fix: inner event signature verification (fixes #64)

[1amKhush]

Description

This PR implements cryptographic signature verification for decrypted inner events to prevent identity forgery attacks, addressing issue #64.

The Problem

Previously, after decrypting a gift-wrapped event, the inner payload was parsed and its pubkey was trusted implicitly without verifying the attached cryptographic signature (sig). This meant a malicious actor could wrap a forged payload and claim the identity of an authorized/whitelisted server or client, bypassing access controls.

The Solution

• Integrated verifyEvent from nostr-tools/pure into handleEncryptedEvent (Server) and processIncomingEvent (Client).
• The transport layer now cryptographically validates the inner event immediately after decryption.
• If the inner event's signature is invalid or forged, the event is immediately rejected and logged.
• Updated the deduplication test suite (nostr-server-transport.dedup-response.test.ts and nostr-transport-deduplication.test.ts) to generate cryptographically valid inner events using finalizeEvent and real keypairs, replacing the hardcoded '0'.repeat(128) signatures that were correctly failing the new strict verification logic.
• Added explicit unit tests (nostr-server-transport.inner-event-verification.test.ts) to ensure forged signatures are rejected and valid ones are properly authorized.

Testing

• All 194 tests across 22 test files pass.
• Added specific coverage for signature rejection logic.

[ContextVM-org]

Great! please add a patch changeset and we can mege this

[Copilot]

Pull request overview

Implements cryptographic signature verification (verifyEvent) for decrypted inner Nostr events on both server and client transports to prevent forged inner payloads from spoofing trusted identities (fixes #64).

Changes:

• Added verifyEvent checks for decrypted inner events in NostrServerTransport and NostrClientTransport.
• Updated deduplication-related tests to generate properly signed inner events using finalizeEvent + real keypairs.
• Added a new unit test file covering acceptance/rejection behavior for inner-event verification, plus a changeset entry.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/transport/nostr-server-transport.ts	Verifies decrypted inner event signatures before dedupe/authorization.
src/transport/nostr-client-transport.ts	Verifies decrypted inner event signatures before processing responses/notifications.
src/transport/nostr-transport-deduplication.test.ts	Uses finalizeEvent-signed inner events so verification passes in dedupe tests.
src/transport/nostr-server-transport.dedup-response.test.ts	Updates deterministic decrypt stubs to return valid signed inner events.
src/transport/nostr-server-transport.inner-event-verification.test.ts	Adds explicit tests for rejecting forged inner events and accepting valid ones.
.changeset/very-very-secure-inner-events.md	Adds release note for the fix (needs alignment with actual PR contents).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.