feat: secure allowance creationby including protocol information

src/app/components/Enable/WeblnEnable.tsx

@@ -85,6 +85,7 @@ function WeblnEnableComponent(props: Props) {
  </div>
  </div>
  </div>
+
  <div className="text-center flex flex-col">
  <ConfirmOrCancel
  disabled={loading}

src/app/components/LNURLAuth/index.tsx

@@ -36,8 +36,8 @@ function LNURLAuthComponent() {
  lnurlDetails: details,
  });
 
- if (navState.isPrompt && origin?.host) {
- const allowance = await api.getAllowance(origin.host);
+ if (navState.isPrompt && origin?.domain) {
+ const allowance = await api.getAllowance(origin.domain);
 
  if (allowance.lnurlAuth === false) {
  await msg.request("updateAllowance", {

src/app/components/PublisherPanel/index.tsx

@@ -70,7 +70,7 @@ export default function PublisherPanel({
  </h2>
  {url && (
  <a
- href={`https://${url}`}
+ href={url}
  title={url}
  target="_blank"
  className="text-gray-500 dark:text-gray-400 overflow-hidden text-ellipsis whitespace-nowrap leading-1 text-lg"

src/app/screens/ConfirmKeysend/index.tsx

@@ -116,7 +116,7 @@ function ConfirmKeysend() {
  if (!budget) return;
  return msg.request("addAllowance", {
  totalBudget: parseInt(budget),
- host: origin.host,
+ host: origin.domain,
  name: origin.name,
  imageURL: origin.icon,
  });

src/app/screens/ConfirmPayment/index.tsx

@@ -122,7 +122,7 @@ function ConfirmPayment() {
  if (!budget || !navState.origin) return;
  return msg.request("addAllowance", {
  totalBudget: parseInt(budget),
- host: navState.origin.host,
+ host: navState.origin.domain,
  name: navState.origin.name,
  imageURL: navState.origin.icon,
  });

src/app/screens/Home/index.tsx

@@ -20,7 +20,7 @@ const Home: FC = () => {
  // typeguard, currentUrl should exist at this point
  if (!currentUrl) throw new Error("No established browser connection");
 
- const result = await api.getAllowance(currentUrl.host);
+ const result = await api.getAllowance(currentUrl.origin);
 
  if (result.enabled) {
  setAllowance(result);

src/common/utils/helpers.ts

@@ -21,8 +21,8 @@ export function getHostFromSender(sender: Sender) {
  // from a privileged page, otherwise use MessageSender.url
  // MessageSender.origin is more reliable as it is not spoofable by a
  // compromised renderer.
- if (sender.origin) return new URL(sender.origin).host;
- else if (sender.url) return new URL(sender.url).host;
+ if (sender.origin) return sender.origin;
+ else if (sender.url) return new URL(sender.url).origin;
  else return null;
 }
 

src/extension/background-script/actions/allowances/__tests__/add.test.ts

@@ -22,7 +22,7 @@ describe("add allowance", () => {
  internal: true,
  },
  args: {
- host: "lnmarkets.com",
+ host: "https://lnmarkets.com",
  name: "LN Markets",
  imageURL: "https://lnmarkets.com/apple-touch-icon.png",
  totalBudget: 200,
@@ -41,7 +41,7 @@ describe("add allowance", () => {
  expect(dbAllowances).toContainEqual({
  createdAt: "1487076708000",
  enabled: true,
- host: "lnmarkets.com",
+ host: "https://lnmarkets.com",
  imageURL: "https://lnmarkets.com/apple-touch-icon.png",
  lastPaymentAt: 0,
  lnurlAuth: false,

src/extension/background-script/actions/allowances/__tests__/delete.test.ts

@@ -74,7 +74,7 @@ describe("delete allowance", () => {
  expect(dbAllowances).toEqual([
  {
  enabled: true,
- host: "getalby.com",
+ host: "https://getalby.com",
  id: 1,
  imageURL: "https://getalby.com/favicon.ico",
  lastPaymentAt: 0,

src/extension/background-script/actions/allowances/__tests__/enable.test.ts

@@ -45,7 +45,7 @@ describe("enable allowance", () => {
  external: true,
  },
  args: {
- host: "lnmarkets.com",
+ host: "https://lnmarkets.com",
  },
  };
 
