From 75ec27747ec05da8990208d67052ad11d25f3c44 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Mon, 3 Aug 2026 22:28:53 -0700 Subject: Speak as the account you logged in with, or not at all MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Logging in with a remote signer and reloading left the app showing your avatar and profile while signing everything with the wallet's own key — so chat messages arrived under a different npub with a stranger's punk on them. identity() had a fallback: when the login signer wasn't available it quietly used the wallet key instead. That fallback is gone. If you logged in as a nostr account, the app speaks as that account or it refuses and says so. Refusing is only reasonable if the signer usually comes back, so a login now persists what it takes to be that identity again. A remote signer stores its NIP-46 client key and pointer — the signer authorised that client key, not one page load, so rebuilding from it resumes the session without prompting. A pasted key stores the key, which is already the seed of everything here since the wallet's mnemonic derives from it. Resume is single-flight with a pause after failure, because identity() is asked on every send and a signer that isn't answering must not mean a relay connection per keystroke. Existing remote-signer logins predate the stored session, so they need one more sign-in to become resumable. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi --- src/features/messages.js | 6 +++- src/features/nostrlogin.js | 63 +++++++++++++++++++++++++++----- src/i18n.js | 10 +++--- src/nostr-login.js | 31 ++++++++++++++-- tools/identity-test.js | 89 ++++++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 181 insertions(+), 18 deletions(-) create mode 100644 tools/identity-test.js diff --git a/src/features/messages.js b/src/features/messages.js index 5aa8dfe..74abdd8 100644 --- a/src/features/messages.js +++ b/src/features/messages.js @@ -114,11 +114,15 @@ export function messagesFeature(ctx) { // ---- identity ----------------------------------------------------------- + // Who we speak as. If the user logged in with a nostr account we speak as + // that account or not at all — falling back to the wallet's own key would + // sign under a pubkey that isn't the one their avatar and profile show, + // which reads to everyone else as a different person entirely. async function identity() { const id = hook('nostrLoginIdentity'); if (id) { const signer = id.signer || (await hook('nostrLoginResume')); - if (signer) return { pubkey: id.pubkey, signer }; + return signer ? { pubkey: id.pubkey, signer } : null; } if (wallet.nostr && wallet.nostr.sk) return { pubkey: wallet.nostr.pk, signer: wallet.nostr.sk }; return null; diff --git a/src/features/nostrlogin.js b/src/features/nostrlogin.js index 777a11e..fa0ad3a 100644 --- a/src/features/nostrlogin.js +++ b/src/features/nostrlogin.js @@ -12,9 +12,10 @@ import { newMnemonic } from '../wallet.js'; import { npubOf } from '../nostr.js'; import { t } from '../i18n.js'; import { qrSvg } from '../qr.js'; +import { hex } from '@scure/base'; import { extensionSigner, bunkerSigner, keySigner, parseNostrSecret, - walletForSigner, publishWalletBackup, nostrConnect} from '../nostr-login.js'; + walletForSigner, publishWalletBackup, nostrConnect, resumeBunker } from '../nostr-login.js'; // The nostr ostrich, in the brand's monochrome. const OSTRICH = ''; @@ -32,6 +33,25 @@ export function nostrLoginFeature(ctx) { // the user's real npub as their payment address (and nominate the wallet // key as manager, so later updates work without the signer). let live = null; + let resuming = null; + let resumeFailedAt = 0; + + // What it takes to be this identity again after a reload. Without it the app + // shows your face in the header but signs everything else with the wallet's + // own key — a different pubkey, which is exactly the mismatch people notice + // when their chat messages come out under a stranger's name. + // + // A remote signer stores its NIP-46 client key, which the signer authorised + // for this app and which cannot sign anything on its own. A pasted key + // stores the key itself: it is already the seed of everything here (the + // wallet's mnemonic derives from it), so this is the same secret the app is + // holding either way, not a new one. + const sessionOf = (signer) => { + if (!signer) return {}; + if (signer.session) return { session: