fix: the typed data screen shows only the message fields that are signed (closes #539)

ethers signs only the fields a type declares and drops any other key, but
the Message section listed every key the site sent, so an added key read
as signed. The Message section now follows the signed type, at every level
of nesting and in the type's order. Typed data with other keys is not
refused: those keys are listed after the message under "Not part of the
signature", by their place in the message. README SignApproval says so.
The operator/spender test now also checks the Message section, and new
tests cover an added key in a nested struct and in a list item.

Model: opus-5-5

README.md

@@ -464,9 +464,6 @@ papered over:
   forced by clicking Reveal and the settings gear in one page task, which a
   person cannot do; the case a person can hit, the first decrypt after the popup
   opens while libsodium is still loading, is not driven.
-- Approval windows open at 1280x720 whatever size the extension asks for, so
-  whether an approval screen fits its window is checked in the Firefox suite
-  only.
 
 Any test that drives a failure path on purpose declares the `console.error` it
 is about to provoke, via `errors.expect()`. That is not a mute: the declaration
@@ -539,8 +536,7 @@ suite), wallet creation through the UI, the Add Token screen, and the dApp round
 trips — `eth_requestAccounts`, `personal_sign`, `wallet_switchEthereumChain`
 rejected and then approved, `eth_sendTransaction`, and a closed approval window
 rejecting with EIP-1193 4001 — driven through the real content script,
-background page and approval windows. The `personal_sign` prompt is also
-required to fit its window without scrolling sideways.
+background page and approval windows.
 
 The suite lives in `tests/e2e/firefox/`. Its WebDriver client (`driver.js`) has
 **no npm dependencies at all**: it is built on global `fetch` and
@@ -897,11 +893,8 @@ discoverable.
   enough that vanilla JS with simple view switching is sufficient. A framework
   would add bundle size, build complexity, and attack surface for no benefit at
   this scale.
-- **396x600 popup**: The page is 396 pixels wide (`body` in
-  `src/popup/styles/main.css`), and 600 pixels is as tall as the browser lets
-  the toolbar popup grow. The UI is designed for this fixed viewport. The window
-  an approval opens in is given the same size; the browser counts the window's
-  frame in its width, so the page widens the window by whatever the frame takes.
+- **360x600 popup**: Standard browser extension popup dimensions. The UI is
+  designed for this fixed viewport.
 
 #### No Layout Shift
 
@@ -2082,9 +2075,7 @@ view would leave a wallet one click from deletion.
   artifact can be compared with it field for field. A nonce the site supplies is
   ignored: the nonce is always the account's next nonce from the node, so a site
   cannot replace one of the user's pending transactions or leave this one stuck
-  behind a gap. A gas limit the site supplies, as `gas` or `gasLimit`, is used
-  in place of the node's estimate; a request giving both with different values
-  is refused. A request that cannot be populated — unreachable node, reverting
+  behind a gap. A request that cannot be populated — unreachable node, reverting
   gas estimate — opens no window and is failed back to the site. Only one
   transaction approval exists at a time: populating fixes the nonce, so a second
   `eth_sendTransaction` arriving while one is unanswered is refused with
@@ -2152,7 +2143,12 @@ view would leave a wallet one click from deletion.
       Bytes that are not UTF-8 are shown as "This message is not text." For
       typed data, formatted domain/type/message fields (EIP-712). The primary
       type shown is the one ethers signs, derived from the typed data's `types`,
-      not the type the site states.
+      not the type the site states. The message shows only the fields that type
+      declares, at every level of nesting and in the type's order: ethers signs
+      those and drops any other key. Typed data carrying other keys is not
+      refused; each such key is listed after the message under "Not part of the
+      signature", by its place in the message (`details.note`,
+      `details[1].note`) and its value.
     - Token permission warning, at the top of the message (typed data whose
       primary type is `Permit`, as in EIP-2612, or one of Permit2's signature
       types): "⚠️ TOKEN PERMISSION: Signing this lets the spender below take the

src/background/index.js

@@ -423,10 +423,7 @@ function releaseApproval(approval) {
 // the result on the floor, so a rejection here would be unhandled.
 async function openApprovalWindow(id) {
     const popupUrl = runtime.getURL("src/popup/index.html?approval=" + id);
-    // As wide as the page: body in src/popup/styles/main.css. The browser
-    // counts the window's frame in this width; the page itself adds back
-    // whatever the frame takes (src/popup/index.js).
-    const popupWidth = 396;
+    const popupWidth = 360;
     const popupHeight = 600;
 
