From 10ac15f8a20ace6fded99b2609bdf7a361a42ded Mon Sep 17 00:00:00 2001
From: Jon Staab <shtaab@gmail.com>
Date: Fri, 6 Mar 2026 09:23:37 -0800
Subject: [PATCH] Add LogInSelect step for disambiguating pomade sessions

---
 package.json                              |  2 +-
 pnpm-lock.yaml                            | 18 ++---
 src/app/components/LogInEmail.svelte      | 34 ++++++----
 src/app/components/LogInOTPConfirm.svelte | 40 ++++++-----
 src/app/components/LogInSelect.svelte     | 82 +++++++++++++++++++++++
 5 files changed, 135 insertions(+), 41 deletions(-)
 create mode 100644 src/app/components/LogInSelect.svelte

diff --git a/package.json b/package.json
index 6f32adcd..a9c1e20e 100644
--- a/package.json
+++ b/package.json
@@ -57,7 +57,7 @@
     "@getalby/lightning-tools": "^6.1.0",
     "@getalby/sdk": "^5.1.2",
     "@noble/curves": "^1.9.7",
-    "@pomade/core": "^0.2.0",
+    "@pomade/core": "^0.2.1",
     "@poppanator/sveltekit-svg": "^4.2.1",
     "@sveltejs/adapter-static": "^3.0.10",
     "@tiptap/core": "^2.27.2",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 98946c21..e8366811 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -57,8 +57,8 @@ importers:
         specifier: ^1.9.7
         version: 1.9.7
       '@pomade/core':
-        specifier: ^0.1.3
-        version: 0.1.3(@frostr/bifrost@1.0.7(typescript@5.9.3))(@noble/hashes@2.0.1)(@welshman/lib@0.8.8)(@welshman/net@0.8.8(@welshman/lib@0.8.8)(@welshman/util@0.8.8(@noble/curves@1.9.7)(@welshman/lib@0.8.8)(nostr-tools@2.20.0(typescript@5.9.3)))(ws@8.18.3))(@welshman/signer@0.8.8(@noble/curves@1.9.7)(@noble/hashes@2.0.1)(@welshman/lib@0.8.8)(@welshman/net@0.8.8(@welshman/lib@0.8.8)(@welshman/util@0.8.8(@noble/curves@1.9.7)(@welshman/lib@0.8.8)(nostr-tools@2.20.0(typescript@5.9.3)))(ws@8.18.3))(@welshman/util@0.8.8(@noble/curves@1.9.7)(@welshman/lib@0.8.8)(nostr-tools@2.20.0(typescript@5.9.3)))(nostr-signer-capacitor-plugin@https://codeload.github.com/coracle-social/nostr-signer-capacitor-plugin/tar.gz/be4bb90a1a15c8eec0934f2f66ce9e82ecc72d51(@capacitor/core@8.0.1))(nostr-tools@2.20.0(typescript@5.9.3)))(@welshman/util@0.8.8(@noble/curves@1.9.7)(@welshman/lib@0.8.8)(nostr-tools@2.20.0(typescript@5.9.3)))(nostr-tools@2.20.0(typescript@5.9.3))
