feat: secure allowance creationby including protocol information

src/app/components/Enable/AlbyEnable.tsx

@@ -4,6 +4,7 @@ import Container from "@components/Container";
 import PublisherCard from "@components/PublisherCard";
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
+import Alert from "~/app/components/Alert";
 import ScreenHeader from "~/app/components/ScreenHeader";
 import toast from "~/app/components/Toast";
 import { USER_REJECTED_ERROR } from "~/common/constants";
@@ -15,6 +16,7 @@ type Props = {
 };
 function AlbyEnableComponent(props: Props) {
  const [loading, setLoading] = useState(false);
+ const hasHttp = props.origin.domain.startsWith("http://");
  const { t } = useTranslation("translation", {
  keyPrefix: "alby_enable",
  });
@@ -62,6 +64,14 @@ function AlbyEnableComponent(props: Props) {
  isSmall={false}
  />
 
+ <div className="pt-3">
+ {hasHttp && (
+ <Alert type="warn">
+ {tCommon("enable.insecure_domain_warn")}
+ </Alert>
+ )}
+ </div>
+
  <div className="dark:text-white pt-6">
  <p className="mb-2">{tCommon("enable.allow")}</p>
 

src/app/components/Enable/LiquidEnable.tsx

@@ -4,6 +4,7 @@ import Container from "@components/Container";
 import PublisherCard from "@components/PublisherCard";
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
+import Alert from "~/app/components/Alert";
 import ScreenHeader from "~/app/components/ScreenHeader";
 import toast from "~/app/components/Toast";
 import { USER_REJECTED_ERROR } from "~/common/constants";
@@ -15,6 +16,7 @@ type Props = {
 };
 function LiquidEnableComponent(props: Props) {
  const [loading, setLoading] = useState(false);
+ const hasHttp = props.origin.domain.startsWith("http://");
  const { t } = useTranslation("translation", {
  keyPrefix: "liquid_enable",
  });
@@ -62,6 +64,14 @@ function LiquidEnableComponent(props: Props) {
  isSmall={false}
  />
 
+ <div className="pt-3">
+ {hasHttp && (
+ <Alert type="warn">
+ {tCommon("enable.insecure_domain_warn")}
+ </Alert>
+ )}
+ </div>
+
  <div className="dark:text-white pt-6">
  <p className="mb-2">{tCommon("enable.allow")}</p>
 

src/app/components/Enable/NostrEnable.tsx

@@ -4,6 +4,7 @@ import Container from "@components/Container";
 import PublisherCard from "@components/PublisherCard";
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
+import Alert from "~/app/components/Alert";
 import ScreenHeader from "~/app/components/ScreenHeader";
 import toast from "~/app/components/Toast";
 import { USER_REJECTED_ERROR } from "~/common/constants";
@@ -15,6 +16,7 @@ type Props = {
 };
 function NostrEnableComponent(props: Props) {
  const [loading, setLoading] = useState(false);
+ const hasHttp = props.origin.domain.startsWith("http://");
  const { t } = useTranslation("translation", {
  keyPrefix: "nostr_enable",
  });
@@ -62,6 +64,14 @@ function NostrEnableComponent(props: Props) {
  isSmall={false}
  />
 
+ <div className="pt-3">
+ {hasHttp && (
+ <Alert type="warn">
+ {tCommon("enable.insecure_domain_warn")}
+ </Alert>
+ )}
+ </div>
+
  <div className="dark:text-white pt-6">
  <p className="mb-2">{tCommon("enable.allow")}</p>
 

src/app/components/Enable/WebbtcEnable.tsx

@@ -4,6 +4,7 @@ import Container from "@components/Container";
 import PublisherCard from "@components/PublisherCard";
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
+import Alert from "~/app/components/Alert";
 import ScreenHeader from "~/app/components/ScreenHeader";
 import toast from "~/app/components/Toast";
 import { USER_REJECTED_ERROR } from "~/common/constants";
@@ -15,6 +16,7 @@ type Props = {
 };
 function WebbtcEnableComponent(props: Props) {
  const [loading, setLoading] = useState(false);
+ const hasHttp = props.origin.domain.startsWith("http://");
  const { t } = useTranslation("translation", {
  keyPrefix: "webbtc_enable",
  });
@@ -62,6 +64,14 @@ function WebbtcEnableComponent(props: Props) {
  isSmall={false}
  />
 
