mirror of
https://github.com/block/buzz.git
synced 2026-10-29 13:31:44 +00:00
Observer frames return before the ingest write-path ban gate, and NIP-98 auth does not consult bans, so a banned owner could keep sending control frames through POST /events. Check the authoring pubkey's ban state before accepting the frame, failing closed on lookup errors. Generated with AI Co-Authored-By: rp1 <bot@rp1.run> Signed-off-by: Prem Pillai <prem@squareup.com>