+        specifier: ^0.2.1
+        version: 0.2.1(@frostr/bifrost@1.0.7(typescript@5.9.3))(@noble/hashes@2.0.1)(@welshman/lib@0.8.8)(@welshman/net@0.8.8(@welshman/lib@0.8.8)(@welshman/util@0.8.8(@noble/curves@1.9.7)(@welshman/lib@0.8.8)(nostr-tools@2.20.0(typescript@5.9.3)))(ws@8.18.3))(@welshman/signer@0.8.8(@noble/curves@1.9.7)(@noble/hashes@2.0.1)(@welshman/lib@0.8.8)(@welshman/net@0.8.8(@welshman/lib@0.8.8)(@welshman/util@0.8.8(@noble/curves@1.9.7)(@welshman/lib@0.8.8)(nostr-tools@2.20.0(typescript@5.9.3)))(ws@8.18.3))(@welshman/util@0.8.8(@noble/curves@1.9.7)(@welshman/lib@0.8.8)(nostr-tools@2.20.0(typescript@5.9.3)))(nostr-signer-capacitor-plugin@https://codeload.github.com/coracle-social/nostr-signer-capacitor-plugin/tar.gz/be4bb90a1a15c8eec0934f2f66ce9e82ecc72d51(@capacitor/core@8.0.1))(nostr-tools@2.20.0(typescript@5.9.3)))(@welshman/util@0.8.8(@noble/curves@1.9.7)(@welshman/lib@0.8.8)(nostr-tools@2.20.0(typescript@5.9.3)))(nostr-tools@2.20.0(typescript@5.9.3))
       '@poppanator/sveltekit-svg':
         specifier: ^4.2.1
         version: 4.2.1(rollup@2.80.0)(svelte@5.48.0)(svgo@3.3.2)(vite@5.4.21(@types/node@25.0.10)(terser@5.46.0))
@@ -82,7 +82,7 @@ importers:
         version: 0.6.8(@sveltejs/kit@2.50.1(@sveltejs/vite-plugin-svelte@4.0.4(svelte@5.48.0)(vite@5.4.21(@types/node@25.0.10)(terser@5.46.0)))(svelte@5.48.0)(typescript@5.9.3)(vite@5.4.21(@types/node@25.0.10)(terser@5.46.0)))(@vite-pwa/assets-generator@0.2.6)(vite-plugin-pwa@0.21.2(@vite-pwa/assets-generator@0.2.6)(vite@5.4.21(@types/node@25.0.10)(terser@5.46.0))(workbox-build@7.3.0)(workbox-window@7.3.0))
       '@welshman/app':
         specifier: ^0.8.8
-        version: 0.8.8(659f4846f3d6dd8c528f1a15ef74a226)
+        version: 0.8.8(b90dd618d8ad3ba87405490e903259ce)
       '@welshman/content':
         specifier: ^0.8.8
         version: 0.8.8(nostr-tools@2.20.0(typescript@5.9.3))
@@ -1376,9 +1376,9 @@ packages:
   '@polka/url@1.0.0-next.29':
     resolution: {integrity: sha512-wwQAWhWSuHaag8c4q/KN/vCoeOJYshAIvMQwD4GpSb3OiZklFfvAgmj0VCBBImRpuF/aFgIRzllXlVX93Jevww==}
 
