Key the events store by addressable coordinate (kind:pubkey:dtag), not bare d-tag #121

New issue

Closed

opened 2026-06-18 11:20:49 +00:00 by padreug · 0 comments

padreug commented

2026-06-18 11:20:49 +00:00

Owner

From the nostr-patterns review against NDK + welshman.

Problem

src/modules/events/stores/events.ts keys events by event.id = the bare d-tag, and upsertEvent replaces on createdAt >= existing.createdAt ignoring pubkey. NIP-52 calendar events (31922/31923) are addressable (parameterized-replaceable) and their d-tags are author-scoped. So a different author publishing the same d-tag with a newer created_at would overwrite the legit event in the store (cross-author hijack). Both NDK (events/index.ts coordinate()) and welshman (eventsByAddress) key addressable events by kind:pubkey:dtag.

Proposed fix (client-side only — no DB/relay change)

Key the store Map by the full coordinate ${kind}:${pubkey}:${dtag}; replace only within the same coordinate (and newer created_at). Different authors → stored separately, no hijack.
Keep the d-tag as the route identifier: getEventById(dtag) resolves by scanning/secondary-index (unambiguous for our single-publisher calendar events). Add getByCoordinate(coord) for precise lookups.

No demo-DB surgery: the store is rebuilt from the relay each session.

Testing

Unit tests (vitest): same-coordinate-newer-wins, same-coordinate-older-ignored, same-d-tag-different-pubkey → both kept (no overwrite), getEventById resolves by d-tag.

To be done as a PR (gap #1 of the review).

From the nostr-patterns review against NDK + welshman. ## Problem `src/modules/events/stores/events.ts` keys events by `event.id` = the **bare d-tag**, and `upsertEvent` replaces on `createdAt >= existing.createdAt` **ignoring pubkey**. NIP-52 calendar events (31922/31923) are *addressable* (parameterized-replaceable) and their d-tags are **author-scoped**. So a different author publishing the same d-tag with a newer `created_at` would **overwrite** the legit event in the store (cross-author hijack). Both NDK (`events/index.ts coordinate()`) and welshman (`eventsByAddress`) key addressable events by `kind:pubkey:dtag`. ## Proposed fix (client-side only — no DB/relay change) - Key the store Map by the full coordinate `${kind}:${pubkey}:${dtag}`; replace only within the same coordinate (and newer `created_at`). Different authors → stored separately, no hijack. - Keep the d-tag as the route identifier: `getEventById(dtag)` resolves by scanning/secondary-index (unambiguous for our single-publisher calendar events). Add `getByCoordinate(coord)` for precise lookups. No demo-DB surgery: the store is rebuilt from the relay each session. ## Testing Unit tests (vitest): same-coordinate-newer-wins, same-coordinate-older-ignored, **same-d-tag-different-pubkey → both kept (no overwrite)**, `getEventById` resolves by d-tag. _To be done as a PR (gap #1 of the review)._

padreug added the

app:webapp

bug

labels

2026-06-18 11:21:13 +00:00

padreug referenced this issue from a commit

2026-06-18 11:30:54 +00:00

fix(events): key the events store by addressable coordinate (#121)

padreug referenced this issue

2026-06-18 11:31:15 +00:00

chore(test): add vitest runner + smoke test #124

padreug referenced this issue from a pull request that will close it,