clawbot
bd0a626e7b
Five defects, one of which destroyed every wallet, came from src/background reading and writing the module-level state singleton the MV3 worker never populates, which silently served DEFAULT_STATE. Each point fix created the next defect. The background now has its own per-call getState() and a queued read-modify-write updateState(); the singleton is unreachable from it, and an unpopulated read throws instead of serving defaults. The prohibition is enforced by the build, not by review: build.js asserts over esbuild's own metafile that no forbidden module is an input of a background bundle, so every specifier syntax esbuild resolves is covered, and both halves of the table are checked for rot -- a stale key, a stale module, an empty list, or an unlisted entry point under src/background/ all fail the build. The ESLint rule remains as fast local feedback and reads the same shared table. Known bounds are documented where the table lives. Also closes #320: getProvider() now requires a validated network id, so a cold worker no longer prepares a non-mainnet dApp transaction for mainnet and gets refused by the wallet's own verifier. backgroundRefresh() no longer mutates address objects across a network round trip, the broadcast path takes its endpoint and chain id from one snapshot, and eight test storage stubs now structured-clone on get as the real chrome.storage.local does. closes #320
478 lines
19 KiB
JavaScript
478 lines
19 KiB
JavaScript
// The lost-password route off the delete-wallet screen (issue #312).
|
|
//
|
|
// What is pinned here is that a user who has forgotten the password can
|
|
// still get out — no password is asked for and none is checked — and that
|
|
// the escape hatch destroys exactly the wallet it names and nothing else.
|
|
// The second half is the dangerous one: this is the only control in the
|
|
// product that erases key material without the password that encrypted it,
|
|
// so an off-by-one in the wallet it removes would take a wallet whose
|
|
// owner never asked for it to be touched.
|
|
//
|
|
// The assertions are made against what came back OUT of extension storage,
|
|
// not against the live `state` object. Deleting a wallet in memory and
|
|
// never persisting it looks identical from `state`, and a build that never
|
|
// wrote at all would pass a check that only reads `state` back.
|
|
//
|
|
// That makes the storage stub load-bearing, so it is the shared one from
|
|
// tests/support/storageStub.js, a real store that structured-clones on both
|
|
// `set` and `get`. A stub whose `get` hands back the same object its `set`
|
|
// was given aliases the caller's own array: the test then reads its own
|
|
// in-memory mutation and calls it persistence, and passes against a build
|
|
// that persists nothing
|
|
// (https://git.eeqj.de/sneak/AutistMask/issues/324). The aliasing is closed
|
|
// off explicitly by the first test below rather than left as an assumption
|
|
// about `structuredClone`.
|
|
//
|
|
// The view is driven against a minimal DOM stub, in the same shape as
|
|
// tests/exportPrivkey.test.js: the module reads and writes named nodes and
|
|
// needs nothing else from a document.
|
|
|
|
const mockSettingsShow = jest.fn();
|
|
jest.mock("../src/popup/views/settings", () => ({
|
|
show: mockSettingsShow,
|
|
}));
|
|
jest.mock("../src/shared/vault", () => ({
|
|
decryptWithPassword: jest.fn(),
|
|
}));
|
|
|
|
const { RESTORABLE_VIEWS } = require("../src/popup/restorableViews");
|
|
const { makeStorageStub } = require("./support/storageStub");
|
|
|
|
const VIEW = "delete-wallet-lost-password";
|
|
|
|
// Fixed addresses — never used for anything but these tests.
|
|
const A0 = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
|
|
const A1 = "0xdAC17F958D2ee523a2206206994597C13D831ec7";
|
|
const B0 = "0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599";
|
|
const C0 = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";
|
|
|
|
// ------------------------------------------------------------ DOM stub
|
|
|
|
function makeElement(id) {
|
|
const classes = new Set();
|
|
const el = {
|
|
id,
|
|
textContent: "",
|
|
value: "",
|
|
innerHTML: "",
|
|
disabled: false,
|
|
style: {},
|
|
dataset: {},
|
|
listeners: {},
|
|
classList: {
|
|
add: (...names) => names.forEach((n) => classes.add(n)),
|
|
remove: (...names) => names.forEach((n) => classes.delete(n)),
|
|
contains: (n) => classes.has(n),
|
|
toggle: (n, force) => {
|
|
const on = force === undefined ? !classes.has(n) : force;
|
|
if (on) classes.add(n);
|
|
else classes.delete(n);
|
|
return on;
|
|
},
|
|
},
|
|
addEventListener: (name, fn) => {
|
|
el.listeners[name] = el.listeners[name] || [];
|
|
el.listeners[name].push(fn);
|
|
},
|
|
appendChild: () => {},
|
|
remove: () => {},
|
|
querySelectorAll: () => [],
|
|
};
|
|
return el;
|
|
}
|
|
|
|
function makeDocument() {
|
|
const els = new Map();
|
|
return {
|
|
getElementById(id) {
|
|
// The debug banner is created on demand by helpers.js; absent
|
|
// is the state a non-debug, non-testnet popup is in.
