fix(desktop): accept uppercase/mixed-case nsec in key import (#4247) - #4263
Open
iroiro147 wants to merge 1 commit into
Open
fix(desktop): accept uppercase/mixed-case nsec in key import (#4247)#4263iroiro147 wants to merge 1 commit into
iroiro147 wants to merge 1 commit into
Conversation
) The desktop key-import form told users pasting a valid nsec1… key that it was invalid whenever the encoding used uppercase (or mixed-case) letters. Bech32 permits an all-uppercase encoding, and tools that emit printable/backup keys often uppercase them — the checksum is identical regardless of case. - nostrUtils.nsecToNpub: lowercase after trim before the prefix and checksum checks. Whitespace tolerance is unchanged. - keyImportInput.classifyKeyImportInput: case-insensitive on the nsec1 HRP, mirroring the existing ncryptsec1 handling, so the form picks the correct mode for an uppercase key. Both paths continue to reject corrupted checksums and non-nsec inputs. The parser is deliberately permissive on casing: a copy-paste that damaged only case should still resolve rather than reject the user. Regression coverage: - onboarding/lib/keyImportInput.test.mjs — uppercase classify + submit - shared/lib/nostrUtils.test.mjs (new) — lowercase / uppercase / mixed case / whitespace tolerance / checksum rejection / non-nsec rejection Refs block#4247 Signed-off-by: Sarthak Singh <sarthak.singh@juspay.in>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The desktop onboarding key-import form told users pasting a valid
nsec1…key that it was invalid whenever the encoding used uppercase letters — Bech32 permits an all-uppercase encoding (the checksum is identical regardless of case), and tools that emit printable/backup keys often uppercase them.Issue #4247 reports users hitting "Waiting for a valid nsec1 key" / "Invalid key" on keys that other Nostr clients accept.
Root cause
Two case-sensitive HRP/prefix checks:
shared/lib/nostrUtils.ts:nsecToNpubcomparedtrimmed.startsWith("nsec1")before callingnostr-tools/nip19.decode(). Uppercase input failed the prefix check; mixed-case made it todecode()and rejected by the spec-compliant checksum library.features/onboarding/lib/keyImportInput.ts:classifyKeyImportInputalready lowercased the longerncryptsec1HRP but kepttrimmed.startsWith("nsec1")case-sensitive, so an uppercaseNSEC1…classified as"unknown"and the form showed the unencrypted-error path.Changes
nsecToNpub: lowercases aftertrim()before both the prefix check anddecode(). Whitespace tolerance is unchanged. The parser is intentionally permissive on casing — a copy-paste that damaged only case should still resolve rather than reject the user.classifyKeyImportInput: mirrors the existingncryptsec1lowercase-slice pattern fornsec1so an uppercase key is classified as"nsec"and npub preview / submit gating continue down the correct path.Corrupted checksums, non-nsec inputs, and empty strings still reject exactly as before.
Tests
New
src/shared/lib/nostrUtils.test.mjs(6 cases):Extended
src/features/onboarding/lib/keyImportInput.test.mjs:"nsec"and submit-enables without a passphraseReceipts: 12/12 nostrUtils+keyImportInput tests pass; 238/238 across the related onboarding+shared-lib suites;
pnpm exec tsc --noEmitclean;ncryptsecSourceScanallowlist unaffected.Linked issue
Refs #4247