fix(dm): keep hidden DMs hidden across refetch via relay-signed visibility snapshot (NIP-DV) (#857)

Signed-off-by: Wes <wesbillman@users.noreply.github.com>
Signed-off-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@sprout-oss.stage.blox.sqprod.co>
Co-authored-by: Brain <21994759fc7a6fa6b965551d35cfd7897d262f2495467f2d78694ddcfa6a5c7e@sprout-oss.stage.blox.sqprod.co>
Co-authored-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@sprout-oss.stage.blox.sqprod.co>

Author: 3 people

crates/sprout-core/src/filter.rs

@@ -11,6 +11,24 @@ pub fn filters_match(filters: &[Filter], event: &StoredEvent) -> bool {
     filters.iter().any(|f| filter_match_one(f, event))
 }
 
+/// Result-level read authorization for relay-signed events whose content is
+/// private to a single viewer. Currently only `KIND_DM_VISIBILITY`: the reader
+/// MUST equal the snapshot's `#p` (owner). Returns `true` for every other kind.
+///
+/// This guards the delivery surfaces directly, so a query that bypasses the
+/// filter-level `#p` gate (e.g. a kindless `ids:[…]` lookup of a known snapshot
+/// id) still cannot read another viewer's hidden-DM set.
+pub fn reader_authorized_for_event(event: &nostr::Event, reader_pubkey_hex: &str) -> bool {
+    if crate::kind::event_kind_u32(event) != crate::kind::KIND_DM_VISIBILITY {
+        return true;
+    }
+    let p = nostr::SingleLetterTag::lowercase(nostr::Alphabet::P);
+    event
+        .tags
+        .filter(nostr::TagKind::SingleLetter(p))
+        .any(|t| t.content() == Some(reader_pubkey_hex))
+}
+
 fn filter_match_one(f: &Filter, ev: &StoredEvent) -> bool {
     if let Some(kinds) = &f.kinds {
         if !kinds.contains(&ev.event.kind) {
@@ -213,4 +231,34 @@ mod tests {
             "explicit h-tag must be authoritative — channel_id fallback must not override it"
         );
     }
+
+    #[test]
+    fn reader_authorized_for_event_gates_dm_visibility_by_p() {
+        let relay = Keys::generate();
+        let owner = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+        let other = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
+
+        let snapshot = EventBuilder::new(Kind::Custom(crate::kind::KIND_DM_VISIBILITY as u16), "")
+            .tags([
+                Tag::parse(["d", owner]).unwrap(),
+                Tag::parse(["p", owner]).unwrap(),
+            ])
+            .sign_with_keys(&relay)
+            .expect("sign");
+
+        assert!(
+            reader_authorized_for_event(&snapshot, owner),
+            "owner must be authorized to read their own snapshot"
+        );
+        assert!(
+            !reader_authorized_for_event(&snapshot, other),
+            "a third party must NOT be authorized to read another viewer's snapshot"
+        );
+
+        // Non-DV events are unaffected by this gate.
+        let note = EventBuilder::new(Kind::TextNote, "hi")
+            .sign_with_keys(&relay)
+            .expect("sign");
+        assert!(reader_authorized_for_event(&note, other));
+    }
 }

crates/sprout-core/src/kind.rs

@@ -161,6 +161,13 @@ pub const KIND_WORKFLOW_DEF: u32 = 30620;
 /// of mesh status, including EndpointAddr dial pointers for serving nodes.
 pub const KIND_MESH_LLM_RELAY_STATUS: u32 = 30621;
 
+/// NIP-DV: per-viewer DM visibility snapshot (relay-signed, parameterized
+/// replaceable, d=viewer_pubkey). Carries one `h` tag per DM the viewer has
+/// hidden from their sidebar. Re-published by the relay on every hide/unhide so
+/// the latest event is always the authoritative hidden set. The relay knows
+/// `hidden_at` per viewer; this is the only Nostr-visible projection of it.
+pub const KIND_DM_VISIBILITY: u32 = 30622;
+
 /// Lower bound of the NIP-33 parameterized replaceable range (30000–39999).
 pub const PARAM_REPLACEABLE_KIND_MIN: u32 = 30000;
 /// Upper bound of the NIP-33 parameterized replaceable range (30000–39999).
@@ -408,6 +415,7 @@ pub const ALL_KINDS: &[u32] = &[
     KIND_CHANNEL_SUMMARY,
     KIND_PRESENCE_SNAPSHOT,
     KIND_MESH_LLM_RELAY_STATUS,
+    KIND_DM_VISIBILITY,
     KIND_DM_OPEN,
     KIND_DM_ADD_MEMBER,
     KIND_DM_HIDE,
@@ -520,7 +528,10 @@ pub const fn is_command_kind(kind: u32) -> bool {
 pub const fn is_relay_only_kind(kind: u32) -> bool {
     matches!(
         kind,
-        KIND_CHANNEL_SUMMARY | KIND_PRESENCE_SNAPSHOT | KIND_MESH_LLM_RELAY_STATUS
+        KIND_CHANNEL_SUMMARY
+            | KIND_PRESENCE_SNAPSHOT
+            | KIND_MESH_LLM_RELAY_STATUS
+            | KIND_DM_VISIBILITY
     )
 }
 