|
|
if (id === "debug-banner") return null;
|
|
if (!els.has(id)) els.set(id, makeElement(id));
|
|
return els.get(id);
|
|
},
|
|
createElement: () => makeElement("created"),
|
|
addEventListener: () => {},
|
|
body: { prepend: () => {} },
|
|
};
|
|
}
|
|
|
|
// ------------------------------------------------------------ harness
|
|
|
|
function wallet(name, secret, addresses) {
|
|
return {
|
|
type: "hd",
|
|
name,
|
|
xpub: "xpub-" + name,
|
|
encryptedSecret: secret,
|
|
nextIndex: addresses.length,
|
|
addresses: addresses.map((address) => ({
|
|
address,
|
|
balance: "0.0000",
|
|
tokenBalances: [],
|
|
})),
|
|
};
|
|
}
|
|
|
|
function load() {
|
|
jest.resetModules();
|
|
mockSettingsShow.mockClear();
|
|
|
|
const storage = makeStorageStub();
|
|
const sent = [];
|
|
globalThis.chrome = {
|
|
storage: { local: storage.local },
|
|
runtime: { sendMessage: (msg) => sent.push(msg) },
|
|
};
|
|
globalThis.document = makeDocument();
|
|
|
|
const helpers = require("../src/popup/views/helpers");
|
|
const { state } = require("../src/shared/state");
|
|
const vault = require("../src/shared/vault");
|
|
const deleteWallet = require("../src/popup/views/deleteWallet");
|
|
|
|
state.hasWallet = true;
|
|
state.wallets = [
|
|
wallet("Wallet 1", "secret-one", [A0, A1]),
|
|
wallet("Wallet 2", "secret-two", [B0]),
|
|
wallet("Wallet 3", "secret-three", [C0]),
|
|
];
|
|
state.selectedWallet = 0;
|
|
state.selectedAddress = 0;
|
|
state.activeAddress = A0;
|
|
state.allowedSites = { [A0]: ["a.example"], [B0]: ["b.example"] };
|
|
state.deniedSites = { [B0]: ["c.example"], [C0]: ["d.example"] };
|
|
state.viewStack = ["main", "settings"];
|
|
state.currentView = "settings";
|
|
|
|
const renderWalletList = jest.fn();
|
|
deleteWallet.init({ renderWalletList });
|
|
|
|
return { helpers, state, vault, deleteWallet, storage, sent };
|
|
}
|
|
|
|
function click(id) {
|
|
const el = globalThis.document.getElementById(id);
|
|
return Promise.all((el.listeners.click || []).map((fn) => fn()));
|
|
}
|
|
|
|
function node(id) {
|
|
return globalThis.document.getElementById(id);
|
|
}
|
|
|
|
// The wallets as the extension would read them back on a cold start.
|
|
async function persistedWallets(storage) {
|
|
const result = await storage.get("autistmask");
|
|
return result.autistmask.wallets;
|
|
}
|
|
|
|
// Open the lost-password screen for a wallet, the way the user does.
|
|
async function openLostPassword(deleteWallet, walletIdx) {
|
|
deleteWallet.show(walletIdx);
|
|
await click("btn-delete-wallet-lost-password");
|
|
}
|
|
|
|
// ------------------------------------------------------------ tests
|
|
|
|
// The stub is what every persistence assertion below rests on, so its one
|
|
// dangerous failure mode is closed off first. An aliasing store passes
|
|
// every other test in this file against a build that never writes.
|
|
describe("the storage stub", () => {
|
|
test("does not hand back the object it was given", async () => {
|
|
const storage = makeStorageStub();
|
|
const written = { wallets: [{ name: "Wallet 1" }] };
|
|
|
|
await storage.set({ autistmask: written });
|
|
written.wallets.push({ name: "Wallet 2" });
|
|
written.wallets[0].name = "renamed after the write";
|
|
|
|
const readBack = (await storage.get("autistmask")).autistmask;
|
|
expect(readBack.wallets).toHaveLength(1);
|
|
expect(readBack.wallets[0].name).toBe("Wallet 1");
|
|
|
|
// And the other direction: mutating what came out must not reach
|
|
// back into the store.
