@polkadot/extension-base 0.59.2 → 0.61.1

package/background/handlers/Extension.js

@@ -19,16 +19,16 @@ function isJsonPayload(value) {
     return value.genesisHash !== undefined;
 }
 export default class Extension {
-    __internal__cachedUnlocks;
-    __internal__state;
+    #cachedUnlocks;
+    #state;
     constructor(state) {
-        this.__internal__cachedUnlocks = {};
-        this.__internal__state = state;
+        this.#cachedUnlocks = {};
+        this.#state = state;
     }
     transformAccounts(accounts) {
         return Object.values(accounts).map(({ json: { address, meta }, type }) => ({
             address,
-            isDefaultAuthSelected: this.__internal__state.defaultAuthAccountSelection.includes(address),
+            isDefaultAuthSelected: this.#state.defaultAuthAccountSelection.includes(address),
             ...meta,
             type
         }));
@@ -77,26 +77,26 @@ export default class Extension {
     async accountsForget({ address }) {
         const authorizedAccountsDiff = [];
         // cycle through authUrls and prepare the array of diff
-        Object.entries(this.__internal__state.authUrls).forEach(([url, urlInfo]) => {
+        Object.entries(this.#state.authUrls).forEach(([url, urlInfo]) => {
             // Note that urlInfo.authorizedAccounts may be undefined if this website entry
             // was created before the "account authorization per website" functionality was introduced
             if (urlInfo.authorizedAccounts?.includes(address)) {
                 authorizedAccountsDiff.push([url, urlInfo.authorizedAccounts.filter((previousAddress) => previousAddress !== address)]);
             }
         });
-        await this.__internal__state.updateAuthorizedAccounts(authorizedAccountsDiff);
+        await this.#state.updateAuthorizedAccounts(authorizedAccountsDiff);
         // cycle through default account selection for auth and remove any occurrence of the account
-        const newDefaultAuthAccounts = this.__internal__state.defaultAuthAccountSelection.filter((defaultSelectionAddress) => defaultSelectionAddress !== address);
-        await this.__internal__state.updateDefaultAuthAccounts(newDefaultAuthAccounts);
+        const newDefaultAuthAccounts = this.#state.defaultAuthAccountSelection.filter((defaultSelectionAddress) => defaultSelectionAddress !== address);
+        await this.#state.updateDefaultAuthAccounts(newDefaultAuthAccounts);
         keyring.forgetAccount(address);
         return true;
     }
     refreshAccountPasswordCache(pair) {
         const { address } = pair;
-        const savedExpiry = this.__internal__cachedUnlocks[address] || 0;
+        const savedExpiry = this.#cachedUnlocks[address] || 0;
         const remainingTime = savedExpiry - Date.now();
         if (remainingTime < 0) {
-            this.__internal__cachedUnlocks[address] = 0;
+            this.#cachedUnlocks[address] = 0;
             pair.lock();
             return 0;
         }
@@ -133,22 +133,22 @@ export default class Extension {
         return true;
     }
     authorizeApprove({ authorizedAccounts, id }) {
-        const queued = this.__internal__state.getAuthRequest(id);
+        const queued = this.#state.getAuthRequest(id);
         assert(queued, 'Unable to find request');
         const { resolve } = queued;
         resolve({ authorizedAccounts, result: true });
         return true;
     }
     async authorizeUpdate({ authorizedAccounts, url }) {
-        return await this.__internal__state.updateAuthorizedAccounts([[url, authorizedAccounts]]);
+        return await this.#state.updateAuthorizedAccounts([[url, authorizedAccounts]]);
     }
     getAuthList() {
-        return { list: this.__internal__state.authUrls };
+        return { list: this.#state.authUrls };
     }
     // FIXME This looks very much like what we have in accounts
     authorizeSubscribe(id, port) {
         const cb = createSubscription(id, port);
-        const subscription = this.__internal__state.authSubject.subscribe((requests) => cb(requests));
+        const subscription = this.#state.authSubject.subscribe((requests) => cb(requests));
         port.onDisconnect.addListener(() => {
             unsubscribe(id);
             subscription.unsubscribe();
@@ -156,21 +156,21 @@ export default class Extension {
         return true;
     }
     async metadataApprove({ id }) {
-        const queued = this.__internal__state.getMetaRequest(id);
+        const queued = this.#state.getMetaRequest(id);
         assert(queued, 'Unable to find request');
         const { request, resolve } = queued;
-        await this.__internal__state.saveMetadata(request);
