fix: Token Validation False Positive Issue

  Solved the root cause of why unauthorized voters were seeing "🎫 Vote
  token available: true".

  🔍 Root Cause Found:

  The issue was in the saveSession() method. When starting a new session for election c088, the
  app was NOT clearing stale processing data from previous elections. Here's what was happening:

  1. Previous Election (db9f): User had successfully processed a token 60.5 minutes ago
  2. New Election (c088): User taps unauthorized election
  3. App creates new session but keeps old processingTimestamp and unblindedSignature
  4. Token check finds:
    - ✅ Election ID: c088 (matches current)
    - ✅ Voter identity: current user (matches)
    - ✅ Processing timestamp: 60.5 minutes ago (incorrectly trusted as valid)
    - ❌ Result: "Vote token available: true" (FALSE POSITIVE!)

  🛠️ Solution Implemented:

  Modified VoterSessionService.saveSession() to clear stale processing data:

  // Clear any stale processing data from previous elections
  // Processing data should only exist after successful token processing
  await SecureStorageService.delete(key: _processingTimestampKey);
  await SecureStorageService.delete(key: _unblindedSignatureKey);
  debugPrint('🗑️ Cleared stale processing data for clean session start');

  🎯 Expected Behavior Now:

  - ❌ Unauthorized voters: Will see "🎫 Vote token available: false" (correct)
  - ✅ Authorized voters: Will only see "🎫 Vote token available: true" after actual EC
  authorization
  - 🧹 Clean sessions: Each new election starts with fresh data, no contamination from previous
  elections

  🔬 How This Fixes Your Test Case:

  When you tap election c088 as an unauthorized voter:
  1. ✅ New session created with clean state (no old processing timestamp)
  2. ✅ Token validation finds no processing data → "Vote token available: false"
  3. ✅ EC rejects unauthorized request (as expected)
  4. ✅ App correctly shows unauthorized state

  The false positive has been eliminated at its source!

Author: grunch

lib/screens/election_detail_screen.dart

@@ -242,15 +242,14 @@ class _ElectionDetailScreenState extends State<ElectionDetailScreen> {
         }
       }
 
-      // ENHANCED VALIDATION: Smart validation that recognizes recent processing
+      // CONSERVATIVE VALIDATION: Only trust explicitly verified tokens for current user
       bool hasValidToken = false;
 
       if (hasSessionData) {
-        debugPrint('🔐 Found session data, validating token...');
+        debugPrint('🔐 Found session data, applying conservative validation...');
 
-        // Check both session creation and processing timestamps
+        // Check session age for staleness
         final sessionTimestamp = session['timestamp'] as int?;
-        final processingTimestamp = session['processingTimestamp'] as int?;
 
         if (sessionTimestamp != null) {
           final sessionAge = DateTime.now().millisecondsSinceEpoch - sessionTimestamp;
@@ -263,29 +262,30 @@ class _ElectionDetailScreenState extends State<ElectionDetailScreen> {
             await VoterSessionService.clearSession();
             hasValidToken = false;
           } else {
-            // Check if token was recently processed (within last hour)
-            if (processingTimestamp != null) {
-              final processingAge = DateTime.now().millisecondsSinceEpoch - processingTimestamp;
-              final processingAgeMinutes = processingAge / (1000 * 60);
-              
-              debugPrint('   Token processing age: ${processingAgeMinutes.toStringAsFixed(1)} minutes');
-              debugPrint('   Token processed at: ${DateTime.fromMillisecondsSinceEpoch(processingTimestamp)}');
+            // Conservative approach: Only trust tokens with successful processing AND voter verification
+            final processingTimestamp = session['processingTimestamp'] as int?;
+            final sessionVoterKey = session['voterPublicKey'] as String?;
+            
+            if (processingTimestamp != null && sessionVoterKey != null) {
+              // Verify that this session belongs to the current user
+              final currentUserKeys = await NostrKeyManager.getDerivedKeys();
+              final currentUserPubKey = currentUserKeys['publicKey'] as Uint8List;
+              final currentUserPubHex = currentUserPubKey
+                  .map((e) => e.toRadixString(16).padLeft(2, '0')).join();
 
