2 files changed, 112 insertions, 0 deletions

diff --git a/src/nostr/builder.rs b/src/nostr/builder.rs
index 939ccef..acaac71 100644
--- a/src/nostr/builder.rs
+++ b/src/nostr/builder.rs
@@ -102,6 +102,11 @@ impl Nip34WritePolicy {
                         }
 
                         tracing::debug!("Accepted repository announcement: {}", event_id_str);
+                        
+                        // Check purgatory for state events that might now be authorized
+                        self.check_purgatory_state_events_for_identifier(&announcement.identifier)
+                            .await;
+                        
                         WritePolicyResult::Accept
                     }
                     Err(e) => {
@@ -125,6 +130,11 @@ impl Nip34WritePolicy {
                             announcement.identifier
                         );
                         // Don't create bare repository for external announcements
+                        
+                        // Check purgatory for state events that might now be authorized
+                        self.check_purgatory_state_events_for_identifier(&announcement.identifier)
+                            .await;
+                        
                         WritePolicyResult::Accept
                     }
                     Err(e) => {
@@ -304,6 +314,68 @@ impl Nip34WritePolicy {
         }
     }
 
+    /// Check purgatory for state events that might now be authorized by a new announcement
+    ///
+    /// When an announcement is accepted, state events in purgatory that were previously
+    /// rejected due to missing announcements might now be authorized. This method:
+    /// 1. Finds all state events in purgatory for the identifier
+    /// 2. Re-evaluates authorization for each event
+    /// 3. Processes authorized events (releases from purgatory)
+    /// 4. Keeps unauthorized events in purgatory (will expire naturally)
+    async fn check_purgatory_state_events_for_identifier(&self, identifier: &str) {
+        let state_events = self.ctx.purgatory.find_state(identifier);
+        
+        if state_events.is_empty() {
+            return;
+        }
+        
+        tracing::debug!(
+            identifier = %identifier,
+            count = state_events.len(),
+            "Checking purgatory state events after announcement acceptance"
+        );
+        
+        for entry in state_events {
+            // Re-evaluate authorization with the new announcement
+            match self.state_policy.process_state_event(&entry.event, false).await {
+                Ok(WritePolicyResult::Accept) => {
+                    tracing::info!(
+                        event_id = %entry.event.id,
+                        identifier = %identifier,
+                        "State event in purgatory now authorized, will be processed"
+                    );
+                    // Event will be automatically removed from purgatory by process_state_event
+                    // and broadcast to subscribers
+                }
+                Ok(WritePolicyResult::Reject { message, .. }) => {
+                    if message.contains("not authorized") {
+                        tracing::debug!(
+                            event_id = %entry.event.id,
+                            identifier = %identifier,
+                            "State event in purgatory still not authorized, keeping in purgatory"
+                        );
+                        // Keep in purgatory - will expire naturally after 30 minutes
+                    } else {
+                        tracing::debug!(
+                            event_id = %entry.event.id,
+                            identifier = %identifier,
+                            reason = %message,
+                            "State event in purgatory rejected for other reason"
+                        );
+                    }
+                }
+                Err(e) => {
+                    tracing::warn!(
+                        event_id = %entry.event.id,
+                        identifier = %identifier,
+                        error = %e,
+                        "Error re-evaluating state event in purgatory"
+                    );
+                }
+            }
+        }
+    }
+
     /// Handle events that must reference accepted repositories or events
     async fn handle_related_event(&self, event: &Event, event_type: &str) -> WritePolicyResult {
         let event_id_str = event.id.to_bech32().unwrap_or_else(|_| event.id.to_hex());
diff --git a/src/nostr/policy/state.rs b/src/nostr/policy/state.rs
index acb76a3..d26b5ec 100644
--- a/src/nostr/policy/state.rs
+++ b/src/nostr/policy/state.rs
@@ -78,6 +78,46 @@ impl StatePolicy {
         // Get all repositories and state events from db with identifier
         let db_repo_data = fetch_repository_data(&self.ctx.database, &state.identifier).await?;
 
+        // CRITICAL: Check if author is authorized via maintainer set
+        // State events MUST be rejected if author is not in maintainer set of any accepted announcement
+        if db_repo_data.announcements.is_empty() {
+            tracing::warn!(
+                event_id = %event.id,
+                identifier = %state.identifier,
+                author = %event.pubkey.to_hex(),
+                "Rejecting state event: no announcement exists for this repository"
+            );
+            return Ok(WritePolicyResult::Reject {
+                status: false,
+                message: "invalid: no announcement exists for this repository".into(),
+            });
+        }
+
+        let authorized_owners =
+            crate::git::authorization::pubkey_authorised_for_repo_owners(&event.pubkey, &db_repo_data);
+        
+        if authorized_owners.is_empty() {
+            tracing::warn!(
+                event_id = %event.id,
+                identifier = %state.identifier,
+                author = %event.pubkey.to_hex(),
+                announcements_count = db_repo_data.announcements.len(),
+                "Rejecting state event: author not in maintainer set of any announcement"
+            );
+            return Ok(WritePolicyResult::Reject {
+                status: false,
+                message: "invalid: author not authorized for this repository".into(),
+            });
+        }
+
+        tracing::debug!(
+            event_id = %event.id,
+            identifier = %state.identifier,
+            author = %event.pubkey.to_hex(),
+            authorized_for_owners = ?authorized_owners,
+            "State event author authorized via maintainer set"
+        );
+
         // Duplicate check in db
         if db_repo_data.states.iter().any(|e| e.event.id.eq(&event.id)) {
             tracing::debug!("processed state event duplicate (in db): {}", event.id);