feat: secure allowance creationby including protocol information

src/app/components/Enable/WeblnEnable.tsx

@@ -85,6 +85,7 @@ function WeblnEnableComponent(props: Props) {
             </div>
           </div>
         </div>
+
         <div className="text-center flex flex-col">
           <ConfirmOrCancel
             disabled={loading}

src/app/components/LNURLAuth/index.tsx

@@ -36,8 +36,8 @@ function LNURLAuthComponent() {
         lnurlDetails: details,
       });
 
-      if (navState.isPrompt && origin?.host) {
-        const allowance = await api.getAllowance(origin.host);
+      if (navState.isPrompt && origin?.domain) {
+        const allowance = await api.getAllowance(origin.domain);
 
         if (allowance.lnurlAuth === false) {
           await msg.request("updateAllowance", {

src/app/components/PublisherPanel/index.tsx

@@ -70,7 +70,7 @@ export default function PublisherPanel({
               </h2>
               {url && (
                 <a
-                  href={`https://${url}`}
+                  href={url}
                   title={url}
                   target="_blank"
                   className="text-gray-500 dark:text-gray-400 overflow-hidden text-ellipsis whitespace-nowrap leading-1 text-lg"

src/app/screens/ConfirmKeysend/index.tsx

@@ -116,7 +116,7 @@ function ConfirmKeysend() {
     if (!budget) return;
     return msg.request("addAllowance", {
       totalBudget: parseInt(budget),
-      host: origin.host,
+      host: origin.domain,
       name: origin.name,
       imageURL: origin.icon,
     });

src/app/screens/ConfirmPayment/index.tsx

@@ -122,7 +122,7 @@ function ConfirmPayment() {
     if (!budget || !navState.origin) return;
     return msg.request("addAllowance", {
       totalBudget: parseInt(budget),
-      host: navState.origin.host,
+      host: navState.origin.domain,
       name: navState.origin.name,
       imageURL: navState.origin.icon,
     });

src/app/screens/Home/index.tsx

@@ -20,7 +20,7 @@ const Home: FC = () => {
       // typeguard, currentUrl should exist at this point
       if (!currentUrl) throw new Error("No established browser connection");
 
-      const result = await api.getAllowance(currentUrl.host);
+      const result = await api.getAllowance(currentUrl.origin);
 
       if (result.enabled) {
         setAllowance(result);

src/common/utils/helpers.ts

@@ -21,8 +21,8 @@ export function getHostFromSender(sender: Sender) {
   // from a privileged page, otherwise use MessageSender.url
   // MessageSender.origin is more reliable as it is not spoofable by a
   // compromised renderer.
-  if (sender.origin) return new URL(sender.origin).host;
-  else if (sender.url) return new URL(sender.url).host;
+  if (sender.origin) return sender.origin;
+  else if (sender.url) return new URL(sender.url).origin;
   else return null;
 }
 

src/extension/background-script/actions/allowances/__tests__/add.test.ts

@@ -22,7 +22,7 @@ describe("add allowance", () => {
         internal: true,
       },
       args: {
-        host: "lnmarkets.com",
+        host: "https://lnmarkets.com",
         name: "LN Markets",
         imageURL: "https://lnmarkets.com/apple-touch-icon.png",
         totalBudget: 200,
@@ -41,7 +41,7 @@ describe("add allowance", () => {
     expect(dbAllowances).toContainEqual({
       createdAt: "1487076708000",
       enabled: true,
-      host: "lnmarkets.com",
+      host: "https://lnmarkets.com",
       imageURL: "https://lnmarkets.com/apple-touch-icon.png",
       lastPaymentAt: 0,
       lnurlAuth: false,

src/extension/background-script/actions/allowances/__tests__/delete.test.ts

@@ -74,7 +74,7 @@ describe("delete allowance", () => {
     expect(dbAllowances).toEqual([
       {
         enabled: true,
-        host: "getalby.com",
+        host: "https://getalby.com",
         id: 1,
         imageURL: "https://getalby.com/favicon.ico",
         lastPaymentAt: 0,

src/extension/background-script/actions/allowances/__tests__/enable.test.ts

@@ -45,7 +45,7 @@ describe("enable allowance", () => {
         external: true,
       },
       args: {
-        host: "lnmarkets.com",
+        host: "https://lnmarkets.com",
       },
     };
 
