/** * messages.ts — the only background message handler. * * All `chrome.runtime.onMessage` handling for the service worker lives here. * Do not handle messages inline in entry.ts, alarms.ts, or any other * background file. Every background-bound MessageType in shared/types.ts * must have a case below. Content-script-bound message types (PING, * SUMMON_AUTOFILL, VAULT_LOCKED) are documented in shared/types.ts and * intentionally have no case here — they are sent *to* content scripts. */ import { copyToClipboard } from "./clipboard"; import { setupAutoLock, touchAutoLock } from "./alarms"; import * as vault from "./vault"; import * as syncLifecycle from "./sync-lifecycle"; import { activateLicense, deactivateLicense, getLicenseInfo, getLicenseKey, isProUser, markCelebrationPlayed, shouldPlayCelebration, } from "./license"; import { cancelFirefoxPasskeyCreate, completeFirefoxPasskeyCreate, getPasskeyProviderState, getPendingPasskeyRequest, handleFirefoxPasskeyCreate, handleFirefoxPasskeyGet, handlePasskeyHasCredentials, initiateFirefoxPasskeyCreate, isPasskeyOfferDeclined, recordPasskeyOfferDecline, resolvePendingPasskeyRequest, setPasskeyProviderEnabled, } from "./passkey"; import { buildAdvancedHealthReport, resolveResetUrl } from "./health"; import { Capacitor } from "@capacitor/core"; import { storageClear } from "../shared/storage"; import type { Message, MessageResponse, MessageType, ProFeature, } from "../shared/types"; import { isPasskeyOnly } from "../shared/types"; import type { SyncStatus } from "../shared/sync-types"; /** * The single Pro gate. Every gated handler calls this first; the broadcast * lets the popup react (navigate to the License section, highlight the * relevant feature). Background never touches the popup view directly — * the popup owns navigation. See Projects.md "Pro gate rule". */ async function requirePro( feature: ProFeature, trigger: "user" | "background" = "user" ): Promise<{ allowed: boolean }> { if (await isProUser()) return { allowed: true }; if (trigger === "user") { // User deliberately triggered this feature — redirect the popup immediately. if (!Capacitor.isNativePlatform()) { chrome.runtime .sendMessage({ type: "PRO_GATE_TRIGGERED", payload: { feature } }) .catch(() => { // Popup may be closed — the gate signal is best-effort. }); } } else { // Background trigger (e.g. passive sync initiation) — no popup is open. // Queue a notice so the next popup open shows a soft banner instead of // silently failing. if (!Capacitor.isNativePlatform() && chrome.storage.session) { chrome.storage.session .set({ pendingProNotice: { feature, triggeredAt: Date.now() } }) .catch(() => {}); } } return { allowed: false }; } // --------------------------------------------------------------------------- // Local device name. Peers see this string in PAIR_REQUEST / PAIR_ACCEPT and // next to the device in their paired-devices list. Default to a platform-aware // fallback when the user hasn't set one explicitly. const DEVICE_NAME_KEY = "peach_device_name"; async function getLocalDeviceName(): Promise { try { const stored = await chrome.storage.local.get(DEVICE_NAME_KEY); const value = (stored as Record)[DEVICE_NAME_KEY]; if (typeof value === "string" && value.trim()) return value.trim(); } catch { // fall through to default } if (Capacitor.getPlatform() === "android") return "Peach Android"; if (Capacitor.getPlatform() === "ios") return "Peach iOS"; return "Peach"; } // --------------------------------------------------------------------------- // 6-digit code pairing. const PAIRING_TOKEN_TTL_MS = 5 * 60 * 1000; // Active Android show-mode pairing handle, if any. Held module-locally so // STOP_PAIRING_SERVER can tear it down without round-tripping through // Kotlin storage. Cleared on success, on stop, and when the SW restarts // (the Kotlin server dies with the app process anyway). let activeAndroidPairingHandle: { stop: () => Promise } | null = null; function generateSixDigitToken(): string { // crypto.getRandomValues, not Math.random — the token is the only secret // protecting the pairing window from a same-LAN attacker. 