security: announce a fresh EIP-6963 provider UUID per page load (closes #398)

The provider UUID was generated once, kept in extension storage and
announced to every page on every load, so any site could read it as a
stable identifier for the install across sites and browser restarts.

inpage.js now generates one UUID per page load, shared by every
announcement in that load, and stores nothing. The eip6963Uuid storage
key and the AUTISTMASK_PROVIDER_UUID content-script message are removed.
The key was never part of the versioned autistmask profile, so the state
schema is untouched.

The test posts each load the same stored UUID the way the old content
script did, and asserts that no load announces it and that two loads
announce different UUIDs.

Model: opus-5-5

src/content/inpage.js

@@ -204,12 +204,11 @@
                 "</svg>",
         );
 
-    // EIP-6963 wants a fresh UUIDv4 per page load — it identifies one
+    // EIP-6963 asks for one UUIDv4 per provider for the life of the page: one
-    // announcement, so a provider can be told apart from another instance of
+    // per page load, shared by every announcement in that load. It is
-    // itself in the same page. It is generated here and never stored:
+    // generated here and never stored: announcing one persisted value to every
-    // announcing one persisted value to every site, on every load and across
+    // site, on every load and across restarts, turned it into a stable
-    // restarts, turned it into a stable cross-site, cross-session tracking
+    // cross-site, cross-session tracking identifier any page could read
-    // identifier any page could read
     // (https://git.eeqj.de/sneak/AutistMask/issues/398).
     const providerUuid = crypto.randomUUID();
 

tests/inpageProviderUuid.test.js

@@ -4,8 +4,13 @@
 // persisted in extension storage, and announced verbatim to every page on
 // every load and across browser restarts, so any site — connected or not —
 // could read a stable cross-site, cross-session identifier for the install.
-// EIP-6963 wants a fresh UUIDv4 per announcement instead. The fix generates
+// EIP-6963 asks for one UUIDv4 per page load, shared by every announcement in
-// it per page load and stores nothing.
+// that load. The fix generates it per page load and stores nothing.
+//
+// The stored UUID reached inpage.js as an AUTISTMASK_PROVIDER_UUID page
+// message from the content script, and inpage.js then announced it. Each load
+// below is posted the same stored UUID that way, so on the old code both loads
+// announce it and the last two tests fail.
 //
 // inpage.js is a bare IIFE injected into the page's JS context, not a module;
 // see tests/inpageErrors.test.js for why it is evaluated against a stub window
@@ -44,9 +49,14 @@ class StubCustomEvent extends StubEvent {
     }
 }
 
-// Evaluate inpage.js once against a fresh stub window and return every UUID it
+// What the old content script read out of extension storage and posted to
-// announced. A `requestProvider` event is dispatched too, so a re-announcement
+// every page load.
-// within one load is observed as well as the announcement at load.
+const STORED_UUID = "11111111-2222-4333-8444-555555555555";
+
+// Evaluate inpage.js once against a fresh stub window, post it STORED_UUID the
+// way the old content script did, then dispatch a `requestProvider` event so a
+// re-announcement is observed as well as the announcement at load. Returns
+// every UUID the load announced, in order.
 function announcedUuids() {
     const listeners = {};
     const uuids = [];
@@ -73,6 +83,11 @@ function announcedUuids() {
     win.window = win;
 
     loadInto(win, win, webcrypto, StubEvent, StubCustomEvent);
+    win.dispatchEvent({
+        type: "message",
+        source: win,
+        data: { type: "AUTISTMASK_PROVIDER_UUID", uuid: STORED_UUID },
+    });
     win.dispatchEvent(new StubEvent("eip6963:requestProvider"));
     return uuids;
 }
@@ -81,7 +96,7 @@ const UUID_V4 =
     /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 
 describe("the EIP-6963 provider UUID is fresh per page load", () => {
-    test("a load announces a UUIDv4, unprompted, with nothing delivered", () => {
+    test("a load announces a UUIDv4 without being asked", () => {
         const uuids = announcedUuids();
         expect(uuids.length).toBeGreaterThan(0);
         expect(uuids[0]).toMatch(UUID_V4);
@@ -93,11 +108,11 @@ describe("the EIP-6963 provider UUID is fresh per page load", () => {
         expect(new Set(uuids).size).toBe(1);
     });
 
-    test("two page loads announce different UUIDs", () => {
+    test("two page loads announce different UUIDs, neither the stored one", () => {
-        const first = announcedUuids()[0];
+        const first = announcedUuids();
-        const second = announcedUuids()[0];
+        const second = announcedUuids();
-        expect(first).toMatch(UUID_V4);
+        expect(first).not.toContain(STORED_UUID);
-        expect(second).toMatch(UUID_V4);
+        expect(second).not.toContain(STORED_UUID);
-        expect(second).not.toBe(first);
+        expect(second[0]).not.toBe(first[0]);
     });
 });