     let currentWin = null;
@@ -446,7 +443,7 @@ async function openApprovalWindow(id) {
     // Centred on a browser window only. The last focused window can be
     // another approval window still open, and centring on one can give a
     // position the browser refuses ("Bounds must be at least 50% within
-    // visible screen space"): headless Chrome reports this 396x600 popup as
+    // visible screen space"): headless Chrome reports this 360x600 popup as
     // 1280x720. The request then failed with no window at all. Over a popup,
     // the browser picks the position.
     if (currentWin && currentWin.type === "normal") {

src/popup/index.js

@@ -21,7 +21,6 @@ const {
     goBack,
 } = require("./views/helpers");
 const { applyTheme } = require("./theme");
-const { windowsGetCurrent, windowsUpdate } = require("../shared/browserApi");
 // Renders a view the popup lands on without having navigated to it forward:
 // on restore here, and on Back. Only the views that can be fully re-rendered
 // from persisted state (RESTORABLE_VIEWS, src/shared/restorableViews.js) go
@@ -234,22 +233,6 @@ async function init() {
     const params = new URLSearchParams(window.location.search);
     const approvalId = params.get("approval");
     if (approvalId) {
-        // The background opens this window as wide as the page, but the
-        // browser counts the window's frame in that width, and how wide the
-        // frame is depends on the browser and the system. The window is
-        // widened by however far the page would scroll sideways. The
-        // connection prompt can also show in the toolbar popup, whose window
-        // is the user's browser window; that one is left alone.
-        const sideways =
-            document.documentElement.scrollWidth -
-            document.documentElement.clientWidth;
-        if (sideways > 0) {
-            windowsGetCurrent().then((win) => {
-                if (win.type === "popup") {
-                    windowsUpdate(win.id, { width: win.width + sideways });
-                }
-            });
-        }
         // Deliberately not awaited, and deliberately not .catch()ed. show()
         // is async, so a throw past its first await surfaces as an unhandled
         // rejection rather than an uncaught error — measured as still failing

src/popup/views/approval.js

@@ -626,10 +626,38 @@ function permitWarningHtml(types, primaryType, domain, message) {
     return html;
 }
 
+// What ethers signs of a message value of type `type`: a struct keeps only
+// the fields its type declares, in the type's order, and a list is read item
+// by item. ethers drops every other key, so each one is added to `notSigned`
+// with its place in the message and its value, for the screen to list apart.
+function signedValue(types, type, value, path, notSigned) {
+    const itemType = type.replace(/\[\d*\]$/, "");
+    if (itemType !== type) {
+        if (!Array.isArray(value)) return value;
+        return value.map((item, i) =>
+            signedValue(types, itemType, item, `${path}[${i}]`, notSigned),
+        );
+    }
+    const fields = types[type];
+    if (!fields || !value || typeof value !== "object") return value;
+    const at = (name) => (path ? `${path}.${name}` : name);
+    for (const [key, val] of Object.entries(value)) {
+        if (!fields.some((f) => f.name === key)) notSigned.push([at(key), val]);
+    }
+    return Object.fromEntries(
+        fields.map((f) => [
+            f.name,
+            signedValue(types, f.type, value[f.name], at(f.name), notSigned),
+        ]),
+    );
+}
+
 // The typed data as the screen shows it. The primary type shown is the one
 // ethers signs, never the page's word for it; typedDataRefusal() keeps the two
-// from differing on anything that can be signed. Only typed data that cannot
-// be read at all is shown as raw text, and typedDataRefusal() refuses it.
+// from differing on anything that can be signed. The Message section shows
+// only what is signed, and any other key the page sent is listed after it as
+// not part of the signature. Only typed data that cannot be read at all is
+// shown as raw text, and typedDataRefusal() refuses it.
 function formatTypedDataHtml(jsonStr) {
     let data;
     let primaryType;
@@ -663,12 +691,30 @@ function formatTypedDataHtml(jsonStr) {
     html += `<div class="mb-2"><div class="text-muted">Primary type</div>`;
     html += `<div class="font-bold">${escapeHtml(primaryType)}</div></div>`;
 