-  '@pomade/core@0.1.3':
-    resolution: {integrity: sha512-I7y0bhLKOhnxWZSLqeLfEW6qLXsSZf5l3R1eOTe4izr257eVwDRu3EyUsHDJ+PjR8jJptJxMyN+exlt8BBCpgA==}
-    version: 0.1.3
+  '@pomade/core@0.2.1':
+    resolution: {integrity: sha512-zXpPQPkhVe7OchmRDe2MbHdUxiCSeUuMwrHOyeOBs/xD1EfY093Mwj6Cu/OLfz0wxivBDSp1GMMmxqKbLWam3Q==}
+    version: 0.2.1
     engines: {node: '>=12.0.0'}
     peerDependencies:
       '@frostr/bifrost': ^1.0.7
@@ -6436,7 +6436,7 @@ snapshots:
 
   '@polka/url@1.0.0-next.29': {}
 
-  '@pomade/core@0.1.3(@frostr/bifrost@1.0.7(typescript@5.9.3))(@noble/hashes@2.0.1)(@welshman/lib@0.8.8)(@welshman/net@0.8.8(@welshman/lib@0.8.8)(@welshman/util@0.8.8(@noble/curves@1.9.7)(@welshman/lib@0.8.8)(nostr-tools@2.20.0(typescript@5.9.3)))(ws@8.18.3))(@welshman/signer@0.8.8(@noble/curves@1.9.7)(@noble/hashes@2.0.1)(@welshman/lib@0.8.8)(@welshman/net@0.8.8(@welshman/lib@0.8.8)(@welshman/util@0.8.8(@noble/curves@1.9.7)(@welshman/lib@0.8.8)(nostr-tools@2.20.0(typescript@5.9.3)))(ws@8.18.3))(@welshman/util@0.8.8(@noble/curves@1.9.7)(@welshman/lib@0.8.8)(nostr-tools@2.20.0(typescript@5.9.3)))(nostr-signer-capacitor-plugin@https://codeload.github.com/coracle-social/nostr-signer-capacitor-plugin/tar.gz/be4bb90a1a15c8eec0934f2f66ce9e82ecc72d51(@capacitor/core@8.0.1))(nostr-tools@2.20.0(typescript@5.9.3)))(@welshman/util@0.8.8(@noble/curves@1.9.7)(@welshman/lib@0.8.8)(nostr-tools@2.20.0(typescript@5.9.3)))(nostr-tools@2.20.0(typescript@5.9.3))':
+  '@pomade/core@0.2.1(@frostr/bifrost@1.0.7(typescript@5.9.3))(@noble/hashes@2.0.1)(@welshman/lib@0.8.8)(@welshman/net@0.8.8(@welshman/lib@0.8.8)(@welshman/util@0.8.8(@noble/curves@1.9.7)(@welshman/lib@0.8.8)(nostr-tools@2.20.0(typescript@5.9.3)))(ws@8.18.3))(@welshman/signer@0.8.8(@noble/curves@1.9.7)(@noble/hashes@2.0.1)(@welshman/lib@0.8.8)(@welshman/net@0.8.8(@welshman/lib@0.8.8)(@welshman/util@0.8.8(@noble/curves@1.9.7)(@welshman/lib@0.8.8)(nostr-tools@2.20.0(typescript@5.9.3)))(ws@8.18.3))(@welshman/util@0.8.8(@noble/curves@1.9.7)(@welshman/lib@0.8.8)(nostr-tools@2.20.0(typescript@5.9.3)))(nostr-signer-capacitor-plugin@https://codeload.github.com/coracle-social/nostr-signer-capacitor-plugin/tar.gz/be4bb90a1a15c8eec0934f2f66ce9e82ecc72d51(@capacitor/core@8.0.1))(nostr-tools@2.20.0(typescript@5.9.3)))(@welshman/util@0.8.8(@noble/curves@1.9.7)(@welshman/lib@0.8.8)(nostr-tools@2.20.0(typescript@5.9.3)))(nostr-tools@2.20.0(typescript@5.9.3))':
     dependencies:
       '@frostr/bifrost': 1.0.7(typescript@5.9.3)
       '@noble/hashes': 2.0.1
@@ -7031,9 +7031,9 @@ snapshots:
     optionalDependencies:
       '@vite-pwa/assets-generator': 0.2.6
 
