AutistMask

sneak/AutistMask

Fork 0

Author	SHA1	Message	Date
clawbot	ad34fa8699	feat: password-gated recovery phrase display for HD wallets (closes #161 ) Some checks failed check / check (push) Has been cancelled Details A user who created a wallet in AutistMask and did not write the phrase down had no way to retrieve it. Adds a "Show recovery phrase" action on the wallet row in Settings, next to the per-wallet actions that already live there, mirroring the per-address private key export in structure, password gate and warning treatment. The screen displays the secret that owns every address in the wallet, so: - Only HD wallets are offered it. walletHasRecoveryPhrase() is an allowlist on type "hd", so the key and xprv types — which have no phrase at all — are excluded, as is any type added later. - Nothing is decrypted and nothing enters the page until decryptWithPassword accepts the password. A wrong password produces a full-sentence error and leaves the value node empty. - Leaving the screen wipes it by any route, not just "Back": views that hold a secret register a cleanup with showView() via onViewLeave(), which also covers the settings gear. - The phrase is never assigned to state, so it cannot be persisted, and the view is not in RESTORABLE_VIEWS — reopening the popup lands on Home. That set moves to src/popup/restorableViews.js so the exclusion can be asserted directly; the popup entry point cannot be required outside a browser. - The phrase cannot reach the logger: the view does not import src/shared/log.js, and the failed-decrypt path reports a fixed sentence rather than the caught error. Tests: unit coverage for the type gate, the RESTORABLE_VIEWS exclusion and the absence of any logger path; the DOM behaviour is driven against the real popup in the e2e suite, which is where this repo tests views.	2026-08-11 13:00:59 +00:00

Author

SHA1

Message

Date

clawbot

ad34fa8699

feat: password-gated recovery phrase display for HD wallets (closes #161 )

check / check (push) Has been cancelled

Details

A user who created a wallet in AutistMask and did not write the phrase
down had no way to retrieve it. Adds a "Show recovery phrase" action on
the wallet row in Settings, next to the per-wallet actions that already
live there, mirroring the per-address private key export in structure,
password gate and warning treatment.

The screen displays the secret that owns every address in the wallet, so:

  - Only HD wallets are offered it. walletHasRecoveryPhrase() is an
    allowlist on type "hd", so the key and xprv types — which have no
    phrase at all — are excluded, as is any type added later.
  - Nothing is decrypted and nothing enters the page until
    decryptWithPassword accepts the password. A wrong password produces a
    full-sentence error and leaves the value node empty.
  - Leaving the screen wipes it by any route, not just "Back": views that
    hold a secret register a cleanup with showView() via onViewLeave(),
    which also covers the settings gear.
  - The phrase is never assigned to state, so it cannot be persisted, and
    the view is not in RESTORABLE_VIEWS — reopening the popup lands on
    Home. That set moves to src/popup/restorableViews.js so the exclusion
    can be asserted directly; the popup entry point cannot be required
    outside a browser.
  - The phrase cannot reach the logger: the view does not import
    src/shared/log.js, and the failed-decrypt path reports a fixed
    sentence rather than the caught error.

Tests: unit coverage for the type gate, the RESTORABLE_VIEWS exclusion
and the absence of any logger path; the DOM behaviour is driven against
the real popup in the e2e suite, which is where this repo tests views.

2026-08-11 13:00:59 +00:00

Compare commits

1 Commits

c951028837 ... ad34fa8699

Diff Content Not Available

Compare commits

1 Commits c951028837 ... ad34fa8699

Diff Content Not Available

1 Commits

c951028837 ... ad34fa8699