From 7a11473d0d29cee48d4cd36d5b0e9cceb0632e5d Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Tue, 30 Jun 2026 21:54:43 -0400
Subject: [PATCH] =?UTF-8?q?[docs]=20#42=20signer=20audit=20complete=20?=
 =?UTF-8?q?=E2=80=94=20active-signer=20path=20clean=20(adminListStore=20wa?=
 =?UTF-8?q?s=20the=20only=20bug)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Swept every .signEvent(/window.nostr/ensureExtensionPermissions caller. No window.nostr
is used to sign or encrypt anywhere; all publishing uses the active signer, and every
extension-permission gate is guarded on signer type/capability so nsec + NIP-46 pass
through. Recorded the findings + one dead-code note (auth/signingAdapter.js
createNip07SigningAdapter is unused by app code).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 todo/TODO_2026-06-20_pre-launch.md | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/todo/TODO_2026-06-20_pre-launch.md b/todo/TODO_2026-06-20_pre-launch.md
index 51fc43c9..b5dbeda7 100644
--- a/todo/TODO_2026-06-20_pre-launch.md
+++ b/todo/TODO_2026-06-20_pre-launch.md
@@ -534,12 +534,25 @@ toward freshness and looked identical. Gave each a structural identity:
       extension (`type === "extension"/"nip07"`). Regression test added to
       `tests/admin-list-store.test.mjs` (nsec signer used while `window.nostr.signEvent`
       throws). Build + lint clean.
-- [ ] **AUDIT (follow-up):** sweep EVERY place that signs an event and confirm it uses the
-      active-signer path (`getActiveSigner().signEvent` / the client's sign helper), NOT
-      `window.nostr` directly. `window.nostr`-only signing breaks nsec + NIP-46. Grep for
-      `window.nostr`, `extension.signEvent`, and direct `signEvent` calls across publish
-      paths (lists, reactions, reposts, comments, profile metadata, NWC, watch history,
-      deletes, NIP-71 mirror, view events) and fix any that bypass the active signer.
+- [x] **AUDIT DONE 2026-06-30 — clean (adminListStore was the only bug).** Swept every
+      `.signEvent(`, `window.nostr`, and `ensureExtensionPermissions`/
+      `requestDefaultExtensionPermissions` caller:
+      - **Signing:** NO `window.nostr` is used to sign/encrypt anywhere. Every publish
+        path signs with the active signer (`signer.signEvent`): subscriptions, userBlocks,
+        hashtag prefs, relay prefs, moderationService reports, nip71MirrorService,
+        encryptedSyncFacade, DM seal + legacy DM (`nostr/client` signingAdapter defaults
+        to the active signer), DM relay list, admin lists.
+      - **Extension-permission gates:** every caller (reactions, comments, subscriptions,
+        userBlocks, watchHistory, relayManager, DM relays) guards the request behind a
+        signer-type (`extension`/`nip07`) or capability check, so nsec/NIP-46 skip it and
+        go straight to active-signer signing — they never hit the `extension-missing`
+        failure that broke admin lists.
+      - **Decrypt:** gates on the active signer's nip04/nip44 capability with `window.nostr`
+        only as a fallback; nsec (closures) + NIP-46 (remote) both decrypt fine.
+      - **Cleanup note (low priority):** `js/auth/signingAdapter.js`
+        (`createNip07SigningAdapter`, defaults to `window.nostr`) is dead production code —
+        referenced only by its own test, no app callers. Harmless; remove or repoint at
+        the active signer if ever reused.
 
 ### 43. Logged-in profile card at the top of the profile modal (UX)
 - [ ] Show the **logged-in user's profile photo + name** at the **top-center** of the