@1shotapi/ows-signer 0.4.0 → 0.4.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1shotapi/ows-signer",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "OWS Signing Layer — plain JavaScript WebAuthn PRF key custody with curve-based signing (on-chain via EIP-8244)",
   "type": "module",
   "files": [

package/src/handlers.js

@@ -1096,6 +1096,13 @@ function handleError(error, correlationId, targetOrigin) {
     return;
   }
 
+  if (name === "AbortError" || message === "ceremonyCancelled") {
+    emitEvent(window.parent, targetOrigin, "SignDenied", correlationId, {
+      reason: "ceremonyCancelled",
+    });
+    return;
+  }
+
   if (name === "NotAllowedError" || message.includes("NotAllowed")) {
     emitEvent(window.parent, targetOrigin, "NotAllowed", correlationId, {
       reason: message || "notAllowed",
@@ -1105,7 +1112,7 @@ function handleError(error, correlationId, targetOrigin) {
 
   if (message === "ceremonyInProgress") {
     emitEvent(window.parent, targetOrigin, "InvalidRequest", correlationId, {
-      reason: "ceremonyInProgress",
+      reason: "A request is already pending.",
     });
     return;
   }

package/src/main.js

@@ -2,6 +2,7 @@ import { handleRequest } from "./handlers.js";
 import {
   abandonCeremony,
   isValidNesting,
+  setCancelConfirmHook,
   setTrustedParentOrigin,
 } from "./state.js";
 import { cancelPendingCeremonyConfirm, initUi } from "./ui.js";
@@ -13,13 +14,14 @@ function bootstrap() {
     throw new Error("OWS signer root element missing");
   }
   initUi(root);
+  setCancelConfirmHook(cancelPendingCeremonyConfirm);
 
   if (!isValidNesting()) {
     console.error("[ows-signer] Must be embedded in a wallet iframe (double iframe).");
     return;
   }
 
-  window.addEventListener("message", async (event) => {
+  window.addEventListener("message", (event) => {
     if (!isValidParentMessage(event)) return;
 
     const data = event.data;
@@ -29,7 +31,9 @@ function bootstrap() {
       /** @type {{ kind?: unknown }} */ (data).kind === "cancel"
     ) {
       setTrustedParentOrigin(event.origin);
-      await abandonCeremony(cancelPendingCeremonyConfirm);
+      // Do not await — parent timeout must unlock immediately even if a prior
+      // handleRequest is still suspended on credentials.get.
+      void abandonCeremony(cancelPendingCeremonyConfirm);
       return;
     }
 
@@ -41,15 +45,18 @@ function bootstrap() {
       data
     );
 
-    // Drop a stuck Confirm wait (e.g. parent timed out) before starting anew.
-    await abandonCeremony(cancelPendingCeremonyConfirm);
-
-    await handleRequest(
-      method,
-      /** @type {Record<string, unknown>} */ (params),
-      correlationId,
-      targetOrigin,
-    );
+    void (async () => {
+      // Drop a stuck Confirm wait (e.g. parent timed out) before starting anew.
+      await abandonCeremony(cancelPendingCeremonyConfirm);
+      await handleRequest(
+        method,
+        /** @type {Record<string, unknown>} */ (params),
+        correlationId,
+        targetOrigin,
+      );
+    })().catch((error) => {
+      console.error("[ows-signer] request handler failed", error);
+    });
   });
 }
 

package/src/state.js

@@ -4,6 +4,9 @@ let recoveryPrivateKey = null;
 /** @type {Promise<unknown> | null} */
 let ceremonyPromise = null;
 
+/** @type {AbortController | null} */
+let ceremonyAbortController = null;
+
 /** @type {string | null} */
 let trustedParentOrigin = null;
 
