src/db.rs (1)

442-461: Harden get_all_trade_keys: drop empty entries and prep for scale (index).

• Filter out empty strings to avoid useless fetches.
• Consider adding an index on orders.trade_keys to make DISTINCT/IS NOT NULL fast.

Apply this diff within this function to skip empties:

-        let trade_keys: Vec<String> = rows
-            .into_iter()
-            .filter_map(|row| row.trade_keys)
-            .collect();
+        let trade_keys: Vec<String> = rows
+            .into_iter()
+            .filter_map(|row| row.trade_keys)
+            .filter(|s| !s.trim().is_empty())
+            .collect();

Additionally, create an index during DB setup (outside this hunk, in connect()):

         sqlx::query(
             r#"
           CREATE TABLE IF NOT EXISTS orders (
             ...
           );
           CREATE TABLE IF NOT EXISTS users (
             ...
           );
+          CREATE INDEX IF NOT EXISTS idx_orders_trade_keys ON orders(trade_keys);
           "#,
         )

src/cli/adm_send_dm.rs (1)

19-25: Use structured logging for non-errors; stderr for errors.

Keep stdout clean for command output; prefer info!/warn!/eprintln!.

-    println!("SENDING DM with admin keys: {}", admin_keys.public_key().to_hex());
+    info!("Sending DM with admin pubkey: {}", admin_keys.public_key().to_hex());
...
-    println!("Admin gift wrap message sent to {}", receiver);
+    println!("Admin gift wrap message sent to {}", receiver);

src/cli/get_dm_user.rs (2)

15-18: Validate admin key before adding; avoid silent skip later.

Parse now so a bad env var fails loudly.

-    if let Ok(admin_privkey_hex) = std::env::var("NSEC_PRIVKEY") {
-        trade_keys_hex.push(admin_privkey_hex);
-    }
+    if let Ok(admin_privkey_hex) = std::env::var("NSEC_PRIVKEY") {
+        if Keys::parse(&admin_privkey_hex).is_ok() {
+            trade_keys_hex.push(admin_privkey_hex);
+        } else {
+            eprintln!("Ignoring invalid NSEC_PRIVKEY value (failed to parse)");
+        }
+    }

---

56-57: Pass owned Strings to comfy_table to avoid unnecessary refs.

Cleaner and avoids potential trait-coercion quirks.

-        table.add_row(vec![&formatted_date, &sender_hex, &message_str]);
+        table.add_row(vec![formatted_date, sender_hex, message_str]);

src/cli.rs (3)

168-173: Consider adding validation for the since parameter.

The since parameter represents minutes and should have reasonable bounds to prevent excessive data fetching or negative values that could cause unexpected behavior.

Consider adding validation either in the clap definition or in the execute function:

 GetDmUser {
     /// Since time of the messages in minutes
     #[arg(short, long)]
     #[clap(default_value_t = 30)]
+    #[clap(value_parser = clap::value_parser!(i64).range(0..=10080))] // Max 1 week
     since: i64,
 },

---

196-207: Improve documentation clarity for gift-wrapped messages.

The command description should clarify that this uses gift-wrapped messages with ephemeral keys for privacy, distinguishing it from the regular SendDm command.

-    /// Send gift wrapped direct message to a user
+    /// Send gift-wrapped direct message to a user using ephemeral trade keys from an order
     DmToUser {

---

517-524: Consider extracting duplicate pubkey parsing logic.

The pubkey parsing from string is duplicated across multiple command handlers. Consider extracting this to a helper function.

Add a helper function to reduce duplication:

+fn parse_pubkey(pubkey_str: &str) -> Result<PublicKey> {
+    PublicKey::from_str(pubkey_str)
+}

 Commands::DmToUser {
     pubkey,
     order_id,
     message,
 } => {
-    let pubkey = PublicKey::from_str(pubkey)?;
+    let pubkey = parse_pubkey(pubkey)?;
     execute_dm_to_user(pubkey, &client, order_id, message).await?
 }

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

src/util.rs (1)

53-61: Validate the admin key before sending admin DMs.

