fix: harden community selector with error handling, locale formatting, and verification tracking

grunch · grunch · commit 47cf62497e51 · 2026-04-07T13:15:00.000-03:00
- Add error handling in _selectAndProceed with user-facing SnackBar
- Track hasEvents only after verified events are applied, so unverified
  relays fall through to the next relay instead of returning empty results
- Use locale-aware NumberFormat.compact for sats formatting in cards
- Add language tags to fenced code blocks in COMMUNITY_DISCOVERY.md
- Update doc to match current redirect and relay fallback behavior
- Remove duplicated test helper in favor of CommunityRepository.verifyEvent
diff --git a/docs/COMMUNITY_DISCOVERY.md b/docs/COMMUNITY_DISCOVERY.md
@@ -13,19 +13,19 @@ Existing users are never interrupted. The selector is shown only once after the
 
 ### New User
 
-```
+```text
 App install -> Walkthrough (complete or skip) -> Community Selector -> Home
 ```
 
 ### Existing User (upgrade)
 
-```
+```text
 App launch -> Home (auto-migrated, no interruption)
 ```
 
 ### Returning to Community Selection
 
-```
+```text
 Home -> Settings -> Mostro Card -> Node Selector (existing feature)
 ```
 
@@ -47,12 +47,12 @@ Mirrored from [mostro.community](https://github.com/MostroP2P/community). Define
 
 ### Data Flow
 
-```
+```text
 trustedCommunities (static config)
         |
         v
 CommunityRepository.fetchCommunityMetadata(pubkeys)
-        |   WebSocket -> wss://relay.mostro.network
+        |   WebSocket -> Config.nostrRelays (with fallback)
         |   REQ kind 0 (profile: name, about, picture)
         |   REQ kind 38385 (trade info: currencies, fee, min/max)
         |   Timeout: 10s, partial data OK
@@ -79,7 +79,7 @@ Home Screen
 
 ### File Structure
 
-```
+```text
 lib/
   core/
     config/
@@ -159,14 +159,14 @@ When kind 38385 event exists (`hasTradeInfo = true`) but `fiat_currencies_accept
 
 In `lib/core/app_routes.dart`, the redirect logic evaluates two providers sequentially:
 
-```
+```text
 1. firstRunProvider:
    - loading -> redirect to /walkthrough
    - data(isFirstRun=true) -> redirect to /walkthrough
    - data(isFirstRun=false) -> proceed to step 2
 
 2. communitySelectedProvider:
-   - loading -> redirect to /community_selector (prevents flash of home)
+   - loading -> no redirect (wait for provider to resolve; router refreshes on change)
    - data(false) -> redirect to /community_selector
    - data(true) -> no redirect (proceed to requested route)
    - error -> no redirect (don't block on errors)
@@ -233,7 +233,7 @@ Previously hardcoded as a single entry (`Mostro P2P`). Now derived from `trusted
 
 ### UI Layout
 
-```
+```text
 +-----------------------------+
 |  bolt  Choose your community |  <- Title with bolt icon
 |  [search icon] Search...     |  <- Search bar (filters by name, region, currency, about)
diff --git a/lib/data/repositories/community_repository.dart b/lib/data/repositories/community_repository.dart
@@ -4,6 +4,7 @@ import 'dart:io';
 import 'dart:math';
 import 'package:crypto/crypto.dart';
 import 'package:dart_nostr/dart_nostr.dart';
+import 'package:flutter/foundation.dart' show visibleForTesting;
 import 'package:mostro_mobile/core/config.dart';
 import 'package:mostro_mobile/services/logger_service.dart';
 
@@ -85,8 +86,9 @@ class CommunityRepository {
 
             if (type == 'EVENT' && msg.length >= 3) {
               final event = msg[2] as Map<String, dynamic>;
-              _processEvent(event, results);
-              hasEvents = true;
+              if (_processEvent(event, results)) {
+                hasEvents = true;
+              }
             } else if (type == 'EOSE') {
               eoseCount++;
               if (eoseCount >= 2 && !completer.isCompleted) {
@@ -139,7 +141,8 @@ class CommunityRepository {
   /// Verifies a raw Nostr event per NIP-01:
   /// 1. Recomputes the event ID from the serialized content
   /// 2. Verifies the Schnorr signature over the ID
-  bool _verifyEvent(Map<String, dynamic> event) {
+  @visibleForTesting
+  bool verifyEvent(Map<String, dynamic> event) {
     try {
       final id = event['id'] as String?;
       final pubkey = event['pubkey'] as String?;
@@ -183,22 +186,24 @@ class CommunityRepository {
     }
   }
 
-  void _processEvent(
+  /// Processes a raw event, applying it to [results] if it passes
+  /// verification. Returns true if the event was verified and applied.
+  bool _processEvent(
     Map<String, dynamic> event,
     Map<String, CommunityMetadata> results,
   ) {
     final pubkey = event['pubkey'] as String?;
     final kind = event['kind'] as int?;
-    if (pubkey == null || kind == null) return;
