harden: list and end site connections made without Remember in Settings #419

Merged
clawbot merged 1 commits from issue-406-revoke-session-connection into next 2026-10-04 06:41:41 +02:00
Collaborator

Closes #406.

A site allowed without "Remember" lives only in the background's in-memory connectedSites map. Settings listed only remembered sites, and AUTISTMASK_REMOVE_SITE, sent on every remove, did nothing, so such a connection could be neither seen nor ended.

  • Settings asks the background for those sites (AUTISTMASK_GET_CONNECTED_SITES) and lists them in a new Connected Sites well between Allowed Sites and Denied Sites, with the same [x].
  • [x] in Allowed Sites or Connected Sites disconnects the site: its hostname is dropped from allowedSites under every address, and AUTISTMASK_REMOVE_SITE now carries the hostname. The background deletes every connectedSites entry whose origin has that hostname and sends accountsChanged with an empty list to the site's open tabs.
  • The background refuses both messages unless they come from the extension's own pages.

Not visible in the diff:

  • Matching is by hostname, as remembered sites are keyed today, so removing a site ends its connections on every scheme and port. #402 changes that key later.
  • Judgement call: [x] on a Connected Sites row also drops the hostname from Allowed Sites, so the site really is disconnected and the empty accountsChanged is true.
  • Judgement call: [x] in Denied Sites no longer sends AUTISTMASK_REMOVE_SITE. Forgetting a refusal ends no connection, and sending it would now disconnect the site under another address.
  • Each new test fails without the fix.

Model: opus-5-5

Closes https://git.eeqj.de/sneak/AutistMask/issues/406. A site allowed without "Remember" lives only in the background's in-memory `connectedSites` map. Settings listed only remembered sites, and `AUTISTMASK_REMOVE_SITE`, sent on every remove, did nothing, so such a connection could be neither seen nor ended. - Settings asks the background for those sites (`AUTISTMASK_GET_CONNECTED_SITES`) and lists them in a new Connected Sites well between Allowed Sites and Denied Sites, with the same `[x]`. - `[x]` in Allowed Sites or Connected Sites disconnects the site: its hostname is dropped from `allowedSites` under every address, and `AUTISTMASK_REMOVE_SITE` now carries the hostname. The background deletes every `connectedSites` entry whose origin has that hostname and sends `accountsChanged` with an empty list to the site's open tabs. - The background refuses both messages unless they come from the extension's own pages. Not visible in the diff: - Matching is by hostname, as remembered sites are keyed today, so removing a site ends its connections on every scheme and port. https://git.eeqj.de/sneak/AutistMask/issues/402 changes that key later. - Judgement call: `[x]` on a Connected Sites row also drops the hostname from Allowed Sites, so the site really is disconnected and the empty `accountsChanged` is true. - Judgement call: `[x]` in Denied Sites no longer sends `AUTISTMASK_REMOVE_SITE`. Forgetting a refusal ends no connection, and sending it would now disconnect the site under another address. - Each new test fails without the fix. Model: opus-5-5
clawbot added the needs-review label 2026-10-04 06:07:36 +02:00
clawbot self-assigned this 2026-10-04 06:07:36 +02:00
clawbot added 1 commit 2026-10-04 06:07:37 +02:00
harden: list and end site connections made without Remember in Settings (closes #406)
check / check (push) Successful in 3m2s
e2e / e2e-chrome (push) Successful in 3m53s
e2e / e2e-firefox (push) Successful in 3m15s
b931866e70
A site allowed without "Remember" lives only in the background's
in-memory connectedSites map. Settings never listed it, and
AUTISTMASK_REMOVE_SITE, sent on every remove, did nothing, so the user
could not end such a connection.

Settings now asks the background for those sites and lists them under
Connected Sites. Removing a site from Allowed Sites or Connected Sites
drops its remembered entry under every address and sends
AUTISTMASK_REMOVE_SITE with the hostname; the background deletes every
matching connectedSites entry and sends accountsChanged with an empty
list to the site's tabs. Only the extension's own pages may send either
message.

Model: opus-5-5
Author
Collaborator

PASS

Model: opus-5-5

PASS Model: opus-5-5
clawbot merged commit 49a7da87e8 into next 2026-10-04 06:41:41 +02:00
clawbot deleted branch issue-406-revoke-session-connection 2026-10-04 06:41:42 +02:00
Sign in to join this conversation.
No Reviewers
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/AutistMask#419