From 5106e572a5e41346f79021ae83de092a25eb3531 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 23 Apr 2026 00:34:51 +0000 Subject: [PATCH] fix: consume Marmot inner reactions/deletions as verified MIP-03 inner events inside a kind:445 GroupEvent are unsigned (sig is empty or placeholder), so LocalCache's `justVerify()` fails and `consume(ReactionEvent)` skips the branch that attaches the reaction to its target note via `addReaction()`. The same applies to kind:5 deletions. Side-channel inner events from other Marmot clients (WhiteNoise in particular) were therefore silently dropped by LocalCache, so an inbound emoji reaction never appeared on the target chat bubble. NIP-17 has the same "unsigned inner rumor" shape and already hands the inner event to `justConsume(..., wasVerified = true)`. Align Marmot with that contract at the two inbound call sites: - `GroupEventHandler.add` (fresh kind:445 from relay) - `Account` restore-from-disk loop (persisted plaintext at app start) Authenticity is already guaranteed by the MLS layer: `MarmotInboundProcessor.processPrivateMessage` rejects any inner event whose `pubkey` doesn't match the MLS sender credential identity before ever emitting an `ApplicationMessage`. https://claude.ai/code/session_01KhVtLJAEkNCwpRWUUTqDFM --- .../java/com/vitorpamplona/amethyst/model/Account.kt | 7 ++++++- .../ui/screen/loggedIn/DecryptAndIndexProcessor.kt | 10 +++++++++- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/amethyst/src/main/java/com/vitorpamplona/amethyst/model/Account.kt b/amethyst/src/main/java/com/vitorpamplona/amethyst/model/Account.kt index 831057941..10ec32d29 100644 --- a/amethyst/src/main/java/com/vitorpamplona/amethyst/model/Account.kt +++ b/amethyst/src/main/java/com/vitorpamplona/amethyst/model/Account.kt @@ -3018,7 +3018,12 @@ class Account( val innerEvent = com.vitorpamplona.quartz.nip01Core.core.Event .fromJson(json) - val isNew = cache.justConsume(innerEvent, null, false) + // wasVerified=true: these events were already verified + // via MLS credential identity when first decrypted (see + // GroupEventHandler). Persisted inner events are + // unsigned per MIP-03, so justVerify would fail and + // reactions/deletions would silently drop here. + val isNew = cache.justConsume(innerEvent, null, true) val innerNote = cache.getOrCreateNote(innerEvent.id) if (isNew) { innerNote.event = innerEvent diff --git a/amethyst/src/main/java/com/vitorpamplona/amethyst/ui/screen/loggedIn/DecryptAndIndexProcessor.kt b/amethyst/src/main/java/com/vitorpamplona/amethyst/ui/screen/loggedIn/DecryptAndIndexProcessor.kt index 100760c5e..6226c6fd8 100644 --- a/amethyst/src/main/java/com/vitorpamplona/amethyst/ui/screen/loggedIn/DecryptAndIndexProcessor.kt +++ b/amethyst/src/main/java/com/vitorpamplona/amethyst/ui/screen/loggedIn/DecryptAndIndexProcessor.kt @@ -592,7 +592,15 @@ class GroupEventHandler( "GroupEventHandler.add: ApplicationMessage decrypted innerKind=${innerEvent.kind} " + "innerId=${innerEvent.id.take(8)}… author=${innerEvent.pubKey.take(8)}…" } - if (cache.justConsume(innerEvent, null, false)) { + // wasVerified=true: MIP-03 inner events are unsigned (sig is empty + // or placeholder), so justVerify() would fail. Authenticity is + // already guaranteed by the MLS layer — MarmotInboundProcessor + // enforces innerEvent.pubKey == MLS sender credential identity + // before returning ApplicationMessage. Without this, side-channel + // inner events from other Marmot clients (kind:7 reactions, + // kind:5 deletions) are silently dropped by LocalCache, so a + // WhiteNoise reaction never attaches to its target chat bubble. + if (cache.justConsume(innerEvent, null, true)) { val innerNote = cache.getOrCreateNote(innerEvent.id) innerNote.event = innerEvent