-  '@welshman/app@0.8.8(659f4846f3d6dd8c528f1a15ef74a226)':
+  '@welshman/app@0.8.8(b90dd618d8ad3ba87405490e903259ce)':
     dependencies:
-      '@pomade/core': 0.1.3(@frostr/bifrost@1.0.7(typescript@5.9.3))(@noble/hashes@2.0.1)(@welshman/lib@0.8.8)(@welshman/net@0.8.8(@welshman/lib@0.8.8)(@welshman/util@0.8.8(@noble/curves@1.9.7)(@welshman/lib@0.8.8)(nostr-tools@2.20.0(typescript@5.9.3)))(ws@8.18.3))(@welshman/signer@0.8.8(@noble/curves@1.9.7)(@noble/hashes@2.0.1)(@welshman/lib@0.8.8)(@welshman/net@0.8.8(@welshman/lib@0.8.8)(@welshman/util@0.8.8(@noble/curves@1.9.7)(@welshman/lib@0.8.8)(nostr-tools@2.20.0(typescript@5.9.3)))(ws@8.18.3))(@welshman/util@0.8.8(@noble/curves@1.9.7)(@welshman/lib@0.8.8)(nostr-tools@2.20.0(typescript@5.9.3)))(nostr-signer-capacitor-plugin@https://codeload.github.com/coracle-social/nostr-signer-capacitor-plugin/tar.gz/be4bb90a1a15c8eec0934f2f66ce9e82ecc72d51(@capacitor/core@8.0.1))(nostr-tools@2.20.0(typescript@5.9.3)))(@welshman/util@0.8.8(@noble/curves@1.9.7)(@welshman/lib@0.8.8)(nostr-tools@2.20.0(typescript@5.9.3)))(nostr-tools@2.20.0(typescript@5.9.3))
+      '@pomade/core': 0.2.1(@frostr/bifrost@1.0.7(typescript@5.9.3))(@noble/hashes@2.0.1)(@welshman/lib@0.8.8)(@welshman/net@0.8.8(@welshman/lib@0.8.8)(@welshman/util@0.8.8(@noble/curves@1.9.7)(@welshman/lib@0.8.8)(nostr-tools@2.20.0(typescript@5.9.3)))(ws@8.18.3))(@welshman/signer@0.8.8(@noble/curves@1.9.7)(@noble/hashes@2.0.1)(@welshman/lib@0.8.8)(@welshman/net@0.8.8(@welshman/lib@0.8.8)(@welshman/util@0.8.8(@noble/curves@1.9.7)(@welshman/lib@0.8.8)(nostr-tools@2.20.0(typescript@5.9.3)))(ws@8.18.3))(@welshman/util@0.8.8(@noble/curves@1.9.7)(@welshman/lib@0.8.8)(nostr-tools@2.20.0(typescript@5.9.3)))(nostr-signer-capacitor-plugin@https://codeload.github.com/coracle-social/nostr-signer-capacitor-plugin/tar.gz/be4bb90a1a15c8eec0934f2f66ce9e82ecc72d51(@capacitor/core@8.0.1))(nostr-tools@2.20.0(typescript@5.9.3)))(@welshman/util@0.8.8(@noble/curves@1.9.7)(@welshman/lib@0.8.8)(nostr-tools@2.20.0(typescript@5.9.3)))(nostr-tools@2.20.0(typescript@5.9.3))
       '@welshman/feeds': 0.8.8(827c582d718d0d373e9315813bab1085)
       '@welshman/lib': 0.8.8
       '@welshman/net': 0.8.8(@welshman/lib@0.8.8)(@welshman/util@0.8.8(@noble/curves@1.9.7)(@welshman/lib@0.8.8)(nostr-tools@2.20.0(typescript@5.9.3)))(ws@8.18.3)
diff --git a/src/app/components/LogInEmail.svelte b/src/app/components/LogInEmail.svelte
index 133b2778..0c647a9f 100644
--- a/src/app/components/LogInEmail.svelte
+++ b/src/app/components/LogInEmail.svelte
@@ -1,4 +1,5 @@
 <script lang="ts">
+  import {uniq} from "@welshman/lib"
   import {Client} from "@pomade/core"
   import {loginWithPomade} from "@welshman/app"
   import {preventDefault} from "@lib/html"
@@ -17,6 +18,7 @@
   import ModalSubtitle from "@lib/components/ModalSubtitle.svelte"
   import ModalFooter from "@lib/components/ModalFooter.svelte"
   import LogInOTP from "@app/components/LogInOTP.svelte"
+  import LogInSelect from "@app/components/LogInSelect.svelte"
   import {pushModal, clearModals} from "@app/util/modal"
   import {setChecked} from "@app/util/notifications"
   import {pushToast} from "@app/util/toast"
@@ -38,7 +40,7 @@
     try {
       const {ok, options, messages, clientSecret} = await Client.loginWithPassword(email, password)
 
