clawbot
387f40689e
Settings has a new "Allow weak passwords" checkbox, off in a new profile. While it is off, AddWallet refuses a password shorter than 12 characters, as before. While it is on, AddWallet accepts any password that is not empty. Key derivation is unchanged: one Argon2id derivation at libsodium's interactive setting. README's Key Decisions now states those parameters and why one light derivation is enough: the password's length is what protects the stored secret. The screens say "password", as README's wording rules require, so the setting is "Allow weak passwords". Model: opus-5-5
409 lines
14 KiB
JavaScript
409 lines
14 KiB
JavaScript
const {
|
|
$,
|
|
showView,
|
|
showFlash,
|
|
showError,
|
|
hideError,
|
|
goBack,
|
|
clearViewStack,
|
|
onViewLeave,
|
|
} = require("./helpers");
|
|
const {
|
|
generateMnemonic,
|
|
hdWalletFromMnemonic,
|
|
isValidMnemonic,
|
|
addressFromPrivateKey,
|
|
hdWalletFromXprv,
|
|
isValidXprv,
|
|
isMasterExtendedKey,
|
|
} = require("../../shared/wallet");
|
|
const { encryptWithPassword } = require("../../shared/vault");
|
|
const { state, saveState } = require("../../shared/state");
|
|
const { scanForAddresses } = require("../../shared/balances");
|
|
const { notify } = require("../../shared/browserApi");
|
|
|
|
/**
|
|
* Check if an address already exists in ANY wallet (hd, xprv, or key).
|
|
* Returns the wallet object if found, or undefined.
|
|
*/
|
|
function findWalletByAddress(addr) {
|
|
const lower = addr.toLowerCase();
|
|
return state.wallets.find((w) =>
|
|
w.addresses.some((a) => a.address.toLowerCase() === lower),
|
|
);
|
|
}
|
|
|
|
/**
|
|
* Check if an xpub already exists in any HD-type wallet (hd or xprv).
|
|
* Returns the wallet object if found, or undefined.
|
|
*/
|
|
function findWalletByXpub(xpub) {
|
|
return state.wallets.find((w) => w.xpub && w.xpub === xpub);
|
|
}
|
|
|
|
let currentMode = "mnemonic";
|
|
|
|
const MODES = ["mnemonic", "privkey", "xprv"];
|
|
|
|
// Each hint names what this import mode's own backup is, because a key
|
|
// wallet and an xprv wallet have no recovery phrase to point the user at.
|
|
// All three say the same thing about the password: it is gone for good if
|
|
// it is forgotten. That sentence is the only warning the user gets before
|
|
// the wallet exists, and without it the lost-password route in
|
|
// views/deleteWallet.js is the first they hear of it.
|
|
//
|
|
// Keep the three within a couple of characters of each other in length.
|
|
// The hint sits directly above the password fields and the tabs swap it in
|
|
// place, so a wording that wraps to a different number of lines would move
|
|
// those fields under the pointer; the reserved height on
|
|
// #add-wallet-password-hint is the other half of that guarantee.
|
|
const PASSWORD_HINTS = {
|
|
mnemonic:
|
|
"This password encrypts your recovery phrase on this device. You will need it to send funds. It cannot be recovered or reset, so keep your recovery phrase written down: it is the only backup of this wallet.",
|
|
privkey:
|
|
"This password encrypts your private key on this device. You will need it to send funds. It cannot be recovered or reset, so keep your private key saved somewhere safe: it is the only backup of this wallet.",
|
|
xprv: "This password encrypts your key on this device. You will need it to send funds. It cannot be recovered or reset, so keep your extended private key saved somewhere safe: it is the only backup of this wallet.",
|
|
};
|
|
|
|
function switchMode(mode) {
|
|
currentMode = mode;
|
|
for (const m of MODES) {
|
|
$("add-wallet-section-" + m).classList.toggle("hidden", m !== mode);
|
|
const tab = $("tab-" + m);
|
|
const isActive = m === mode;
|
|
// Active: bold, solid border on top/sides, no bottom border (connects to content)
|
|
tab.classList.toggle("font-bold", isActive);
|
|
tab.classList.toggle("border-solid", isActive);
|
|
tab.classList.toggle("border-border", isActive);
|
|
tab.classList.toggle("border-b-bg", isActive);
|
|
tab.classList.toggle("bg-bg", isActive);
|
|
// Inactive: muted text, dashed border on top/sides, transparent bottom, hover invert
|
|
tab.classList.toggle("text-muted", !isActive);
|
|
tab.classList.toggle("border-dashed", !isActive);
|
|
tab.classList.toggle("border-border-light", !isActive);
|
|
tab.classList.toggle("border-b-transparent", !isActive);
|
|
tab.classList.toggle("hover:bg-fg", !isActive);
|
|
tab.classList.toggle("hover:text-bg", !isActive);
|
|
}
|
|
$("add-wallet-password-hint").textContent = PASSWORD_HINTS[mode];
|
|
}
|
|
|
|
// Wipe the secret material this screen holds in the DOM: a generated or
|
|
// pasted recovery phrase, an imported private key or extended private key,
|
|
// and the password that would encrypt them. Registered as the view-leave
|
|
// handler as well as run on entry, so none of it survives in the hidden
|
|
// view after the user navigates away by any route, including the Settings
|
|
// gear and the import itself.