Enforce an optional check against a configured admin pubkey to prevent accidental misuse; avoid leaking full keys in logs.

 pub async fn send_admin_gift_wrap_dm(
     client: &Client,
     admin_keys: &Keys,
     receiver_pubkey: &PublicKey,
     message: &str,
 ) -> Result<()> {
+    // Optional hardening: if EXPECTED_ADMIN_PUBKEY is set, enforce it
+    if let Ok(expected_hex) = var("EXPECTED_ADMIN_PUBKEY") {
+        let expected = PublicKey::from_hex(&expected_hex)?;
+        anyhow::ensure!(
+            admin_keys.public_key() == expected,
+            "Provided key does not match EXPECTED_ADMIN_PUBKEY"
+        );
+    }
     send_gift_wrap_dm_internal(client, admin_keys, receiver_pubkey, message, true).await
 }

src/cli.rs (4)

167-173: Clarify GetDmUser help to reflect user-only messages

Current help text is vague. Make it explicit that this excludes Mostro/admin messages to avoid confusion with GetDm.

-    /// Get direct messages sent to any trade keys
+    /// Get user-to-user (gift-wrapped) DMs received on your trade keys (excludes Mostro/admin messages)

---

196-207: Disambiguate DmToUser vs SendDm in help text

Spell out that order_id’s trade keys are used for gift-wrap, so users pick this over SendDm when appropriate.

-    /// Send gift wrapped direct message to a user
+    /// Send gift-wrapped direct message to a user using the order's trade keys
@@
-        /// Order id to get ephemeral keys
+        /// Order id whose trade keys will be used for gift-wrapping

---

269-277: Document admin key requirement for AdmSendDm

Add a note in the help text that NSEC_PRIVKEY must be set. The runtime check is good; this improves UX.

-    /// Send gift wrapped direct message to a user (only admin)
+    /// Send gift-wrapped direct message to a user (only admin; requires NSEC_PRIVKEY)

---

433-440: Good switch to anyhow::bail for missing NSEC_PRIVKEY; consider DRY helper

Nice improvement over printing and exiting. To reduce repetition across admin arms, introduce a small helper.

Add once (outside match):

fn admin_keys() -> anyhow::Result<Keys> {
    match std::env::var("NSEC_PRIVKEY") {
        Ok(k) => Ok(Keys::parse(&k)?),
        Err(e) => anyhow::bail!("NSEC_PRIVKEY not set: {e}"),
    }
}

Then update each arm (example shown; apply similarly to others):

-                let id_key = match std::env::var("NSEC_PRIVKEY") {
-                    Ok(id_key) => Keys::parse(&id_key)?,
-                    Err(e) => {
-                        anyhow::bail!("NSEC_PRIVKEY not set: {e}");
-                    }
-                };
+                let id_key = admin_keys()?;

Also applies to: 476-479, 486-489, 496-499

src/util.rs (4)

22-25: Emit a warning when POW is invalid; mirror this in send_dm.

Currently defaults silently to 0. Log once to aid ops/debug. Also replicate the safe parsing in send_dm (Line 80) to avoid panic.

-    let pow: u8 = var("POW")
-        .unwrap_or_else(|_| "0".to_string())
-        .parse()
-        .unwrap_or(0);
+    let pow: u8 = var("POW")
+        .ok()
+        .and_then(|s| s.parse::<u8>().ok())
+        .unwrap_or_else(|| {
+            log::warn!("Invalid POW env var, defaulting to 0");
+            0
+        });

Outside this hunk (send_dm, Line 80), replace:

let pow: u8 = var("POW").unwrap_or('0'.to_string()).parse().unwrap();

with the same safe+warn parsing shown above.

---

215-219: Clamp/validate the since window to avoid surprises with negatives/overflow.

Protect against negative or extreme inputs and keep behavior predictable.

-    let since_time = chrono::Utc::now()
-        .checked_sub_signed(chrono::Duration::minutes(since))
+    let since = since.max(0).min(60 * 24 * 30); // 0..=30 days
+    let since_time = chrono::Utc::now()
+        .checked_sub_signed(chrono::Duration::minutes(since))
         .unwrap()
         .timestamp() as u64;

---

225-231: Consider adding a reasonable limit to the filter.

Without a limit, relays may return large result sets. A modest cap keeps queries bounded.

-            let filters = Filter::new()
+            let filters = Filter::new()
                 .kind(nostr_sdk::Kind::GiftWrap)
                 .pubkey(trade_keys.public_key())
-                .since(fake_timestamp);
+                .since(fake_timestamp)
+                .limit(500);

---

356-363: Filter logic is correct; also align time filtering with the caller-provided since.

The Mostro-only filter looks right. Consider replacing the hardcoded 30-minute cutoff below (Lines 371–374) with the since parameter for consistency with getdm/getdmuser semantics.

Example (outside this hunk):

// Replace fixed 30 min window with the since parameter
let since_time = chrono::Utc::now()
    .checked_sub_signed(chrono::Duration::minutes(since))
    .unwrap()
    .timestamp() as u64;

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.