|
|
readBack.wallets[0].name = "renamed after the read";
|
|
const again = (await storage.get("autistmask")).autistmask;
|
|
expect(again.wallets[0].name).toBe("Wallet 1");
|
|
});
|
|
});
|
|
|
|
describe("reaching the screen", () => {
|
|
test("the delete screen offers the route", async () => {
|
|
const { deleteWallet, state } = load();
|
|
await openLostPassword(deleteWallet, 1);
|
|
|
|
expect(state.currentView).toBe(VIEW);
|
|
expect(node("delete-wallet-lost-name").textContent).toBe("Wallet 2");
|
|
expect(node("delete-wallet-lost-name-echo").textContent).toBe(
|
|
"Wallet 2",
|
|
);
|
|
});
|
|
|
|
// Both delete screens hang off Settings. Pushing one onto the other
|
|
// would leave Back on the confirm screen popping onto itself.
|
|
test("it does not push the screen it came from", async () => {
|
|
const { deleteWallet, state } = load();
|
|
await openLostPassword(deleteWallet, 1);
|
|
|
|
expect(state.viewStack).toEqual(["main", "settings"]);
|
|
});
|
|
|
|
test("Back returns to the delete screen with its wallet still chosen", async () => {
|
|
const { deleteWallet, state } = load();
|
|
await openLostPassword(deleteWallet, 1);
|
|
await click("btn-delete-wallet-lost-back");
|
|
|
|
expect(state.currentView).toBe("delete-wallet-confirm");
|
|
expect(node("delete-wallet-name").textContent).toBe("Wallet 2");
|
|
expect(state.viewStack).toEqual(["main", "settings"]);
|
|
|
|
// The confirm screen is usable, not merely on screen: the wallet
|
|
// it holds is the one that was chosen, so its own button does not
|
|
// answer "No wallet selected for deletion."
|
|
node("delete-wallet-password").value = "some password";
|
|
const { decryptWithPassword } = require("../src/shared/vault");
|
|
decryptWithPassword.mockRejectedValue(new Error("nope"));
|
|
await click("btn-delete-wallet-confirm");
|
|
expect(node("delete-wallet-flash").textContent).toBe(
|
|
"That password is incorrect. Please try again.",
|
|
);
|
|
});
|
|
});
|
|
|
|
describe("the typed confirmation", () => {
|
|
test("a name that is not the wallet's deletes nothing", async () => {
|
|
const { deleteWallet, state, storage } = load();
|
|
await openLostPassword(deleteWallet, 1);
|
|
|
|
node("delete-wallet-lost-name-input").value = "Wallet 3";
|
|
await click("btn-delete-wallet-lost-confirm");
|
|
|
|
expect(node("delete-wallet-lost-flash").textContent).toBe(
|
|
"That is not the name of this wallet. Type Wallet 2 to confirm.",
|
|
);
|
|
expect(node("delete-wallet-lost-flash").style.visibility).toBe(
|
|
"visible",
|
|
);
|
|
expect(state.wallets.map((w) => w.name)).toEqual([
|
|
"Wallet 1",
|
|
"Wallet 2",
|
|
"Wallet 3",
|
|
]);
|
|
expect(state.currentView).toBe(VIEW);
|
|
// Nothing was destroyed on disk either. Storage is not empty —
|
|
// showView() persists the current screen on the way in — so what
|
|
// is asserted is that all three wallets are still in it.
|
|
const persisted = await persistedWallets(storage);
|
|
expect(persisted.map((w) => w.encryptedSecret)).toEqual([
|
|
"secret-one",
|
|
"secret-two",
|
|
"secret-three",
|
|
]);
|
|
});
|
|
|
|
test("an empty field deletes nothing", async () => {
|
|
const { deleteWallet, state } = load();
|
|
await openLostPassword(deleteWallet, 1);
|
|
|
|
await click("btn-delete-wallet-lost-confirm");
|
|
|
|
expect(node("delete-wallet-lost-flash").style.visibility).toBe(
|
|
"visible",
|
|
);
|
|
expect(state.wallets).toHaveLength(3);
|
|
});
|
|
|
|
// Not a secret and not a password: it asks whether the user knows
|
|
// which wallet they are on. Refusing the name they can plainly read,
|
|
// over letter case, would only teach them to distrust the control.