|
|
function clear() {
|
|
$("wallet-mnemonic").value = "";
|
|
$("import-private-key").value = "";
|
|
$("import-xprv-key").value = "";
|
|
$("add-wallet-password").value = "";
|
|
$("add-wallet-password-confirm").value = "";
|
|
$("add-wallet-phrase-warning").style.visibility = "hidden";
|
|
hideError("add-wallet-password-error");
|
|
}
|
|
|
|
// Each wallet has its own password (its own encryptedSecret), so adding a
|
|
// second wallet does not reuse the first one's. The note that says so is
|
|
// only meaningful once a wallet exists — on the first wallet there is no
|
|
// other password to be separate from — so it is shown only then. This is
|
|
// decided on entry and stays put while the screen is up, so it does not
|
|
// move the password fields the way a per-tab hint would.
|
|
function updateSeparatePasswordNote() {
|
|
const hasExistingWallet = state.wallets.length > 0;
|
|
$("add-wallet-separate-password-note").classList.toggle(
|
|
"hidden",
|
|
!hasExistingWallet,
|
|
);
|
|
}
|
|
|
|
function show() {
|
|
clear();
|
|
switchMode("mnemonic");
|
|
updateSeparatePasswordNote();
|
|
showView("add-wallet");
|
|
}
|
|
|
|
function validatePassword() {
|
|
const pw = $("add-wallet-password").value;
|
|
const pw2 = $("add-wallet-password-confirm").value;
|
|
if (!pw) {
|
|
showError("add-wallet-password-error", "Please choose a password.");
|
|
return null;
|
|
}
|
|
// "Allow weak passwords" in Settings lifts the 12-character minimum.
|
|
if (!state.allowWeakPasswords && pw.length < 12) {
|
|
showError(
|
|
"add-wallet-password-error",
|
|
"Password must be at least 12 characters.",
|
|
);
|
|
return null;
|
|
}
|
|
if (pw !== pw2) {
|
|
showError("add-wallet-password-error", "Passwords do not match.");
|
|
return null;
|
|
}
|
|
return pw;
|
|
}
|
|
|
|
async function importMnemonic(ctx) {
|
|
const mnemonic = $("wallet-mnemonic").value.trim();
|
|
if (!mnemonic) {
|
|
showFlash("Enter a recovery phrase, or press the die.");
|
|
return;
|
|
}
|
|
const words = mnemonic.split(/\s+/);
|
|
if (words.length !== 12 && words.length !== 24) {
|
|
showFlash(
|
|
"Recovery phrase must be 12 or 24 words, not " + words.length + ".",
|
|
);
|
|
return;
|
|
}
|
|
if (!isValidMnemonic(mnemonic)) {
|
|
showFlash("Invalid recovery phrase. Check for typos.");
|
|
return;
|
|
}
|
|
const pw = validatePassword();
|
|
if (!pw) return;
|
|
const { xpub, firstAddress } = hdWalletFromMnemonic(mnemonic);
|
|
const xpubDup = findWalletByXpub(xpub);
|
|
if (xpubDup) {
|
|
showFlash("This recovery phrase is already added.");
|
|
return;
|
|
}
|
|
const addrDup = findWalletByAddress(firstAddress);
|
|
if (addrDup) {
|
|
showFlash("Address already exists in a wallet.");
|
|
return;
|
|
}
|
|
const encrypted = await encryptWithPassword(mnemonic, pw);
|
|
const walletNum = state.wallets.length + 1;
|
|
const wallet = {
|
|
type: "hd",
|
|
name: "Wallet " + walletNum,
|
|
xpub: xpub,
|
|
encryptedSecret: encrypted,
|
|
nextIndex: 1,
|
|
addresses: [
|
|
{
|
|
address: firstAddress,
|
|
index: 0,
|
|
balance: "0.0000",
|
|
tokenBalances: [],
|
|
},
|
|
],
|
|
};
|
|
state.wallets.push(wallet);
|
|
state.hasWallet = true;
|
|
if (state.activeAddress === null) {
|
|
state.activeAddress = firstAddress;
|
|
}
|
|
await saveState();
|
|
clearViewStack();
|
|
ctx.renderWalletList();
|
|
showView("main");
|
|
|
|
// Scan for used HD addresses beyond index 0.
