Skip to content

fix(comms): use /attestation/check to validate chat sender #723

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rickyrombo merged 1 commit into from
Mar 17, 2026
Merged

fix(comms): use /attestation/check to validate chat sender #723

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 5 additions & 10 deletions api/comms/validator.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
package comms

import (
"bytes"
"context"
"encoding/json"
"errors"
Expand Down Expand Up @@ -521,27 +520,23 @@ func validatePermittedToMessage(pool *dbv1.DBPools, ctx context.Context, userId

var ErrAttestationFailed = errors.New("attestation failed")

// TODO: Better AAO usage that corresponds to the claim rewards code
func validateSenderPassesAbuseCheck(pool *dbv1.DBPools, ctx context.Context, logger *zap.Logger, userId int32, aaoServer string) error {
if aaoServer == "" {
return nil
}
// Keeping this somewhat opaque as it gets sent to client
var handle string
err := pool.QueryRow(ctx, `SELECT handle FROM users WHERE user_id = $1`, userId).Scan(&handle)
var wallet string
err := pool.QueryRow(ctx, `SELECT wallet FROM users WHERE user_id = $1`, userId).Scan(&wallet)
if err != nil {
if err == pgx.ErrNoRows {
return fmt.Errorf("user %d not found", userId)
}
return err
Comment on lines +527 to 533
}

url := fmt.Sprintf("%s/attestation/%s", aaoServer, handle)
// Dummy challenge for now to mitigate
requestBody := []byte(`{ "challengeId": "x", "challengeSpecifier": "x", "amount": 0 }`)
resp, err := http.Post(url, "application/json", bytes.NewBuffer(requestBody))
url := fmt.Sprintf("%s/attestation/check?wallet=%s", aaoServer, wallet)
resp, err := http.Get(url)
Comment on lines +536 to +537
if err != nil {
Comment on lines +537 to 538
logger.Error("Error checking user attestation", zap.Error(err), zap.String("handle", handle))
logger.Error("Error checking user attestation", zap.Error(err), zap.String("wallet", wallet))
return err
}
defer resp.Body.Close()
Expand Down
Loading