|
|
test("case and surrounding spaces do not matter", async () => {
|
|
const { deleteWallet, state, storage } = load();
|
|
await openLostPassword(deleteWallet, 1);
|
|
|
|
node("delete-wallet-lost-name-input").value = " wALLet 2 ";
|
|
await click("btn-delete-wallet-lost-confirm");
|
|
|
|
expect(state.wallets.map((w) => w.name)).toEqual([
|
|
"Wallet 1",
|
|
"Wallet 3",
|
|
]);
|
|
expect(await persistedWallets(storage)).toHaveLength(2);
|
|
});
|
|
|
|
// A name with a doubled inner space RENDERS with one — HTML collapses
|
|
// runs of whitespace — so the string the user can see and type is not
|
|
// the string the name is stored as. Comparing the two raw would make
|
|
// this wallet's confirmation impossible to satisfy by any typing at
|
|
// all, wedging the one screen that exists to unwedge people.
|
|
test("a doubled space inside the name is typed back as one", async () => {
|
|
const { deleteWallet, state, storage } = load();
|
|
state.wallets[1].name = "My Wallet";
|
|
await openLostPassword(deleteWallet, 1);
|
|
|
|
// What the DOM was handed still has both spaces; what the user
|
|
// reads off the screen, and therefore types, has one.
|
|
expect(node("delete-wallet-lost-name").textContent).toBe("My Wallet");
|
|
node("delete-wallet-lost-name-input").value = "My Wallet";
|
|
await click("btn-delete-wallet-lost-confirm");
|
|
|
|
expect(state.wallets.map((w) => w.name)).toEqual([
|
|
"Wallet 1",
|
|
"Wallet 3",
|
|
]);
|
|
const persisted = await persistedWallets(storage);
|
|
expect(persisted.map((w) => w.encryptedSecret)).toEqual([
|
|
"secret-one",
|
|
"secret-three",
|
|
]);
|
|
});
|
|
});
|
|
|
|
describe("deleting without the password", () => {
|
|
test("no password is asked for and none is checked", async () => {
|
|
const { deleteWallet, vault, storage } = load();
|
|
await openLostPassword(deleteWallet, 1);
|
|
|
|
node("delete-wallet-lost-name-input").value = "Wallet 2";
|
|
await click("btn-delete-wallet-lost-confirm");
|
|
|
|
expect(vault.decryptWithPassword).not.toHaveBeenCalled();
|
|
expect(await persistedWallets(storage)).toHaveLength(2);
|
|
});
|
|
|
|
// The load-bearing assertion of the whole file, and the one that says
|
|
// this control is safe to give a user who cannot prove anything: it
|
|
// removes the wallet it named, and every other wallet survives intact,
|
|
// key material included.
|
|
test("exactly the named wallet is destroyed", async () => {
|
|
const { deleteWallet, storage } = load();
|
|
await openLostPassword(deleteWallet, 1);
|
|
|
|
node("delete-wallet-lost-name-input").value = "Wallet 2";
|
|
await click("btn-delete-wallet-lost-confirm");
|
|
|
|
const wallets = await persistedWallets(storage);
|
|
expect(wallets.map((w) => w.name)).toEqual(["Wallet 1", "Wallet 3"]);
|
|
expect(wallets.map((w) => w.encryptedSecret)).toEqual([
|
|
"secret-one",
|
|
"secret-three",
|
|
]);
|
|
expect(wallets.map((w) => w.xpub)).toEqual([
|
|
"xpub-Wallet 1",
|
|
"xpub-Wallet 3",
|
|
]);
|
|
expect(wallets[0].addresses.map((a) => a.address)).toEqual([A0, A1]);
|
|
expect(wallets[1].addresses.map((a) => a.address)).toEqual([C0]);
|
|
|
|
// The deleted wallet's secret is gone from storage entirely, not
|
|
// merely unreferenced by the wallet list.
|
|
expect(JSON.stringify(storage.read())).not.toContain("secret-two");
|
|
expect(JSON.stringify(storage.read())).not.toContain("xpub-Wallet 2");
|
|
});
|
|
|
|
test("only the deleted wallet's site permissions are dropped", async () => {
|
|
const { deleteWallet, storage } = load();
|
|
await openLostPassword(deleteWallet, 1);
|
|
|
|
node("delete-wallet-lost-name-input").value = "Wallet 2";
|
|
await click("btn-delete-wallet-lost-confirm");
|
|
|
|
const saved = (await storage.get("autistmask")).autistmask;
|
|
expect(saved.allowedSites).toEqual({ [A0]: ["a.example"] });
|
|
expect(saved.deniedSites).toEqual({ [C0]: ["d.example"] });
|
|
});
|
|
|
|
// The route shares finishDelete() with the password route, so the
|
|
// selection repair and the accountsChanged broadcast are the same on
|
|
// both. Deleting a wallet that did not own the active address must
|
|
// leave that address, and the selection, exactly where they were.
