The user's block/mute list (NIP-51) was not being checked when
processing direct messages, allowing blocked users' messages to appear
in conversations, trigger notifications, and increment unseen counts.
This adds block filtering at four layers:
- nostrService.applyDirectMessage: drops incoming DMs from blocked users
before they enter the in-memory message cache
- nostrService.persistDirectMessageRecord: prevents blocked DM senders
from being persisted to IndexedDB or triggering notifications
- profileModalController.buildDmConversationData: filters blocked users
from the conversation list UI (catches pre-block persisted messages)
- applicationBootstrap: excludes blocked-user conversations from the
unread DM badge count
The block checker is injected via setDmBlockChecker() to keep
nostrService decoupled from userBlocks, wired up in app.js init().
https://claude.ai/code/session_01EAVLtAM14GN99Eik8otLg2
- Throttle the "Privacy warning: direct messages are using your default relays..." message so it only appears once per session/identity change.
- Rename "DM Relay Hints" to "NIP-17 Relay List" in the DM Settings modal to match the warning message and reduce user confusion.
- Add regression test for the warning throttling logic.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Created `DMSettingsModalController` to manage the new settings modal UI.
- Added `components/dm-settings-modal.html` with sections for Privacy and DM Relay Hints.
- Updated `AppShell.js` to delegate the settings action to `onOpenSettings` callback, bypassing the legacy popover.
- Updated `ProfileModalController.js` to wire up the new modal controller, handling state persistence for relays and privacy settings.
- This improves the UX for managing NIP-17 DM relay hints and privacy options.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Remove separate relay health panel from profile modal.
- Merge health indicators (latency, errors) directly into the relay list items.
- Consolidate refresh logic to update both list configuration and health status.
- Move telemetry toggle to the bottom of the relay section.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Updates `js/userBlocks.js` to treat Kind 10000 (standard Mute List) as the primary write target.
- Public mutes are stored in `p` tags, and private blocks are stored in encrypted content within the same event.
- Legacy `d=user-blocks` lists are still read for backward compatibility (preferring the newest event), but no longer written.
- Updates `js/nostrEventSchemas.js` to mark `USER_BLOCK_LIST` as legacy and standardise `MUTE_LIST`.
- Updates UI controllers (`MoreMenuController`, `ProfileModalController`) to use "Mute/Block List" terminology and delegate all mute/block actions to `userBlocks`.
- Updates `ModerationService` to delegate viewer mute operations to `userBlocks` and disable direct Kind 10000 publishing to prevent overwrites.
- Documentation updated in `docs/nostr-event-schemas.md`.
- Fixes regressions in `more-menu-controller.test.mjs`, `moderation-service.test.mjs`, `trusted-mute-lists.test.mjs`, and `user-blocks.test.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
Moves `handleAddProfile` logic from the main application class into `ProfileModalController` to improve separation of concerns as per `AGENTS.md`.
- Extracts `handleAddProfile` to `js/ui/profileModalController.js`.
- Updates `ProfileModalController` to handle add account flow internally.
- Removes legacy callback wiring from `js/app.js` and `js/ui/applicationBootstrap.js`.
- Adds unit tests for the extracted logic in `tests/ui/profileModalController-addProfile.test.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Added `onMessage` callback to `NostrClient.listDirectMessages` to stream decrypted messages.
- Updated `NostrService.loadDirectMessages` to use the callback and trigger `applyDirectMessage` incrementally.
- Updated `ProfileModalController` to allow rendering updates during the initial load if the reason is `load-incremental`.
- Verified changes with existing tests and code review.
Co-authored-by: PR0M3TH3AN <[email protected]>
The profile modal was slow to open (~100ms+ delay) when a user has many trusted contacts, blocked users, or moderation reports, because `refreshModerationSettingsUi` and `populateBlockedList` were called synchronously before making the modal visible.
This change refactors `ProfileModalController.show()` to:
1. Render the header synchronously (fast).
2. Call `open()` immediately to make the modal visible.
3. Defer expensive data population (`refreshModerationSettingsUi`, `populateBlockedList`, `refreshWalletPaneState`) to the next animation frame using `requestAnimationFrame`.
This significantly improves the perceived responsiveness of the profile button.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Add helper text to the S3 storage configuration form to guide users on Endpoint URL format.
- Add 'Force Path Style' checkbox to S3 storage configuration to support MinIO and other S3-compatible providers that require it.
- Update `ProfileModalController` to toggle visibility of these new fields based on the selected provider.
- Update `ProfileModalController` to save and load the `forcePathStyle` setting.
- Update `tests/ui/storageService.test.mjs` to verify persistence of `forcePathStyle`.
Updates the privacy warning notifications in `ProfileModalController` to auto-dismiss after 5 seconds. This resolves an issue where warnings about direct message relays and NIP-17 delivery would persist indefinitely, requiring manual dismissal or page reload.
The fix applies `{ autoHideMs: 5000 }` to `this.showStatus` calls for:
- "Privacy warning: direct messages are using your default relays because no NIP-17 relay list is available."
