search

fiatjaf / window.nostr.js

drop-in <script> that adds seamless NIP-46 support to apps that rely on window.nostr
https://git.njump.me/wnj
19 stars 1 forks source link

Signup flow is broken because the wrong local keypair is saved to local store #2

Closed nostrband closed 4 months ago

nostrband commented 4 months ago

Right now nostr-tools.nip46.createAccount generates a local keypair and creates a BunkerSigner with it to execute the create_account method. The BunkerSigner object is then returned, which is reused as the signer for the current session.

The first issue is that onauth isn't set or isn't triggered, so no popups are opening while we continue the session. Didn't dig deep enough to figure out what the problem is.

The second issue is that the local keypair generated by createAccount and stored in that BunkerSigner is not retrievable (it's a private field), and it's not saved to local store. And if we reload the page, we get a wrong local keypair from localstore, that isn't authorized to do anything by the nip46 server. That's not known until the app tries to access the signer, then window.nostr.js sends connect and gets auth_url back, and user has to essentially login again (confirm a new connection in the signer). A simple solution seems to be to supply the local keypair to the nostr-tools.nip46.createAccount.

dtonon commented 4 months ago

Fixed with https://github.com/nbd-wtf/nostr-tools/commit/fd945757be02df1b1ac734df2f0baf5fe729c3f5 + a8bdad5d