+    if (pubkey == null || kind == null) return false;
 
     final meta = results[pubkey];
-    if (meta == null) return;
+    if (meta == null) return false;
 
-    if (!_verifyEvent(event)) {
+    if (!verifyEvent(event)) {
       logger.w(
         'Rejecting kind $kind event from $pubkey: verification failed',
       );
-      return;
+      return false;
     }
 
     final createdAt = event['created_at'] as int? ?? 0;
@@ -210,16 +215,21 @@ class CommunityRepository {
               jsonDecode(event['content'] as String) as Map<String, dynamic>;
           meta.kind0 = content;
           meta.kind0CreatedAt = createdAt;
+          return true;
         } catch (e) {
           logger.w('Failed to parse kind 0 content for $pubkey: $e');
+          return false;
         }
       }
     } else if (kind == 38385) {
       if (createdAt >= (meta.kind38385CreatedAt ?? 0)) {
         meta.kind38385Tags = _extractTags(event);
         meta.kind38385CreatedAt = createdAt;
+        return true;
       }
     }
+
+    return false;
   }
 
   Map<String, String> _extractTags(Map<String, dynamic> event) {
diff --git a/lib/features/community/screens/community_selector_screen.dart b/lib/features/community/screens/community_selector_screen.dart
@@ -10,6 +10,7 @@ import 'package:mostro_mobile/features/community/widgets/community_card.dart';
 import 'package:mostro_mobile/features/mostro/mostro_nodes_provider.dart';
 import 'package:mostro_mobile/features/mostro/widgets/add_custom_node_dialog.dart';
 import 'package:mostro_mobile/generated/l10n.dart';
+import 'package:mostro_mobile/services/logger_service.dart';
 
 class CommunitySelectorScreen extends ConsumerStatefulWidget {
   const CommunitySelectorScreen({super.key});
@@ -296,22 +297,11 @@ class _CommunitySelectorScreenState
 
   Future<void> _onConfirm(BuildContext context) async {
     if (_selectedPubkey == null) return;
-    setState(() => _isSelecting = true);
-
-    try {
-      await _selectAndProceed(_selectedPubkey!);
-    } finally {
-      if (mounted) setState(() => _isSelecting = false);
-    }
+    await _runSelection(() => _selectAndProceed(_selectedPubkey!));
   }
 
   Future<void> _onSkip(BuildContext context) async {
-    setState(() => _isSelecting = true);
-    try {
-      await _selectAndProceed(defaultMostroPubkey);
-    } finally {
-      if (mounted) setState(() => _isSelecting = false);
-    }
+    await _runSelection(() => _selectAndProceed(defaultMostroPubkey));
   }
 
   Future<void> _onUseCustomNode(BuildContext context) async {
@@ -325,24 +315,34 @@ class _CommunitySelectorScreenState
         ref.read(mostroNodesProvider).map((n) => n.pubkey).toSet();
     final newPubkeys = pubkeysAfter.difference(pubkeysBefore);
     if (newPubkeys.isNotEmpty) {
-      setState(() => _isSelecting = true);
-      try {
-        await _selectAndProceed(newPubkeys.first);
-      } finally {
-        if (mounted) setState(() => _isSelecting = false);
+      await _runSelection(() => _selectAndProceed(newPubkeys.first));
+    }
+  }
+
+  Future<void> _runSelection(Future<void> Function() action) async {
+    setState(() => _isSelecting = true);
+    try {
+      await action();
+    } catch (e) {
+      logger.e('Community selection failed: $e');
+      if (mounted) {
+        ScaffoldMessenger.of(context).showSnackBar(
+          SnackBar(
+            content: Text(S.of(context)!.communityLoadingError),
+          ),
+        );
       }
+    } finally {
+      if (mounted) setState(() => _isSelecting = false);
     }
   }
 
   Future<void> _selectAndProceed(String pubkey) async {
-    // Ensure the pubkey exists as a node
     await _ensureNodeExists(pubkey);
 
-    // Select the node
     final nodesNotifier = ref.read(mostroNodesProvider.notifier);
     await nodesNotifier.selectNode(pubkey);
 
-    // Mark community as selected
     await ref
         .read(communitySelectedProvider.notifier)
         .markCommunitySelected();
diff --git a/lib/features/community/widgets/community_card.dart b/lib/features/community/widgets/community_card.dart
@@ -1,4 +1,5 @@
 import 'package:flutter/material.dart';
+import 'package:intl/intl.dart';
 import 'package:mostro_mobile/core/app_theme.dart';
 import 'package:mostro_mobile/features/community/community.dart';
 import 'package:mostro_mobile/generated/l10n.dart';
@@ -232,17 +233,11 @@ class CommunityCard extends StatelessWidget {
   }
 
   String _formatSats(BuildContext context, int amount) {
-    if (amount >= 1000000) {
-      return S.of(context)!.communityFormatSats(
-        '${(amount / 1000000).toStringAsFixed(1)}M',
-      );
-    }
-    if (amount >= 1000) {
-      return S.of(context)!.communityFormatSats(