- "Privacy warning: this recipient has not shared NIP-17 relays, so we'll use your default relays."
- "Privacy warning: this message used default relays because no NIP-17 relay list was found."
- Renamed "Public URL / Prefix" to "Public Access URL" in Profile Modal to differentiate from S3 API Endpoint.
- Added helper text clarifying that Account ID is used for connection and Public URL is for CDN.
- Implemented validation in `ProfileModalController` to detect and warn if an S3/R2 API endpoint is entered into the Public URL field.
- Added blocking validation on save to prevent misconfiguration.
- Verified changes with unit tests and Playwright frontend verification.
When saving an R2 storage connection, the "Prefix" input (which holds the Public Bucket URL) was not being mapped to `meta.baseDomain` or `meta.publicBaseUrl`. This caused `R2Service.ensureBucketConfigForNpub` to throw "Public Bucket URL is missing" during upload preparation, as it relies on these properties.
This commit updates `ProfileModalController.handleSaveStorage` to correctly assign the prefix value to `baseDomain` and `publicBaseUrl` for the `cloudflare_r2` provider, aligning it with the behavior for generic S3 providers and resolving the upload error.
This change ensures that cloud storage credentials are not leaked between Nostr profiles when switching accounts in the UI.
Changes:
- Imported `storageService` in `js/app.js` to enable the `bitvid:auth-changed` event listener to correctly lock the previous profile's storage session.
- Updated `ProfileModalController.populateStoragePane` to explicitly clear the storage form before loading new data.
- Enhanced `ProfileModalController.handleClearStorage` to fully reset the form state, including the provider selection and visibility toggles.
Verified with a reproduction script (`reproduce_storage_isolation.mjs`) that `StorageService` correctly isolates data by pubkey at the backend level. The UI fixes address the frontend persistence issue.
Prevents storage unlock failures and security risks when switching profiles by verifying that the active signer's public key matches the target profile. This ensures users are prompted to switch accounts in their NIP-07 extension if a mismatch occurs.
Fixes an issue where switching profiles caused the storage tab to break due to using the wrong decryption key.
Import `PROVIDERS` from `../services/storageService.js` in `js/ui/profileModalController.js`.
This fixes a `ReferenceError` when testing or saving generic S3 storage configurations.
The error was caused by using `PROVIDERS.GENERIC` without importing the constant.
- Added a forced refresh button to the conversation list in the DM tab (via `onRefreshConversations` in `ProfileModalController`).
- Updated the DM settings gear icon to use `icon-button accent-action-button` classes, matching the `VideoCard` style.
- Ensured the `dm-app-shell` container has a transparent background when rendered inside the profile modal to prevent visual clashes with the modal backdrop.
- Add a refresh button to `ConversationList` header.
- Make DM sidebar background transparent.
- Update DM settings gear icon to match `VideoCard` style.
- Wire up refresh action in `ProfileModalController` to force-fetch messages.
- Update AppShell.js to split view into Conversations and Message History.
- Rename sidebar title to "Conversations".
- Update MessageThread.js to pass avatar URLs to bubbles.
- Update MessageBubble.js to render avatars and use flex layout for alignment.
- Update CSS to style message rows, avatars, and bubbles.
- Ensure peak animations match hashtag strip timing (600ms/800ms).
- Redesigned watch history cards to use a list view layout (flex-row) for better space utilization on both desktop and mobile.
- Updated `buildHistoryCard` in `js/historyView.js` to support a `variant` prop ('compact' or 'modal') for context-specific sizing.
- Updated `js/ui/profileModalController.js` to pass `variant: "modal"` to the watch history renderer.
- Fixed a bug where the "Watched [time] ago" timestamp was unavailable because `normalizeHistoryItems` failed to check `pointer.watchedAt`.
- Verified changes with a reproduction script for the timestamp bug and existing unit tests for the controller.
Removed the "Republish now" button from the watch history tab in the profile modal (profile-modal.html) and its configuration reference in the controller (profileModalController.js). This button was deemed unnecessary for the watch history functionality within the modal. Verified by unit tests and manual inspection.
- Implement mobile view state management (`list` vs `thread`) in `ProfileModalController`.
- Update `AppShell` to apply `data-dm-view` attribute for CSS toggling.
- Update `MessageThread` to render a "Back" button on mobile.
- Add CSS rules to hide/show sidebar and thread panels based on mobile view state.
- Ensure desktop layout remains split-pane.
- Added a new mobile-specific "Logout" button to the profile navigation list, visible only on screens smaller than `lg`.
- Hid the existing footer logout button on mobile screens.
- Updated `ProfileModalController` to bind the logout logic to the new mobile button.
- Applied `data-variant="critical"` and spacing to the new button to match styling requirements.
Adds `modal-open` class to `body` and `documentElement` when the profile modal opens, and removes it when it closes. This activates the existing CSS rule that hides the sidebar and lowers its z-index, resolving the issue where the sidebar appeared on top of the modal on desktop.