@@ -87,7 +87,7 @@ describe("enable allowance", () => {
  external: true,
  },
  args: {
- host: "getalby.com",
+ host: `https://getalby.com`,
  },
  };
  const sender: Sender = {

src/extension/background-script/actions/allowances/__tests__/get.test.ts

@@ -23,7 +23,7 @@ describe("get allowance", () => {
  internal: true,
  },
  args: {
- host: "getalby.com",
+ host: "https://getalby.com",
  },
  };
 

src/extension/background-script/actions/nostr/__tests__/signSchnorr.test.ts

@@ -45,8 +45,8 @@ const sender: Sender = {
  documentId: "ALBY123",
  documentLifecycle: "active",
  id: "alby",
- origin: `https://${allowanceInDB.host}`,
- url: `https://${allowanceInDB.host}/test`,
+ origin: `${allowanceInDB.host}`,
+ url: `${allowanceInDB.host}/test`,
 };
 
 const requestResponse = { data: "" };

src/extension/background-script/actions/payments/__tests__/all.test.ts

@@ -10,7 +10,7 @@ const mockPayments: DbPayment[] = [
  createdAt: "123456",
  description: "A blue bird?!",
  destination: "Space",
- host: "getalby.com",
+ host: "https://getalby.com",
  id: 4,
  location: "https://www.getalby.com",
  name: "Alby",
@@ -26,7 +26,7 @@ const mockPayments: DbPayment[] = [
  createdAt: "123456",
  description: "A yellow bird?!",
  destination: "Space",
- host: "getalby.com",
+ host: "https://getalby.com",
  id: 5,
  location: "https://www.getalby.com",
  name: "Alby",

src/extension/background-script/events/__test__/persistPayments.test.ts

@@ -24,7 +24,7 @@ const updatedPayments: DbPayment[] = [
  createdAt: "1487076708000",
  description: "A red bird?!",
  destination: "Space",
- host: "getalby.com",
+ host: "https://getalby.com",
  id: 6,
  location: "test",
  name: "Alby",
@@ -72,8 +72,8 @@ const data: PaymentNotificationData = {
  },
  origin: {
  location: "test",
- domain: "",
- host: "getalby.com",
+ domain: "https://getalby.com",
+ host: "https://getalby.com",
  pathname: "test",
  name: "Alby",
  description: "test",

src/extension/background-script/events/__test__/updateAllowances.test.ts

@@ -32,7 +32,7 @@ const data: PaymentNotificationData = {
  origin: {
  location: "test",
  domain: "",
- host: "getalby.com",
+ host: "https://getalby.com",
  pathname: "test",
  name: "Alby",
  description: "test",
@@ -56,7 +56,7 @@ describe("Update Allowances", () => {
  internal: true,
  },
  args: {
- host: "getalby.com",
+ host: "https://getalby.com",
  },
  };
 

src/extension/background-script/events/persistPayments.ts

@@ -7,7 +7,7 @@ const persistSuccessfulPayment = async (
  data: PaymentNotificationData
 ) => {
  const name = data?.origin?.name;
- const host = data?.origin?.host || "";
+ const host = data?.origin?.domain || "";
  const location = data?.origin?.location;
  const accountId = data.accountId;
  const paymentResponse = data.response;

src/extension/background-script/migrations/index.ts

@@ -1,10 +1,8 @@
-// import db from "../db";
-// import state from "../state";
+import db from "~/extension/background-script/db";
+import state from "../state";
 
 export type Migration = keyof typeof migrations;
 
-/*
-
 // TS does not want unused code.
 // we need this for the next migration again
 
@@ -30,19 +28,45 @@ const setMigrated = (name: Migration): Promise<void> => {
  return state.getState().saveToStorage();
 };
 
