Extension and sigit can have different "logged in" users #290

New Issue

enes · 2024-12-27T10:39:20Z

enes commented

2024-12-27 10:39:20 +00:00

An error occurred after signing a sigit which caused toast JSON parse error on the first signer.

Steps to reproduce:

Sign in with extension
Change extension options - change the user
Sigit still shows old user - proceed with sigit creation
Notice that signing was successful

issue is visible and errors pop up if the creator is also a first signer, if creator is second signer this goes unnoticed

Sigit is in now un unexpected state and will break on arrival after trying to process event with JSON signature parse error

TODO:
Replicate the broken state - different user

Detect if the sigit and extension users differ and manually log out (or log in correctly?)
- only way to detect a difference between logged in user and the one in the extension is by signing an event, result of the signing includes the author's pubkey which is from the extension, and comparing that with the auth will result in the desired comparison
- Disallow publish if users sigit and extension user mismatch
Check processingEvent - what happens if we error out during createSignature parse step

- An error occurred after signing a sigit which caused toast JSON parse error on the first signer. Steps to reproduce: 1. Sign in with extension 2. Change extension options - change the user 3. Sigit still shows old user - proceed with sigit creation 4. Notice that signing was successful - issue is visible and errors pop up if the creator is also a first signer, if creator is second signer this goes unnoticed 5. Sigit is in now un unexpected state and will break on arrival after trying to process event with JSON signature parse error TODO: Replicate the broken state - different user - [x] Detect if the sigit and extension users differ and manually log out (or log in correctly?) - only way to detect a difference between logged in user and the one in the extension is by signing an event, result of the signing includes the author's pubkey which is from the extension, and comparing that with the auth will result in the desired comparison - [x] Disallow publish if users sigit and extension user mismatch - [x] Check processingEvent - what happens if we error out during createSignature parse step

enes added the

Kind/Bug

label 2024-12-27 10:39:20 +00:00

enes self-assigned this 2024-12-27 10:39:20 +00:00

enes added this to the MVP project 2024-12-27 10:39:20 +00:00

enes referenced this issue

2024-12-27 12:20:14 +00:00

Failed to publish notifications after signing the doc #292

enes added a new dependency 2024-12-27 12:21:07 +00:00

#292 Failed to publish notifications after signing the doc

b closed this issue

2025-01-02 09:47:04 +00:00