+    const lineHtml = (key, val) =>
+        `<div><span class="text-muted">${escapeHtml(key)}:</span> <span class="break-all">${escapeHtml(display(val))}</span></div>`;
+
     if (data.message) {
+        const notSigned = [];
+        const message = signedValue(
+            data.types,
+            primaryType,
+            data.message,
+            "",
+            notSigned,
+        );
         html += `<div class="mb-2"><div class="text-muted">Message</div>`;
-        for (const [key, val] of Object.entries(data.message)) {
-            html += `<div><span class="text-muted">${escapeHtml(key)}:</span> <span class="break-all">${escapeHtml(display(val))}</span></div>`;
+        for (const [key, val] of Object.entries(message)) {
+            html += lineHtml(key, val);
         }
         html += `</div>`;
+        if (notSigned.length > 0) {
+            html += `<div class="mb-2"><div class="text-muted">Not part of the signature</div>`;
+            for (const [key, val] of notSigned) {
+                html += lineHtml(key, val);
+            }
+            html += `</div>`;
+        }
     }
 
     return html;

src/shared/approvalTx.js

@@ -1,14 +1,13 @@
 // Preparation of the transaction an approval screen displays.
 //
-// A dApp's eth_sendTransaction normally fixes `to`, `value` and `data`, and
-// sometimes the gas limit. The nonce, the fees, and the gas limit when the
-// site gives none have to be filled in from the network before anything can
-// be signed, and whoever fills them in decides what the user is shown. That
-// work used to happen in the popup, after the user had already approved: the
-// numbers on the approval screen came from the popup and were compared against
-// nothing, so a compromised popup could display one fee and sign another, and
-// the ceilings in approvalVerify.js were all that stood between the user and a
-// fee that hands the validator the balance.
+// A dApp's eth_sendTransaction normally fixes only `to`, `value` and `data`.
+// The nonce, the gas limit and the fees have to be filled in from the network
+// before anything can be signed, and whoever fills them in decides what the
+// user is shown. That work used to happen in the popup, after the user had
+// already approved: the numbers on the approval screen came from the popup and
+// were compared against nothing, so a compromised popup could display one fee
+// and sign another, and the ceilings in approvalVerify.js were all that stood
+// between the user and a fee that hands the validator the balance.
 //
 // So it happens here instead, in the background, before the approval window is
 // opened. The background populates the transaction, shows that object, and
@@ -32,7 +31,6 @@ const {
     VoidSigner,
     accessListify,
     getAddress,
-    getBigInt,
     getBytes,
     hexlify,
     toQuantity,
@@ -49,11 +47,10 @@ const {
 // minutes long, which is not a wait anyone will sit through.
 const POPULATE_TIMEOUT_MS = 20000;
 
-// The request fields taken from the page, plus `gas`, which requestFrom()
-// takes as the gas limit. Anything else is dropped rather than passed to
-// ethers: the object is page-controlled, and a future ethers that learns to
-// carry a new transaction field must not start picking one up out of it
-// without this module knowing.
+// The request fields taken from the page. Anything else is dropped rather than
+// passed to ethers: the object is page-controlled, and a future ethers that
+// learns to carry a new transaction field must not start picking one up out of
+// it without this module knowing.
 //
 // The nonce is not taken from the page; it is always the account's next nonce
 // from the network. A page that chose it could replace one of the user's
@@ -87,16 +84,6 @@ function present(v) {
     return v !== null && v !== undefined && v !== "";
 }
 
-// Whether two quantities from the page are the same number. One that is not a
-// number matches nothing.
-function sameQuantity(a, b) {
-    try {
-        return getBigInt(a) === getBigInt(b);
-    } catch {
-        return false;
-    }
-}
-
 // These strings reach the user through the requesting page, so they are full
 // sentences even when the tail of one came from ethers or from the node.
 function sentence(text) {
@@ -124,20 +111,6 @@ function requestFrom(txParams, from) {
     for (const key of REQUEST_FIELDS) {
         if (present(txParams[key])) request[key] = txParams[key];
     }
-    // JSON-RPC calls the gas limit `gas`, and that is the name sites send.
-    // ethers only reads `gasLimit`: left as `gas` it would be dropped and an
-    // estimate signed in its place.
-    if (present(txParams.gas)) {
-        if (
-            present(request.gasLimit) &&
-            !sameQuantity(request.gasLimit, txParams.gas)
-        ) {
-            throw fail(
-                "The site asked for two different gas limits for this transaction.",
-            );
-        }
-        request.gasLimit = txParams.gas;
-    }
     if (
         present(request.type) &&
         !ALLOWED_TX_TYPES.includes(Number(request.type))

src/shared/browserApi.js

@@ -250,22 +250,6 @@ function windowsGetLastFocused() {
     return invoke(windowsApi(), "getLastFocused");
 }
 
