diff --git a/js/app.js b/js/app.js index 82dd525f..ad5ce4fc 100644 --- a/js/app.js +++ b/js/app.js @@ -3351,9 +3351,15 @@ class Application { typeof sessionActor?.source === "string" ? sessionActor.source.trim() : ""; + // The anonymous view-event actor is created with source "session" (see + // SignerManager.ensureSessionActor). It's telemetry, NOT an alternate login + // identity, so it must not disqualify a real login — otherwise watching any + // video flips isUserLoggedIn() to false and breaks zaps/etc. Only a managed + // real source (e.g. "nsec") for a DIFFERENT pubkey disqualifies. + const isManagedSource = Boolean(declaredSource) && declaredSource !== "session"; const isPersisted = sessionActor?.persisted === true; - if (!hasEmbeddedPrivateKey || declaredSource || isPersisted) { + if (!hasEmbeddedPrivateKey || isManagedSource || isPersisted) { return false; } } diff --git a/tests/app/is-user-logged-in.test.mjs b/tests/app/is-user-logged-in.test.mjs index 57779a5f..50c4d703 100644 --- a/tests/app/is-user-logged-in.test.mjs +++ b/tests/app/is-user-logged-in.test.mjs @@ -112,6 +112,31 @@ test("isUserLoggedIn ignores anonymous session actor mismatches", () => { } }); +test("isUserLoggedIn allows the anonymous view-event session actor (source 'session')", () => { + // Regression: watching a video creates an anonymous view-event actor with + // source "session" and a different pubkey. It must NOT log the user out (which + // broke zaps with "Log in and connect a wallet"). + const previousPubkey = nostrClient.pubkey; + const previousSessionActor = nostrClient.sessionActor; + + try { + const pubkey = "1".repeat(64); + nostrClient.pubkey = pubkey; + nostrClient.sessionActor = { + pubkey: "2".repeat(64), + privateKey: "3".repeat(64), + source: "session", + createdAt: Date.now(), + }; + + const app = createTestApp(pubkey); + assert.equal(app.isUserLoggedIn(), true); + } finally { + nostrClient.pubkey = previousPubkey; + nostrClient.sessionActor = previousSessionActor; + } +}); + test("isUserLoggedIn rejects mismatched managed session actors", () => { const previousPubkey = nostrClient.pubkey; const previousSessionActor = nostrClient.sessionActor;