mirror of
https://relay.ngit.dev/npub15qydau2hjma6ngxkl2cyar74wzyjshvl65za5k5rl69264ar2exs5cyejr/ngit-grasp.git
synced 2026-10-06 07:28:23 +00:00
DanConwayDev
3dd5d7c7c3
A kind-5 deletion that arrives before its target laid down an author-agnostic tombstone: is_event_deleted matched any kind-5 carrying the e-tag id, and is_coordinate_deleted matched any kind-5 carrying the a-tag coordinate, regardless of who signed the deletion. This let any pubkey pre-emptively censor another's events by racing a kind-5 ahead of the target (out-of-order delete). Bind both checks to the rightful author: - is_event_deleted now takes the candidate event's author and only honours a kind-5 signed by that same pubkey; - is_coordinate_deleted requires the kind-5 author to match the pubkey embedded in the coordinate (<kind>:<pubkey>:<d>). Add integration test out_of_order_deletion_by_other_pubkey_not_actioned and unit tests covering both the e-tag and a-tag cross-author cases.