From 32151b3ffd470fb0cc36c5524b28be20329ecec3 Mon Sep 17 00:00:00 2001 From: Laan Tungir Date: Thu, 6 Aug 2026 08:00:25 -0400 Subject: [PATCH] v0.1.18 - Fixed template-role pubkey caching: re-derive on each concrete path request (nostr_range wildcard was returning the same key for all account indices) --- src/main.c | 4 ++-- src/server.c | 15 +++++++++++---- 2 files changed, 13 insertions(+), 6 deletions(-) diff --git a/src/main.c b/src/main.c index ac5be73..894fd68 100644 --- a/src/main.c +++ b/src/main.c @@ -813,8 +813,8 @@ int socket_name_random(char *out, size_t out_len); /* Version information (auto-updated by build/version tooling) */ #define NSIGNER_VERSION_MAJOR 0 #define NSIGNER_VERSION_MINOR 1 -#define NSIGNER_VERSION_PATCH 17 -#define NSIGNER_VERSION "v0.1.17" +#define NSIGNER_VERSION_PATCH 18 +#define NSIGNER_VERSION "v0.1.18" /* NSIGNER_HEADERLESS_DECLS_END */ diff --git a/src/server.c b/src/server.c index aad5ca3..090a245 100644 --- a/src/server.c +++ b/src/server.c @@ -2443,12 +2443,19 @@ int server_handle_one(server_ctx_t *ctx, server_activity_cb cb, void *cb_data) { if (selector_req.has_role_path) { /* Case (a): client supplied a concrete path that was already - * validated by selector_resolve. Use it directly. */ + * validated by selector_resolve. Use it directly. + * + * Always re-derive for template roles: the client may request + * a different concrete path (e.g. a different account index) + * than the one previously derived and cached on the role. + * The derivation block below swaps in the concrete path, + * clears derived/pubkey, re-derives, and restores the + * template — so forcing pending_derivation here is safe and + * correct. Without this, a second request with a different + * path would return the stale cached pubkey from the first. */ snprintf(concrete_path, sizeof(concrete_path), "%s", selector_req.role_path); - if (!role->derived) { - pending_derivation = 1; - } + pending_derivation = 1; } else { /* Case (b): role only — resolve index from --index or default */ int chosen_index;