+        await this.#state.saveMetadata(request);
         resolve(true);
         return true;
     }
     metadataGet(genesisHash) {
-        return this.__internal__state.knownMetadata.find((result) => result.genesisHash === genesisHash) || null;
+        return this.#state.knownMetadata.find((result) => result.genesisHash === genesisHash) || null;
     }
     metadataList() {
-        return this.__internal__state.knownMetadata;
+        return this.#state.knownMetadata;
     }
     metadataReject({ id }) {
-        const queued = this.__internal__state.getMetaRequest(id);
+        const queued = this.#state.getMetaRequest(id);
         assert(queued, 'Unable to find request');
         const { reject } = queued;
         reject(new Error('Rejected'));
@@ -178,7 +178,7 @@ export default class Extension {
     }
     metadataSubscribe(id, port) {
         const cb = createSubscription(id, port);
-        const subscription = this.__internal__state.metaSubject.subscribe((requests) => cb(requests));
+        const subscription = this.#state.metaSubject.subscribe((requests) => cb(requests));
         port.onDisconnect.addListener(() => {
             unsubscribe(id);
             subscription.unsubscribe();
@@ -239,7 +239,7 @@ export default class Extension {
         };
     }
     signingApprovePassword({ id, password, savePass }) {
-        const queued = this.__internal__state.getSignRequest(id);
+        const queued = this.#state.getSignRequest(id);
         assert(queued, 'Unable to find request');
         const { reject, request, resolve } = queued;
         const pair = keyring.getPair(queued.account.address);
@@ -260,7 +260,7 @@ export default class Extension {
         const { payload } = request;
         if (isJsonPayload(payload)) {
             // Get the metadata for the genesisHash
-            const metadata = this.__internal__state.knownMetadata.find(({ genesisHash }) => genesisHash === payload.genesisHash);
+            const metadata = this.#state.knownMetadata.find(({ genesisHash }) => genesisHash === payload.genesisHash);
             if (metadata) {
                 // we have metadata, expand it and extract the info/registry
                 const expanded = metadataExpand(metadata, false);
@@ -282,7 +282,7 @@ export default class Extension {
             // unlike queued.account.address the following
             // address is encoded with the default prefix
             // which what is used for password caching mapping
-            this.__internal__cachedUnlocks[pair.address] = Date.now() + PASSWORD_EXPIRY_MS;
+            this.#cachedUnlocks[pair.address] = Date.now() + PASSWORD_EXPIRY_MS;
         }
         else {
             pair.lock();
@@ -294,21 +294,21 @@ export default class Extension {
         return true;
     }
     signingApproveSignature({ id, signature, signedTransaction }) {
-        const queued = this.__internal__state.getSignRequest(id);
+        const queued = this.#state.getSignRequest(id);
         assert(queued, 'Unable to find request');
         const { resolve } = queued;
         resolve({ id, signature, signedTransaction });
         return true;
     }
     signingCancel({ id }) {
-        const queued = this.__internal__state.getSignRequest(id);
+        const queued = this.#state.getSignRequest(id);
         assert(queued, 'Unable to find request');
         const { reject } = queued;
         reject(new Error('Cancelled'));
         return true;
     }
     signingIsLocked({ id }) {
-        const queued = this.__internal__state.getSignRequest(id);
+        const queued = this.#state.getSignRequest(id);
         assert(queued, 'Unable to find request');
         const address = queued.request.payload.address;
         const pair = keyring.getPair(address);
@@ -322,7 +322,7 @@ export default class Extension {
     // FIXME This looks very much like what we have in authorization
     signingSubscribe(id, port) {
         const cb = createSubscription(id, port);
-        const subscription = this.__internal__state.signSubject.subscribe((requests) => cb(requests));
+        const subscription = this.#state.signSubject.subscribe((requests) => cb(requests));
         port.onDisconnect.addListener(() => {
             unsubscribe(id);
             subscription.unsubscribe();
@@ -371,13 +371,13 @@ export default class Extension {
         return true;
     }
     async removeAuthorization(url) {
-        const remAuth = await this.__internal__state.removeAuthorization(url);
+        const remAuth = await this.#state.removeAuthorization(url);
         return { list: remAuth };
     }
     // Reject the authorization request and add the URL to the authorized list with no keys.