@@ -87,7 +87,7 @@ describe("enable allowance", () => {
         external: true,
       },
       args: {
-        host: "getalby.com",
+        host: `https://getalby.com`,
       },
     };
     const sender: Sender = {

src/extension/background-script/actions/allowances/__tests__/get.test.ts

@@ -23,7 +23,7 @@ describe("get allowance", () => {
         internal: true,
       },
       args: {
-        host: "getalby.com",
+        host: "https://getalby.com",
       },
     };
 

src/extension/background-script/actions/nostr/__tests__/signSchnorr.test.ts

@@ -45,8 +45,8 @@ const sender: Sender = {
   documentId: "ALBY123",
   documentLifecycle: "active",
   id: "alby",
-  origin: `https://${allowanceInDB.host}`,
-  url: `https://${allowanceInDB.host}/test`,
+  origin: `${allowanceInDB.host}`,
+  url: `${allowanceInDB.host}/test`,
 };
 
 const requestResponse = { data: "" };

src/extension/background-script/actions/payments/__tests__/all.test.ts

@@ -10,7 +10,7 @@ const mockPayments: DbPayment[] = [
     createdAt: "123456",
     description: "A blue bird?!",
     destination: "Space",
-    host: "getalby.com",
+    host: "https://getalby.com",
     id: 4,
     location: "https://www.getalby.com",
     name: "Alby",
@@ -26,7 +26,7 @@ const mockPayments: DbPayment[] = [
     createdAt: "123456",
     description: "A yellow bird?!",
     destination: "Space",
-    host: "getalby.com",
+    host: "https://getalby.com",
     id: 5,
     location: "https://www.getalby.com",
     name: "Alby",

src/extension/background-script/events/__test__/persistPayments.test.ts

@@ -24,7 +24,7 @@ const updatedPayments: DbPayment[] = [
     createdAt: "1487076708000",
     description: "A red bird?!",
     destination: "Space",
-    host: "getalby.com",
+    host: "https://getalby.com",
     id: 6,
     location: "test",
     name: "Alby",
@@ -72,8 +72,8 @@ const data: PaymentNotificationData = {
   },
   origin: {
     location: "test",
-    domain: "",
-    host: "getalby.com",
+    domain: "https://getalby.com",
+    host: "https://getalby.com",
     pathname: "test",
     name: "Alby",
     description: "test",

src/extension/background-script/events/__test__/updateAllowances.test.ts

@@ -32,7 +32,7 @@ const data: PaymentNotificationData = {
   origin: {
     location: "test",
     domain: "",
-    host: "getalby.com",
+    host: "https://getalby.com",
     pathname: "test",
     name: "Alby",
     description: "test",
@@ -56,7 +56,7 @@ describe("Update Allowances", () => {
         internal: true,
       },
       args: {
-        host: "getalby.com",
+        host: "https://getalby.com",
       },
     };
 

src/extension/background-script/events/persistPayments.ts

@@ -7,7 +7,7 @@ const persistSuccessfulPayment = async (
   data: PaymentNotificationData
 ) => {
   const name = data?.origin?.name;
-  const host = data?.origin?.host || "";
+  const host = data?.origin?.domain || "";
   const location = data?.origin?.location;
   const accountId = data.accountId;
   const paymentResponse = data.response;

src/extension/background-script/migrations/index.ts

@@ -1,10 +1,8 @@
-// import db from "../db";
-// import state from "../state";
+import db from "~/extension/background-script/db";
+import state from "../state";
 
 export type Migration = keyof typeof migrations;
 
-/*
-
 // TS does not want unused code.
 // we need this for the next migration again
 
@@ -30,19 +28,45 @@ const setMigrated = (name: Migration): Promise<void> => {
   return state.getState().saveToStorage();
 };
 