+ <div className="pt-3">
+ {hasHttp && (
+ <Alert type="warn">
+ {tCommon("enable.insecure_domain_warn")}
+ </Alert>
+ )}
+ </div>
+
  <div className="dark:text-white pt-6">
  <p className="mb-2">{tCommon("enable.allow")}</p>
 

src/app/components/Enable/WeblnEnable.tsx

@@ -4,6 +4,7 @@ import Container from "@components/Container";
 import PublisherCard from "@components/PublisherCard";
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
+import Alert from "~/app/components/Alert";
 import ScreenHeader from "~/app/components/ScreenHeader";
 import toast from "~/app/components/Toast";
 import { USER_REJECTED_ERROR } from "~/common/constants";
@@ -15,6 +16,7 @@ type Props = {
 };
 function WeblnEnableComponent(props: Props) {
  const [loading, setLoading] = useState(false);
+ const hasHttp = props.origin.domain.startsWith("http://");
  const { t } = useTranslation("translation", {
  keyPrefix: "webln_enable",
  });
@@ -62,6 +64,14 @@ function WeblnEnableComponent(props: Props) {
  isSmall={false}
  />
 
+ <div className="pt-3">
+ {hasHttp && (
+ <Alert type="warn">
+ {tCommon("enable.insecure_domain_warn")}
+ </Alert>
+ )}
+ </div>
+
  <div className="dark:text-white pt-6">
  <p className="mb-2">{tCommon("enable.allow")}</p>
 
@@ -75,6 +85,7 @@ function WeblnEnableComponent(props: Props) {
  </div>
  </div>
  </div>
+
  <div className="text-center flex flex-col">
  <ConfirmOrCancel
  disabled={loading}

src/app/screens/ConfirmKeysend/index.tsx

@@ -116,7 +116,7 @@ function ConfirmKeysend() {
  if (!budget) return;
  return msg.request("addAllowance", {
  totalBudget: parseInt(budget),
- host: origin.host,
+ host: origin.domain,
  name: origin.name,
  imageURL: origin.icon,
  });

src/app/screens/ConfirmPayment/index.tsx

@@ -122,7 +122,7 @@ function ConfirmPayment() {
  if (!budget || !navState.origin) return;
  return msg.request("addAllowance", {
  totalBudget: parseInt(budget),
- host: navState.origin.host,
+ host: navState.origin.domain,
  name: navState.origin.name,
  imageURL: navState.origin.icon,
  });

src/common/utils/helpers.ts

@@ -21,8 +21,8 @@ export function getHostFromSender(sender: Sender) {
  // from a privileged page, otherwise use MessageSender.url
  // MessageSender.origin is more reliable as it is not spoofable by a
  // compromised renderer.
- if (sender.origin) return new URL(sender.origin).host;
- else if (sender.url) return new URL(sender.url).host;
+ if (sender.origin) return sender.origin;
+ else if (sender.url) return new URL(sender.url).origin;
  else return null;
 }
 

src/extension/background-script/actions/allowances/__tests__/add.test.ts

@@ -22,7 +22,7 @@ describe("add allowance", () => {
  internal: true,
  },
  args: {
- host: "lnmarkets.com",
+ host: "https://lnmarkets.com",
  name: "LN Markets",
  imageURL: "https://lnmarkets.com/apple-touch-icon.png",
  totalBudget: 200,
@@ -41,7 +41,7 @@ describe("add allowance", () => {
  expect(dbAllowances).toContainEqual({
  createdAt: "1487076708000",
  enabled: true,
- host: "lnmarkets.com",
+ host: "https://lnmarkets.com",
  imageURL: "https://lnmarkets.com/apple-touch-icon.png",
  lastPaymentAt: 0,
  lnurlAuth: false,

src/extension/background-script/actions/allowances/__tests__/delete.test.ts

@@ -74,7 +74,7 @@ describe("delete allowance", () => {
  expect(dbAllowances).toEqual([
  {
  enabled: true,
- host: "getalby.com",
+ host: "https://getalby.com",
  id: 1,
  imageURL: "https://getalby.com/favicon.ico",
  lastPaymentAt: 0,

src/extension/background-script/actions/allowances/__tests__/enable.test.ts

@@ -45,7 +45,7 @@ describe("enable allowance", () => {
  external: true,
  },
  args: {
- host: "lnmarkets.com",
+ host: "https://lnmarkets.com",
  },
  };
 
@@ -87,7 +87,7 @@ describe("enable allowance", () => {
  external: true,
  },
  args: {
- host: "getalby.com",
+ host: `https://getalby.com`,
  },
  };
  const sender: Sender = {

src/extension/background-script/actions/allowances/__tests__/get.test.ts

@@ -23,7 +23,7 @@ describe("get allowance", () => {
  internal: true,
  },
  args: {
- host: "getalby.com",
+ host: "https://getalby.com",
  },
  };
 

src/extension/background-script/actions/nostr/__tests__/signSchnorr.test.ts

@@ -45,8 +45,8 @@ const sender: Sender = {
  documentId: "ALBY123",
  documentLifecycle: "active",
  id: "alby",
- origin: `https://${allowanceInDB.host}`,
- url: `https://${allowanceInDB.host}/test`,
+ origin: `${allowanceInDB.host}`,
+ url: `${allowanceInDB.host}/test`,
 };
 