-/**
- * @returns {Promise<Object>} the window the calling page is in.
- */
-function windowsGetCurrent() {
-    return invoke(windowsApi(), "getCurrent");
-}
-
-/**
- * @param {number} windowId
- * @param {Object} updateInfo
- * @returns {Promise<Object>} the updated window.
- */
-function windowsUpdate(windowId, updateInfo) {
-    return invoke(windowsApi(), "update", windowId, updateInfo);
-}
-
 /**
  * @param {number} windowId
  * @returns {Promise<void>}
@@ -291,8 +275,6 @@ module.exports = {
     tabsSendMessage,
     windowsApi,
     windowsCreate,
-    windowsGetCurrent,
     windowsGetLastFocused,
     windowsRemove,
-    windowsUpdate,
 };

tests/approvalTx.test.js

@@ -9,7 +9,7 @@
 // requesting page or the RPC node can say turns it into an approval that
 // should never have been raised.
 
-const { Network, Transaction, Wallet, toQuantity } = require("ethers");
+const { Network, Wallet } = require("ethers");
 const {
     prepareApprovalTx,
     serializeApprovedTx,
@@ -138,43 +138,6 @@ describe("prepareApprovalTx", () => {
         expect(approved.maxFeePerGas).toBe("0x12a05f200");
     });
 
-    // `gas` is the JSON-RPC name for the gas limit and the one sites send.
-    // The node would estimate 21000; the site's 200000 is what is shown and
-    // what is signed.
-    test("uses the gas limit a site sends as gas", async () => {
-        const approved = await prepareApprovalTx(
-            providerWith(),
-            signer.address,
-            { ...TX_PARAMS, gas: "0x30d40" },
-        );
-        expect(approved.gasLimit).toBe("0x30d40");
-        const signed = Transaction.from(
-            await signer.signTransaction({ ...approved }),
-        );
-        expect(signed.gasLimit).toBe(200000n);
-    });
-
-    test("accepts gas and gasLimit that name the same number", async () => {
-        const approved = await prepareApprovalTx(
-            providerWith(),
-            signer.address,
-            { ...TX_PARAMS, gas: "0x30d40", gasLimit: 200000 },
-        );
-        expect(approved.gasLimit).toBe("0x30d40");
-    });
-
-    test("refuses gas and gasLimit that disagree", async () => {
-        await expect(
-            prepareApprovalTx(providerWith(), signer.address, {
-                ...TX_PARAMS,
-                gas: "0x30d40",
-                gasLimit: "0x5208",
-            }),
-        ).rejects.toThrow(
-            "The site asked for two different gas limits for this transaction.",
-        );
-    });
-
     test("carries an access list the request asked for", async () => {
         const approved = await prepareApprovalTx(
             providerWith(),
@@ -249,15 +212,6 @@ describe("prepareApprovalTx", () => {
         ).rejects.toThrow(/gas limit no network this wallet supports/);
     });
 
-    test("refuses a gas limit the site sent above the ceiling", async () => {
-        await expect(
-            prepareApprovalTx(providerWith(), signer.address, {
-                ...TX_PARAMS,
-                gas: toQuantity(MAX_GAS_LIMIT + 1n),
-            }),
-        ).rejects.toThrow(/gas limit no network this wallet supports/);
-    });
-
     // The combined bound at population: a gas limit and a fee that are each
     // under their own ceiling but multiply to thousands of ETH is refused
     // before the approval window opens, so the user is never shown a

tests/approvalVerify.test.js

@@ -58,6 +58,7 @@ const TX_PARAMS = {
     to: RECIPIENT,
     value: "0x2386f26fc10000",
     data: "0xdeadbeef",
+    gas: "0x5208",
 };
 
 // The values populateTransaction() fills in when the dApp fixed none of them.