     // The site will not prompt for re-authorization on future visits.
     rejectAuthRequest(id) {
-        const queued = this.__internal__state.getAuthRequest(id);
+        const queued = this.#state.getAuthRequest(id);
         assert(queued, 'Unable to find request');
         const { reject } = queued;
         reject(new Error('Rejected'));
@@ -385,16 +385,16 @@ export default class Extension {
     // Cancel the authorization request and do not add the URL to the authorized list.
     // The site will prompt for authorization on future visits.
     cancelAuthRequest(id) {
-        const queued = this.__internal__state.getAuthRequest(id);
+        const queued = this.#state.getAuthRequest(id);
         assert(queued, 'Unable to find request');
         const { reject } = queued;
         reject(new Error('Cancelled'));
     }
     updateCurrentTabs({ urls }) {
-        this.__internal__state.updateCurrentTabsUrl(urls);
+        this.#state.updateCurrentTabsUrl(urls);
     }
     getConnectedTabsUrl() {
-        return this.__internal__state.getConnectedTabsUrl();
+        return this.#state.getConnectedTabsUrl();
     }
     // Weird thought, the eslint override is not needed in Tabs
     // eslint-disable-next-line @typescript-eslint/require-await
@@ -469,7 +469,7 @@ export default class Extension {
             case 'pri(seed.validate)':
                 return this.seedValidate(request);
             case 'pri(settings.notification)':
-                return this.__internal__state.setNotification(request);
+                return this.#state.setNotification(request);
             case 'pri(signing.approve.password)':
                 return this.signingApprovePassword(request);
             case 'pri(signing.approve.signature)':

package/background/handlers/State.d.ts

@@ -90,6 +90,7 @@ export default class State {
     rpcUnsubscribe(request: RequestRpcUnsubscribe, port: chrome.runtime.Port): Promise<boolean>;
     saveMetadata(meta: MetadataDef): Promise<void>;
     setNotification(notification: string): boolean;
+    private handleSignRequest;
     sign(url: string, request: RequestSign, account: AccountJson): Promise<ResponseSigning>;
 }
 export {};

package/background/handlers/State.js

@@ -63,35 +63,38 @@ async function extractMetadata(store) {
     });
 }
 export default class State {
-    __internal__authUrls = {};
-    __internal__authRequests = {};
-    __internal__metaStore = new MetadataStore();
+    #authUrls = new Map();
+    #lastRequestTimestamps = new Map();
+    #maxEntries = 10;
+    #rateLimitInterval = 3000; // 3 seconds
+    #authRequests = {};
+    #metaStore = new MetadataStore();
     // Map of providers currently injected in tabs
-    __internal__injectedProviders = new Map();
-    __internal__metaRequests = {};
-    __internal__notification = settings.notification;
+    #injectedProviders = new Map();
+    #metaRequests = {};
+    #notification = settings.notification;
     // Map of all providers exposed by the extension, they are retrievable by key
-    __internal__providers;
-    __internal__signRequests = {};
-    __internal__windows = [];
-    __internal__connectedTabsUrl = [];
+    #providers;
+    #signRequests = {};
+    #windows = [];
+    #connectedTabsUrl = [];
     authSubject = new BehaviorSubject([]);
     metaSubject = new BehaviorSubject([]);
     signSubject = new BehaviorSubject([]);
     authUrlSubjects = {};
     defaultAuthAccountSelection = [];
     constructor(providers = {}) {
-        this.__internal__providers = providers;
+        this.#providers = providers;
     }
     async init() {
-        await extractMetadata(this.__internal__metaStore);
+        await extractMetadata(this.#metaStore);
         // retrieve previously set authorizations
         const storageAuthUrls = await chrome.storage.local.get(AUTH_URLS_KEY);
         const authString = storageAuthUrls?.[AUTH_URLS_KEY] || '{}';
         const previousAuth = JSON.parse(authString);
-        this.__internal__authUrls = previousAuth;
+        this.#authUrls = new Map(Object.entries(previousAuth));
         // Initialize authUrlSubjects for each URL
