mirror of
https://github.com/vitorpamplona/amethyst.git
synced 2026-08-10 08:27:04 +00:00
Claude
e8a50bfa11
When composing an anonymous post (tap pfp to go anon on the short-note or comment screens), media uploads still authorized against the Blossom / NIP-96 server with the real account's signer. The server echoes that pubkey back in the returned media URL (e.g. Blossom's `as=<pubkey>`), linking the real identity to the supposedly anonymous post. Thread an optional `forcedSigner` through the upload chain (MultiOrchestrator -> UploadOrchestrator -> NIP-96/Blossom auth). Both ShortNotePostViewModel and CommentPostViewModel now hold a single ephemeral signer per compose session, reused for every photo/voice upload and for the final anonymous broadcast, so the upload auth event and the post share one throwaway key. signAnonymouslyAndBroadcast accepts that signer so the media author matches the post author. Non-anonymous callers are unaffected (forcedSigner defaults to null). The signer is reset in cancel() so each new compose session gets a fresh anonymous identity.