@1shotapi/ows-signer 0.4.2 → 0.4.4

package/README.md

@@ -101,16 +101,23 @@ reference/                1ShotPay reference (not published)
 
 Serve the Signing Layer document (and its `/src/*` modules) with a **fail-closed** CSP. The signer has no legitimate network I/O — only same-origin scripts/styles and `postMessage` / WebAuthn / WebCrypto.
 
+**Branding and Signing must share the same origin** (e.g. `https://wallet.example/` + `/signer/`). Cross-origin embeds of a shared CDN/IPFS signer are not supported: a hostile Branding could otherwise drive passkey-gated signing with attacker-written Confirm copy. The Signing Layer rejects parent `postMessage` when `event.origin !== location.origin`, and hosts should set `frame-ancestors 'self'` (optionally `X-Frame-Options: SAMEORIGIN`) so foreign pages cannot frame `/signer/` at all.
+
 Canonical header (single line in production):
 
 ```http
-Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'none'; img-src 'none'; font-src 'none'; media-src 'none'; object-src 'none'; child-src 'none'; frame-src 'none'; worker-src 'none'; manifest-src 'none'; base-uri 'none'; form-action 'none'; upgrade-insecure-requests
+Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'none'; img-src 'none'; font-src 'none'; media-src 'none'; object-src 'none'; child-src 'none'; frame-src 'none'; worker-src 'none'; manifest-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'self'; upgrade-insecure-requests
 ```
 
 - Apply on the **Signing Layer origin path** (e.g. nginx `location /signer/`), not on the Branding Layer SPA.
-- **Omit `frame-ancestors`** so arbitrary Branding Layers may embed the signer. Nesting safety remains in JS (`event.source === window.parent`, `window.parent !== window.top`).
+- Nesting safety also remains in JS (`event.source === window.parent`, `window.parent !== window.top`, same-origin parent).
+- Reveal / export UI requires the signer document to be **visible and focused** before showing the key or writing the clipboard (defense against obscured-frame clickjacking).
 - Keep iframe Permissions Policy `allow` for WebAuthn / clipboard (set before `src` in `createSignerIframe`) — that is not CSP.
 
+## Audits
+
+See [audits/](audits/) for scoped security review notes (AI-assisted).
+
 ## On-chain
 
 See `@1shotapi/ows-onchain`.

package/html/signer.css

@@ -56,8 +56,71 @@ body {
   text-align: center;
 }
 
+body.ows-ceremony-open {
+  align-items: stretch;
+  justify-content: flex-end;
+  background: transparent;
+}
+
 .ows-signer-ui--ceremony {
   gap: 0;
+  margin: 0;
+  width: 100%;
+  max-width: none;
+  height: 100%;
+  max-height: 100%;
+  min-height: 0;
+  padding: 12px 20px 0;
+  justify-content: flex-start;
+  overflow: hidden;
+  border: 1px solid var(--ows-border);
+  border-bottom: none;
+  border-radius: var(--ows-radius-card) var(--ows-radius-card) 0 0;
+  box-shadow: 0 -2px 16px rgb(0 0 0 / 6%);
+  animation: ows-sheet-in 280ms cubic-bezier(0.32, 0.72, 0, 1) both;
+}
+
+@keyframes ows-sheet-in {
+  from {
+    transform: translateY(100%);
+  }
+
+  to {
+    transform: translateY(0);
+  }
+}
+
+.ows-ceremony-grab {
+  flex: 0 0 auto;
+  width: 2.5rem;
+  height: 0.25rem;
+  border-radius: 999px;
+  background: color-mix(in srgb, var(--ows-text-muted) 35%, transparent);
+}
+
+.ows-signer-ui--ceremony .ows-ceremony-grab {
+  margin: 0 auto 12px;
+}
+
+.ows-signer-ui--ceremony .ows-ceremony-header {
+  flex-shrink: 0;
+  padding: 0;
+  margin: 0 0 8px;
+  text-align: left;
+}
+
+.ows-signer-ui--ceremony .ows-ceremony-body {
+  flex: 0 0 auto;
+  flex-shrink: 0;
+  min-height: auto;
+  overflow: visible;
+  padding: 0 0 4px;
+  margin-bottom: 12px;
+  text-align: left;
+}
+
+.ows-signer-ui--ceremony .ows-ceremony-actions {
+  padding-bottom: max(16px, env(safe-area-inset-bottom, 0px));
 }
 
 .ows-signer-ui:empty {
@@ -106,6 +169,14 @@ body {
   color: var(--ows-text);
 }
 
+.ows-ceremony-origin {
+  margin: 8px 0 0;
+  font-size: 0.75rem;
+  line-height: 1.4;
+  color: var(--ows-text-muted);
+  word-break: break-all;
+}
+
 .ows-ceremony-body {
   flex: 0 1 auto;
   min-height: 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1shotapi/ows-signer",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "OWS Signing Layer — plain JavaScript WebAuthn PRF key custody with curve-based signing (on-chain via EIP-8244)",
   "type": "module",
   "files": [

package/src/main.js

@@ -1,6 +1,7 @@
 import { handleRequest } from "./handlers.js";
 import {
   abandonCeremony,
+  getTrustedParentOrigin,
   isValidNesting,
   setCancelConfirmHook,
   setTrustedParentOrigin,
@@ -8,6 +9,17 @@ import {
 import { cancelPendingCeremonyConfirm, initUi } from "./ui.js";
 import { isValidParentMessage, parseRequest } from "./rpc.js";
 