@@ -70,15 +73,65 @@ export function clearRecoveryPrivateKey() {
   }
 }
 
+/**
+ * AbortSignal for the active ceremony (WebAuthn `credentials.get/create`).
+ * @returns {AbortSignal | undefined}
+ */
+export function getCeremonyAbortSignal() {
+  return ceremonyAbortController?.signal;
+}
+
+/** @type {(() => void) | null} */
+let cancelConfirmHook = null;
+
+/**
+ * Branding/UI registers the Confirm-cancel hook so steal / abandon can dismiss
+ * the panel without a circular import on `ui.js`.
+ *
+ * @param {(() => void) | null} hook
+ */
+export function setCancelConfirmHook(hook) {
+  cancelConfirmHook = hook;
+}
+
+/**
+ * Force-drop the ceremony lock and abort in-flight WebAuthn.
+ * Safe to call when no ceremony is active.
+ */
+function forceUnlockCeremony() {
+  try {
+    cancelConfirmHook?.();
+  } catch {
+    // ignore
+  }
+  const abort = ceremonyAbortController;
+  const pending = ceremonyPromise;
+  ceremonyPromise = null;
+  ceremonyAbortController = null;
+  try {
+    abort?.abort();
+  } catch {
+    // ignore
+  }
+  if (pending) {
+    void pending.catch(() => {
+      // Prior ceremony was cancelled, aborted, or failed.
+    });
+  }
+}
+
 /**
  * @param {() => Promise<T>} fn
  * @returns {Promise<T>}
  * @template T
  */
 export async function withCeremony(fn) {
+  // Steal any leftover lock (e.g. hung credentials.get after parent timeout).
+  // Throwing ceremonyInProgress left Branding retries stuck after RPC timeout.
   if (ceremonyPromise) {
-    throw new Error("ceremonyInProgress");
+    forceUnlockCeremony();
   }
+  ceremonyAbortController = new AbortController();
   const promise = fn();
   ceremonyPromise = promise;
   try {
@@ -86,24 +139,27 @@ export async function withCeremony(fn) {
   } finally {
     if (ceremonyPromise === promise) {
       ceremonyPromise = null;
+      ceremonyAbortController = null;
     }
   }
 }
 
 /**
- * Cancel an open Confirm UI and wait for any in-flight ceremony lock to clear.
- * Used when the parent times out or starts a new RPC.
+ * Cancel Confirm UI, abort in-flight WebAuthn, and unlock the ceremony immediately.
+ * Used when the parent times out or starts a new RPC. Must not wait forever on
+ * hung `credentials.get` — that left Branding retries stuck with ceremonyInProgress.
  *
- * @param {() => void} cancelPendingConfirm
+ * @param {() => void} [_cancelPendingConfirm]
  */
-export async function abandonCeremony(cancelPendingConfirm) {
-  cancelPendingConfirm();
-  const pending = ceremonyPromise;
-  if (!pending) return;
-  try {
-    await pending;
-  } catch {
-    // Prior ceremony was cancelled or failed — lock clears in withCeremony finally.
+export async function abandonCeremony(_cancelPendingConfirm) {
+  // Prefer the registered hook (always current); keep the argument for callers.
+  forceUnlockCeremony();
+  if (typeof _cancelPendingConfirm === "function") {
+    try {
+      _cancelPendingConfirm();
+    } catch {
+      // ignore — hook already ran
+    }
   }
 }
 

package/src/webauthn.js

@@ -1,4 +1,4 @@
-import { getRpId } from "./state.js";
+import { getCeremonyAbortSignal, getRpId } from "./state.js";
 import { PRF_LABEL_SECP256K1 } from "./constants.js";
 import { bufferToBase64Url } from "./hex.js";
 import { debugLog, describePrfExtensionResults } from "./debug.js";
@@ -27,6 +27,7 @@ export async function createPasskeyCredential(name, options = {}) {
     ? Uint8Array.from(atob(options.userId), (c) => c.charCodeAt(0))
     : randomUserId();
   const displayName = options.userDisplayName ?? name;
+  const signal = getCeremonyAbortSignal();
 
   debugLog("createPasskeyCredential userActivation.isActive", {
     isActive: navigator.userActivation?.isActive ?? false,
@@ -41,7 +42,12 @@ export async function createPasskeyCredential(name, options = {}) {
         displayName,
       },
       challenge: crypto.getRandomValues(new Uint8Array(32)),
-      pubKeyCredParams: [{ type: "public-key", alg: -7 }],
+      // Chromium warns when ES256 (-7) is present without RS256 (-257).
+      // Prefer ES256 (PRF); RS256 is listed for authenticator compatibility.
+      pubKeyCredParams: [
+        { type: "public-key", alg: -7 },
+        { type: "public-key", alg: -257 },
+      ],
       authenticatorSelection: {
         residentKey: "required",
         requireResidentKey: true,
@@ -55,6 +61,7 @@ export async function createPasskeyCredential(name, options = {}) {
         },
       },
     },
+    ...(signal ? { signal } : {}),
   });
 
   if (!credential || !(credential instanceof PublicKeyCredential)) {
@@ -79,6 +86,7 @@ export async function getPasskeyAssertion(challenge, credentialId) {
         },
       ]
     : undefined;
+  const signal = getCeremonyAbortSignal();
 
   const credential = await navigator.credentials.get({
     publicKey: {
@@ -94,6 +102,7 @@ export async function getPasskeyAssertion(challenge, credentialId) {
         },
       },
     },
+    ...(signal ? { signal } : {}),
   });
 
   if (!credential || !(credential instanceof PublicKeyCredential)) {