From 8c844d76db3f5cdf6c2edc804660a9d596308997 Mon Sep 17 00:00:00 2001 From: nrobi144 Date: Mon, 6 Jul 2026 16:18:11 +0300 Subject: [PATCH] fix(desktop): use strict kind:10050 for tier-1 AUTH classification MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit DesktopAuthCoordinator.selfApprovedRelaysFor was calling the lenient User.dmInboxRelays() helper, whose NIP-65-read fallback silently expanded the tier-1 auto-allow set to include every relay in the user's read markers. That defeated the tier-2 prompt for any AUTH- required relay the user happened to have in NIP-65 — such as wss://pyramid.fiatjaf.com, which never surfaced a banner during manual testing because the coordinator was auto-signing it as tier-1. Switch to dmInboxRelaysStrict() (added in the earlier pre-send alignment fix) so tier-1 is truly kind:10050 only. The KDoc already promised strictness ("write/read relays are NOT included") — this just makes the code match. Surfaced during manual T3 testing 2026-07-06 with an account whose NIP-65 outbox included pyramid.fiatjaf.com. --- .../amethyst/desktop/auth/DesktopAuthCoordinator.kt | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/desktopApp/src/jvmMain/kotlin/com/vitorpamplona/amethyst/desktop/auth/DesktopAuthCoordinator.kt b/desktopApp/src/jvmMain/kotlin/com/vitorpamplona/amethyst/desktop/auth/DesktopAuthCoordinator.kt index 3bf9ee8d7c..0f6de969a9 100644 --- a/desktopApp/src/jvmMain/kotlin/com/vitorpamplona/amethyst/desktop/auth/DesktopAuthCoordinator.kt +++ b/desktopApp/src/jvmMain/kotlin/com/vitorpamplona/amethyst/desktop/auth/DesktopAuthCoordinator.kt @@ -145,12 +145,18 @@ class DesktopAuthCoordinator( } private fun selfApprovedRelaysFor(pubKeyHex: String): Set { - // Tier-1 = the user's own NIP-17 DM-inbox (kind:10050). Conservative + // Tier-1 = the user's own NIP-17 DM-inbox (kind:10050). Strict // by design — write/read relays (NIP-65 kind:10002) are NOT included, // because the user may have read-only relays they don't intend to // identify themselves to via AUTH. + // + // MUST use dmInboxRelaysStrict (kind:10050 only) rather than the + // lenient dmInboxRelays helper, which falls back to NIP-65 read + // relays and would silently expand tier-1 to include every relay + // in the user's outbox. That defeats the tier-2 prompt for any + // relay in the user's normal read set. val user = localCache.getOrCreateUser(pubKeyHex) - return user.dmInboxRelays()?.toSet() ?: emptySet() + return user.dmInboxRelaysStrict()?.toSet() ?: emptySet() } private suspend fun signWithPolicy(