@1shotapi/ows-signer 0.4.3 → 0.4.4

package/README.md

@@ -101,16 +101,23 @@ reference/                1ShotPay reference (not published)
 
 Serve the Signing Layer document (and its `/src/*` modules) with a **fail-closed** CSP. The signer has no legitimate network I/O — only same-origin scripts/styles and `postMessage` / WebAuthn / WebCrypto.
 
+**Branding and Signing must share the same origin** (e.g. `https://wallet.example/` + `/signer/`). Cross-origin embeds of a shared CDN/IPFS signer are not supported: a hostile Branding could otherwise drive passkey-gated signing with attacker-written Confirm copy. The Signing Layer rejects parent `postMessage` when `event.origin !== location.origin`, and hosts should set `frame-ancestors 'self'` (optionally `X-Frame-Options: SAMEORIGIN`) so foreign pages cannot frame `/signer/` at all.
+
 Canonical header (single line in production):
 
 ```http
-Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'none'; img-src 'none'; font-src 'none'; media-src 'none'; object-src 'none'; child-src 'none'; frame-src 'none'; worker-src 'none'; manifest-src 'none'; base-uri 'none'; form-action 'none'; upgrade-insecure-requests
+Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'none'; img-src 'none'; font-src 'none'; media-src 'none'; object-src 'none'; child-src 'none'; frame-src 'none'; worker-src 'none'; manifest-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'self'; upgrade-insecure-requests
 ```
 
 - Apply on the **Signing Layer origin path** (e.g. nginx `location /signer/`), not on the Branding Layer SPA.
-- **Omit `frame-ancestors`** so arbitrary Branding Layers may embed the signer. Nesting safety remains in JS (`event.source === window.parent`, `window.parent !== window.top`).
+- Nesting safety also remains in JS (`event.source === window.parent`, `window.parent !== window.top`, same-origin parent).
+- Reveal / export UI requires the signer document to be **visible and focused** before showing the key or writing the clipboard (defense against obscured-frame clickjacking).
 - Keep iframe Permissions Policy `allow` for WebAuthn / clipboard (set before `src` in `createSignerIframe`) — that is not CSP.
 
+## Audits
+
+See [audits/](audits/) for scoped security review notes (AI-assisted).
+
 ## On-chain
 
 See `@1shotapi/ows-onchain`.

package/html/signer.css

@@ -169,6 +169,14 @@ body.ows-ceremony-open {
   color: var(--ows-text);
 }
 
+.ows-ceremony-origin {
+  margin: 8px 0 0;
+  font-size: 0.75rem;
+  line-height: 1.4;
+  color: var(--ows-text-muted);
+  word-break: break-all;
+}
+
 .ows-ceremony-body {
   flex: 0 1 auto;
   min-height: 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1shotapi/ows-signer",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "description": "OWS Signing Layer — plain JavaScript WebAuthn PRF key custody with curve-based signing (on-chain via EIP-8244)",
   "type": "module",
   "files": [

package/src/main.js

@@ -1,6 +1,7 @@
 import { handleRequest } from "./handlers.js";
 import {
   abandonCeremony,
+  getTrustedParentOrigin,
   isValidNesting,
   setCancelConfirmHook,
   setTrustedParentOrigin,
@@ -8,6 +9,17 @@ import {
 import { cancelPendingCeremonyConfirm, initUi } from "./ui.js";
 import { isValidParentMessage, parseRequest } from "./rpc.js";
 
+/**
+ * @param {MessageEvent} event
+ * @returns {boolean}
+ */
+function acceptParentMessage(event) {
+  if (!isValidParentMessage(event)) return false;
+  const trusted = getTrustedParentOrigin();
+  if (trusted !== null && event.origin !== trusted) return false;
+  return true;
+}
+
 function bootstrap() {
   const root = document.getElementById("ows-signer-root");
   if (!root) {
@@ -22,7 +34,7 @@ function bootstrap() {
   }
 
   window.addEventListener("message", (event) => {
-    if (!isValidParentMessage(event)) return;
+    if (!acceptParentMessage(event)) return;
 
     const data = event.data;
     if (

package/src/rpc.js

@@ -23,6 +23,9 @@ export function emitEvent(target, targetOrigin, event, correlationId, data) {
 }
 
 /**
+ * Branding↔Signing must be same origin. Reject cross-origin parents
+ * (e.g. sketchy.ru embedding wallet.1shotapi.com/signer/).
+ *
  * @param {MessageEvent} event
  * @returns {boolean}
  */
@@ -30,6 +33,7 @@ export function isValidParentMessage(event) {
   if (event.source !== window.parent) return false;
   if (window.parent === window.top) return false;
   if (event.source === window) return false;
+  if (event.origin !== window.location.origin) return false;
   return true;
 }
 

package/src/ui.js

@@ -1,5 +1,20 @@
 import { to0xHex } from "./hex.js";
 import { debugLog, describeCeremonyEnvironment } from "./debug.js";
+import { getTrustedParentOrigin } from "./state.js";
+
+/**
+ * Reveal / clipboard must not run when the signer document is hidden or
+ * unfocused (clickjack / obscured-frame mitigation).
+ * @returns {boolean}
+ */
+export function isSignerDocumentInteractive() {
+  if (typeof document === "undefined") return false;
+  if (document.visibilityState !== "visible") return false;
+  if (typeof document.hasFocus === "function" && !document.hasFocus()) {
+    return false;
+  }
+  return true;
+}
 
 /** @type {HTMLElement | null} */
 let root = null;
@@ -198,6 +213,13 @@ export function promptCeremonyConfirm(fields, runOnConfirm) {
     text.textContent = ui.explanation;
     body.append(text);
 
+    const requesterOrigin =
+      getTrustedParentOrigin() ?? window.location.origin;
+    const originLine = document.createElement("p");
+    originLine.className = "ows-ceremony-origin";
+    originLine.textContent = `Requester: ${requesterOrigin}`;
+    body.append(originLine);
+
     const actions = document.createElement("div");
     actions.className = "ows-ceremony-actions";
 
@@ -258,6 +280,9 @@ export function promptCeremonyConfirm(fields, runOnConfirm) {
  * Show the private key hex with Copy + Done. Resolves when the user clicks Done
  * (or the UI is cleared), so Branding can keep the ceremony panel open.
  *
+ * Requires the signer document to be visible and focused before showing the key
+ * or writing the clipboard.
+ *
  * @param {Uint8Array} privateKey
  * @returns {Promise<void>}
  */
@@ -265,6 +290,9 @@ export function showPrivateKey(privateKey) {
   if (!root) {
     return Promise.reject(new Error("uiNotInitialized"));
   }
+  if (!isSignerDocumentInteractive()) {
+    return Promise.reject(new Error("signerNotInteractive"));
+  }
   cancelPendingCeremonyConfirm();
   clearUi();
   const hex = to0xHex(privateKey);
@@ -277,6 +305,7 @@ export function showPrivateKey(privateKey) {
     copyBtn.className = "ows-copy";
     copyBtn.textContent = "Copy";
     copyBtn.addEventListener("click", async () => {
+      if (!isSignerDocumentInteractive()) return;
       await navigator.clipboard.writeText(pre.textContent ?? "");
     });
     const doneBtn = document.createElement("button");