tests/approvalWindow.test.js

@@ -45,50 +45,3 @@ test("the approval window shows no screen until the background describes the app
     expect(env.visibleViews()).toEqual(["approve-network"]);
     expect(env.pageErrors).toEqual([]);
 });
-
-// The background opens the approval window as wide as the page, but the
-// browser counts the window's frame in that width
-// (https://git.eeqj.de/sneak/AutistMask/issues/518). The browser suites run
-// without frames, so the widening is checked here.
-function windowsStub(type) {
-    const updates = [];
-    return {
-        updates,
-        getCurrent: (done) => done({ id: 7, type, width: 396 }),
-        update: (id, info, done) => {
-            updates.push({ id, info });
-            done({});
-        },
-    };
-}
-
-const approvalRuntime = {
-    connect: () => ({ postMessage: () => {} }),
-    sendMessage: () => {},
-};
-
-test("the approval window widens itself by whatever its frame takes", async () => {
-    const windows = windowsStub("popup");
-    const env = await bootPopup(unversionedValidProfile(), {
-        search: "?approval=approval-1",
-        runtime: approvalRuntime,
-        windows,
-        documentElement: { scrollWidth: 396, clientWidth: 380 },
-    });
-
-    expect(windows.updates).toEqual([{ id: 7, info: { width: 412 } }]);
-    expect(env.pageErrors).toEqual([]);
-});
-
-test("a connection prompt in the toolbar popup leaves the browser window alone", async () => {
-    const windows = windowsStub("normal");
-    const env = await bootPopup(unversionedValidProfile(), {
-        search: "?approval=approval-1",
-        runtime: approvalRuntime,
-        windows,
-        documentElement: { scrollWidth: 396, clientWidth: 380 },
-    });
-
-    expect(windows.updates).toEqual([]);
-    expect(env.pageErrors).toEqual([]);
-});

tests/backgroundApproval.test.js

@@ -2805,7 +2805,7 @@ describe("where an approval window opens", () => {
         await settle();
 
         expect(bg.created).toHaveLength(1);
-        expect(bg.created[0]).toMatchObject({ left: 442, top: 60 });
+        expect(bg.created[0]).toMatchObject({ left: 460, top: 60 });
     });
 
     test("not centred on an approval window the user was last in", async () => {
@@ -2822,7 +2822,7 @@ describe("where an approval window opens", () => {
         bg.requestSign();
         await settle();
 
-        // Centred, it would be at left 882, the position the browser refused.
+        // Centred, it would be at left 900, the position the browser refused.
         expect(bg.created).toHaveLength(1);
         expect(bg.created[0].left).toBeUndefined();
         expect(bg.created[0].top).toBeUndefined();
@@ -2844,7 +2844,7 @@ describe("where an approval window opens", () => {
         await settle();
 
         expect(bg.created).toHaveLength(2);
-        expect(bg.created[0]).toMatchObject({ left: 1502, top: 750 });
+        expect(bg.created[0]).toMatchObject({ left: 1520, top: 750 });
         expect(bg.created[1].left).toBeUndefined();
         expect(bg.created[1].top).toBeUndefined();
 

tests/e2e/firefox/run.js

@@ -640,19 +640,6 @@ step(
         await d.switchToWindow(popup);
         await d.waitVisible("#view-approve-sign");
 
-        // The window is opened as wide as the page
-        // (https://git.eeqj.de/sneak/AutistMask/issues/518). This suite is
-        // where that is checked: the Chrome suite's approval windows open at
-        // 1280x720 whatever width the extension asks for.
-        const sideways = await d.execute(
-            "return document.documentElement.scrollWidth -" +
-                " document.documentElement.clientWidth;",
-        );
-        assert(
-            sideways <= 0,
-            "the sign prompt scrolls sideways by " + sideways + "px",
-        );
-
         const screen = await d.execute(
             `return {
              origin: document.getElementById("approve-sign-origin").textContent,

tests/support/popupBoot.js

@@ -242,11 +242,6 @@ async function settle() {
  *     "?approval=" and an id for the popup opened as an approval window.
  * @param {object} [options.runtime] members of chrome.runtime that replace the
  *     stub's own, for a test that has to answer the background's messages.
- * @param {object} [options.windows] chrome.windows, for a test of the approval
- *     window resizing itself.
- * @param {object} [options.documentElement] members of document.documentElement
- *     that replace the stub's own: scrollWidth and clientWidth, which are equal
- *     unless a test says otherwise, so the page does not scroll sideways.
  * @returns {Promise<object>} handles onto the booted page.
  */
 async function bootPopup(stored, options) {
@@ -282,11 +277,6 @@ async function bootPopup(stored, options) {
         (options && options.storage) ||
         makeStorageStub(stored === undefined ? {} : { autistmask: stored });
     const document = makeDocument(POPUP_HTML);
-    Object.assign(
-        document.documentElement,
-        { scrollWidth: 396, clientWidth: 396 },
-        options && options.documentElement,
-    );
     const reloads = [];
 