|
|
showFlash("Scanning for addresses...", 30000);
|
|
const scan = await scanForAddresses(
|
|
xpub,
|
|
state.rpcUrl,
|
|
state.networkId,
|
|
ctx.pageClosed,
|
|
);
|
|
if (scan.addresses.length > 1) {
|
|
wallet.addresses = scan.addresses.map((a) => ({
|
|
address: a.address,
|
|
index: a.index,
|
|
balance: "0.0000",
|
|
tokenBalances: [],
|
|
}));
|
|
wallet.nextIndex = scan.nextIndex;
|
|
// The new list leaves out the first address when the scan found it
|
|
// unused. If it was the active one, the new list's first takes over,
|
|
// and the background is told as when the user picks one on Home.
|
|
const activeMoved =
|
|
state.activeAddress === firstAddress &&
|
|
wallet.addresses[0].address !== firstAddress;
|
|
if (activeMoved) state.activeAddress = wallet.addresses[0].address;
|
|
await saveState();
|
|
ctx.renderWalletList();
|
|
if (activeMoved) notify({ type: "AUTISTMASK_ACTIVE_CHANGED" });
|
|
showFlash("Found " + scan.addresses.length + " addresses.");
|
|
} else {
|
|
showFlash("Ready.", 1000);
|
|
}
|
|
|
|
ctx.startRefresh();
|
|
}
|
|
|
|
async function importPrivateKey(ctx) {
|
|
const key = $("import-private-key").value.trim();
|
|
if (!key) {
|
|
showFlash("Please enter your private key.");
|
|
return;
|
|
}
|
|
let addr;
|
|
try {
|
|
addr = addressFromPrivateKey(key);
|
|
} catch {
|
|
showFlash("Invalid private key.");
|
|
return;
|
|
}
|
|
const pw = validatePassword();
|
|
if (!pw) return;
|
|
const duplicate = findWalletByAddress(addr);
|
|
if (duplicate) {
|
|
showFlash("This address already exists in a wallet.");
|
|
return;
|
|
}
|
|
const encrypted = await encryptWithPassword(key, pw);
|
|
const walletNum = state.wallets.length + 1;
|
|
state.wallets.push({
|
|
type: "key",
|
|
name: "Wallet " + walletNum,
|
|
encryptedSecret: encrypted,
|
|
addresses: [{ address: addr, balance: "0.0000", tokenBalances: [] }],
|
|
});
|
|
state.hasWallet = true;
|
|
if (state.activeAddress === null) {
|
|
state.activeAddress = addr;
|
|
}
|
|
await saveState();
|
|
clearViewStack();
|
|
ctx.renderWalletList();
|
|
showView("main");
|
|
|
|
ctx.startRefresh();
|
|
}
|
|
|
|
async function importXprvKey(ctx) {
|
|
const xprv = $("import-xprv-key").value.trim();
|
|
if (!xprv) {
|
|
showFlash("Please enter your extended private key.");
|
|
return;
|
|
}
|
|
if (!isValidXprv(xprv)) {
|
|
showFlash("That extended private key is not valid.");
|
|
return;
|
|
}
|
|
if (!isMasterExtendedKey(xprv)) {
|
|
showFlash("Please paste the master key, not a child key.");
|
|
return;
|
|
}
|
|
let result;
|
|
try {
|
|
result = hdWalletFromXprv(xprv);
|
|
} catch {
|
|
showFlash("That extended private key is not valid.");
|
|
return;
|
|
}
|
|
const { xpub, firstAddress } = result;
|
|
const xpubDup = findWalletByXpub(xpub);
|
|
if (xpubDup) {
|
|
showFlash("This key is already added.");
|
|
return;
|
|
}
|
|
const addrDup = findWalletByAddress(firstAddress);
|
|
if (addrDup) {
|
|
