mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
Michael Neale
604f5f3b2e
Replies in encrypted serverless channels (DM/private) were falling through to the plaintext path — a privacy leak: the reply content went to public relays as a cleartext kind-9. The encrypt branch was gated on parent_event_id.is_none(), so only top-level messages were gift-wrapped. Fix: encrypt replies too. The NIP-10 thread tags now live INSIDE the rumor (the encrypted inner event), so threading is preserved without leaking the reply. The thread root is resolved locally from decrypted messages (the parent rumor isn't queryable in plaintext on the relay) and passed via a new root_event_id command arg. Proven by encrypted_threaded_reply_is_wrapped_and_preserves_thread: asserts the wire event is kind-1059 (not plaintext kind-9), content never leaks, and the decrypted rumor carries the NIP-10 root + reply e-tags.