+/**
+ * @param {MessageEvent} event
+ * @returns {boolean}
+ */
+function acceptParentMessage(event) {
+  if (!isValidParentMessage(event)) return false;
+  const trusted = getTrustedParentOrigin();
+  if (trusted !== null && event.origin !== trusted) return false;
+  return true;
+}
+
 function bootstrap() {
   const root = document.getElementById("ows-signer-root");
   if (!root) {
@@ -22,7 +34,7 @@ function bootstrap() {
   }
 
   window.addEventListener("message", (event) => {
-    if (!isValidParentMessage(event)) return;
+    if (!acceptParentMessage(event)) return;
 
     const data = event.data;
     if (

package/src/rpc.js

@@ -23,6 +23,9 @@ export function emitEvent(target, targetOrigin, event, correlationId, data) {
 }
 
 /**
+ * Branding↔Signing must be same origin. Reject cross-origin parents
+ * (e.g. sketchy.ru embedding wallet.1shotapi.com/signer/).
+ *
  * @param {MessageEvent} event
  * @returns {boolean}
  */
@@ -30,6 +33,7 @@ export function isValidParentMessage(event) {
   if (event.source !== window.parent) return false;
   if (window.parent === window.top) return false;
   if (event.source === window) return false;
+  if (event.origin !== window.location.origin) return false;
   return true;
 }
 

package/src/ui.js

@@ -1,5 +1,20 @@
 import { to0xHex } from "./hex.js";
 import { debugLog, describeCeremonyEnvironment } from "./debug.js";
+import { getTrustedParentOrigin } from "./state.js";
+
+/**
+ * Reveal / clipboard must not run when the signer document is hidden or
+ * unfocused (clickjack / obscured-frame mitigation).
+ * @returns {boolean}
+ */
+export function isSignerDocumentInteractive() {
+  if (typeof document === "undefined") return false;
+  if (document.visibilityState !== "visible") return false;
+  if (typeof document.hasFocus === "function" && !document.hasFocus()) {
+    return false;
+  }
+  return true;
+}
 
 /** @type {HTMLElement | null} */
 let root = null;
@@ -66,7 +81,14 @@ export function initUi(container) {
   root.className = "ows-signer-ui";
 }
 
+function setCeremonyOpen(open) {
+  if (typeof document !== "undefined" && document.body) {
+    document.body.classList.toggle("ows-ceremony-open", open);
+  }
+}
+
 export function clearUi() {
+  setCeremonyOpen(false);
   if (root) {
     root.innerHTML = "";
     root.className = "ows-signer-ui";
@@ -170,11 +192,16 @@ export function promptCeremonyConfirm(fields, runOnConfirm) {
   cancelPendingCeremonyConfirm();
   clearUi();
   root.className = "ows-signer-ui ows-signer-ui--ceremony";
+  setCeremonyOpen(true);
   const ui = resolveCeremonyUi(fields);
 
   return new Promise((resolve, reject) => {
     pendingConfirmReject = reject;
 
+    const grab = document.createElement("div");
+    grab.className = "ows-ceremony-grab";
+    grab.setAttribute("aria-hidden", "true");
+
     const header = document.createElement("h2");
     header.className = "ows-ceremony-header";
     header.textContent = ui.header;
@@ -186,6 +213,13 @@ export function promptCeremonyConfirm(fields, runOnConfirm) {
     text.textContent = ui.explanation;
     body.append(text);
 
+    const requesterOrigin =
+      getTrustedParentOrigin() ?? window.location.origin;
+    const originLine = document.createElement("p");
+    originLine.className = "ows-ceremony-origin";
+    originLine.textContent = `Requester: ${requesterOrigin}`;
+    body.append(originLine);
+
     const actions = document.createElement("div");
     actions.className = "ows-ceremony-actions";
 
@@ -238,7 +272,7 @@ export function promptCeremonyConfirm(fields, runOnConfirm) {
     });
 
     actions.append(confirmBtn, denyBtn);
-    root.append(header, body, actions);
+    root.append(grab, header, body, actions);
   });
 }
 
@@ -246,6 +280,9 @@ export function promptCeremonyConfirm(fields, runOnConfirm) {
  * Show the private key hex with Copy + Done. Resolves when the user clicks Done
  * (or the UI is cleared), so Branding can keep the ceremony panel open.
  *
+ * Requires the signer document to be visible and focused before showing the key
+ * or writing the clipboard.
+ *
  * @param {Uint8Array} privateKey
  * @returns {Promise<void>}
  */
@@ -253,6 +290,9 @@ export function showPrivateKey(privateKey) {
   if (!root) {
     return Promise.reject(new Error("uiNotInitialized"));
   }
+  if (!isSignerDocumentInteractive()) {
+    return Promise.reject(new Error("signerNotInteractive"));
+  }
   cancelPendingCeremonyConfirm();
   clearUi();
   const hex = to0xHex(privateKey);
@@ -265,6 +305,7 @@ export function showPrivateKey(privateKey) {
     copyBtn.className = "ows-copy";
     copyBtn.textContent = "Copy";
     copyBtn.addEventListener("click", async () => {
+      if (!isSignerDocumentInteractive()) return;
       await navigator.clipboard.writeText(pre.textContent ?? "");
     });
     const doneBtn = document.createElement("button");