From ebdcdf83dd2341166f860a43e55497a4c3652568 Mon Sep 17 00:00:00 2001
From: jack <jackjackbits@users.noreply.github.com>
Date: Fri, 19 Jun 2026 17:39:00 +0200
Subject: [PATCH] Authenticate courier deposits by ingress peer

---
 bitchat/Services/BLE/BLEService.swift         |  2 +-
 .../EndToEnd/CourierEndToEndTests.swift       | 43 +++++++++++++++++++
 2 files changed, 44 insertions(+), 1 deletion(-)

diff --git a/bitchat/Services/BLE/BLEService.swift b/bitchat/Services/BLE/BLEService.swift
index ecb1f45a..dfc1ec22 100644
--- a/bitchat/Services/BLE/BLEService.swift
+++ b/bitchat/Services/BLE/BLEService.swift
@@ -3104,7 +3104,7 @@ extension BLEService {
             handleFileTransfer(packet, from: senderID)
 
         case .courierEnvelope:
-            handleCourierEnvelope(packet, from: senderID)
+            handleCourierEnvelope(packet, from: peerID)
 
         case .leave:
             handleLeave(packet, from: senderID)
diff --git a/bitchatTests/EndToEnd/CourierEndToEndTests.swift b/bitchatTests/EndToEnd/CourierEndToEndTests.swift
index 4d085990..7a5518df 100644
--- a/bitchatTests/EndToEnd/CourierEndToEndTests.swift
+++ b/bitchatTests/EndToEnd/CourierEndToEndTests.swift
@@ -292,6 +292,49 @@ struct CourierEndToEndTests {
         #expect(!stored)
     }
 
+    @Test func courierDepositTrustUsesIngressPeerNotClaimedSender() async throws {
+        let alice = makeService()
+        let carol = makeService()
+        let mallory = makeService()
+        preseedConnectedPeer(alice, in: carol)
+        preseedConnectedPeer(mallory, in: carol)
+
+        let trustedAliceKey = Data(hexString: alice.myPeerID.id) ?? Data()
+        carol.courierDepositPolicy = { depositorKey in
+            depositorKey == trustedAliceKey
+        }
+
+        let aliceNoise = NoiseEncryptionService(keychain: MockKeychain())
+        let bobKey = NoiseEncryptionService(keychain: MockKeychain()).getStaticPublicKeyData()
+        let typedPayload = try #require(BLENoisePayloadFactory.privateMessage(content: "spoofed", messageID: "m-spoof"))
+        let sealed = try aliceNoise.sealCourierPayload(typedPayload, recipientStaticKey: bobKey)
+        let now = Date()
+        let envelope = CourierEnvelope(
+            recipientTag: CourierEnvelope.recipientTag(
+                noiseStaticKey: bobKey,
+                epochDay: CourierEnvelope.epochDay(for: now)
+            ),
+            expiry: UInt64((now.timeIntervalSince1970 + 3600) * 1000),
+            ciphertext: sealed
+        )
+        let packet = BitchatPacket(
+            type: MessageType.courierEnvelope.rawValue,
+            senderID: Data(hexString: alice.myPeerID.id) ?? Data(),
+            recipientID: Data(hexString: carol.myPeerID.id),
+            timestamp: UInt64(now.timeIntervalSince1970 * 1000),
+            payload: try #require(envelope.encode()),
+            signature: nil,
+            ttl: 1
+        )
+
+        carol._test_handlePacket(packet, fromPeerID: mallory.myPeerID, preseedPeer: false)
+        let stored = await TestHelpers.waitUntil(
+            { !carol.courierStore.isEmpty },
+            timeout: TestConstants.shortTimeout
+        )
+        #expect(!stored)
+    }
+
     private func makeUnsignedAnnounce(from service: BLEService) throws -> BitchatPacket {
         let announcement = AnnouncementPacket(
             nickname: "Unsigned",