 const requestResponse = { data: "" };

src/extension/background-script/actions/payments/__tests__/all.test.ts

@@ -10,7 +10,7 @@ const mockPayments: DbPayment[] = [
  createdAt: "123456",
  description: "A blue bird?!",
  destination: "Space",
- host: "getalby.com",
+ host: "https://getalby.com",
  id: 4,
  location: "https://www.getalby.com",
  name: "Alby",
@@ -26,7 +26,7 @@ const mockPayments: DbPayment[] = [
  createdAt: "123456",
  description: "A yellow bird?!",
  destination: "Space",
- host: "getalby.com",
+ host: "https://getalby.com",
  id: 5,
  location: "https://www.getalby.com",
  name: "Alby",

src/extension/background-script/events/__test__/persistPayments.test.ts

@@ -24,7 +24,7 @@ const updatedPayments: DbPayment[] = [
  createdAt: "1487076708000",
  description: "A red bird?!",
  destination: "Space",
- host: "getalby.com",
+ host: "https://getalby.com",
  id: 6,
  location: "test",
  name: "Alby",
@@ -73,7 +73,7 @@ const data: PaymentNotificationData = {
  origin: {
  location: "test",
  domain: "",
- host: "getalby.com",
+ host: "https://getalby.com",
  pathname: "test",
  name: "Alby",
  description: "test",

src/extension/background-script/events/__test__/updateAllowances.test.ts

@@ -32,7 +32,7 @@ const data: PaymentNotificationData = {
  origin: {
  location: "test",
  domain: "",
- host: "getalby.com",
+ host: "https://getalby.com",
  pathname: "test",
  name: "Alby",
  description: "test",
@@ -56,7 +56,7 @@ describe("Update Allowances", () => {
  internal: true,
  },
  args: {
- host: "getalby.com",
+ host: "https://getalby.com",
  },
  };
 

src/extension/background-script/migrations/index.ts

@@ -1,10 +1,8 @@
-// import db from "../db";
-// import state from "../state";
+import db from "~/extension/background-script/db";
+import state from "../state";
 
 export type Migration = keyof typeof migrations;
 
-/*
-
 // TS does not want unused code.
 // we need this for the next migration again
 
@@ -30,19 +28,28 @@ const setMigrated = (name: Migration): Promise<void> => {
  return state.getState().saveToStorage();
 };
 
-*/
-
-const migrations = {};
+const migrations = {
+ migrateAllowanceDomainProtocol: async () => {
+ const allowances = await db.allowances.toArray();
+
+ allowances.forEach(async (allowances) => {
+ allowances.id &&
+ (await db.allowances.update(allowances.id, {
+ host: `https://${allowances.host}`,
+ }));
+ });
+ },
+};
 
 const migrate = async () => {
  // going forward we can iterate through the the migrations object above and DRY this up:
  // Object.keys(migrations).forEach((name: string) => {
  // example:
- //if (shouldMigrate("migratePermissionsWithoutAccountId")) {
- // console.info("Running migration for: migratePermissionsWithoutAccountId");
- // await migrations["migratePermissionsWithoutAccountId"]();
- // await setMigrated("migratePermissionsWithoutAccountId");
- //}
+ if (shouldMigrate("migrateAllowanceDomainProtocol")) {
+ console.info("Running migration for: migrateAllowanceDomainProtocol");
+ await migrations["migrateAllowanceDomainProtocol"]();
+ await setMigrated("migrateAllowanceDomainProtocol");
+ }
 };
 
 export default migrate;

src/fixtures/allowances.ts

@@ -3,7 +3,7 @@ import type { DbAllowance } from "~/types";
 export const allowanceFixture: DbAllowance[] = [
  {
  enabled: true,
- host: "getalby.com",
+ host: "https://getalby.com",
  id: 1,
  imageURL: "https://getalby.com/favicon.ico",
  lastPaymentAt: 0,
@@ -17,7 +17,7 @@ export const allowanceFixture: DbAllowance[] = [
  },
  {
  enabled: false,
- host: "lnmarkets.com",
+ host: "https://lnmarkets.com",
  id: 2,
  imageURL: "https://lnmarkets.com/apple-touch-icon.png",
  lastPaymentAt: 0,

src/fixtures/payment.ts

@@ -7,7 +7,7 @@ export const paymentsFixture: DbPayment[] = [
  createdAt: "123456",
  description: "A blue bird?!",
  destination: "Space",
- host: "getalby.com",
+ host: "https://getalby.com",
  id: 4,
  location: "https://www.getalby.com",
  name: "Alby",
@@ -23,7 +23,7 @@ export const paymentsFixture: DbPayment[] = [
  createdAt: "123456",
  description: "A yellow bird?!",
  destination: "Space",
- host: "getalby.com",
+ host: "https://getalby.com",
  id: 5,
  location: "https://www.getalby.com",
  name: "Alby",