@spirobel/monero-wallet-api 0.6.12 → 0.6.16

package/dist/tools/calls/001.js

@@ -26,17 +26,24 @@ function make(payload) {
     const base = `${TOOL_MAGIC_STRING}001_amount_${payload.amount}_address_${payload.address}`;
     return payload.no_check ? `${base}_no_check` : base;
 }
+// base58, 95 chars for a standard address and 106 for an integrated one.
+const MONERO_ADDRESS_SHAPE = /^[1-9A-HJ-NP-Za-km-z]{95}$|^[1-9A-HJ-NP-Za-km-z]{106}$/;
 async function validate_check(invo) {
     const tool = invo.tool;
     if (tool.tool_id !== "001")
         return "unverified";
     if (tool.payload.no_check)
         return "unverified";
+    // the address goes into the path. a real address is base58 and 95 or 106 chars.
+    // anything else could rewrite the request path, so it never reaches the fetch.
+    if (!MONERO_ADDRESS_SHAPE.test(tool.payload.address))
+        return "invalid";
     const link = invo[invo.found_in];
     const invo_link = new URL(link);
     const checkUrl = `${invo_link.origin}/monerochan001/${tool.payload.address}`;
     try {
-        const result = (await (await fetch(checkUrl)).json());
+        // no redirects: a shop must not bounce the request to another host.
+        const result = (await (await fetch(checkUrl, { redirect: "error" })).json());
         if (result &&
             typeof result === "object" &&
             "valid_address" in result &&

package/dist/tools/content.d.ts

@@ -1,22 +1,8 @@
-type ExtensionRuntime = {
-    sendMessage: (msg: unknown) => Promise<unknown>;
-    connect: (info: {
-        name: string;
-    }) => {
-        onMessage: {
-            addListener: (cb: (msg: unknown) => void) => void;
-        };
-    };
-};
-type ExtensionBrowser = {
-    runtime: ExtensionRuntime;
-};
+import type { ExtensionBrowser } from "./globals";
 declare global {
     var browser: ExtensionBrowser;
     var chrome: ExtensionBrowser;
 }
 export declare function interceptToolLinkCallback(e: Event): void;
 export declare function deliverToolUrl(url: string): boolean;
-export declare function DefaultConfirmationCallback(loc_href: string): boolean;
-export declare function installToolLinkEventInterception(confirmationcallback?: (loc_href: string) => boolean): void;
-export {};
+export declare function installToolLinkEventInterception(): void;

package/dist/tools/content.js

@@ -71,11 +71,8 @@ export function deliverToolUrl(url) {
     deliver(invo);
     return true;
 }
-export function DefaultConfirmationCallback(loc_href) {
-    return window.confirm("Did you just follow a monerochan tool link?");
-}
-export function installToolLinkEventInterception(confirmationcallback = DefaultConfirmationCallback) {
+export function installToolLinkEventInterception() {
+    // click only. keyboard activation (enter) dispatches a click, a touch tap does too.
+    // a keydown on a focused link is not an activation, so it must not deliver.
     document.addEventListener("click", interceptToolLinkCallback, true);
-    document.addEventListener("touchend", interceptToolLinkCallback, true);
-    document.addEventListener("keydown", interceptToolLinkCallback, true);
 }

package/dist/tools/globals.d.ts

@@ -120,6 +120,7 @@ export type ExtensionRuntime = {
     connect: (info: {
         name: string;
     }) => ExtensionPort;
+    getURL: (path: string) => string;
     onMessage: {
         addListener: (cb: (msg: unknown, sender: unknown) => void) => void;
     };
@@ -127,6 +128,21 @@ export type ExtensionRuntime = {
         addListener: (cb: (port: ExtensionPort) => void) => void;
     };
 };
+export type ExtensionBrowser = {
+    runtime: ExtensionRuntime;
+    tabs: {
+        query: (query: {
+            url?: string;
+        }) => Promise<{
+            id?: number;
+        }[]>;
+        remove: (ids: number[]) => Promise<void>;
+        update: (id: number, update: {
+            url?: string;
+            active?: boolean;
+        }) => Promise<unknown>;
+    };
+};
 export declare function getExtensionRuntime(): ExtensionRuntime | null;
 export declare function sendToBackground<K extends ExtensionMessageKind>(kind: K, payload: ExtensionMessageByKind[K]): Promise<unknown>;
 export type PortMessageByKind = {