-*/
+const migrations = {
+  migrateHostInAllowances: async () => {
+    const allowances = await db.allowances.toArray();
+
+    allowances.forEach(async (allowances) => {
+      allowances.id &&
+        (await db.allowances.update(allowances.id, {
+          host: `https://${allowances.host}`,
+        }));
+    });
+  },
 
-const migrations = {};
+  migrateHostInPayments: async () => {
+    const payments = await db.payments.toArray();
+
+    payments.forEach(async (payments) => {
+      payments.id &&
+        (await db.payments.update(payments.id, {
+          host: `https://${payments.host}`,
+        }));
+    });
+  },
+};
 
 const migrate = async () => {
   // going forward we can iterate through the the migrations object above and DRY this up:
   // Object.keys(migrations).forEach((name: string) => {
   // example:
-  //if (shouldMigrate("migratePermissionsWithoutAccountId")) {
-  //  console.info("Running migration for: migratePermissionsWithoutAccountId");
-  //  await migrations["migratePermissionsWithoutAccountId"]();
-  //  await setMigrated("migratePermissionsWithoutAccountId");
-  //}
+  if (shouldMigrate("migrateHostInAllowances")) {
+    console.info("Running migration for: migrateHostInAllowances");
+    await migrations["migrateHostInAllowances"]();
+    await setMigrated("migrateHostInAllowances");
+  }
+
+  if (shouldMigrate("migrateHostInPayments")) {
+    console.info("Running migration for: migrateHostInPayments");
+    await migrations["migrateHostInPayments"]();
+    await setMigrated("migrateHostInPayments");
+  }
 };
 
 export default migrate;

src/fixtures/allowances.ts

@@ -3,7 +3,7 @@ import type { DbAllowance } from "~/types";
 export const allowanceFixture: DbAllowance[] = [
   {
     enabled: true,
-    host: "getalby.com",
+    host: "https://getalby.com",
     id: 1,
     imageURL: "https://getalby.com/favicon.ico",
     lastPaymentAt: 0,
@@ -17,7 +17,7 @@ export const allowanceFixture: DbAllowance[] = [
   },
   {
     enabled: false,
-    host: "lnmarkets.com",
+    host: "https://lnmarkets.com",
     id: 2,
     imageURL: "https://lnmarkets.com/apple-touch-icon.png",
     lastPaymentAt: 0,

src/fixtures/payment.ts

@@ -7,7 +7,7 @@ export const paymentsFixture: DbPayment[] = [
     createdAt: "123456",
     description: "A blue bird?!",
     destination: "Space",
-    host: "getalby.com",
+    host: "https://getalby.com",
     id: 4,
     location: "https://www.getalby.com",
     name: "Alby",
@@ -23,7 +23,7 @@ export const paymentsFixture: DbPayment[] = [
     createdAt: "123456",
     description: "A yellow bird?!",
     destination: "Space",
-    host: "getalby.com",
+    host: "https://getalby.com",
     id: 5,
     location: "https://www.getalby.com",
     name: "Alby",

src/fixtures/permissions.ts

@@ -6,7 +6,7 @@ export const permissionsFixture: DbPermission[] = [
     accountId: "8b7f1dc6-ab87-4c6c-bca5-19fa8632731e",
     allowanceId: 1,
     createdAt: "1487076708000",
-    host: "getalby.com",
+    host: "https://getalby.com",
     method: "the-request-method-1",
     blocked: false,
     enabled: true,
@@ -16,7 +16,7 @@ export const permissionsFixture: DbPermission[] = [
     accountId: "8b7f1dc6-ab87-4c6c-bca5-19fa8632731e",
     allowanceId: 1,
     createdAt: "1487076708000",
-    host: "getalby.com",
+    host: "https://getalby.com",
     method: "the-request-method-2",
     blocked: false,
     enabled: true,
@@ -26,7 +26,7 @@ export const permissionsFixture: DbPermission[] = [
     accountId: "8b7f1dc6-ab87-4c6c-bca5-19fa8632731e",
     allowanceId: 2,
     createdAt: "1487076708000",
-    host: "lnmarkets.com",
+    host: "https://lnmarkets.com",
     method: "the-request-method-3",
     blocked: false,
     enabled: true,