|
|
test("a selection in another wallet is left alone", async () => {
|
|
const { deleteWallet, storage, sent } = load();
|
|
await openLostPassword(deleteWallet, 1);
|
|
|
|
node("delete-wallet-lost-name-input").value = "Wallet 2";
|
|
await click("btn-delete-wallet-lost-confirm");
|
|
|
|
const saved = (await storage.get("autistmask")).autistmask;
|
|
expect(saved.activeAddress).toBe(A0);
|
|
expect(saved.selectedWallet).toBe(0);
|
|
expect(saved.selectedAddress).toBe(0);
|
|
expect(sent).toEqual([]);
|
|
// Settings is stubbed, so this is where the route hands over, not
|
|
// where it renders.
|
|
expect(mockSettingsShow).toHaveBeenCalled();
|
|
});
|
|
|
|
test("deleting the wallet holding the active address moves it and says so", async () => {
|
|
const { deleteWallet, storage, sent } = load();
|
|
await openLostPassword(deleteWallet, 0);
|
|
|
|
node("delete-wallet-lost-name-input").value = "Wallet 1";
|
|
await click("btn-delete-wallet-lost-confirm");
|
|
|
|
const saved = (await storage.get("autistmask")).autistmask;
|
|
expect(saved.wallets.map((w) => w.name)).toEqual([
|
|
"Wallet 2",
|
|
"Wallet 3",
|
|
]);
|
|
expect(saved.activeAddress).toBe(B0);
|
|
expect(sent).toEqual([{ type: "AUTISTMASK_ACTIVE_CHANGED" }]);
|
|
});
|
|
|
|
test("deleting the last wallet lands on Welcome with nothing left", async () => {
|
|
const { deleteWallet, state, storage } = load();
|
|
state.wallets = [wallet("Wallet 1", "secret-one", [A0])];
|
|
state.allowedSites = { [A0]: ["a.example"] };
|
|
state.deniedSites = {};
|
|
|
|
await openLostPassword(deleteWallet, 0);
|
|
node("delete-wallet-lost-name-input").value = "Wallet 1";
|
|
await click("btn-delete-wallet-lost-confirm");
|
|
|
|
const saved = (await storage.get("autistmask")).autistmask;
|
|
expect(saved.wallets).toEqual([]);
|
|
expect(saved.hasWallet).toBe(false);
|
|
expect(saved.activeAddress).toBeNull();
|
|
expect(saved.allowedSites).toEqual({});
|
|
expect(state.currentView).toBe("welcome");
|
|
expect(JSON.stringify(storage.read())).not.toContain("secret-one");
|
|
});
|
|
});
|
|
|
|
describe("what the screen leaves behind", () => {
|
|
test("the typed confirmation is wiped when the screen is left", async () => {
|
|
const { helpers, deleteWallet } = load();
|
|
await openLostPassword(deleteWallet, 1);
|
|
|
|
node("delete-wallet-lost-name-input").value = "Wallet 2";
|
|
// The Settings gear, which is not this screen's Back button.
|
|
helpers.showView("settings");
|
|
|
|
expect(node("delete-wallet-lost-name-input").value).toBe("");
|
|
expect(node("delete-wallet-lost-flash").textContent).toBe("");
|
|
expect(node("delete-wallet-lost-flash").style.visibility).toBe(
|
|
"hidden",
|
|
);
|
|
});
|
|
|
|
// Left mid-delete, the screen has to come back usable.
|
|
test("the confirm button is re-enabled on the way out", async () => {
|
|
const { helpers, deleteWallet } = load();
|
|
await openLostPassword(deleteWallet, 1);
|
|
|
|
node("btn-delete-wallet-lost-confirm").disabled = true;
|
|
helpers.showView("settings");
|
|
|
|
expect(node("btn-delete-wallet-lost-confirm").disabled).toBe(false);
|
|
});
|
|
|
|
// A wallet name is not a secret, so the screen is excluded for the
|
|
// other reason: reopening the popup must not land the user on a screen
|
|
// whose button erases key material.
|
|
test("the popup may not reopen onto it", () => {
|
|
expect(RESTORABLE_VIEWS.has(VIEW)).toBe(false);
|
|
expect(RESTORABLE_VIEWS.has("delete-wallet-confirm")).toBe(false);
|
|
});
|
|
});
|