package/dist/tools/monero-tools.d.ts

@@ -2,6 +2,7 @@ import { TOOL_MAGIC_STRING, type ToolArm, type ToolInvocationValidity, type Tool
 export { TOOL_MAGIC_STRING, type ToolInvocationValidity };
 export type { ToolArm, ToolContentZone, ToolCounterpartyZone, ToolInvocationForValidate, ToolWorkerZone, } from "./globals";
 export type { ToolUiCopy, ToolNotice, ToolPermission, } from "./globals";
+export type { ExtensionRuntime, ExtensionBrowser } from "./globals";
 export declare const tools: {
     readonly "001": ToolArm<import("./calls/001").SendTransactionToolPayload, {
         validate_route: (deps: {
@@ -14,6 +15,7 @@ export declare const tools: {
 };
 export type ToolId = keyof typeof tools;
 export declare const TOOL_IDS: ToolId[];
+export declare const TOOL_IDS_WITHOUT_DIRECT_OPEN: ToolId[];
 export declare function getToolUiByPermissions(permissions: ToolPermission[]): ToolUiCopy | null;
 type PayloadOf<A> = A extends ToolArm<infer P, infer _E> ? P : never;
 export type MoneroTool = {

package/dist/tools/monero-tools.js

@@ -10,6 +10,9 @@ export const tools = {
     "002": tool002,
 };
 export const TOOL_IDS = Object.keys(tools);
+// tool calls that cannot be started from a tool link. the content script port
+// carries the rest of the exchange, so the page that made the call has to stay.
+export const TOOL_IDS_WITHOUT_DIRECT_OPEN = ["002"];
 export function getToolUiByPermissions(permissions) {
     const want = new Set(permissions);
     for (const id of Object.keys(tools)) {
@@ -25,6 +28,34 @@ function isToolId(id) {
     return id in tools;
 }
 export function parseToolLink(link) {
+    // the browser can wrap a pasted monero: uri in the search url it built, escaped or plain
+    const lower = link.toLowerCase();
+    const plain_at = lower.indexOf("monero:");
+    const escaped_at = lower.indexOf("monero%3a");
+    const legacy_at = plain_at !== -1 ? plain_at : escaped_at;
+    if (legacy_at !== -1) {
+        try {
+            // an escaped uri sits inside one parameter, so the next raw & ends it
+            //...?q=monero%3AADDR&source=desktop
+            //       the pasted uri, ends at &
+            const tail = link.slice(legacy_at);
+            const uri = new URL(decodeURIComponent(plain_at !== -1 ? tail : tail.split("&")[0] ?? ""));
+            const address = uri.pathname;
+            const amount = uri.searchParams.get("tx_amount") ?? "";
+            if (!/^([1-9A-HJ-NP-Za-km-z]{95}|[1-9A-HJ-NP-Za-km-z]{106})$/.test(address))
+                return null;
+            if (amount && !/^\d+(?:\.\d{1,12})?$/.test(amount))
+                return null;
+            // separate payment ids are not supported. do not drop one or choose between amounts.
+            if (uri.searchParams.has("tx_payment_id") || uri.searchParams.getAll("tx_amount").length > 1)
+                return null;
+            return { tool_id: "001", payload: { address, amount, no_check: true } };
+        }
+        catch {
+            // a broken monero uri is not a tool call. do not fall through to the marker scan.
+            return null;
+        }
+    }
     const magic_str_index = link.lastIndexOf(TOOL_MAGIC_STRING);
     if (magic_str_index === -1)
         return null;