-      if (!ok) {
+      if (!ok || options.length === 0) {
         console.error(messages)
 
         return pushToast({
@@ -47,21 +49,25 @@
         })
       }
 
-      const [client, peers] = options[0]!
-      const {clientOptions, ...res} = await Client.selectLogin(clientSecret, client, peers)
-
-      if (res.ok && clientOptions) {
-        loginWithPomade(clientOptions.group.group_pk.slice(2), email, clientOptions)
-        deleteOldPomadeSessions()
-        setChecked("*")
-        clearModals()
+      if (uniq(options.map(o => o.pubkey)).length > 1) {
+        pushModal(LogInSelect, {email, options, clientSecret})
       } else {
-        console.error(res.messages)
+        const {client, peers} = options[0]
+        const {clientOptions, ...res} = await Client.selectLogin(clientSecret, client, peers)
 
-        pushToast({
-          theme: "error",
-          message: "Sorry, we were unable to log you in.",
-        })
+        if (res.ok && clientOptions) {
+          loginWithPomade(clientOptions.group.group_pk.slice(2), email, clientOptions)
+          deleteOldPomadeSessions()
+          setChecked("*")
+          clearModals()
+        } else {
+          console.error(res.messages)
+
+          pushToast({
+            theme: "error",
+            message: "Sorry, we were unable to log you in.",
+          })
+        }
       }
     } finally {
       loading = false
diff --git a/src/app/components/LogInOTPConfirm.svelte b/src/app/components/LogInOTPConfirm.svelte
index b6cf823c..e00b68c8 100644
--- a/src/app/components/LogInOTPConfirm.svelte
+++ b/src/app/components/LogInOTPConfirm.svelte
@@ -1,4 +1,5 @@
 <script lang="ts">
+  import {uniq} from "@welshman/lib"
   import {Client} from "@pomade/core"
   import {loginWithPomade} from "@welshman/app"
   import {preventDefault} from "@lib/html"
@@ -13,7 +14,8 @@
   import ModalTitle from "@lib/components/ModalTitle.svelte"
   import ModalSubtitle from "@lib/components/ModalSubtitle.svelte"
   import ModalFooter from "@lib/components/ModalFooter.svelte"
-  import {clearModals} from "@app/util/modal"
+  import LogInSelect from "@app/components/LogInSelect.svelte"
+  import {pushModal, clearModals} from "@app/util/modal"
   import {setChecked} from "@app/util/notifications"
   import {pushToast} from "@app/util/toast"
   import {POMADE_SIGNERS} from "@app/core/state"
@@ -34,10 +36,10 @@
       .map(x => x.trim())
       .filter(x => x.match(/^[0-9]{8}$/))
 
-    if (otps.length < 2) {
+    if (otps.length < 3) {
       return pushToast({
         theme: "error",
-        message: "Failed to recover, not enough valid recovery codes were provided.",
+        message: "Not enough valid recovery codes were provided.",
       })
     }
 
@@ -50,7 +52,7 @@
         otps,
       )
 
-      if (!ok) {
+      if (!ok || options.length === 0) {
         console.error(messages)
 
         return pushToast({
@@ -59,21 +61,25 @@
         })
       }
 
-      const [client, peers] = options[0]!
-      const {clientOptions, ...res} = await Client.selectLogin(clientSecret, client, peers)
-
-      if (res.ok && clientOptions) {
-        loginWithPomade(clientOptions.group.group_pk.slice(2), email, clientOptions)
-        deleteOldPomadeSessions()
-        setChecked("*")
-        clearModals()
+      if (uniq(options.map(o => o.pubkey)).length > 1) {
+        pushModal(LogInSelect, {email, options, clientSecret})
       } else {
-        console.error(res.messages)
+        const {client, peers} = options[0]
+        const {clientOptions, ...res} = await Client.selectLogin(clientSecret, client, peers)
 
