fix: verify identity ownership for the app identity

Author: pcarranzav

apps/server/src/index.ts

@@ -318,6 +318,20 @@ app.post('/connect/app-identity', async (req, res) => {
       res.status(401).send('Unauthorized');
       return;
     }
+    if (
+      !Identity.verifyIdentityOwnership(
+        accountAddress,
+        message.signaturePublicKey,
+        message.accountProof,
+        message.keyProof,
+        CHAIN,
+        RPC_URL,
+      )
+    ) {
+      console.log('Ownership proof is invalid');
+      res.status(401).send('Unauthorized');
+      return;
+    }
     const sessionToken = bytesToHex(randomBytes(32));
     const sessionTokenExpires = new Date(Date.now() + 1000 * 60 * 60 * 24 * 30); // 30 days
     const appIdentity = await createAppIdentity({