@orangecheck/sdk 1.9.0 → 1.10.0

package/dist/index.mjs

@@ -1595,11 +1595,14 @@ function isValidDomain(domain) {
   const domainPattern = /^[a-z0-9]+([\-\.]{1}[a-z0-9]+)*\.[a-z]{2,}$/i;
   return domainPattern.test(cleanDomain);
 }
-function isDnsIdentityVerified(attestationId, _domain, cachedContent) {
-  if (!cachedContent) {
+function isDnsIdentityVerified(attestationId, domain, cachedContent) {
+  if (!cachedContent || !cachedContent.includes(attestationId)) {
     return false;
   }
-  return cachedContent.includes(attestationId);
+  const named = /^Domain:\s*(\S+)\s*$/im.exec(cachedContent);
+  if (!named) return true;
+  const cleanDomain = domain.replace(/^https?:\/\//, "").replace(/\/$/, "").toLowerCase();
+  return named[1].toLowerCase() === cleanDomain;
 }
 
 // src/identity/github.ts
@@ -1743,8 +1746,10 @@ This gist proves that I control both:
 Learn more about OrangeCheck: https://ochk.io
 `;
 }
-function isGitHubIdentityVerified(attestationId, _username, cachedGists) {
+function isGitHubIdentityVerified(attestationId, username, cachedGists) {
+  const login = username.replace(/^@/, "").toLowerCase();
   return cachedGists.some((gist) => {
+    if (gist.owner?.login?.toLowerCase() !== login) return false;
     if (gist.description?.includes(attestationId)) {
       return true;
     }
@@ -1843,6 +1848,9 @@ async function queryNostrEvents(options) {
   return events;
 }
 async function verifyNostrEventSignature(event) {
+  return nostrEventSignatureValid(event);
+}
+function nostrEventSignatureValid(event) {
   try {
     if (!event.id || !event.sig || !event.pubkey || typeof event.id !== "string" || typeof event.sig !== "string" || typeof event.pubkey !== "string" || event.sig.length !== 128 || !HEX_64_RE2.test(event.id) || !HEX_64_RE2.test(event.pubkey)) {
       return false;
@@ -1929,7 +1937,7 @@ The verification will search Nostr relays for your note and confirm you control
 function isNostrIdentityVerified(attestationId, npub, cachedEvents) {
   const pubkeyHex = npubToHex(npub);
   return cachedEvents.some(
-    (event) => event.pubkey === pubkeyHex && event.kind === 1 && event.content.includes(attestationId)
+    (event) => event.pubkey === pubkeyHex && event.kind === 1 && event.content.includes(attestationId) && nostrEventSignatureValid(event)
   );
 }