feat: check zap service pubkeys

packages/app/src/Element/Zap.tsx

@@ -10,6 +10,7 @@ import Text from "Element/Text";
 import ProfileImage from "Element/ProfileImage";
 import { RootState } from "State/Store";
 import { ZapperSpam } from "Const";
+import { UserCache } from "State/Users/UserCache";
 
 import messages from "./messages";
 
@@ -75,6 +76,10 @@ export function parseZap(zapReceipt: TaggedRawEvent): ParsedZap {
         ret.valid = false;
         ret.errors.push("amount tag does not match invoice amount");
       }
+      if (UserCache.get(ret.receiver)?.zapService !== ret.zapService) {
+        ret.valid = false;
+        ret.errors.push("zap service pubkey doesn't match");
+      }
       if (!ret.valid) {
         console.debug("Invalid zap", ret);
       }

packages/app/src/LNURL.ts

@@ -111,6 +111,13 @@ export class LNURL {
     return this.#service?.nostrPubkey ? true : false;
   }
 
+  /**
+   * Return pubkey of zap service
+   */
+  get zapperPubkey() {
+    return this.#service?.nostrPubkey;
+  }
+
   /**
    * Get the max allowed comment length
    */

packages/app/src/State/Users/UserCache.ts

@@ -1,5 +1,6 @@
 import { HexKey } from "@snort/nostr";
 import { db } from "Db";
+import { LNURL } from "LNURL";
 import { unixNowMs, unwrap } from "Util";
 import { MetadataCache } from ".";
 
@@ -99,6 +100,18 @@ export class UserProfileCache {
     if (!existing || existing.created < m.created || refresh) {
       this.#cache.set(m.pubkey, m);
       if (db.ready) {
+        // fetch zapper key
+        const lnurl = m.lud16 || m.lud06;
+        if (lnurl) {
+          try {
+            const svc = new LNURL(lnurl);
+            await svc.load();
+            m.zapService = svc.zapperPubkey;
+          } catch {
+            console.debug("Failed to load LNURL for zapper pubkey", lnurl);
+          }
+          // ignored
+        }
         await db.users.put(m);
         this.#diskCache.add(m.pubkey);
       }

packages/app/src/State/Users/index.ts

@@ -21,6 +21,11 @@ export interface MetadataCache extends UserMetadata {
    * The bech32 encoded pubkey
    */
   npub: string;
+
+  /**
+   * Pubkey of zapper service
+   */
+  zapService?: HexKey;
 }
 
 export function mapEventToProfile(ev: TaggedRawEvent) {