From 28a37393ee62e3b53dad69d58810f72151bd58c2 Mon Sep 17 00:00:00 2001
From: DanConwayDev <DanConwayDev@protonmail.com>
Date: Fri, 15 Aug 2025 15:17:39 +0100
Subject: feat(remote): list proposals as `refs/pr-by-id/*`

This branch name cannot be attacked by brute forcing a
shorthand event id like refs/pr/<branch-name(<shorthand-event-id)
can.
---
 src/bin/git_remote_nostr/list.rs | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'src/bin/git_remote_nostr')

diff --git a/src/bin/git_remote_nostr/list.rs b/src/bin/git_remote_nostr/list.rs
index 137c13f..f5eaee4 100644
--- a/src/bin/git_remote_nostr/list.rs
+++ b/src/bin/git_remote_nostr/list.rs
@@ -86,7 +86,7 @@ pub async fn run_list(
     );
 
     state.extend(
-        // get as refs/pr/<branch-name>(<shorthand-event-id>)
+        // get as refs/pr/<branch-name>(<shorthand-event-id>) and refs/pr-by-id/<event-id>
         get_all_proposals_state(git_repo, repo_ref).await?,
     );
 
@@ -248,11 +248,13 @@ async fn get_all_proposals_state(
                 {
                     if let Ok(tip) = tag_value(pr_or_pr_update, "c") {
                         state.insert(format!("refs/{branch_name}"), tip.clone());
+                        state.insert(format!("refs/pr-by-id/{}", proposal.id), tip);
                     }
                 } else if let Ok(tip) =
                     make_commits_for_proposal(git_repo, repo_ref, &events_to_apply)
                 {
                     state.insert(format!("refs/{branch_name}"), tip.clone());
+                    state.insert(format!("refs/pr-by-id/{}", proposal.id), tip);
                 }
             }
         }
-- 
cgit v1.2.3