-        '${(amount / 1000).toStringAsFixed(0)}K',
-      );
-    }
-    return S.of(context)!.communityFormatSats(amount.toString());
+    final locale = Localizations.localeOf(context).toString();
+    final formatted = amount < 1000
+        ? NumberFormat.decimalPattern(locale).format(amount)
+        : NumberFormat.compact(locale: locale).format(amount);
+    return '$formatted sats';
   }
 
   IconData _socialIcon(String type) {
diff --git a/test/data/repositories/community_signature_test.dart b/test/data/repositories/community_signature_test.dart
@@ -3,36 +3,16 @@ import 'dart:convert';
 import 'package:crypto/crypto.dart';
 import 'package:dart_nostr/dart_nostr.dart';
 import 'package:flutter_test/flutter_test.dart';
+import 'package:mostro_mobile/data/repositories/community_repository.dart';
 import 'package:mostro_mobile/shared/utils/nostr_utils.dart';
 
-/// Reproduces the verification logic used in CommunityRepository.
-/// Returns true only if the event ID matches the content hash AND
-/// the Schnorr signature is valid for that ID.
-bool verifyRawEvent(Map<String, dynamic> event) {
-  final id = event['id'] as String?;
-  final pubkey = event['pubkey'] as String?;
-  final sig = event['sig'] as String?;
-  final createdAt = event['created_at'] as int?;
-  final kind = event['kind'] as int?;
-  final content = event['content'] as String? ?? '';
-  final tags = event['tags'] as List<dynamic>?;
-
-  if (id == null || pubkey == null || sig == null ||
-      createdAt == null || kind == null) {
-    return false;
-  }
-
-  // Step 1: Verify event ID matches content hash (NIP-01)
-  final serialized =
-      jsonEncode([0, pubkey, createdAt, kind, tags ?? [], content]);
-  final computedId = sha256.convert(utf8.encode(serialized)).toString();
-  if (computedId != id) return false;
-
-  // Step 2: Verify Schnorr signature over the event ID
-  return NostrKeyPairs.verify(pubkey, id, sig);
-}
-
 void main() {
+  late CommunityRepository repository;
+
+  setUp(() {
+    repository = CommunityRepository();
+  });
+
   group('CommunityRepository event verification', () {
     test('accepts valid kind 0 event', () {
       final keyPair = NostrUtils.generateKeyPair();
@@ -45,7 +25,7 @@ void main() {
         ],
       );
 
-      expect(verifyRawEvent(event.toMap()), isTrue);
+      expect(repository.verifyEvent(event.toMap()), isTrue);
     });
 
     test('accepts valid kind 38385 event with empty content', () {
@@ -61,7 +41,7 @@ void main() {
         ],
       );
 
-      expect(verifyRawEvent(event.toMap()), isTrue);
+      expect(repository.verifyEvent(event.toMap()), isTrue);
     });
 
     test('rejects event with tampered content', () {
@@ -75,8 +55,7 @@ void main() {
       final tampered = Map<String, dynamic>.from(event.toMap());
       tampered['content'] = '{"name":"Spoofed Node"}';
 
-      // ID no longer matches the tampered content
-      expect(verifyRawEvent(tampered), isFalse);
+      expect(repository.verifyEvent(tampered), isFalse);
     });
 
     test('rejects event with tampered pubkey', () {
@@ -91,7 +70,7 @@ void main() {
       final tampered = Map<String, dynamic>.from(event.toMap());
       tampered['pubkey'] = otherKeyPair.public;
 
-      expect(verifyRawEvent(tampered), isFalse);
+      expect(repository.verifyEvent(tampered), isFalse);
     });
 
     test('rejects event with forged id and signature', () {
@@ -104,7 +83,6 @@ void main() {
         keyPairs: keyPair,
       );
 
-      // Attacker creates a new event with spoofed content but original pubkey
       final spoofedContent = '{"name":"Spoofed"}';
       final originalMap = original.toMap();
       final serialized = jsonEncode([
@@ -116,16 +94,14 @@ void main() {
         spoofedContent,
       ]);
       final forgedId = sha256.convert(utf8.encode(serialized)).toString();
-      // Attacker signs with their own key
       final forgedSig = attackerKeyPair.sign(forgedId);
 
       final tampered = Map<String, dynamic>.from(originalMap);
       tampered['content'] = spoofedContent;
       tampered['id'] = forgedId;
       tampered['sig'] = forgedSig;
 
-      // Signature was made by attacker, not by the original pubkey
-      expect(verifyRawEvent(tampered), isFalse);
+      expect(repository.verifyEvent(tampered), isFalse);
     });
 
     test('handles event with null content as empty string', () {
@@ -140,11 +116,9 @@ void main() {
       );
 
       final rawMap = event.toMap();
-      // Simulate relay sending null content (edge case)
       rawMap.remove('content');
 
-      // Should still work — defaults to empty string
-      expect(verifyRawEvent(rawMap), isTrue);
+      expect(repository.verifyEvent(rawMap), isTrue);
     });
   });
 }
