Tighten panic wipe and NIP-17 regressions

bitchatTests/NostrProtocolTests.swift

@@ -120,6 +120,42 @@ struct NostrProtocolTests {
         }
     }
 
+    @Test func decryptRejectsInvalidSealSignature() throws {
+        let sender = try NostrIdentity.generate()
+        let recipient = try NostrIdentity.generate()
+        let giftWrap = try NostrProtocol.createPrivateMessageWithInvalidSealSignatureForTesting(
+            content: "forged signature",
+            recipientPubkey: recipient.publicKeyHex,
+            senderIdentity: sender
+        )
+
+        expectInvalidEvent {
+            _ = try NostrProtocol.decryptPrivateMessage(
+                giftWrap: giftWrap,
+                recipientIdentity: recipient
+            )
+        }
+    }
+
+    @Test func decryptRejectsSealRumorPubkeyMismatch() throws {
+        let claimedSender = try NostrIdentity.generate()
+        let sealSigner = try NostrIdentity.generate()
+        let recipient = try NostrIdentity.generate()
+        let giftWrap = try NostrProtocol.createPrivateMessageWithMismatchedSealRumorPubkeyForTesting(
+            content: "spoofed sender",
+            recipientPubkey: recipient.publicKeyHex,
+            rumorIdentity: claimedSender,
+            sealSignerIdentity: sealSigner
+        )
+
+        expectInvalidEvent {
+            _ = try NostrProtocol.decryptPrivateMessage(
+                giftWrap: giftWrap,
+                recipientIdentity: recipient
+            )
+        }
+    }
+
     func testAckRoundTripNIP44V2_Delivered() throws {
         // Identities
         let sender = try NostrIdentity.generate()
@@ -260,4 +296,15 @@ struct NostrProtocolTests {
         if rem > 0 { str.append(String(repeating: "=", count: 4 - rem)) }
         return Data(base64Encoded: str)
     }
+
+    private func expectInvalidEvent(_ operation: () throws -> Void) {
+        do {
+            try operation()
+            Issue.record("Expected NostrError.invalidEvent")
+        } catch NostrError.invalidEvent {
+            return
+        } catch {
+            Issue.record("Expected NostrError.invalidEvent, got \(error)")
+        }
+    }
 }