-        Object.entries(previousAuth).forEach(([url, authInfo]) => {
+        this.#authUrls.forEach((authInfo, url) => {
             this.authUrlSubjects[url] = new BehaviorSubject(authInfo);
         });
         // retrieve previously set default auth accounts
@@ -104,49 +107,49 @@ export default class State {
         return knownMetadata();
     }
     get numAuthRequests() {
-        return Object.keys(this.__internal__authRequests).length;
+        return Object.keys(this.#authRequests).length;
     }
     get numMetaRequests() {
-        return Object.keys(this.__internal__metaRequests).length;
+        return Object.keys(this.#metaRequests).length;
     }
     get numSignRequests() {
-        return Object.keys(this.__internal__signRequests).length;
+        return Object.keys(this.#signRequests).length;
     }
     get allAuthRequests() {
         return Object
-            .values(this.__internal__authRequests)
+            .values(this.#authRequests)
             .map(({ id, request, url }) => ({ id, request, url }));
     }
     get allMetaRequests() {
         return Object
-            .values(this.__internal__metaRequests)
+            .values(this.#metaRequests)
             .map(({ id, request, url }) => ({ id, request, url }));
     }
     get allSignRequests() {
         return Object
-            .values(this.__internal__signRequests)
+            .values(this.#signRequests)
             .map(({ account, id, request, url }) => ({ account, id, request, url }));
     }
     get authUrls() {
-        return this.__internal__authUrls;
+        return Object.fromEntries(this.#authUrls);
     }
     popupClose() {
-        this.__internal__windows.forEach((id) => withErrorLog(() => chrome.windows.remove(id)));
-        this.__internal__windows = [];
+        this.#windows.forEach((id) => withErrorLog(() => chrome.windows.remove(id)));
+        this.#windows = [];
     }
     popupOpen() {
-        this.__internal__notification !== 'extension' &&
-            chrome.windows.create(this.__internal__notification === 'window'
+        this.#notification !== 'extension' &&
+            chrome.windows.create(this.#notification === 'window'
                 ? NORMAL_WINDOW_OPTS
                 : POPUP_WINDOW_OPTS, (window) => {
                 if (window) {
-                    this.__internal__windows.push(window.id || 0);
+                    this.#windows.push(window.id || 0);
                 }
             });
     }
     authComplete = (id, resolve, reject) => {
         const complete = async (authorizedAccounts = []) => {
-            const { idStr, request: { origin }, url } = this.__internal__authRequests[id];
+            const { idStr, request: { origin }, url } = this.#authRequests[id];
             const strippedUrl = this.stripUrl(url);
             const authInfo = {
                 authorizedAccounts,
@@ -155,7 +158,7 @@ export default class State {
                 origin,
                 url
             };
-            this.__internal__authUrls[strippedUrl] = authInfo;
+            this.#authUrls.set(strippedUrl, authInfo);
             if (!this.authUrlSubjects[strippedUrl]) {
                 this.authUrlSubjects[strippedUrl] = new BehaviorSubject(authInfo);
             }
@@ -164,14 +167,14 @@ export default class State {
             }
             await this.saveCurrentAuthList();
             await this.updateDefaultAuthAccounts(authorizedAccounts);
-            delete this.__internal__authRequests[id];
+            delete this.#authRequests[id];
             this.updateIconAuth(true);
         };
         return {
             // eslint-disable-next-line @typescript-eslint/no-misused-promises
             reject: async (error) => {
                 if (error.message === 'Cancelled') {
-                    delete this.__internal__authRequests[id];
+                    delete this.#authRequests[id];
                     this.updateIconAuth(true);
                     reject(new Error('Connection request was cancelled by the user.'));
                 }
@@ -209,17 +212,17 @@ export default class State {
                 : undefined;
         })
             .filter((value) => !!value);