6 decimal digits // is 1 in 1,000,000; combined with a 5-minute TTL and pairing-mode gating // on the responder this is the right tradeoff between UX and security. const buf = new Uint32Array(1); crypto.getRandomValues(buf); const value = buf[0] % 1_000_000; return value.toString().padStart(6, "0"); } // --------------------------------------------------------------------------- // Peer discovery glue (Phase 7 popup pairing flow). // // The popup opens discovery via START_PEER_DISCOVERY. We connect to the // native sync host, subscribe once, and re-broadcast every PEER_DISCOVERED / // PEER_LOST event to the popup as a SYNC_PEER_DISCOVERED / SYNC_PEER_LOST // runtime message. The popup is the only consumer; if it closes, STOP is // sent on cleanup which tears down subscriptions and the native discovery. // --------------------------------------------------------------------------- let peerDiscoverySubscriptions: Array<() => void> = []; async function startPeerDiscoveryForPopup(): Promise { await stopPeerDiscoveryForPopup(); const sync = await import('./sync'); const { getPairedDevices } = await import('./sync-storage'); sync.connectSyncHost(); const unsubDiscovered = sync.onPeerDiscovered((peer) => { void (async () => { const paired = await getPairedDevices(); const alreadyPaired = paired.some((d) => d.deviceId === peer.deviceId); if (Capacitor.isNativePlatform()) return; chrome.runtime .sendMessage({ type: "SYNC_PEER_DISCOVERED", peer: { deviceId: peer.deviceId, deviceName: peer.name, host: peer.host, port: peer.port, wsPort: peer.wsPort, x25519PublicKey: peer.x25519PublicKey, alreadyPaired, }, }) .catch(() => {}); })(); }); const unsubLost = sync.onPeerLost((deviceId) => { if (Capacitor.isNativePlatform()) return; chrome.runtime .sendMessage({ type: "SYNC_PEER_LOST", deviceId }) .catch(() => {}); }); peerDiscoverySubscriptions = [unsubDiscovered, unsubLost]; sync.discoverPeers(); } async function stopPeerDiscoveryForPopup(): Promise { for (const unsub of peerDiscoverySubscriptions) unsub(); peerDiscoverySubscriptions = []; try { const sync = await import('./sync'); if (sync.isHostConnected()) { await sync.stopDiscovery(); } } catch { // best-effort } } const PRIVATE_IPV4_RANGES = [ { prefix: "10." }, { prefix: "127." }, { prefix: "169.254." }, { prefix: "192.168." }, ]; // Empty disables network submission while the UI continues to function as a // no-op (the handler returns ok:true without calling fetch). When set, the // URL is validated by `isAllowedCanaryWebhookUrl` before any request, so the // same private-IP/HTTPS rules that gate canary webhooks apply here. const FEEDBACK_ENDPOINT = ""; export function setupMessageHandler(): void { chrome.runtime.onMessage.addListener( (msg: unknown, sender, sendResponse) => { if (!isMessage(msg)) { sendResponse({ ok: false, error: "invalid message" }); return true; } handleMessage(msg, sender) .then(sendResponse) .catch((err) => sendResponse({ ok: false, error: err instanceof Error ? err.message : String(err), }) ); return true; } ); } function isMessage(m: unknown): m is Message { return typeof m === "object" && m !== null && "type" in m; } export async function handleMessage( msg: Message, sender: Partial = {} ): Promise { try { // Validate sender — only allow messages from our extension pages/scripts. // `sender.id` is undefined for messages originating from extension UI // (popup/options), which is legitimate; reject only when it is defined // and does not match our extension id. if ( !Capacitor.isNativePlatform() && sender.id !== undefined && sender.id !== chrome.runtime.id ) { return { ok: false, error: "invalid sender" }; } if (shouldRefreshAutoLock(msg.type) && vault.isUnlocked()) { touchAutoLock(); } switch (msg.type) { case "CREATE_VAULT": { const { password } = msg.payload as { password: string }; await vault.createVault(password); await setupAutoLock(); broadcastToContentScripts({ type: "VAULT_UNLOCKED" }); void syncLifecycle.onVaultUnlocked(); return { ok: true }; } case "UNLOCK": { const { password } = msg.payload as { password: string }; const ok = await vault.unlock(password); if (ok) { await setupAutoLock(); broadcastToContentScripts({ type: "VAULT_UNLOCKED" }); void syncLifecycle.onVaultUnlocked(); } return { ok }; } case "LOCK": vault.lock(); void syncLifecycle.onVaultLocked(); return { ok: true }; case "IS_UNLOCKED": return { ok: true, data: vault.isUnlocked() }; case "GET_VAULT_STATUS": return { ok: true, unlocked: vault.isUnlocked() }; case "HAS_VAULT": return { ok: true, data: await vault.hasVault() }; case "GET_ENTRIES": return { ok: true, data: vault.getEntries() }; case "ADD_ENTRY": { if (!vault.isUnlocked()) return { ok: false, error: "vault locked" }; const entry = await vault.addEntry(msg.payload as any); return { ok: true, data: entry }; } case "BATCH_ADD_ENTRIES": { const { entries } = msg.payload as { entries: any[] }; const