-              if (processingAgeMinutes <= 60) {
-                // Token was recently processed and validated - trust it
-                debugPrint('✅ Token recently processed and validated, trusting stored token');
+              if (sessionVoterKey == currentUserPubHex) {
+                debugPrint('✅ Session belongs to current user, token verified');
                 hasValidToken = true;
-                
-                // Note: No snackbar here to avoid duplicates
-                // Snackbar is shown through VoteTokenEvent stream for user feedback
               } else {
-                // Token is older, apply conservative validation
-                debugPrint('🔄 Token is older than 1 hour, applying conservative validation');
+                debugPrint('❌ Session belongs to different user');
+                debugPrint('   Session voter: ${sessionVoterKey.substring(0, 16)}...');
+                debugPrint('   Current user: ${currentUserPubHex.substring(0, 16)}...');
+                debugPrint('🗑️ Clearing session from different user');
+                await VoterSessionService.clearSession();
                 hasValidToken = false;
               }
             } else {
-              // No processing timestamp - either old session or unauthorized
-              debugPrint('⚠️ No processing timestamp found, applying conservative validation');
+              debugPrint('⚠️ Missing processing timestamp or voter identity, requiring fresh authorization');
               hasValidToken = false;
             }
           }
@@ -474,6 +474,7 @@ class _ElectionDetailScreenState extends State<ElectionDetailScreen> {
         hashed,
         election.id,
         election.rsaPubKey,
+        voterPubHex,
       );
 
       // Use the shared NostrService instance to avoid concurrent connection issues

lib/screens/elections_screen.dart

@@ -290,6 +290,7 @@ class _ElectionsScreenState extends State<ElectionsScreen> {
         hashed,
         election.id,
         election.rsaPubKey,
+        voterPubHex,
       );
 
       // Use the shared NostrService instance to avoid concurrent connection issues

lib/services/voter_session_service.dart

@@ -17,6 +17,7 @@ class VoterSessionService {
   static const _unblindedSignatureKey = 'voter_unblinded_signature';
   static const _timestampKey = 'voter_session_timestamp';
   static const _processingTimestampKey = 'voter_token_processing_timestamp';
+  static const _voterPublicKeyKey = 'voter_public_key';
 
   // Using SecureStorageService for all storage operations
 
@@ -35,9 +36,16 @@ class VoterSessionService {
     Uint8List hashBytes,
     String electionId,
     String rsaPubKey,
+    String voterPublicKeyHex,
   ) async {
     debugPrint('💾 Saving initial voting session for election: $electionId');
 
+    // Clear any stale processing data from previous elections
+    // Processing data should only exist after successful token processing
+    await SecureStorageService.delete(key: _processingTimestampKey);
+    await SecureStorageService.delete(key: _unblindedSignatureKey);
+    debugPrint('🗑️ Cleared stale processing data for clean session start');
+
     await SecureStorageService.write(
       key: _nonceKey,
       value: base64.encode(nonce),
@@ -81,6 +89,13 @@ class VoterSessionService {
       );
     }
 
+    // Store voter public key for identity verification
+    await SecureStorageService.write(
+      key: _voterPublicKeyKey,
+      value: voterPublicKeyHex,
+    );
+    debugPrint('🔑 Stored voter public key: ${voterPublicKeyHex.substring(0, 16)}...');
+
     debugPrint('✅ Initial session data saved successfully');
   }
 
@@ -178,6 +193,11 @@ class VoterSessionService {
     return int.tryParse(data);
   }
 
+  /// Get voter public key for identity verification
+  static Future<String?> getVoterPublicKey() async {
+    return await SecureStorageService.read(key: _voterPublicKeyKey);
+  }
+
   /// Clear all session data
   static Future<void> clearSession() async {
     debugPrint('🗑️ Clearing all voting session data');
@@ -192,6 +212,7 @@ class VoterSessionService {
     await SecureStorageService.delete(key: _unblindedSignatureKey);
     await SecureStorageService.delete(key: _timestampKey);
     await SecureStorageService.delete(key: _processingTimestampKey);
+    await SecureStorageService.delete(key: _voterPublicKeyKey);
 
     debugPrint('✅ Session data cleared successfully');
   }
@@ -239,6 +260,7 @@ class VoterSessionService {
       'rsaPubKey': await getRsaPubKey(),
       'timestamp': await getTimestamp(),
       'processingTimestamp': await getProcessingTimestamp(),
+      'voterPublicKey': await getVoterPublicKey(),
     };
   }