From f6a3e8b2aeb5bf7fb090524325a82d29122b10bb Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Mon, 27 Oct 2025 15:56:08 -0400
Subject: [PATCH] Ensure nostr session actor matches login pubkey

---
 js/app.js                            |  7 +++++++
 tests/app/is-user-logged-in.test.mjs | 19 +++++++++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/js/app.js b/js/app.js
index a6a5d0f8..322db86a 100644
--- a/js/app.js
+++ b/js/app.js
@@ -3499,6 +3499,13 @@ class Application {
       return false;
     }
 
+    const sessionActorPubkey = this.normalizeHexPubkey(
+      nostrClient?.sessionActor?.pubkey,
+    );
+    if (sessionActorPubkey && sessionActorPubkey !== normalizedPubkey) {
+      return false;
+    }
+
     return true;
   }
 
diff --git a/tests/app/is-user-logged-in.test.mjs b/tests/app/is-user-logged-in.test.mjs
index 2ad3c09b..82ee98f6 100644
--- a/tests/app/is-user-logged-in.test.mjs
+++ b/tests/app/is-user-logged-in.test.mjs
@@ -89,3 +89,22 @@ test("isUserLoggedIn guards against mismatched nostrClient state", () => {
     nostrClient.sessionActor = previousSessionActor;
   }
 });
+
+test("isUserLoggedIn rejects mismatched session actor pubkeys", () => {
+  const previousPubkey = nostrClient.pubkey;
+  const previousSessionActor = nostrClient.sessionActor;
+
+  try {
+    const pubkey = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+    nostrClient.pubkey = pubkey;
+    nostrClient.sessionActor = {
+      pubkey: "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+    };
+
+    const app = createTestApp(pubkey);
+    assert.equal(app.isUserLoggedIn(), false);
+  } finally {
+    nostrClient.pubkey = previousPubkey;
+    nostrClient.sessionActor = previousSessionActor;
+  }
+});