-*/
+const migrations = {
+ migrateHostInAllowances: async () => {
+ const allowances = await db.allowances.toArray();
+
+ allowances.forEach(async (allowances) => {
+ allowances.id &&
+ (await db.allowances.update(allowances.id, {
+ host: `https://${allowances.host}`,
+ }));
+ });
+ },
 
-const migrations = {};
+ migrateHostInPayments: async () => {
+ const payments = await db.payments.toArray();
+
+ payments.forEach(async (payments) => {
+ payments.id &&
+ (await db.payments.update(payments.id, {
+ host: `https://${payments.host}`,
+ }));
+ });
+ },
+};
 
 const migrate = async () => {
  // going forward we can iterate through the the migrations object above and DRY this up:
  // Object.keys(migrations).forEach((name: string) => {
  // example:
- //if (shouldMigrate("migratePermissionsWithoutAccountId")) {
- // console.info("Running migration for: migratePermissionsWithoutAccountId");
- // await migrations["migratePermissionsWithoutAccountId"]();
- // await setMigrated("migratePermissionsWithoutAccountId");
- //}
+ if (shouldMigrate("migrateHostInAllowances")) {
+ console.info("Running migration for: migrateHostInAllowances");
+ await migrations["migrateHostInAllowances"]();
+ await setMigrated("migrateHostInAllowances");
+ }
+
+ if (shouldMigrate("migrateHostInPayments")) {
+ console.info("Running migration for: migrateHostInPayments");
+ await migrations["migrateHostInPayments"]();
+ await setMigrated("migrateHostInPayments");
+ }
 };
 
 export default migrate;

src/fixtures/allowances.ts

@@ -3,7 +3,7 @@ import type { DbAllowance } from "~/types";
 export const allowanceFixture: DbAllowance[] = [
  {
  enabled: true,
- host: "getalby.com",
+ host: "https://getalby.com",
  id: 1,
  imageURL: "https://getalby.com/favicon.ico",
  lastPaymentAt: 0,
@@ -17,7 +17,7 @@ export const allowanceFixture: DbAllowance[] = [
  },
  {
  enabled: false,
- host: "lnmarkets.com",
+ host: "https://lnmarkets.com",
  id: 2,
  imageURL: "https://lnmarkets.com/apple-touch-icon.png",
  lastPaymentAt: 0,

src/fixtures/payment.ts

@@ -7,7 +7,7 @@ export const paymentsFixture: DbPayment[] = [
  createdAt: "123456",
  description: "A blue bird?!",
  destination: "Space",
- host: "getalby.com",
+ host: "https://getalby.com",
  id: 4,
  location: "https://www.getalby.com",
  name: "Alby",
@@ -23,7 +23,7 @@ export const paymentsFixture: DbPayment[] = [
  createdAt: "123456",
  description: "A yellow bird?!",
  destination: "Space",
- host: "getalby.com",
+ host: "https://getalby.com",
  id: 5,
  location: "https://www.getalby.com",
  name: "Alby",

src/fixtures/permissions.ts

@@ -6,7 +6,7 @@ export const permissionsFixture: DbPermission[] = [
  accountId: "8b7f1dc6-ab87-4c6c-bca5-19fa8632731e",
  allowanceId: 1,
  createdAt: "1487076708000",
- host: "getalby.com",
+ host: "https://getalby.com",
  method: "the-request-method-1",
  blocked: false,
  enabled: true,
@@ -16,7 +16,7 @@ export const permissionsFixture: DbPermission[] = [
  accountId: "8b7f1dc6-ab87-4c6c-bca5-19fa8632731e",
  allowanceId: 1,
  createdAt: "1487076708000",
- host: "getalby.com",
+ host: "https://getalby.com",
  method: "the-request-method-2",
  blocked: false,
  enabled: true,
@@ -26,7 +26,7 @@ export const permissionsFixture: DbPermission[] = [
  accountId: "8b7f1dc6-ab87-4c6c-bca5-19fa8632731e",
  allowanceId: 2,
  createdAt: "1487076708000",
- host: "lnmarkets.com",
+ host: "https://lnmarkets.com",
  method: "the-request-method-3",
  blocked: false,
  enabled: true,