From 65305bf7de5e0f73fbc7412e337d9afbc6a9eecc Mon Sep 17 00:00:00 2001 From: jwinterm Date: Fri, 10 Jul 2026 10:29:52 -0400 Subject: [PATCH] fix(smirk): grant the Nostr scope via getNostrPublicKey() before signNostrEvent() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Smirk dapp API requires the origin to hold the Nostr scope before signNostrEvent(); without it the wallet throws 'Origin lacks the Nostr scope — call getNostrPublicKey() first'. getNostrPublicKey() establishes that grant (prompts once), so call it first in the NIP-98 path. --- html/js/network/smirkAuth.js | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/html/js/network/smirkAuth.js b/html/js/network/smirkAuth.js index 341a126..6dbc266 100644 --- a/html/js/network/smirkAuth.js +++ b/html/js/network/smirkAuth.js @@ -141,6 +141,11 @@ const SmirkAuth = { * @returns {Promise<{verifyData: object, pubkey: string|null}>} */ async _verifyNip98(socketId, challenge) { + // Grant this origin the Nostr scope first. Per the Smirk dapp API, getNostrPublicKey() + // IS the connection for a Nostr origin (it prompts on first use); signNostrEvent() throws + // "Origin lacks the Nostr scope — call getNostrPublicKey() first" without it. + await window.smirk.getNostrPublicKey(); + // Build the NIP-98 HTTP auth event. The wallet fills in pubkey/id/sig. const evt = { kind: 27235,