signer.session, secret: null }; + if (signer.secret instanceof Uint8Array) return { session: null, secret: hex.encode(signer.secret) }; + return { session: null, secret: null }; + }; const busy = (v) => { ui.nostrLoginBusy = v; render(); }; const fail = (e) => { ui.nostrLoginError = e.message || String(e); busy(false); }; @@ -57,7 +77,7 @@ export function nostrLoginFeature(ctx) { if (res.publish) await publishWalletBackup(signer, { mnemonic: res.mnemonic }).catch(() => {}); live = signer; await ctx.openMnemonic(res.mnemonic, res.passphrase || '', { nostrPubkey: signer.pubkey }); - save({ ...load(), pubkey: signer.pubkey, linked: Date.now() }); + save({ ...load(), pubkey: signer.pubkey, linked: Date.now(), ...sessionOf(signer) }); // claim the real npub as the payment address while this signer is live ctx.hook('namesAdoptIdentity', signer, npubOf(signer.pubkey))?.catch?.(() => {}); toast(res.mode === 'derived' ? t('nlOpenedDerived') : t('nlOpenedRestored')); @@ -75,7 +95,7 @@ export function nostrLoginFeature(ctx) { ui.nostrLoginNew = null; live = st.signer; await ctx.openMnemonic(mnemonic, '', { nostrPubkey: st.signer.pubkey }); - save({ ...load(), pubkey: st.signer.pubkey, linked: Date.now() }); + save({ ...load(), pubkey: st.signer.pubkey, linked: Date.now(), ...sessionOf(st.signer) }); ctx.hook('namesAdoptIdentity', st.signer, npubOf(st.signer.pubkey))?.catch?.(() => {}); toast(t('nlCreated')); busy(false); @@ -97,7 +117,7 @@ export function nostrLoginFeature(ctx) { } await publishWalletBackup(signer, { mnemonic: wallet.mnemonic, passphrase: wallet.passphrase || '' }); live = signer; - save({ ...load(), pubkey: signer.pubkey, linked: Date.now() }); + save({ ...load(), pubkey: signer.pubkey, linked: Date.now(), ...sessionOf(signer) }); ctx.hook('namesAdoptIdentity', signer, npubOf(signer.pubkey))?.catch?.(() => {}); toast(t('nlLinked')); busy(false); @@ -258,13 +278,38 @@ export function nostrLoginFeature(ctx) { async nostrLoginResume() { if (live) return live; const st = load(); - if (!st.pubkey || typeof window === 'undefined' || !window.nostr) return null; + if (!st.pubkey) return null; + // One attempt at a time, and a pause after a failure: identity() asks on + // every send, and a signer that isn't answering shouldn't mean a new + // relay connection per keystroke. + if (resuming) return resuming; + if (Date.now() - resumeFailedAt < 20_000) return null; + resuming = (async () => { + if (typeof window !== 'undefined' && window.nostr) { + try { + const s = await extensionSigner(); + if (s.pubkey === st.pubkey) return (live = s); + } catch {} + } + if (st.secret) { + try { + const s = keySigner(hex.decode(st.secret)); + if (s.pubkey === st.pubkey) return (live = s); + } catch {} + } + if (st.session) { + try { + const s = await resumeBunker(st.session, { onAuth: (url) => { ui.nostrLoginAuthUrl = url; render(); } }); + if (s && s.pubkey === st.pubkey) return (live = s); + } catch {} + } + return null; + })(); try { - const s = await extensionSigner(); - if (s.pubkey !== st.pubkey) return null; - live = s; + const s = await resuming; + if (!s) resumeFailedAt = Date.now(); return s; - } catch { return null; } + } finally { resuming = null; } }, unlockExtra() { return unlockExtra(); }, nostrSettingsCards() { return [settingsCard()]; }, diff --git a/src/i18n.js b/src/i18n.js index 177de06..53cd643 100644 --- a/src/i18n.js +++ b/src/i18n.js @@ -124,11 +124,11 @@ const STR = { howItWorks: 'How it works', installApp: 'Install app', hiwBasicsTitle: 'The basics', - hiwBasics1: 'When you make a wallet, the page generates twelve random words — the key to your money. Anyone who has them can spend your coins, and if you lose them the coins are gone for good: there’s no reset link and no one to call. Write them down on paper before you put money in.', - hiwBasics2: 'There’s no server and no account. The whole app is one page that runs in your browser — nobody holds your coins, nothing on a server ever sees your keys, and you can even save the page and use it offline.', - hiwBasics3: 'It follows the standard Bitcoin formats, so the same twelve words will always restore your wallet in Sparrow, Electrum, or any other standard wallet — even if this site disappears.', + hiwBasics1: 'When you make a wallet, the page generates twelve random words which are the keys to the wallet. Anyone who has them can spend the coins in the wallet. If you lose them, the coins are gone for good. Write