-        pushToast({
-          theme: "error",
-          message: "Sorry, we were unable to log you in.",
-        })
+        if (res.ok && clientOptions) {
+          loginWithPomade(clientOptions.group.group_pk.slice(2), email, clientOptions)
+          deleteOldPomadeSessions()
+          setChecked("*")
+          clearModals()
+        } else {
+          console.error(res.messages)
+
+          pushToast({
+            theme: "error",
+            message: "Sorry, we were unable to log you in.",
+          })
+        }
       }
     } finally {
       loading = false
diff --git a/src/app/components/LogInSelect.svelte b/src/app/components/LogInSelect.svelte
new file mode 100644
index 00000000..16b4f3fb
--- /dev/null
+++ b/src/app/components/LogInSelect.svelte
@@ -0,0 +1,82 @@
+<script lang="ts">
+  import type {AccountOption} from "@pomade/core"
+  import {Client} from "@pomade/core"
+  import {loginWithPomade} from "@welshman/app"
+  import Button from "@lib/components/Button.svelte"
+  import Spinner from "@lib/components/Spinner.svelte"
+  import AltArrowLeft from "@assets/icons/alt-arrow-left.svg?dataurl"
+  import Icon from "@lib/components/Icon.svelte"
+  import Modal from "@lib/components/Modal.svelte"
+  import ModalBody from "@lib/components/ModalBody.svelte"
+  import ModalHeader from "@lib/components/ModalHeader.svelte"
+  import ModalTitle from "@lib/components/ModalTitle.svelte"
+  import ModalSubtitle from "@lib/components/ModalSubtitle.svelte"
+  import ModalFooter from "@lib/components/ModalFooter.svelte"
+  import Profile from "@app/components/Profile.svelte"
+  import {clearModals} from "@app/util/modal"
+  import {setChecked} from "@app/util/notifications"
+  import {pushToast} from "@app/util/toast"
+  import {deleteOldPomadeSessions} from "@app/core/commands"
+
+  interface Props {
+    email: string
+    options: AccountOption[]
+    clientSecret: string
+  }
+
+  let {email, options, clientSecret}: Props = $props()
+
+  let loading = $state(false)
+
+  const back = () => history.back()
+
+  const selectAccount = async ({client, peers}: AccountOption) => {
+    loading = true
+
+    try {
+      const {clientOptions, ...res} = await Client.selectLogin(clientSecret, client, peers)
+
+      if (res.ok && clientOptions) {
+        loginWithPomade(clientOptions.group.group_pk.slice(2), clientOptions.email, clientOptions)
+        deleteOldPomadeSessions()
+        setChecked("*")
+        clearModals()
+      } else {
+        console.error(res.messages)
+
+        pushToast({
+          theme: "error",
+          message: "Sorry, we were unable to log you in.",
+        })
+      }
+    } finally {
+      loading = false
+    }
+  }
+</script>
+
+<Modal>
+  <ModalBody>
+    <ModalHeader>
+      <ModalTitle>Select Account</ModalTitle>
+      <ModalSubtitle>Multiple accounts are associated with {email}. Please select one to continue.</ModalSubtitle>
+    </ModalHeader>
+    <div class="flex flex-col gap-2">
+      {#each options as option (option.pubkey)}
+        <Button
+          onclick={() => selectAccount(option)}
+          disabled={loading}
+          class="card2 bg-alt flex w-full items-center p-3 text-left">
+          <Profile pubkey={option.pubkey} />
+        </Button>
+      {/each}
+    </div>
+  </ModalBody>
+  <ModalFooter>
+    <Button class="btn btn-link" onclick={back} disabled={loading}>
+      <Icon icon={AltArrowLeft} />
+      Go back
+    </Button>
+    <Spinner {loading} />
+  </ModalFooter>
+</Modal>