fix: closing a transaction or signature approval window leaves the request pending (closes #673)

Closing a transaction or signature approval window no longer rejects the request; only Cancel does. The browser can close that window when the user clicks away, for example to copy the password from a password manager. The request stays pending and the site gets no answer. Pressing the toolbar button opens the oldest such request, unless an approved attempt still holds it. A Reject the background refuses keeps the window open with the background's message. The worker points the toolbar back at the wallet when it starts.

While such a request waits, the transaction slot stays held, so another site's eth_sendTransaction gets -32002. An address switch still rejects pending approvals with 4001.

Model: opus-5-5

src/background/index.js

@@ -161,9 +161,9 @@ let txApprovalSlot = null;
 const APPROVAL_PENDING_CODE = -32002;
 
 // True at every moment this can be sent: the slot is taken immediately before
-// the transaction is populated, so the other request is either being prepared
-// or on screen. It does not claim the other one is displayed yet, because for
-// the length of one network round trip it is not.
+// the transaction is populated, so the other request is being prepared, is on
+// screen, or waits with its window closed. It does not claim the other one is
+// displayed yet, because for the length of one network round trip it is not.
 const TX_APPROVAL_PENDING_MESSAGE =
     "AutistMask handles one transaction at a time, and another one is" +
     " already in progress, so this one was not sent. Please finish that" +
@@ -383,14 +383,26 @@ async function proxyRpc(method, params) {
     return json.result;
 }
 
-// The site-connection approval the toolbar popup is set to open, or null while
-// it opens the wallet. Set only by resetPopupUrl() and showInToolbarPopup().
+// The approval the toolbar popup is set to open, or null while it opens the
+// wallet. Set only by updateToolbarPopup() and showInToolbarPopup().
 let toolbarPopupApprovalId = null;
 
-function resetPopupUrl() {
-    toolbarPopupApprovalId = null;
+// Point the toolbar popup at the oldest pending approval whose window closed,
+// or at the wallet when there is none. The user can then answer that approval
+// from the toolbar popup. pendingApprovals lists approvals in the order they
+// were added, so the first one found is the oldest. An approval held by a
+// running attempt is skipped until that attempt ends.
+function updateToolbarPopup() {
+    const closed = Object.values(pendingApprovals).find(
+        (approval) => approval.windowClosed && !approval.attemptInFlight,
+    );
+    toolbarPopupApprovalId = closed ? closed.id : null;
     if (actionNs && typeof actionNs.setPopup === "function") {
-        actionNs.setPopup({ popup: "src/popup/index.html" });
+        actionNs.setPopup({
+            popup: closed
+                ? "src/popup/index.html?approval=" + closed.id
+                : "src/popup/index.html",
+        });
     }
 }
 
@@ -420,15 +432,16 @@ function settleApproval(id, result, options) {
     // approval stops being alive.
     releaseTxApprovalSlotFor(id);
     approval.resolve(result);
-    resetPopupUrl();
+    updateToolbarPopup();
     return true;
 }
 
 // What a pending approval resolves to when it is given up on rather than
-// answered: the window was closed, or could not be opened at all. A tx or sign
-// approval answers the requesting page in EIP-1193 shape; a site-connection or
-// network-switch approval answers its handler in the shape the popup's
-// decision has, as a refusal.
+// answered: a site-connection or network-switch window was closed, or the
+// window could not be opened at all. An address switch in the wallet gives up
+// pending approvals too. A tx or sign approval answers the requesting page in
+// EIP-1193 shape; a site-connection or network-switch approval answers its
+// handler in the shape the popup's decision has, as a refusal.
 function abandonedResult(approval, code, message) {
     if (approval.type === "tx" || approval.type === "sign") {
         return { error: { code, message } };
@@ -436,8 +449,9 @@ function abandonedResult(approval, code, message) {
     return { approved: false, remember: false };
 }
 
-// A window the user closed without answering is a refusal by the user, which
-// is 4001 and the wording every other rejection path already uses.
+// A site-connection or network-switch window the user closed without answering
+// is a refusal by the user, which is 4001 and the wording every other rejection
+// path already uses.
 const APPROVAL_REJECTED_CODE = 4001;
 const APPROVAL_REJECTED_MESSAGE = "User rejected the request.";
 
@@ -465,31 +479,16 @@ const APPROVAL_WINDOW_FAILED_MESSAGE =
 function claimApproval(approval) {
     if (approval.attemptInFlight) return false;
     approval.attemptInFlight = true;
+    updateToolbarPopup();
     return true;
 }
 
 // Release an approval whose attempt failed in a way the user can retry.
-// Nothing was broadcast, so the next attempt may claim it.
-//
-// Unless the window it would be retried in is already gone. The user closed it
-// while the attempt was running and settleApproval() declined then, correctly,
-// because the attempt still owned the approval; the attempt has now failed, so
-// nothing owns it and nothing can reach it. Left standing it would hold the
-// requesting page's promise open forever and, with it, the transaction
-// approval slot. It is settled here as the rejection the closed window
-// already meant.
+// Nothing was broadcast, so the next attempt may claim it. If the user closed
+// its window while the attempt ran, the toolbar popup opens it for that retry.
 function releaseApproval(approval) {
     approval.attemptInFlight = false;
-    if (approval.windowClosed) {
-        settleApproval(
-            approval.id,
-            abandonedResult(
-                approval,
-                APPROVAL_REJECTED_CODE,
-                APPROVAL_REJECTED_MESSAGE,
-            ),
-        );
-    }
+    updateToolbarPopup();
 }
 
