From 67732d1fc1175f94124213eea84a0ee9fdcc6805 Mon Sep 17 00:00:00 2001 From: "William K. Santiago" Date: Sat, 22 Aug 2026 13:48:25 -0400 Subject: [PATCH] Route background NIP-55 pubkey verification through shared checkPubkey helper --- .../privkey/keep/nip55/Nip55ContentProvider.kt | 18 +++++------------- 1 file changed, 5 insertions(+), 13 deletions(-) diff --git a/app/src/main/kotlin/io/privkey/keep/nip55/Nip55ContentProvider.kt b/app/src/main/kotlin/io/privkey/keep/nip55/Nip55ContentProvider.kt index 8be875fc..c630da7f 100644 --- a/app/src/main/kotlin/io/privkey/keep/nip55/Nip55ContentProvider.kt +++ b/app/src/main/kotlin/io/privkey/keep/nip55/Nip55ContentProvider.kt @@ -417,19 +417,11 @@ class Nip55ContentProvider : ContentProvider() { return runCatching { h.handleRequest(request, callerPackage) } .mapCatching { response -> - if (requestType == Nip55RequestType.GET_PUBLIC_KEY) { - if (response.result.isEmpty()) { - throw IllegalStateException("Handler returned empty pubkey") - } - val groupPubkey = app.getStorage()?.getShareMetadata()?.groupPubkey - if (groupPubkey == null || groupPubkey.isEmpty()) { - throw IllegalStateException("Stored pubkey unavailable for verification") - } - val storedPubkey = groupPubkey.joinToString("") { "%02x".format(it.toInt() and 0xFF) } - if (!MessageDigest.isEqual(response.result.toByteArray(Charsets.UTF_8), storedPubkey.toByteArray(Charsets.UTF_8))) { - if (BuildConfig.DEBUG) Log.e(TAG, "Pubkey verification failed: mismatch detected") - throw IllegalStateException("Pubkey verification failed") - } + // Same self-verification as the foreground path: compare the handler's + // returned pubkey against the independently-read stored group pubkey + // (keystore share metadata) through the single shared checkPubkey helper. + checkPubkey(requestType, response.result, app.getStorage()?.getShareMetadata()?.groupPubkey)?.let { + throw IllegalStateException("Pubkey verification failed") } runCatching { runWithTimeout { store.logOperation(callerPackage, requestType, eventKind, "allow", wasAutomatic = true) }