them down on paper before you put money in.', + hiwBasics2: 'There’s no server and no account. The whole app is one page that runs in your browser. You can save the page and use it offline.', + hiwBasics3: 'It follows the standard Bitcoin formats, so the same twelve words will restore your wallet in Sparrow, Electrum, or any other standard wallet even if this site disappears.', hiwLnTitle: 'Spending and Savings', - hiwLn1: 'Your money sits in two places, like a savings account and the cash in your pocket. Savings is ordinary Bitcoin on the blockchain — safest for money you’re keeping, but each move costs a mining fee and waits for a confirmation. Spending sends and arrives instantly and free, and is still only yours: it runs on Ark, a newer layer on top of Bitcoin where every coin stays locked to your key, and it speaks Lightning, so you can pay and be paid by any bitcoin app or shop.', + hiwLn1: 'Your money sits in two places. Savings is ordinary Bitcoin on the blockchain. Withdrawals costs a mining fee and deposits take time to confirm. Deposits into the spending wallet arrive instantly and payments out are free: it runs on Ark and speaks Lightning, so you can pay and be paid by any bitcoin app or shop.', hiwLn2: 'Move money either way under your balance — a small fee each direction, free inside Spending. The wallet handles all the upkeep on its own (just open the app now and then), and every coin in Spending carries a pre-signed escape route: even if the coinos server vanished, you could pull your money back on-chain yourself.', hiwGiftsTitle: 'Gifts', hiwGifts1: 'You can gift bitcoin with a link: whoever opens it claims the coins into their own wallet — no app, no signup. On-chain gifts lock the coins until claimed and can be cancelled or reclaimed; Ark gifts claim instantly and free, even into a brand-new empty wallet.', @@ -157,7 +157,7 @@ const STR = { msgAdmin: 'admin', msgEdited: '(edited)', msgDelete: 'Delete message', - msgNoIdentity: 'No nostr identity available to sign with', + msgNoIdentity: "Your nostr signer isn't connected — reconnect it to send as yourself", msgSendFailed: 'No relay accepted the message', msgDmsTitle: 'Messages', msgCommunitiesTitle: 'Communities', diff --git a/src/nostr-login.js b/src/nostr-login.js index 8a4603f..ec18942 100644 --- a/src/nostr-login.js +++ b/src/nostr-login.js @@ -102,12 +102,37 @@ export async function bunkerSigner(uri, { onAuth } = {}) { }); await signer.connect(); const pubkey = await signer.getPublicKey(); - return bunkerAdapter(signer, pubkey); + return bunkerAdapter(signer, pubkey, local); } -function bunkerAdapter(signer, pubkey) { +// Reconnect a remote signer a page reload dropped. The remote end granted +// permission to this client key, not to this page load, so rebuilding from +// the same client key and pointer picks the session back up — usually without +// prompting the user again. +export async function resumeBunker(session, { onAuth, timeoutMs = 8000 } = {}) { + if (!session || !session.local || !session.bp || !session.bp.pubkey) return null; + const local = hex.decode(session.local); + const signer = BunkerSigner.fromBunker(local, session.bp, { + onauth: (url) => { if (onAuth) onAuth(url); }, + }); + const give = new Promise((_, rej) => setTimeout(() => rej(new Error('signer did not answer')), timeoutMs)); + try { + await Promise.race([signer.connect(), give]); + const pubkey = await Promise.race([signer.getPublicKey(), give]); + return bunkerAdapter(signer, pubkey, local); + } catch (e) { + try { signer.close(); } catch {} + throw e; + } +} + +function bunkerAdapter(signer, pubkey, local) { return { kind: 'bunker', pubkey, label: 'remote signer', + // Everything needed to rebuild this connection later. `local` is the + // client key the remote signer authorised — not the user's identity key, + // which never leaves the signer. + session: local ? { local: hex.encode(local), bp: signer.bp } : null, signEvent: (e) => signer.signEvent(e), encryptSelf: (txt) => signer.nip44Encrypt(pubkey, txt), decryptSelf: (ct) => signer.nip44Decrypt(pubkey, ct), @@ -138,7 +163,7 @@ export function nostrConnect({ relays = ['wss://relay.coinos.io', 'wss://nos.lol const ready = (async () => { const signer = await BunkerSigner.fromURI(local, uri, {}, controller.signal); const pubkey = await signer.getPublicKey(); - return bunkerAdapter(signer, pubkey); + return