added = await vault.batchAddEntries(entries); return { ok: true, data: added }; } case "RESTORE_ENTRIES": { const { entries, mode, settings } = msg.payload as { entries: any[]; mode: "replace" | "merge"; settings?: vault.VaultSettings; }; const summary = await vault.restoreEntries(entries, mode); if (settings && typeof settings === "object") { await vault.updateSettings(settings); } return { ok: true, data: summary }; } case "CLEAR_VAULT_ENTRIES": { await vault.clearVaultEntries("REPLACE_ALL"); return { ok: true }; } case "GET_VAULT_HISTORY": { const snapshots = await vault.getVaultHistory(); return { ok: true, data: snapshots }; } case "RESTORE_VAULT_SNAPSHOT": { const { snapshotId } = msg.payload as { snapshotId: string }; const result = await vault.restoreVaultSnapshot(snapshotId); if (!result.ok) return { ok: false, error: result.error }; broadcastToContentScripts({ type: "VAULT_LOCKED" }); return { ok: true }; } case "COUNT_DUPLICATES": { return { ok: true, data: vault.countDuplicates() }; } case "DEDUPLICATE_ENTRIES": { const removed = await vault.deduplicateEntries(); return { ok: true, data: removed }; } case "UPDATE_ENTRY": { const { id, patch } = msg.payload as any; await vault.updateEntry(id, patch); return { ok: true }; } case "ADD_ADDITIONAL_URL": { const { id, url } = msg.payload as { id: string; url: string }; const trimmed = typeof url === "string" ? url.trim() : ""; if (!trimmed) return { ok: false, error: "url required" }; const existing = vault.getEntryById(id); if (!existing) return { ok: false, error: "entry not found" }; if (existing.type !== "login") return { ok: false, error: "login entries only" }; const merged = [...(existing.additionalUrls ?? []), trimmed]; await vault.updateEntry(id, { additionalUrls: merged }); return { ok: true }; } case "DELETE_ENTRY": { const { id } = msg.payload as { id: string }; await vault.deleteEntry(id); return { ok: true }; } case "GET_DELETED_ENTRIES": return { ok: true, data: vault.getDeletedEntries() }; case "RESTORE_ENTRY": { const { id } = msg.payload as { id: string }; await vault.restoreEntry(id); return { ok: true }; } case "PURGE_ENTRY": { const { id } = msg.payload as { id: string }; await vault.purgeEntry(id); return { ok: true }; } case "PURGE_EXPIRED_TRASH": { const { retentionMs } = msg.payload as { retentionMs: number }; const purged = await vault.purgeExpiredTrash(retentionMs); return { ok: true, data: purged }; } case "AUTOFILL_QUERY": { if (!vault.isUnlocked()) { return { ok: false, error: "VAULT_LOCKED" }; } const { domain, includeAll, kind } = msg.payload as { domain: string; includeAll?: boolean; kind?: "login" | "card"; }; // kind="card": return saved cards as compact summaries for the // inline card silver platter. Cards are not domain-scoped — every // saved card is a candidate on every checkout page — so domain is // ignored when kind === "card". if (kind === "card") { const cards = vault.getEntries().filter((e) => e.type === "card"); return { ok: true, data: cards.map((e) => ({ id: e.id, title: e.cardNickname || e.title, cardholderName: e.cardholderName, last4: e.last4, expMonth: e.expMonth, expYear: e.expYear, network: e.network, })), }; } // The inline selector fills username+password into a form. Passkey- // only entries have no password to fill; sign-in for those goes // through the WebAuthn path instead. Filter them out everywhere so // the user doesn't see four "GitHub" rows that mostly do nothing. // Notes and cards never belonged here either. const matches = ( includeAll ? vault .getEntries() .filter((entry) => entry.type !== "note" && entry.type !== "card") : vault.queryDomain(domain) ).filter((entry) => !isPasskeyOnly(entry)); return { ok: true, data: matches.map((e) => includeAll ? { id: e.id, title: e.title, hasPasskey: e.passkey !== undefined, } : { id: e.id, title: e.title, username: e.username, url: e.url, hasTotp: Boolean(e.totp), hasPasskey: e.passkey !