@@ -540,6 +551,7 @@ pub fn event_kind_i32(event: &nostr::Event) -> i32 {
 const _: () = assert!(is_replaceable(KIND_AGENT_PROFILE)); // 10100 ∈ 10000–19999
 const _: () = assert!(is_parameterized_replaceable(KIND_WORKFLOW_DEF)); // 30620 ∈ 30000–39999
 const _: () = assert!(is_parameterized_replaceable(KIND_MESH_LLM_RELAY_STATUS)); // 30621 ∈ 30000–39999
+const _: () = assert!(is_parameterized_replaceable(KIND_DM_VISIBILITY)); // 30622 ∈ 30000–39999
 
 // Compile-time: NIP-34 parameterized replaceable kinds are in the correct range.
 const _: () = assert!(

crates/sprout-db/src/dm.rs

@@ -412,6 +412,32 @@ pub async fn unhide_dm(pool: &PgPool, channel_id: Uuid, pubkey: &[u8]) -> Result
     Ok(())
 }
 
+/// Return the channel IDs of all DMs the given user currently has hidden
+/// (`hidden_at IS NOT NULL`) while still being an active member. Used to build
+/// the relay-signed NIP-DV visibility snapshot.
+pub async fn list_hidden_dms(pool: &PgPool, pubkey: &[u8]) -> Result<Vec<Uuid>> {
+    let rows = sqlx::query(
+        r#"
+        SELECT cm.channel_id
+        FROM channel_members cm
+        JOIN channels c ON c.id = cm.channel_id
+        WHERE cm.pubkey = $1
+          AND cm.removed_at IS NULL
+          AND cm.hidden_at IS NOT NULL
+          AND c.channel_type = 'dm'
+          AND c.deleted_at IS NULL
+        ORDER BY cm.channel_id
+        "#,
+    )
+    .bind(pubkey)
+    .fetch_all(pool)
+    .await?;
+
+    rows.into_iter()
+        .map(|r| r.try_get::<Uuid, _>("channel_id").map_err(Into::into))
+        .collect()
+}
+
 // -- Row mapping --------------------------------------------------------------
 
 fn row_to_channel_record(row: sqlx::postgres::PgRow) -> Result<ChannelRecord> {

crates/sprout-db/src/lib.rs

@@ -657,6 +657,11 @@ impl Db {
         dm::unhide_dm(&self.pool, channel_id, pubkey).await
     }
 
+    /// List the channel IDs of all DMs the given user currently has hidden.
+    pub async fn list_hidden_dms(&self, pubkey: &[u8]) -> Result<Vec<Uuid>> {
+        dm::list_hidden_dms(&self.pool, pubkey).await
+    }
+
     // ── Threads ──────────────────────────────────────────────────────────────
 
     /// Insert thread metadata.

crates/sprout-relay/src/api/bridge.rs

@@ -266,7 +266,8 @@ pub async fn query_events(
 
     // ── NIP-50 search: route to Typesense if any filter has a `search` field ──
     if filters.iter().any(|f| f.search.is_some()) {
-        return handle_bridge_search(&state, &filters, &accessible_channels).await;
+        return handle_bridge_search(&state, &filters, &accessible_channels, &authed_pubkey_hex)
+            .await;
     }
 
     // ── Presence: synthesize kind:20001 from Redis (ephemeral, never in DB) ──
@@ -438,6 +439,14 @@ pub async fn query_events(
                     if !sprout_core::filter::filters_match(std::slice::from_ref(filter), &se) {
                         continue;
                     }
+                    // Result-level read auth: never hand a viewer-private snapshot
+                    // (kind:30622) to anyone but its owner, even via kindless `ids`.
+                    if !sprout_core::filter::reader_authorized_for_event(
+                        &se.event,
+                        &authed_pubkey_hex,
+                    ) {
+                        continue;
+                    }
                     if let Ok(v) = serde_json::to_value(&se.event) {
                         events.push(v);
                     }
@@ -596,6 +605,7 @@ fn search_hit_accepted(
     filter: &nostr::Filter,
     stored: &sprout_core::StoredEvent,
     accessible_channels: &[uuid::Uuid],
+    reader_pubkey_hex: &str,
 ) -> bool {
     if !sprout_core::filter::filters_match(std::slice::from_ref(filter), stored) {
         return false;
@@ -605,6 +615,9 @@ fn search_hit_accepted(
             return false;
         }
     }
+    if !sprout_core::filter::reader_authorized_for_event(&stored.event, reader_pubkey_hex) {
+        return false;
+    }
     true
 }
 
