mirror of
https://github.com/block/buzz.git
synced 2026-11-02 23:41:08 +00:00
955f6871db
1. P1 — Force NIP-98 signed auth for /transcribe/* endpoints regardless of BUZZ_REQUIRE_AUTH_TOKEN. The X-Pubkey dev fallback is spoofable, so a billable endpoint must always require cryptographic proof of identity before the membership check trusts the pubkey. 2. P2 — DictationButton now allows the stop action whenever isRecording is true, even during startup (mic live but SDP exchange in progress) or when the composer is disabled. Only blocks the button when idle and disabled, or when startup hasn't captured the mic yet.