passkeys-firefox-relay.ts

1/**2 * passkeys-firefox-relay.ts — extension-world relay for the MAIN-world3 * passkey proxy (passkeys-firefox.ts).4 *5 * The MAIN-world script cannot call chrome.runtime.sendMessage — it lives in6 * the page's JS context, not the extension's. This relay listens for the7 * MAIN-world's PEACH_PASSKEY_REQUEST window messages, forwards each payload8 * to the background, and posts the result back as PEACH_PASSKEY_RESPONSE9 * with the same request id.10 *11 * Trust boundary: anything the page can synthesize on `window.message` lands12 * here. Only the message types in ALLOWED_RELAY_TYPES are allowed through to13 * the background. Vault/admin messages must never be proxied from page JS.14 *15 * Removal: deleted alongside the MAIN-world proxy when Firefox ships16 * chrome.webAuthenticationProxy. See src/shared/passkey-flags.ts.17 */1819const ALLOWED_RELAY_TYPES = new Set([20  "PASSKEY_CREATE",21  "PASSKEY_GET",22  "PASSKEY_HAS_CREDENTIALS",23  "INITIATE_FIREFOX_PASSKEY_CREATE",24  "PASSKEY_OFFER_DECLINE",25  "GET_PASSKEY_OFFER_DECLINED",26  "GET_PASSKEY_FOR_DOMAIN",27  "PASSKEY_AUTH_RESPONSE",28]);29// NOTE: COMPLETE_FIREFOX_PASSKEY_CREATE is deliberately NOT relayable — it is30// only ever sent by the approval popup (extension page) and is additionally31// sender-gated to extension origins in messages.ts (Codex Security 2026-08-04).3233window.addEventListener("message", async (event: MessageEvent) => {34  if (event.source !== window) return;35  const data = event.data as36    | { type?: string; id?: string; payload?: unknown }37    | undefined;38  if (!data || data.type !== "PEACH_PASSKEY_REQUEST") return;39  const { id, payload } = data;40  if (!payload || typeof payload !== "object") return;41  const payloadType = (payload as { type?: unknown }).type;42  if (typeof payloadType !== "string" || !ALLOWED_RELAY_TYPES.has(payloadType)) {43    return;44  }45  if (typeof id !== "string") return;4647  // NOTE: page-supplied fields in `payload` (including any `origin`) are NOT48  // trusted. The background re-derives the true caller origin from the message49  // sender (browser-attested) for all passkey rpId<->origin enforcement — see50  // attestedSenderOrigin in messages.ts. This relay only gates the message type.5152  const reply = (replyPayload: unknown) => {53    window.postMessage(54      { type: "PEACH_PASSKEY_RESPONSE", id, payload: replyPayload },55      window.location.origin56    );57  };5859  try {60    const response = await chrome.runtime.sendMessage(payload);61    reply(response);62  } catch {63    // The background may be momentarily unreachable (service worker spin-up,64    // extension reload). Tell the proxy to fall through to the platform65    // rather than throwing into the page.66    reply({ ok: false, error: "extension_error" });67  }68});6970export {};