thePR0M3TH3ANandClaude Opus 4.8 3adf1be77d fix(nip46): enforce the access-control validator on remote-signer login ...

connectRemoteSigner and useStoredRemoteSigner accepted but never used the
`validator` the auth provider passes (accessControl.canAccess) -- so NIP-46
logins bypassed the block/allow gate that nsec/NIP-07 logins enforce. (The
validation lived only on the unused Nip46Connector.)

Both paths now run the validator against the remote signer's resolved user
pubkey BEFORE activating the signer (via _enforceRemoteSignerValidator): the
validator throws on a blocked/non-permitted pubkey, or returning false rejects
with code remote-signer-access-denied. A stored session rejected by the
validator is forgotten so a blocked pubkey can't keep retrying.

Residual (noted in TODO): the silent startup auto-restore
(scheduleStoredRemoteSignerRestore) still reconnects without a validator.

Test: tests/nostr/nip46-prepare-handshake.test.mjs (validator throws / false /
true / absent). Full suite green.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

2026-06-17 06:44:47 -04:00

..

TODO_2025-02-18.md

feat(test-audit): Add daily test integrity and coverage audit workflow

2026-02-18 20:17:01 +00:00

TODO_2026-02-17_perf-agent.md

perf: bound relay concurrency in channel video fetching

2026-02-17 10:41:55 +00:00

TODO_2026-02-17.md

perf: bound DM subsystem network concurrency

2026-02-17 07:41:46 +00:00

TODO_2026-02-18_15-05-00.md

[security] replace innerHTML usages in js/ui/components/DeleteModal.js

2026-02-18 16:23:29 +00:00

TODO_2026-02-18_17-00-00.md

feat(agents): Execute nip-research-agent (NIP-65 compliance)

2026-02-18 17:07:47 +00:00

TODO_2026-02-18_19-45-00.md

docs(agents): sync scheduler rosters with prompt directory

2026-02-18 21:00:30 +00:00

TODO_2026-02-19_00-47-43.md

chore: execute daily test-audit-agent

2026-02-23 20:14:04 +00:00

TODO_2026-02-19_18-55-56.md

chore(docs): content audit 2026-02-19

2026-02-19 19:02:02 +00:00

TODO_2026-02-19_19-58-00.md

[decompose] extract BlockList and EditProfile from ProfileModalController

2026-02-19 20:10:37 +00:00

TODO_2026-02-19_content-audit-agent.md

docs(audit): content-audit-agent run 2026-02-19

2026-02-19 21:56:20 +00:00

TODO_2026-02-20_14-39-21_deps-security-agent.md

chore(deps): deps-security-agent run & bump stylelint to 16.26.1

2026-02-20 14:44:08 +00:00

TODO_2026-02-20_innerhtml.md

[security] replace innerHTML usages in js/ui/components/ShareNostrModal.js — convert to safe DOM APIs

2026-02-20 20:07:34 +00:00

TODO_2026-02-21_23-39-00_nip-research-agent.md

chore: daily nip-research-agent run

2026-02-21 23:46:06 +00:00

TODO_2026-02-21_audit-agent.md

chore(daily): execute audit-agent task 2026-02-21

2026-02-21 17:58:09 +00:00

TODO_2026-02-21_nip-research-agent.md

daily: nip-research-agent NIP-42 update

2026-02-21 20:46:44 +00:00

TODO_2026-02-22_nip-research-agent.md

chore(agent): execute nip-research-agent 2026-02-22

2026-02-22 00:55:12 +00:00

TODO_2026-02-23_15-01-13.md

docs(agents): sync scheduler rosters — 2026-02-23

2026-02-23 15:05:58 +00:00

TODO_2026-02-23_19-56-08_test-audit.md

chore: execute daily test-audit-agent

2026-02-23 20:14:04 +00:00

TODO_2026-02-23_23-34-46.md

docs(agents): scheduler-update-agent sync (no changes)

2026-02-23 23:37:36 +00:00

TODO_2026-02-23_test-audit.md

agents: run daily test-audit-agent (2026-02-23)

2026-02-23 17:11:14 +00:00

TODO_2026-02-23.md

docs(agents): sync scheduler rosters with prompt directory

2026-02-23 00:55:43 +00:00

TODO_2026-02-25_17-01-30.md

audit-agent: Daily audit run

2026-02-25 17:07:41 +00:00

TODO_2026-06-16_r2-followups.md

fix(nip46): enforce the access-control validator on remote-signer login

2026-06-17 06:44:47 -04:00