Ensure nostr session actor matches login pubkey

js/app.js

@@ -3499,6 +3499,13 @@ class Application {
       return false;
     }
 
+    const sessionActorPubkey = this.normalizeHexPubkey(
+      nostrClient?.sessionActor?.pubkey,
+    );
+    if (sessionActorPubkey && sessionActorPubkey !== normalizedPubkey) {
+      return false;
+    }
+
     return true;
   }
 

tests/app/is-user-logged-in.test.mjs

@@ -89,3 +89,22 @@ test("isUserLoggedIn guards against mismatched nostrClient state", () => {
     nostrClient.sessionActor = previousSessionActor;
   }
 });
+
+test("isUserLoggedIn rejects mismatched session actor pubkeys", () => {
+  const previousPubkey = nostrClient.pubkey;
+  const previousSessionActor = nostrClient.sessionActor;
+
+  try {
+    const pubkey = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+    nostrClient.pubkey = pubkey;
+    nostrClient.sessionActor = {
+      pubkey: "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+    };
+
+    const app = createTestApp(pubkey);
+    assert.equal(app.isUserLoggedIn(), false);
+  } finally {
+    nostrClient.pubkey = previousPubkey;
+    nostrClient.sessionActor = previousSessionActor;
+  }
+});