skatespots/SkateSpots
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions 1

cvm-server: only serve signature-verified events to agents (audit F2)

Browse source 
queryNostr() previously returned every event the community data relays
sent back, unverified. A malicious or buggy relay could inject forged
coach profiles / listings that would flow straight into agents as
trusted ground truth. Now each event is signature-verified with
nostr-tools verifyEvent() before being returned; anything that fails
(or throws) is dropped. Mirrors the client-side onlyVerified discipline
already applied in the trust-score hooks.

Co-authored-by: shakespeare.diy <assistant@shakespeare.diy>
This commit is contained in:
shakespeare.diy 2026-09-24 19:36:24 +07:00
parent 8eae0a69e4
commit 0b83749aa1
1 changed files with 7 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
cvm-server/server.ts
View file

@ -22,7 +22,7 @@ import {
ApplesauceRelayPool,
} from "@contextvm/sdk";
import { z } from "zod";
import { SimplePool } from "nostr-tools";
import { SimplePool, verifyEvent } from "nostr-tools";
import type { Filter } from "nostr-tools";
// ─── Config ──────────────────────────────────────────────────────────────────
@ -60,7 +60,12 @@ async function queryNostr(filters: Filter[], timeoutMs = 8000): Promise<any[]> {
}
})
);
return allEvents;
// Audit F2 (server-side): only serve signature-verified events to agents.
// Unverified community-relay data must never become agent-trusted ground
// truth (forged coach profiles / listings would flow straight into agents).
return allEvents.filter((e) => {
try { return verifyEvent(e); } catch { return false; }
});
}
// ─── Helpers ─────────────────────────────────────────────────────────────────