-        this.__internal__connectedTabsUrl = connectedTabs;
+        this.#connectedTabsUrl = connectedTabs;
     }
     getConnectedTabsUrl() {
-        return this.__internal__connectedTabsUrl;
+        return this.#connectedTabsUrl;
     }
     deleteAuthRequest(requestId) {
-        delete this.__internal__authRequests[requestId];
+        delete this.#authRequests[requestId];
         this.updateIconAuth(true);
     }
     async saveCurrentAuthList() {
-        await chrome.storage.local.set({ [AUTH_URLS_KEY]: JSON.stringify(this.__internal__authUrls) });
+        await chrome.storage.local.set({ [AUTH_URLS_KEY]: JSON.stringify(Object.fromEntries(this.#authUrls)) });
     }
     async saveDefaultAuthAccounts() {
         await chrome.storage.local.set({ [DEFAULT_AUTH_ACCOUNTS]: JSON.stringify(this.defaultAuthAccountSelection) });
@@ -230,7 +233,7 @@ export default class State {
     }
     metaComplete = (id, resolve, reject) => {
         const complete = () => {
-            delete this.__internal__metaRequests[id];
+            delete this.#metaRequests[id];
             this.updateIconMeta(true);
         };
         return {
@@ -246,7 +249,7 @@ export default class State {
     };
     signComplete = (id, resolve, reject) => {
         const complete = () => {
-            delete this.__internal__signRequests[id];
+            delete this.#signRequests[id];
             this.updateIconSign(true);
         };
         return {
@@ -261,9 +264,22 @@ export default class State {
         };
     };
     stripUrl(url) {
-        assert(url && (url.startsWith('http:') || url.startsWith('https:') || url.startsWith('ipfs:') || url.startsWith('ipns:')), `Invalid url ${url}, expected to start with http: or https: or ipfs: or ipns:`);
-        const parts = url.split('/');
-        return parts[2];
+        try {
+            const parsedUrl = new URL(url);
+            if (!['http:', 'https:', 'ipfs:', 'ipns:'].includes(parsedUrl.protocol)) {
+                throw new Error(`Invalid protocol ${parsedUrl.protocol}`);
+            }
+            // For ipfs/ipns which don't have a standard origin, we handle it differently.
+            if (parsedUrl.protocol === 'ipfs:' || parsedUrl.protocol === 'ipns:') {
+                // ipfs://<hash> | ipns://<hash>
+                return `${parsedUrl.protocol}//${parsedUrl.hostname}`;
+            }
+            return parsedUrl.origin;
+        }
+        catch (e) {
+            console.error(e);
+            throw new Error('Invalid URL');
+        }
     }
     updateIcon(shouldClose) {
         const authCount = this.numAuthRequests;
@@ -280,15 +296,15 @@ export default class State {
         }
     }
     async removeAuthorization(url) {
-        const entry = this.__internal__authUrls[url];
+        const entry = this.#authUrls.get(url);
         assert(entry, `The source ${url} is not known`);
-        delete this.__internal__authUrls[url];
+        this.#authUrls.delete(url);
         await this.saveCurrentAuthList();
         if (this.authUrlSubjects[url]) {
             entry.authorizedAccounts = [];
             this.authUrlSubjects[url].next(entry);
         }
-        return this.__internal__authUrls;
+        return this.authUrls;
     }
     updateIconAuth(shouldClose) {
         this.authSubject.next(this.allAuthRequests);
@@ -304,8 +320,12 @@ export default class State {
     }
     async updateAuthorizedAccounts(authorizedAccountsDiff) {
         authorizedAccountsDiff.forEach(([url, authorizedAccountDiff]) => {
-            this.__internal__authUrls[url].authorizedAccounts = authorizedAccountDiff;
-            this.authUrlSubjects[url].next(this.__internal__authUrls[url]);
+            const authInfo = this.#authUrls.get(url);
+            if (authInfo) {
+                authInfo.authorizedAccounts = authorizedAccountDiff;
+                this.#authUrls.set(url, authInfo);
+                this.authUrlSubjects[url].next(authInfo);
+            }
         });
         await this.saveCurrentAuthList();
     }
@@ -313,12 +333,13 @@ export default class State {
         const idStr = this.stripUrl(url);
         // Do not enqueue duplicate authorization requests.
