fix: only the user switches the wallet's network (closes #408)

A connected site's wallet_switchEthereumChain request for the other
supported network now opens a prompt in its own window, through the
existing approval machinery, naming the site and both networks. The
network, endpoints, balances and caches change, and chainChanged is
sent, only when the user approves it; rejecting or closing the prompt
answers 4001. One such prompt per site at a time; a request for the
active network needs none. The approval window no longer shows the
connection prompt while it waits for the approval's description,
since both prompts answer on the same port.

Model: opus-5-5

src/background/index.js

@@ -137,11 +137,12 @@ function releaseTxApprovalSlotFor(approvalId) {
     }
 }
 
-// One site-connection approval and one sign approval per site at a time: a
-// page that asks again before the user has answered is refused with the code
-// above instead of opening another window, so it cannot bury the user in
-// prompts. The pending approval itself holds the place, so a caller must test
-// this and raise its approval with nothing awaited in between.
+// One site-connection approval, one sign approval and one network-switch
+// approval per site at a time: a page that asks again before the user has
+// answered is refused with the code above instead of opening another window,
+// so it cannot bury the user in prompts. The pending approval itself holds the
+// place, so a caller must test this and raise its approval with nothing awaited
+// in between.
 function findPendingApproval(origin, type) {
     return Object.values(pendingApprovals).find(
         (approval) => approval.origin === origin && approval.type === type,
@@ -348,8 +349,9 @@ function settleApproval(id, result, options) {
 
 // What a pending approval resolves to when it is given up on rather than
 // answered: the window was closed, or could not be opened at all. A tx or sign
-// approval answers the requesting page in EIP-1193 shape; a site-connection
-// approval answers the connection handler in its own.
+// approval answers the requesting page in EIP-1193 shape; a site-connection or
+// network-switch approval answers its handler in the shape the popup's
+// decision has, as a refusal.
 function abandonedResult(approval, code, message) {
     if (approval.type === "tx" || approval.type === "sign") {
         return { error: { code, message } };
@@ -588,6 +590,26 @@ function requestSignApproval(origin, signParams, approvedFrom) {
     });
 }
 
+// Open a network-switch approval popup and return a promise that resolves with
+// { approved }. Opened in a window, as tx and sign approvals are, because a
+// site's request is not a user gesture. The popup answers on the approval port,
+// as a site-connection approval does.
+function requestNetworkApproval(origin, currentNetworkId, requestedNetworkId) {
+    return new Promise((resolve) => {
+        const id = crypto.randomUUID();
+        pendingApprovals[id] = {
+            id,
+            origin,
+            currentNetworkId,
+            requestedNetworkId,
+            resolve,
+            type: "network",
+        };
+
+        openApprovalWindow(id);
+    });
+}
+
 // Anything only the extension's own pages may say. A content script speaks
 // with the page's URL, so this is what separates the popup from the site the
 // popup is being asked about.
@@ -597,8 +619,8 @@ function isExtensionSender(sender) {
 }
 
 // The approval popup's port: it carries the user's decision on a
-// site-connection approval, and its disconnect is how that approval learns the
-// popup closed without one.
+// site-connection or network-switch approval, and its disconnect is how that
+// approval learns the popup closed without one.
 //
 // The decision travels this port rather than a one-off runtime.sendMessage()
 // for exactly one reason: the port is also what the popup's window.close()
@@ -806,6 +828,10 @@ async function handleRpc(method, params, origin) {
         // tab is served from, so a page the user never connected to must
         // not be able to do it. Ungated, any page could clear the
         // [TESTNET] banner under a user who believed they were on Sepolia.
+        //
+        // A connected site does not switch it either: only the user does,
+        // by approving the request on the prompt below
+        // (https://git.eeqj.de/sneak/AutistMask/issues/408).
         const s = await getState();
         const activeAddress = activeAddressOf(s);
         const allowed = s.allowedSites[activeAddress] || [];
@@ -827,6 +853,27 @@ async function handleRpc(method, params, origin) {
         }
         if (SUPPORTED_CHAIN_IDS.has(chainId)) {
             const target = networkByChainId(chainId);
+            if (findPendingApproval(origin, "network")) {
+                return {
+                    error: {
+                        code: APPROVAL_PENDING_CODE,
+                        message: APPROVAL_PENDING_MESSAGE,
+                    },
+                };
+            }
+            const decision = await requestNetworkApproval(
+                origin,
+                s.networkId,
+                target.id,
+            );
+            if (!decision.approved) {
+                return {
+                    error: {
+                        code: APPROVAL_REJECTED_CODE,
+                        message: APPROVAL_REJECTED_MESSAGE,
+                    },
+                };
+            }
             // Read-modify-write against storage. The old path went through
             // onChainSwitch(), which mutates the singleton and then persists
             // every field of it — on an unloaded worker that wrote empty
@@ -1345,20 +1392,21 @@ startBackgroundJobs();
 // which then fails retryably settles instead of waiting in a window that no
 // longer exists.
 //
-// A site-connection approval whose popup connected its port is not decided
-// here. That popup approves and closes in the same breath, and this event
-// races the decision on a channel of its own — the same race the port exists
-// to end. Its port disconnect says the same thing this event does, in an order
-// that is defined, so the disconnect is left to say it. The window closing
-// before any port connected is the one case with nothing else to speak for it,
-// and is rejected here so the dApp is not left waiting on a window that is
-// gone.
+// A site-connection or network-switch approval whose popup connected its port
+// is not decided here. That popup approves and closes in the same breath, and
+// this event races the decision on a channel of its own — the same race the
+// port exists to end. Its port disconnect says the same thing this event does,
+// in an order that is defined, so the disconnect is left to say it. The window
+// closing before any port connected is the one case with nothing else to speak
+// for it, and is rejected here so the dApp is not left waiting on a window that
+// is gone.
 if (windowsNs && windowsNs.onRemoved) {
     windowsNs.onRemoved.addListener((windowId) => {
         for (const [id, approval] of Object.entries(pendingApprovals)) {
             if (approval.windowId !== windowId) continue;
-            const isSite = approval.type !== "tx" && approval.type !== "sign";
-            if (isSite && approval.portConnected) continue;
+            const decidedOnPort =
+                approval.type !== "tx" && approval.type !== "sign";
+            if (decidedOnPort && approval.portConnected) continue;
             const rejection = abandonedResult(
                 approval,
                 APPROVAL_REJECTED_CODE,
@@ -1446,6 +1494,11 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                 resp.signParams = approval.signParams;
                 resp.approvedFrom = approval.approvedFrom;
             }
+            if (approval.type === "network") {
+                resp.type = "network";
+                resp.currentNetworkId = approval.currentNetworkId;
+                resp.requestedNetworkId = approval.requestedNetworkId;
+            }
             // Flag if the requesting domain is on the phishing blocklist.
             resp.isPhishingDomain = isPhishingDomain(
                 extractHostname(approval.origin),