@@ -614,6 +627,7 @@ async fn handle_bridge_search(
     state: &AppState,
     filters: &[nostr::Filter],
     accessible_channels: &[uuid::Uuid],
+    reader_pubkey_hex: &str,
 ) -> Result<Json<Value>, (StatusCode, Json<Value>)> {
     // Bridge always includes global (non-channel) events — same as WS with full scopes.
     let channel_scope = match crate::handlers::req::build_search_channel_scope_filter(
@@ -727,7 +741,7 @@ async fn handle_bridge_search(
                 Some(ev) => ev,
                 None => continue,
             };
-            if !search_hit_accepted(filter, stored, accessible_channels) {
+            if !search_hit_accepted(filter, stored, accessible_channels, reader_pubkey_hex) {
                 continue;
             }
             // Dedup across filters.
@@ -1004,12 +1018,14 @@ mod tests {
             .kind(Kind::Custom(30174))
             .custom_tags(p_tag, [&owner_a]);
 
+        // 30174 is not owner-gated, so any reader hex is fine here.
+        let reader = Keys::generate().public_key().to_hex();
         assert!(
-            search_hit_accepted(&filter, &env_for_a, &[]),
+            search_hit_accepted(&filter, &env_for_a, &[], &reader),
             "envelope addressed to owner_a must be returned"
         );
         assert!(
-            !search_hit_accepted(&filter, &env_for_b, &[]),
+            !search_hit_accepted(&filter, &env_for_b, &[], &reader),
             "envelope addressed to owner_b must NOT be returned for a #p=[owner_a] search"
         );
     }
@@ -1031,9 +1047,10 @@ mod tests {
             .kind(Kind::Custom(30174))
             .author(agent_a.public_key());
 
-        assert!(search_hit_accepted(&filter, &env_a, &[]));
+        let reader = Keys::generate().public_key().to_hex();
+        assert!(search_hit_accepted(&filter, &env_a, &[], &reader));
         assert!(
-            !search_hit_accepted(&filter, &env_b, &[]),
+            !search_hit_accepted(&filter, &env_b, &[], &reader),
             "authors=[agent_a] search must not return events authored by agent_b"
         );
     }
@@ -1053,12 +1070,13 @@ mod tests {
             .kind(Kind::Custom(30174))
             .custom_tags(p_tag, [&owner]);
 
+        let reader = Keys::generate().public_key().to_hex();
         assert!(
-            !search_hit_accepted(&filter, &stored, &[]),
+            !search_hit_accepted(&filter, &stored, &[], &reader),
             "channel-scoped hit must be rejected when caller has no channel access"
         );
         assert!(
-            search_hit_accepted(&filter, &stored, &[scoped_channel]),
+            search_hit_accepted(&filter, &stored, &[scoped_channel], &reader),
             "channel-scoped hit must be accepted when caller has access to that channel"
         );
     }
@@ -1216,4 +1234,45 @@ mod tests {
         se.channel_id = Some(ch);
         assert!(!event_in_accessible_channel(&se, &[other]));
     }
+
+    /// NIP-DV regression: a relay-signed kind:30622 snapshot must not leak via
+    /// search through a kindless `ids:[snapshot_id]` filter that carries no #p.
+    /// `filters_match` passes (id matches), channel check passes (channel_id =
+    /// None), so only the result-level `reader_authorized_for_event` check
+    /// stands between a third party and the owner's private hide set.
+    #[test]
+    fn search_hit_rejects_dm_visibility_for_kindless_ids_third_party() {
+        let relay = Keys::generate();
+        let viewer = Keys::generate().public_key().to_hex();
+        let third_party = Keys::generate().public_key().to_hex();
+
+        let d_tag = Tag::custom(
+            nostr::TagKind::SingleLetter(SingleLetterTag::lowercase(Alphabet::D)),
+            [&viewer],
+        );
+        let p_tag = Tag::custom(
+            nostr::TagKind::SingleLetter(SingleLetterTag::lowercase(Alphabet::P)),
+            [&viewer],
+        );
+        let ev = EventBuilder::new(
+            Kind::Custom(sprout_core::kind::KIND_DM_VISIBILITY as u16),
+            "",
+        )
+        .tags([d_tag, p_tag])
+        .sign_with_keys(&relay)
+        .expect("sign snapshot");
+        let stored = sprout_core::StoredEvent::new(ev.clone(), None);
+
+        // Kindless filter — the exact bypass shape: no #p, just the id.
+        let filter = nostr::Filter::new().id(ev.id);
+
+        assert!(
+            !search_hit_accepted(&filter, &stored, &[], &third_party),
+            "third party must not receive a DM-visibility snapshot via kindless ids search"
+        );
+        assert!(
+            search_hit_accepted(&filter, &stored, &[], &viewer),
+            "owner must still receive their own snapshot"
+        );
+    }
 }