         const isDuplicate = Object
-            .values(this.__internal__authRequests)
+            .values(this.#authRequests)
             .some((request) => request.idStr === idStr);
         assert(!isDuplicate, `The source ${url} has a pending authorization request`);
-        if (this.__internal__authUrls[idStr]) {
+        if (this.#authUrls.has(idStr)) {
             // this url was seen in the past
-            assert(this.__internal__authUrls[idStr].authorizedAccounts || this.__internal__authUrls[idStr].isAllowed, `The source ${url} is not allowed to interact with this extension`);
+            const authInfo = this.#authUrls.get(idStr);
+            assert(authInfo?.authorizedAccounts || authInfo?.isAllowed, `The source ${url} is not allowed to interact with this extension`);
             return {
                 authorizedAccounts: [],
                 result: false
@@ -326,7 +347,7 @@ export default class State {
         }
         return new Promise((resolve, reject) => {
             const id = getId();
-            this.__internal__authRequests[id] = {
+            this.#authRequests[id] = {
                 ...this.authComplete(id, resolve, reject),
                 id,
                 idStr,
@@ -338,14 +359,14 @@ export default class State {
         });
     }
     ensureUrlAuthorized(url) {
-        const entry = this.__internal__authUrls[this.stripUrl(url)];
+        const entry = this.#authUrls.get(this.stripUrl(url));
         assert(entry, `The source ${url} has not been enabled yet`);
         return true;
     }
     injectMetadata(url, request) {
         return new Promise((resolve, reject) => {
             const id = getId();
-            this.__internal__metaRequests[id] = {
+            this.#metaRequests[id] = {
                 ...this.metaComplete(id, resolve, reject),
                 id,
                 request,
@@ -356,73 +377,92 @@ export default class State {
         });
     }
     getAuthRequest(id) {
-        return this.__internal__authRequests[id];
+        return this.#authRequests[id];
     }
     getMetaRequest(id) {
-        return this.__internal__metaRequests[id];
+        return this.#metaRequests[id];
     }
     getSignRequest(id) {
-        return this.__internal__signRequests[id];
+        return this.#signRequests[id];
     }
     // List all providers the extension is exposing
     rpcListProviders() {
-        return Promise.resolve(Object.keys(this.__internal__providers).reduce((acc, key) => {
-            acc[key] = this.__internal__providers[key].meta;
+        return Promise.resolve(Object.keys(this.#providers).reduce((acc, key) => {
+            acc[key] = this.#providers[key].meta;
             return acc;
         }, {}));
     }
     rpcSend(request, port) {
-        const provider = this.__internal__injectedProviders.get(port);
+        const provider = this.#injectedProviders.get(port);
         assert(provider, 'Cannot call pub(rpc.subscribe) before provider is set');
         return provider.send(request.method, request.params);
     }
     // Start a provider, return its meta
     rpcStartProvider(key, port) {
-        assert(Object.keys(this.__internal__providers).includes(key), `Provider ${key} is not exposed by extension`);
-        if (this.__internal__injectedProviders.get(port)) {
-            return Promise.resolve(this.__internal__providers[key].meta);
+        assert(Object.keys(this.#providers).includes(key), `Provider ${key} is not exposed by extension`);
+        if (this.#injectedProviders.get(port)) {
+            return Promise.resolve(this.#providers[key].meta);
         }
         // Instantiate the provider
-        this.__internal__injectedProviders.set(port, this.__internal__providers[key].start());