     globalThis.chrome = {
@@ -297,7 +287,6 @@ async function bootPopup(stored, options) {
             onMessage: { addListener: () => {} },
             ...(options && options.runtime),
         },
-        windows: options && options.windows,
     };
     globalThis.document = document;
     globalThis.window = {

tests/typedDataPermit.test.js

@@ -233,6 +233,26 @@ function warningOf(data) {
     return html.slice(0, html.indexOf(">Domain<"));
 }
 
+const NOT_SIGNED = ">Not part of the signature<";
+
+// The Message section alone, without the keys listed after it as not part of
+// the signature.
+function messageOf(data) {
+    const html = formatTypedDataHtml(JSON.stringify(data));
+    const end = html.indexOf(NOT_SIGNED);
+    return html.slice(
+        html.indexOf(">Message<"),
+        end === -1 ? html.length : end,
+    );
+}
+
+// The keys listed as not part of the signature, or "" when there are none.
+function notSignedOf(data) {
+    const html = formatTypedDataHtml(JSON.stringify(data));
+    const start = html.indexOf(NOT_SIGNED);
+    return start === -1 ? "" : html.slice(start);
+}
+
 function request(data) {
     return { method: "eth_signTypedData_v4", typedData: JSON.stringify(data) };
 }
@@ -312,7 +332,8 @@ describe("the warning reads only the fields the signed type declares", () => {
     });
 
     // A Permit whose type names its spender `operator`; the page adds a
-    // `spender` key the type does not declare.
+    // `spender` key the type does not declare. The Message section names
+    // only the operator, and the added key is listed apart as not signed.
     test("an added key is not named as the spender", () => {
         const data = {
             ...PERMIT,
@@ -331,6 +352,10 @@ describe("the warning reads only the fields the signed type declares", () => {
         const warning = warningOf(data);
         expect(warning).toContain(WARNING);
         expect(warning).not.toContain(DECOY);
+        expect(messageOf(data)).toContain(SPENDER);
+        expect(messageOf(data)).not.toContain(DECOY);
+        expect(notSignedOf(data)).toContain("spender:");
+        expect(notSignedOf(data)).toContain(DECOY);
     });
 
     // The permit for a Uniswap v3 position NFT: a `Permit` with no amount
@@ -371,6 +396,47 @@ describe("the warning reads only the fields the signed type declares", () => {
     });
 });
 
+// ethers signs only the declared fields at every level of nesting, so an
+// added key inside a struct is not signed either. Such typed data is not
+// refused; the added key is listed apart, with where it sits in the message.
+describe("the Message section shows only the fields that are signed", () => {
+    const NOTE = "This signature only signs you in";
+
+    test("an added key inside a nested struct is listed as not signed", () => {
+        const data = {
+            ...PERMIT_SINGLE,
+            message: {
+                ...PERMIT_SINGLE.message,
+                details: { ...PERMIT_SINGLE.message.details, note: NOTE },
+            },
+        };
+        expect(messageOf(data)).toContain("expiration");
+        expect(messageOf(data)).not.toContain(NOTE);
+        expect(notSignedOf(data)).toContain("details.note:");
+        expect(notSignedOf(data)).toContain(NOTE);
+        expect(typedDataRefusal(request(data))).toBeNull();
+    });
+
+    test("an added key inside a list item is listed with its index", () => {
+        const [first, second] = PERMIT_BATCH.message.details;
+        const data = {
+            ...PERMIT_BATCH,
+            message: {
+                ...PERMIT_BATCH.message,
+                details: [first, { ...second, note: NOTE }],
+            },
+        };
+        expect(messageOf(data)).not.toContain(NOTE);
+        expect(notSignedOf(data)).toContain("details[1].note:");
+        expect(notSignedOf(data)).toContain(NOTE);
+    });
+
+    test("nothing is listed apart when every key is declared", () => {
+        expect(notSignedOf(PERMIT_SINGLE)).toBe("");
+        expect(notSignedOf(LOGIN)).toBe("");
+    });
+});
+
 describe("the primary type shown is the one ethers signs", () => {
     // A drain stated as a sign-in: the page says Login, the types say
     // PermitSingle, and ethers would sign PermitSingle.