 // Open approval in a separate popup window, unless it is no longer pending.
@@ -712,9 +711,7 @@ function isExtensionSender(sender) {
 // had refused.
 //
 // TX and sign approvals do not decide here. They stay pending across a
-// disconnect. When their window closes, the windows.onRemoved listener below
-// rejects them, unless an approved attempt is still running, in which case
-// that attempt answers the page.
+// disconnect, and across their window closing, until the user answers them.
 runtime.onConnect.addListener((port) => {
     if (port.name.startsWith("approval:")) {
         const id = port.name.split(":")[1];
@@ -742,9 +739,7 @@ runtime.onConnect.addListener((port) => {
             const approval = pendingApprovals[id];
             if (approval) {
                 if (approval.type === "tx" || approval.type === "sign") {
-                    // When its window closes, windows.onRemoved rejects it,
-                    // unless an approved attempt is still running, in which
-                    // case that attempt answers the page.
+                    // It stays pending until the user answers it.
                     return;
                 }
                 settleApproval(id, { approved: false, remember: false });
@@ -1297,7 +1292,7 @@ async function broadcastAccountsChanged() {
             windowsRemove(approval.windowId).catch(() => {});
         }
     }
-    resetPopupUrl();
+    updateToolbarPopup();
     // An address switch ends every connection allowed without "Remember". This
     // waits on storage, so it comes after the pending approvals above, which
     // are still rejected the moment the switch arrives.
@@ -1489,36 +1484,44 @@ if (runtime.onStartup) {
 }
 startBackgroundJobs();
 
-// When approval window is closed without a response, treat as rejection.
-// "Without a response" is the operative part: the popup stays open across the
-// verify and broadcast it is waiting on, so a user closing an apparently-hung
-// window is an ordinary event with an attempt already in flight behind it.
-// settleApproval() refuses those, which leaves the attempt to report its real
-// outcome to the page — and the window is recorded as gone, so that an attempt
-// which then fails retryably settles instead of waiting in a window that no
-// longer exists.
+// The toolbar popup keeps its URL when the worker stops. A worker that starts
+// holds no approvals, so the toolbar popup is pointed back at the wallet.
+updateToolbarPopup();
+
+// A transaction or signature approval stays pending when its window closes.
+// The browser can close that window when the user clicks away from it, for
+// example to copy the password from a password manager. The approval is marked
+// as closed, so the toolbar popup can open it (see updateToolbarPopup()). An
+// attempt already running when the window closes goes on and reports its
+// outcome to the page.
 //
-// A site-connection or network-switch approval whose popup connected its port
-// is not decided here. That popup approves and closes in the same breath, and
-// this event races the decision on a channel of its own — the same race the
-// port exists to end. Its port disconnect says the same thing this event does,
-// in an order that is defined, so the disconnect is left to say it. The window
-// closing before any port connected is the one case with nothing else to speak
-// for it, and is rejected here so the dApp is not left waiting on a window that
-// is gone.
+// This listener rejects a site-connection or network-switch approval whose
+// window closes before its popup connected its port. Once the port is
+// connected, the approval is left to the port. That popup approves and closes
+// in the same breath, and this event races the decision on a channel of its
+// own — the same race the port exists to end. Its port disconnect says the
+// same thing this event does, in an order that is defined, so the disconnect is
+// left to say it. The window closing before any port connected is the one case
+// with nothing else to speak for it, and is rejected here so the dApp is not
+// left waiting on a window that is gone.
 if (windowsNs && windowsNs.onRemoved) {
     windowsNs.onRemoved.addListener((windowId) => {
         for (const [id, approval] of Object.entries(pendingApprovals)) {
             if (approval.windowId !== windowId) continue;
-            const decidedOnPort =
-                approval.type !== "tx" && approval.type !== "sign";
-            if (decidedOnPort && approval.portConnected) continue;
-            const rejection = abandonedResult(
-                approval,
-                APPROVAL_REJECTED_CODE,
-                APPROVAL_REJECTED_MESSAGE,
+            if (approval.type === "tx" || approval.type === "sign") {
+                approval.windowClosed = true;
+                updateToolbarPopup();
+                continue;
+            }
+            if (approval.portConnected) continue;
+            settleApproval(
+                id,
+                abandonedResult(
+                    approval,
+                    APPROVAL_REJECTED_CODE,
+                    APPROVAL_REJECTED_MESSAGE,
+                ),
             );
-            if (!settleApproval(id, rejection)) approval.windowClosed = true;
         }
     });
 }
@@ -1663,7 +1666,9 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                 });
                 return false;
             }
-            return true;
+            // The popup waits for this answer before it closes its window.
+            sendResponse(null);
+            return false;
         }
 
         // The popup signs; it reports back here when it could not. Keep the
@@ -1863,7 +1868,8 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                 });
                 return false;
             }
-            return true;
+            sendResponse(null);
+            return false;
         }
 
         // The popup signs; it reports back here when it could not. Keep the