+        this.#injectedProviders.set(port, this.#providers[key].start());
         // Close provider connection when page is closed
         port.onDisconnect.addListener(() => {
-            const provider = this.__internal__injectedProviders.get(port);
+            const provider = this.#injectedProviders.get(port);
             if (provider) {
                 withErrorLog(() => provider.disconnect());
             }
-            this.__internal__injectedProviders.delete(port);
+            this.#injectedProviders.delete(port);
         });
-        return Promise.resolve(this.__internal__providers[key].meta);
+        return Promise.resolve(this.#providers[key].meta);
     }
     rpcSubscribe({ method, params, type }, cb, port) {
-        const provider = this.__internal__injectedProviders.get(port);
+        const provider = this.#injectedProviders.get(port);
         assert(provider, 'Cannot call pub(rpc.subscribe) before provider is set');
         return provider.subscribe(type, method, params, cb);
     }
     rpcSubscribeConnected(_request, cb, port) {
-        const provider = this.__internal__injectedProviders.get(port);
+        const provider = this.#injectedProviders.get(port);
         assert(provider, 'Cannot call pub(rpc.subscribeConnected) before provider is set');
         cb(null, provider.isConnected); // Immediately send back current isConnected
         provider.on('connected', () => cb(null, true));
         provider.on('disconnected', () => cb(null, false));
     }
     rpcUnsubscribe(request, port) {
-        const provider = this.__internal__injectedProviders.get(port);
+        const provider = this.#injectedProviders.get(port);
         assert(provider, 'Cannot call pub(rpc.unsubscribe) before provider is set');
         return provider.unsubscribe(request.type, request.method, request.subscriptionId);
     }
     async saveMetadata(meta) {
-        await this.__internal__metaStore.set(meta.genesisHash, meta);
+        await this.#metaStore.set(meta.genesisHash, meta);
         addMetadata(meta);
     }
     setNotification(notification) {
-        this.__internal__notification = notification;
+        this.#notification = notification;
         return true;
     }
+    handleSignRequest(origin) {
+        const now = Date.now();
+        const lastTime = this.#lastRequestTimestamps.get(origin) || 0;
+        if (now - lastTime < this.#rateLimitInterval) {
+            throw new Error('Rate limit exceeded. Try again later.');
+        }
+        // If we're about to exceed max entries, evict the oldest
+        if (!this.#lastRequestTimestamps.has(origin) && this.#lastRequestTimestamps.size >= this.#maxEntries) {
+            const oldestKey = this.#lastRequestTimestamps.keys().next().value;
+            oldestKey && this.#lastRequestTimestamps.delete(oldestKey);
+        }
+        this.#lastRequestTimestamps.set(origin, now);
+    }
     sign(url, request, account) {
         const id = getId();
+        try {
+            this.handleSignRequest(url);
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
         return new Promise((resolve, reject) => {
-            this.__internal__signRequests[id] = {
+            this.#signRequests[id] = {
                 ...this.signComplete(id, resolve, reject),
                 account,
                 id,

package/background/handlers/Tabs.d.ts

@@ -20,6 +20,7 @@ export default class Tabs {
     private rpcSubscribeConnected;
     private rpcUnsubscribe;
     private redirectPhishingLanding;
+    private parseUrl;
     private redirectIfPhishing;
     handle<TMessageType extends MessageTypes>(id: string, type: TMessageType, request: RequestTypes[TMessageType], url: string, port?: chrome.runtime.Port): Promise<ResponseTypes[keyof ResponseTypes]>;
 }