reya/coop
1
0
Fork 1
Code Issues Pull Requests 1 Releases 3 Activity

fix NIP-4e sync findings and clean up consumed events

Browse Source
This commit is contained in:
reya
2026-10-04 13:02:24 +07:00
parent c15bd3a82d
commit bdf9249eab
2 changed files with 171 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/nip4e-audit.md
+13 -2
View File
@@ -1,9 +1,20 @@
# NIP-4e Audit Report
> **Update**: The P0 findings (C1, C2, C3) are now fixed — seals are always signed by the
> **Update**: The P0 findings (C1, C2, C3) are fixed — seals are always signed by the
> identity key, `extract_rumor` falls back to the device key, the `DEVICE_GIFTWRAP`
> subscription is created, and trashed wraps are retried on `DeviceEvent::Set`.
> The remaining findings (F1–F8, P2 items, UX bugs) are still open.
>
> **Update 2**: The P1 sync findings are fixed — F1 (4455 approvals now filtered by
> the requester's `p` tag so the approver no longer processes its own response), F2
> (decrypted keys are validated against the current 10044 announcement via
> `decrypt_approval`), F3 (`since(now)` removed so offline requests/approvals
> backfill), F4 (`pending_request` resets after an approval completes), F5 (a NIP-09
> deletion now removes the 4454 requests and the consumed 4455 after a successful
> sync), F6 (stale stored 4455s no longer short-circuit `request()` — they are
> validated first and a fresh request is published when invalid), F8 (device keys
> are saved locally *before* the 10044 announcement is published, closing the
> echo/self-request race). Still open: the P2 state-hygiene items and the UX bugs
> in section 5.
**Scope**: `crates/nip4e/src/lib.rs` (key announcement/sync), the send path (`crates/chat/src/room.rs`), the receive path (`crates/chat/src/lib.rs`), UI integration (`crates/workspace`), compared against the [NIP-4e draft](https://github.com/nostr-protocol/nips/blob/per-device-keys/4e.md) and [PsstPsst's implementation](https://github.com/CodyTseng/psstpsst) (`docs/protocols/nip4e.md` + `docs/protocols/nip17-extensions.md`, plus rust-nostr's NIP-59 source to verify crypto mechanics).