showFlash("Address already exists in a wallet.");
|
|
return;
|
|
}
|
|
const pw = validatePassword();
|
|
if (!pw) return;
|
|
const encrypted = await encryptWithPassword(xprv, pw);
|
|
const walletNum = state.wallets.length + 1;
|
|
const wallet = {
|
|
type: "xprv",
|
|
name: "Wallet " + walletNum,
|
|
xpub: xpub,
|
|
encryptedSecret: encrypted,
|
|
nextIndex: 1,
|
|
addresses: [
|
|
{
|
|
address: firstAddress,
|
|
index: 0,
|
|
balance: "0.0000",
|
|
tokenBalances: [],
|
|
},
|
|
],
|
|
};
|
|
state.wallets.push(wallet);
|
|
state.hasWallet = true;
|
|
if (state.activeAddress === null) {
|
|
state.activeAddress = firstAddress;
|
|
}
|
|
await saveState();
|
|
clearViewStack();
|
|
ctx.renderWalletList();
|
|
showView("main");
|
|
|
|
// Scan for used HD addresses beyond index 0.
|
|
showFlash("Scanning for addresses...", 30000);
|
|
const scan = await scanForAddresses(
|
|
xpub,
|
|
state.rpcUrl,
|
|
state.networkId,
|
|
ctx.pageClosed,
|
|
);
|
|
if (scan.addresses.length > 1) {
|
|
wallet.addresses = scan.addresses.map((a) => ({
|
|
address: a.address,
|
|
index: a.index,
|
|
balance: "0.0000",
|
|
tokenBalances: [],
|
|
}));
|
|
wallet.nextIndex = scan.nextIndex;
|
|
// As for a recovery phrase: an active first address the scan left
|
|
// out gives way to the new list's first.
|
|
const activeMoved =
|
|
state.activeAddress === firstAddress &&
|
|
wallet.addresses[0].address !== firstAddress;
|
|
if (activeMoved) state.activeAddress = wallet.addresses[0].address;
|
|
await saveState();
|
|
ctx.renderWalletList();
|
|
if (activeMoved) notify({ type: "AUTISTMASK_ACTIVE_CHANGED" });
|
|
showFlash("Found " + scan.addresses.length + " addresses.");
|
|
} else {
|
|
showFlash("Ready.", 1000);
|
|
}
|
|
|
|
ctx.startRefresh();
|
|
}
|
|
|
|
function init(ctx) {
|
|
onViewLeave("add-wallet", clear);
|
|
|
|
// Tab click handlers
|
|
$("tab-mnemonic").addEventListener("click", () => switchMode("mnemonic"));
|
|
$("tab-privkey").addEventListener("click", () => switchMode("privkey"));
|
|
$("tab-xprv").addEventListener("click", () => switchMode("xprv"));
|
|
|
|
// Generate mnemonic
|
|
$("btn-generate-phrase").addEventListener("click", () => {
|
|
$("wallet-mnemonic").value = generateMnemonic();
|
|
$("add-wallet-phrase-warning").style.visibility = "visible";
|
|
});
|
|
|
|
// Import / confirm. Each press starts with no password error on screen:
|
|
// validatePassword() puts it back if the password is still wrong.
|
|
$("btn-add-wallet-confirm").addEventListener("click", async () => {
|
|
hideError("add-wallet-password-error");
|
|
if (currentMode === "mnemonic") {
|
|
await importMnemonic(ctx);
|
|
} else if (currentMode === "privkey") {
|
|
await importPrivateKey(ctx);
|
|
} else if (currentMode === "xprv") {
|
|
await importXprvKey(ctx);
|
|
}
|
|
});
|
|
|
|
// Back button
|
|
$("btn-add-wallet-back").addEventListener("click", () => {
|
|
goBack();
|
|
});
|
|
}
|
|
|
|
module.exports = { init, show };
|