From b1b7a4e7c30b99b4518073e8e370ecd73593f324 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 1 Jul 2026 20:55:03 +0000 Subject: [PATCH] fix(relayauth): exclude event author from NOTIFY_INBOX counterparties A pending non-gift-wrap event's `p` tags are the people it notifies, but some events self-p-tag the author. Drop the author's own key so the auth reason and follow-trust check reflect who is actually being notified, not the sender. (Own-relay over-attribution is already handled upstream by the isInMyRelayList allow.) Adds a regression test. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01EZjmYpgHP4pf79Sav5QT8a --- .../authCommand/model/RelayAuthPurposeDeriver.kt | 4 +++- .../authCommand/model/RelayAuthPurposeDeriverTest.kt | 10 ++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/authCommand/model/RelayAuthPurposeDeriver.kt b/amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/authCommand/model/RelayAuthPurposeDeriver.kt index 979b7d7c1b..6cacc08fd3 100644 --- a/amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/authCommand/model/RelayAuthPurposeDeriver.kt +++ b/amethyst/src/main/java/com/vitorpamplona/amethyst/service/relayClient/authCommand/model/RelayAuthPurposeDeriver.kt @@ -49,7 +49,9 @@ object RelayAuthPurposeDeriver { if (event.kind == GiftWrapEvent.KIND) { dmRecipients.addAll(pTags) } else { - notifyRecipients.addAll(pTags) + // We're notifying the people the event references, not its author — drop the + // author's own key so a self-p-tag doesn't read as "notify yourself". + notifyRecipients.addAll(pTags - event.pubKey) } } diff --git a/amethyst/src/test/java/com/vitorpamplona/amethyst/service/relayClient/authCommand/model/RelayAuthPurposeDeriverTest.kt b/amethyst/src/test/java/com/vitorpamplona/amethyst/service/relayClient/authCommand/model/RelayAuthPurposeDeriverTest.kt index 3aa692ee9e..3186d1d60b 100644 --- a/amethyst/src/test/java/com/vitorpamplona/amethyst/service/relayClient/authCommand/model/RelayAuthPurposeDeriverTest.kt +++ b/amethyst/src/test/java/com/vitorpamplona/amethyst/service/relayClient/authCommand/model/RelayAuthPurposeDeriverTest.kt @@ -63,6 +63,16 @@ class RelayAuthPurposeDeriverTest { assertEquals(setOf(alice, bob), purposes[0].counterparties) } + @Test + fun notifyExcludesTheEventsOwnAuthor() { + val author = "11".repeat(32) // matches event()'s pubKey + val purposes = RelayAuthPurposeDeriver.derive(listOf(event(1, listOf(author, alice))), emptyMap()) + + assertEquals(1, purposes.size) + assertEquals(AuthPurposeKind.NOTIFY_INBOX, purposes[0].kind) + assertEquals(setOf(alice), purposes[0].counterparties) + } + @Test fun subscriptionAuthorsBecomeReadOutbox() { val purposes = RelayAuthPurposeDeriver.derive(emptyList(), mapOf("sub1" to listOf(Filter(authors = listOf(alice, bob)))))