bunkerAdapter(signer, pubkey, local); })(); ready.finally(() => clearTimeout(timer)).catch(() => {}); return { uri, ready, cancel: (reason) => controller.abort(reason || new Error('cancelled')) }; diff --git a/tools/identity-test.js b/tools/identity-test.js new file mode 100644 index 0000000..179d640 --- /dev/null +++ b/tools/identity-test.js @@ -0,0 +1,89 @@ +// Who the chat speaks as. If you logged in with a nostr account, everything +// this app signs must be signed by THAT account — the alternative is what +// people actually saw: their own avatar in the header, and their messages +// arriving under the wallet key's pubkey, looking like a stranger. +// Run: bun tools/identity-test.js +import { generateSecretKey, getPublicKey } from 'nostr-tools/pure'; +import { messagesFeature } from '../src/features/messages.js'; + +let fails = 0; +const check = (name, ok, detail = '') => { + console.log(` ${ok ? '✓' : '✗'} ${name}${detail ? ' — ' + String(detail).slice(0, 120) : ''}`); + if (!ok) fails++; +}; + +globalThis.localStorage = { + _d: {}, getItem(k) { return this._d[k] ?? null; }, setItem(k, v) { this._d[k] = String(v); }, + removeItem(k) { delete this._d[k]; }, key(i) { return Object.keys(this._d)[i] ?? null; }, + get length() { return Object.keys(this._d).length; }, +}; +globalThis.fetch = async () => { throw new Error('offline'); }; + +const walletSk = generateSecretKey(); +const walletPk = getPublicKey(walletSk); +const loginSk = generateSecretKey(); +const loginPk = getPublicKey(loginSk); + +// Build the feature with a given login situation and see which key it would +// sign a profile with — publishProfile is the shortest path through identity(). +function build({ login, resume }) { + const store = {}; + const signed = []; + const wallet = { + mnemonic: 'x '.repeat(11) + 'y', utxos: [], txs: [], + nostr: { sk: walletSk, pk: walletPk, ck: new Uint8Array(32) }, + loadFeatureState: (n, fb) => JSON.parse(store[n] || 'null') || fb, + saveFeatureState: (n, s) => { store[n] = JSON.stringify(s); }, + _cacheKey: () => 'identity-test', saveCache: () => {}, + registerCacheExtension: () => {}, registerLoadHook: () => {}, + }; + const feature = messagesFeature({ + h: (tag, attrs, ...kids) => ({ tag, attrs, kids }), + ui: {}, render: () => {}, wallet, toast: () => {}, brandHeader: () => null, + hook: (name) => { + if (name === 'nostrLoginIdentity') return login; + if (name === 'nostrLoginResume') return resume; + return null; + }, + }); + return { feature, signed }; +} + +console.log('[logged in with nostr, signer live]'); +{ + const signer = { pubkey: loginPk, signEvent: async (e) => ({ ...e, pubkey: loginPk, id: 'x', sig: 'y' }) }; + const { feature } = build({ login: { pubkey: loginPk, signer }, resume: null }); + let signedBy = null; + try { await feature.publishProfile({ name: 'me' }); } catch (e) { signedBy = e.message; } + // it fails at the relay (offline), but only AFTER choosing an identity — + // what matters is that it never refused for want of one + check('does not refuse for want of an identity', !/signer isn't connected/i.test(signedBy || ''), signedBy || 'reached the relay'); +} + +console.log('\n[logged in with nostr, signer lost to a reload]'); +{ + const { feature } = build({ login: { pubkey: loginPk, signer: null }, resume: null }); + let err = null; + try { await feature.publishProfile({ name: 'me' }); } catch (e) { err = e.message; } + check('refuses rather than signing as someone else', /signer isn't connected/i.test(err || ''), err || 'no error!'); +} + +console.log('\n[logged in with nostr, signer resumes]'); +{ + const signer = { pubkey: loginPk, signEvent: async (e) => ({ ...e, pubkey: loginPk, id: 'x', sig: 'y' }) }; + const { feature } = build({ login: { pubkey: loginPk, signer: null }, resume: Promise.resolve(signer) }); + let err = null; + try { await feature.publishProfile({ name: 'me' }); } catch (e) { err = e.message; } + check('a resumed signer is accepted', !/signer isn't connected/i.test(err || ''), err || 'reached the relay'); +} + +console.log('\n[no nostr login at all]'); +{ + const { feature } = build({ login: null, resume: null }); + let err = null; + try { await feature.publishProfile({ name: 'me' }); } catch (e) { err = e.message; } + check('the wallet key still speaks for a plain seed wallet', !/signer isn't connected/i.test(err || ''), err || 'reached the relay'); +} + +console.log(fails ? `\n${fails} failing` : '\nall passing'); +process.exit(fails ? 1 : 0); -- cgit v1.2.3