crates/sprout-relay/src/handlers/command_executor.rs

@@ -27,6 +27,7 @@ use crate::webhook_secret;
 use super::ingest::{extract_channel_id, IngestAuth, IngestError, IngestResult};
 use super::side_effects::{
     emit_group_discovery_events, emit_membership_notification, emit_system_message,
+    publish_dm_visibility_snapshot,
 };
 
 /// Route a command-kind event to the appropriate handler.
@@ -330,6 +331,12 @@ async fn handle_dm_open(
                 warn!("DM open: membership notification failed: {e}");
             }
         }
+    } else {
+        // Re-open of an existing DM cleared the caller's hidden_at; refresh
+        // their NIP-DV snapshot so the DM reappears in the sidebar.
+        if let Err(e) = publish_dm_visibility_snapshot(state, &self_bytes).await {
+            warn!("DM re-open: visibility snapshot failed: {e}");
+        }
     }
 
     // 6. Return response
@@ -532,7 +539,13 @@ async fn handle_dm_hide(
         .await
         .map_err(|e| IngestError::Internal(format!("error: commit transaction: {e}")))?;
 
-    // 5. Return response
+    // 5. Side effect (post-commit, best-effort): refresh the caller's NIP-DV
+    // visibility snapshot so clients can filter this DM out of the sidebar.
+    if let Err(e) = publish_dm_visibility_snapshot(state, &self_bytes).await {
+        warn!("DM hide: visibility snapshot failed: {e}");
+    }
+
+    // 6. Return response
     Ok(IngestResult {
         event_id: event.id.to_hex(),
         accepted: true,

crates/sprout-relay/src/handlers/event.rs

@@ -125,8 +125,30 @@ pub(crate) async fn dispatch_persistent_event(
 
     let event_json = serde_json::to_string(&stored_event.event)
         .expect("nostr::Event serialization is infallible for well-formed events");
+    // For viewer-private snapshots (kind:30622), live fan-out must reach only the
+    // owner — a kindless `ids:[…]` subscription can otherwise match it. Pull paths
+    // (HTTP /query, WS historical) are gated separately by reader_authorized_for_event.
+    let dm_visibility_owner: Option<String> = (kind_u32 == sprout_core::kind::KIND_DM_VISIBILITY)
+        .then(|| {
+            let p = nostr::SingleLetterTag::lowercase(nostr::Alphabet::P);
+            stored_event
+                .event
+                .tags
+                .filter(nostr::TagKind::SingleLetter(p))
+                .find_map(|t| t.content().map(|s| s.to_string()))
+        })
+        .flatten();
     let mut drop_count = 0u32;
     for (target_conn_id, sub_id) in &matches {
+        if let Some(ref owner_hex) = dm_visibility_owner {
+            let is_owner = state
+                .conn_manager
+                .pubkey_for(*target_conn_id)
+                .is_some_and(|pk| hex::encode(pk) == *owner_hex);
+            if !is_owner {
+                continue;
+            }
+        }
         let msg = format!(r#"["EVENT","{}",{}]"#, sub_id, event_json);
         if !state.conn_manager.send_to(*target_conn_id, msg) {
             drop_count += 1;
@@ -140,8 +162,10 @@ pub(crate) async fn dispatch_persistent_event(
         );
     }
 
-    // Skip search indexing for NIP-17 gift wraps — content is ciphertext.
+    // Skip search indexing for NIP-17 gift wraps (ciphertext) and NIP-DV
+    // visibility snapshots (per-viewer private hide state, owner-gated reads).
     if kind_u32 != KIND_GIFT_WRAP
+        && kind_u32 != sprout_core::kind::KIND_DM_VISIBILITY
         && state
             .search_index_tx
             .try_send(stored_event.clone())