38 lines
1.5 KiB
TypeScript
38 lines
1.5 KiB
TypeScript
import { verifyEvent } from 'nostr-tools';
|
|
import type { NostrEvent } from '@nostrify/nostrify';
|
|
|
|
/**
|
|
* Signature-verify a batch of events, dropping any that fail.
|
|
* ─────────────────────────────────────────────────────────────────────────────
|
|
* Relays are untrusted transport. Rendering event content is already XSS-safe
|
|
* throughout the app, but *trust decisions* (trust scores, moderation flags,
|
|
* listing authorship) must not be made on unverified data — a malicious or
|
|
* buggy relay can otherwise inject forged events that were never signed by the
|
|
* claimed author.
|
|
*
|
|
* `verifyEvent` checks both the event id (hash of the serialized event) and the
|
|
* Schnorr signature against the pubkey, so a passing event is provably authored
|
|
* by `event.pubkey`. Verification is ~1ms/event; memoize upstream if a hot path
|
|
* verifies the same events repeatedly.
|
|
*
|
|
* Never throws — a malformed event that makes `verifyEvent` throw is simply
|
|
* treated as invalid and filtered out.
|
|
*/
|
|
export function onlyVerified(events: NostrEvent[]): NostrEvent[] {
|
|
return events.filter((e) => {
|
|
try {
|
|
return verifyEvent(e);
|
|
} catch {
|
|
return false;
|
|
}
|
|
});
|
|
}
|
|
|
|
/** Single-event convenience wrapper. Returns false on any error. */
|
|
export function isVerified(event: NostrEvent): boolean {
|
|
try {
|
|
return verifyEvent(event);
|
|
} catch {
|
|
return false;
|
|
}
|
|
}
|