Admin list edits worked with a NIP-07 extension but silently failed with nsec and
NIP-46 (Amber). persistNostrState signed with window.nostr.signEvent directly (and
required requestDefaultExtensionPermissions), so non-extension logins threw
"nostr-extension-missing".
Fix: sign with the ACTIVE signer (getActiveSigner() from the registry — extension/nsec/
NIP-46 all expose signEvent), and only run the extension-permission prompt when the
signer is an extension (type extension/nip07). Regression test in
tests/admin-list-store.test.mjs (nsec signer used while window.nostr.signEvent throws).
Also (per maintainer request): raise the file-size lint margins to stop churning on an
arbitrary cap — THRESHOLD 1000→1200 (new files), GROWTH_MARGIN 50→200 (grandfathered).
TODOs added: #42 follow-up audit of every signing path (must use the active signer, not
window.nostr); #43 logged-in profile card at the top of the profile modal (half-on/half-
off); #44 in-modal storage selector + unlock for the upload modal.
Build + lint clean; admin-list suite green.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Triaged two more silently-excluded test files back into CI.
- nostr-boost-actions: STALE SPEC. Test required buildRepostEvent to throw
/missing-event-relay/ with no relay hint, but a relay hint is a NIP-18 SHOULD
(not MUST) — the builder degrades to a two-element `e` tag so a user can always
repost. Replaced with an exact assertion of the valid output (kind 16 + e/p/k).
- admin-list-store: STALE HARNESS (no production change, no assertion weakened).
Community curator lists are fetched via the batched SubscriptionManager
(cold-start relay-storm fix) the harness never mocked; the mock "hex" curator
values started with "npub" so parseCommunityBlacklistReferences decoded them
twice; and createListEvent omitted the `d` tag selectNewestEventsForReferences
matches on. Fixed all three to be faithful to production.
Removed both from the QUARANTINE map; TEST_INTEGRITY.md + TODO updated.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
- Add `firefox` to `npx playwright install` in CI workflow to fix headless execution failures.
- Implement 15s safeguard timeout in `js/app.js` for `_initAccessControl` to prevent app hang during startup.
- Add `SHORT_TIMEOUT_MS` (5s) to `fetchLatestListEvent` in `js/adminListStore.js` to prevent indefinite hanging on relay queries.
- Update `tests/admin-list-store.test.mjs` to force dev mode for warning assertions.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Modified `sanitizeAdminState` in `js/adminListStore.js` to ensure whitelisted users are automatically excluded from the blacklist.
- Updated `tests/admin-list-store.test.mjs` to use `throw-community` failure mode in the mock pool, fixing a flaky test case that incorrectly assumed base lists would load when `throw-authors` was active.
- Updated `tests/ui/tag-pill-list.test.mjs` to expect `#` prefixed tags, aligning with recent UI changes.
Co-authored-by: PR0M3TH3AN <[email protected]>
