feat: vendor and censor the phishing blocklist at build time (closes #219)

src/shared/alarms.js

@@ -17,16 +17,26 @@
 // run finished and the alarm fires one run-duration earlier than that. Every
 // guard must therefore either be strictly shorter than the period it gates or
 // be bypassed on the scheduled tick — see backgroundRefresh() in
-// src/background/index.js and updatePhishingList() in shared/phishingDomains.js.
+// src/background/index.js.
 
 const { alarmsApi } = require("./browserApi");
 
 const BALANCE_REFRESH_ALARM = "autistmask-balance-refresh";
-const PHISHING_REFRESH_ALARM = "autistmask-phishing-refresh";
+
+// Alarms this extension used to create and no longer has a handler for. A
+// browser keeps an alarm until something clears it, so a job that is deleted
+// from the code goes on waking the service worker on its old schedule forever,
+// on every install that ever ran the version which created it. Removing the job
+// means removing the alarm, so retired names are listed here and cleared on
+// every start until the installs that carry them are long gone.
+const OBSOLETE_ALARMS = [
+    // The 24-hour phishing blocklist refresh, retired when the runtime fetch
+    // was removed and the list became purely build-time vendored.
+    "autistmask-phishing-refresh",
+];
 
 const MIN_ALARM_PERIOD_MINUTES = 1;
 const BALANCE_REFRESH_PERIOD_MINUTES = 1;
-const PHISHING_REFRESH_PERIOD_MINUTES = 24 * 60;
 
 // alarmsApi() resolves on use rather than at module load: the worker is torn
 // down and re-evaluated repeatedly, and tests install a stub after requiring
@@ -65,22 +75,34 @@ async function ensureAlarm(name, periodInMinutes) {
 }
 
 /**
- * Ensure both recurring background jobs are scheduled. Safe to call on every
- * worker start, on onInstalled and on onStartup.
+ * Clear every alarm this extension no longer handles.
  *
- * @returns {Promise<{balance: boolean, phishing: boolean}>} which alarms this
- * call had to create.
+ * @returns {Promise<string[]>} the retired alarms this call actually cleared.
+ */
+async function clearObsoleteAlarms() {
+    const api = alarmsApi();
+    if (!api || !api.clear) return [];
+    const cleared = [];
+    for (const name of OBSOLETE_ALARMS) {
+        if (await api.clear(name)) cleared.push(name);
+    }
+    return cleared;
+}
+
+/**
+ * Ensure the recurring background jobs are scheduled, and that retired ones are
+ * not. Safe to call on every worker start, on onInstalled and on onStartup.
+ *
+ * @returns {Promise<{balance: boolean, cleared: string[]}>} which alarms this
+ * call had to create, and which retired ones it removed.
  */
 async function ensureRecurringAlarms() {
     const balance = await ensureAlarm(
         BALANCE_REFRESH_ALARM,
         BALANCE_REFRESH_PERIOD_MINUTES,
     );
-    const phishing = await ensureAlarm(
-        PHISHING_REFRESH_ALARM,
-        PHISHING_REFRESH_PERIOD_MINUTES,
-    );
-    return { balance, phishing };
+    const cleared = await clearObsoleteAlarms();
+    return { balance, cleared };
 }
 
 /**
@@ -102,10 +124,10 @@ function registerAlarmHandlers(handlers) {
 
 module.exports = {
     BALANCE_REFRESH_ALARM,
-    PHISHING_REFRESH_ALARM,
+    OBSOLETE_ALARMS,
     MIN_ALARM_PERIOD_MINUTES,
     BALANCE_REFRESH_PERIOD_MINUTES,
-    PHISHING_REFRESH_PERIOD_MINUTES,
+    clearObsoleteAlarms,
     ensureAlarm,
     ensureRecurringAlarms,
     registerAlarmHandlers,