From 28a37393ee62e3b53dad69d58810f72151bd58c2 Mon Sep 17 00:00:00 2001
From: DanConwayDev <DanConwayDev@protonmail.com>
Date: Fri, 15 Aug 2025 15:17:39 +0100
Subject: feat(remote): list proposals as `refs/pr-by-id/*`

This branch name cannot be attacked by brute forcing a
shorthand event id like refs/pr/<branch-name(<shorthand-event-id)
can.
---
 src/bin/git_remote_nostr/list.rs |  4 +++-
 test_utils/src/lib.rs            | 20 +++++++++++++++++++-
 tests/git_remote_nostr/list.rs   |  2 ++
 3 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/src/bin/git_remote_nostr/list.rs b/src/bin/git_remote_nostr/list.rs
index 137c13f..f5eaee4 100644
--- a/src/bin/git_remote_nostr/list.rs
+++ b/src/bin/git_remote_nostr/list.rs
@@ -86,7 +86,7 @@ pub async fn run_list(
     );
 
     state.extend(
-        // get as refs/pr/<branch-name>(<shorthand-event-id>)
+        // get as refs/pr/<branch-name>(<shorthand-event-id>) and refs/pr-by-id/<event-id>
         get_all_proposals_state(git_repo, repo_ref).await?,
     );
 
@@ -248,11 +248,13 @@ async fn get_all_proposals_state(
                 {
                     if let Ok(tip) = tag_value(pr_or_pr_update, "c") {
                         state.insert(format!("refs/{branch_name}"), tip.clone());
+                        state.insert(format!("refs/pr-by-id/{}", proposal.id), tip);
                     }
                 } else if let Ok(tip) =
                     make_commits_for_proposal(git_repo, repo_ref, &events_to_apply)
                 {
                     state.insert(format!("refs/{branch_name}"), tip.clone());
+                    state.insert(format!("refs/pr-by-id/{}", proposal.id), tip);
                 }
             }
         }
diff --git a/test_utils/src/lib.rs b/test_utils/src/lib.rs
index 3e348a4..8d81efe 100644
--- a/test_utils/src/lib.rs
+++ b/test_utils/src/lib.rs
@@ -12,7 +12,7 @@ use dialoguer::theme::{ColorfulTheme, Theme};
 use futures::{executor::block_on, future::join_all};
 use git::GitTestRepo;
 use git2::{Signature, Time};
-use nostr::{self, Kind, Tag, nips::nip65::RelayMetadata};
+use nostr::{self, Kind, Tag, event::EventId, nips::nip65::RelayMetadata};
 use nostr_database::NostrDatabase;
 use nostr_lmdb::NostrLMDB;
 use nostr_sdk::{Client, Event, NostrSigner, TagStandard, serde_json};
@@ -1197,6 +1197,24 @@ pub fn get_proposal_branch_name_from_events(
     bail!("failed to find proposal root with branch-name tag matching title")
 }
 
+pub fn get_proposal_id_from_branch_name(
+    events: &[nostr::Event],
+    branch_name_in_event: &str,
+) -> Result<EventId> {
+    let mut events = events.to_owned();
+    events.reverse();
+    for event in events {
+        if event
+            .tags
+            .iter()
+            .any(|t| t.as_slice()[0].eq("branch-name") && t.as_slice()[1].eq(branch_name_in_event))
+        {
+            return Ok(event.id);
+        }
+    }
+    bail!("failed to find proposal root with branch-name tag matching title")
+}
+
 pub static FEATURE_BRANCH_NAME_1: &str = "feature-example-t";
 pub static FEATURE_BRANCH_NAME_2: &str = "feature-example-f";
 pub static FEATURE_BRANCH_NAME_3: &str = "feature-example-c";
diff --git a/tests/git_remote_nostr/list.rs b/tests/git_remote_nostr/list.rs
index a2dfe8c..50ea350 100644
--- a/tests/git_remote_nostr/list.rs
+++ b/tests/git_remote_nostr/list.rs
@@ -327,6 +327,8 @@ mod with_state_announcement {
                 let branch_name = get_proposal_branch_name_from_events(&r55.events, name)?;
                 pr_refs.push(format!("{tip} refs/heads/{branch_name}"));
                 pr_refs.push(format!("{tip} refs/{branch_name}"));
+                let proposal_id = get_proposal_id_from_branch_name(&r55.events, name)?;
+                pr_refs.push(format!("{tip} refs/pr-by-id/{proposal_id}"));
             }
 
             assert_eq!(
-- 
cgit v1.2.3