+  let settled = null;
+  const ctx = {
+    h: () => null, ui: {}, render: () => {}, toast: (m) => console.log('toast:', m), fmtAmount: String, unitLabel: () => 'sats', parseAmount: Number, getUnit: () => 'sat', unitTag: () => '', blankSend: () => {},
+    wallet: { watchOnly: false, nostrRelays: () => ['wss://relay.example'], nostrProfile: async () => ({ lud16: '[email protected]' }), nostrSign: (e) => finalizeEvent(e, walletSk) },
+    hook(name, ...a) {
+      if (name === 'canLnPay' || name === 'arkReady') return true;
+      if (name === 'nostrLoginIdentity') return login;
+      if (name === 'arkPayInvoice') return Promise.resolve({});
+      if (name === 'zapSettled') { settled = a; return null; }
+      return null;
+    },
+  };
+  zapsFeature(ctx).lnZapNpub(host, null, 'e'.repeat(64), 21);
+  for (let i = 0; i < 50 && !settled; i++) await new Promise((r) => setTimeout(r, 20));
+  return { req: asked, settled };
+}
+const signedIn = await zapWith({ pubkey: getPublicKey(loginSk), signer: { signEvent: async (e) => finalizeEvent(e, loginSk) } });
+check('signed in: the zap goes through', signedIn.settled && signedIn.settled[1] === true, JSON.stringify(signedIn.settled));
+check('...and its request is signed by the login identity', signedIn.req && signedIn.req.kind === 9734 && signedIn.req.pubkey === getPublicKey(loginSk), signedIn.req && signedIn.req.pubkey);
+const plain = await zapWith(null);
+check('no login: the wallet\'s own key signs it', plain.req && plain.req.pubkey === getPublicKey(walletSk));
+console.log('\n✅ zaps are signed as the person zapping');