== undefined, } ), }; } case "GET_ENTRY_FOR_FILL": { if (!vault.isUnlocked()) return { ok: false, error: "vault locked" }; const { id } = msg.payload as { id: string }; const entry = vault.getEntryById(id); if (!entry) return { ok: false, error: "entry not found" }; // Passkey-only entries (passkey credential, no password) cannot be // filled into a form — sign-in goes through the WebAuthn path. A // login that ALSO has a passkey is still fillable for its password. if (isPasskeyOnly(entry)) return { ok: false, error: "passkey not fillable" }; // Strip the passkey credential from the response — content scripts // never need the private key, and there's no reason to expose the // public credential metadata over the boundary either. const { passkey: _strippedPasskey, ...safeEntry } = entry; return { ok: true, data: safeEntry }; } case "COPY": { const { text, label, alreadyWritten } = msg.payload as { text: string; label: string; alreadyWritten?: boolean; }; await copyToClipboard(text, label, Boolean(alreadyWritten)); return { ok: true }; } case "CHECK_BREACH": { const { password } = msg.payload as { password: string }; const count = await vault.checkBreach(password); return { ok: true, data: count }; } case "CHECK_ALL_BREACHES": { const allEntries = vault.getEntries(); const results: Record = {}; for (const entry of allEntries) { if (entry.type === "note") continue; if (!entry.password) continue; results[entry.id] = await vault.checkBreach(entry.password); // Small delay — be a good citizen to the HIBP API await new Promise((r) => setTimeout(r, 200)); } // Persist any non-zero counts back to entries for (const [id, count] of Object.entries(results)) { const entry = vault.getEntryById(id); if (entry && (entry.breach ?? 0) !== count) { await vault.updateEntry(id, { breach: count > 0 ? count : undefined }); } } return { ok: true, data: results }; } case "GET_SETTINGS": return { ok: true, data: await vault.ensureSettingsLoaded() }; case "UPDATE_SETTINGS": { const patch = msg.payload as Record; await vault.updateSettings(patch as any); if (typeof patch.autoLockMinutes === "number") { await setupAutoLock(); if (vault.isUnlocked()) touchAutoLock(); } return { ok: true }; } case "GET_PENDING_PASSKEY": return { ok: true, data: await getPendingPasskeyRequest() }; case "APPROVE_PASSKEY": { const { requestId } = msg.payload as { requestId: number }; await resolvePendingPasskeyRequest(requestId, true); return { ok: true }; } case "DENY_PASSKEY": { const { requestId } = msg.payload as { requestId: number }; await resolvePendingPasskeyRequest(requestId, false); return { ok: true }; } case "GET_PASSKEYS": return { ok: true, data: vault.getEntries().filter((entry) => entry.passkey !== undefined), }; case "DELETE_PASSKEY": { const { id } = msg.payload as { id: string }; await vault.deleteEntry(id); return { ok: true }; } case "GET_PASSKEY_PROVIDER_STATE": return { ok: true, data: await getPasskeyProviderState() }; case "SET_PASSKEY_PROVIDER_ENABLED": { const { enabled } = msg.payload as { enabled: boolean }; // Disabling is always free; gating fires only when a free user is // trying to turn passkey interception on. if (enabled) { const gate = await requirePro("passkeys"); if (!gate.allowed) return { ok: false, error: "pro_required" }; } return { ok: true, data: await setPasskeyProviderEnabled(enabled) }; } case "FIRE_CANARY_PING": { const { webhookUrl, entryTitle, trigger } = msg.payload as { webhookUrl: string; entryTitle: string; trigger: "password_copied" | "username_copied" | "autofilled" | "submitted" | "test"; }; if (!isAllowedCanaryWebhookUrl(webhookUrl)) { return { ok: false, error: "invalid webhook url" }; } const body = JSON.stringify({ event: trigger === "test" ? "peach_canary_test" : "peach_canary_accessed", entry: entryTitle, trigger, timestamp: new Date().toISOString(), source: "peach-extension", }); if (trigger === "test") { // Permitted outbound fetch: user-configured canary alert endpoint // (validated by isAllowedCanaryWebhookUrl above). This is the // only non-HIBP outbound call in the extension — see // Projects.md §3.7. Test pings are awaited so the UI can show // success/failure. try { const res = await fetch(webhookUrl, { method: "POST", headers: { "Content-Type": "application/json" }, body, }); return { ok: res.ok, error: res.ok ? undefined : `HTTP ${res.status}` }; } catch (err) { return { ok: false, error: err instanceof Error ? err.message : "network error" }; } } // Non-test triggers are fire-and-forget fetch(webhookUrl, { method: "POST", headers: { "Content-Type": "application/json" }, body, }).catch(() => {}); return { ok: true }; } case "ACTIVATE_LICENSE": { const { key } = msg.payload as { key: string }; const licenseInfo = await activateLicense(key); return { ok: true, data: licenseInfo }; } case "GET_LICENSE": { const licenseInfo = await getLicenseInfo(); return { ok: true, data: licenseInfo }; } case "GET_LICENSE_KEY": { const key = await getLicenseKey(); return { ok: true, data: key }; } case "DEACTIVATE_LICENSE": { await deactivateLicense(); return { ok: true }; } case "SHOULD_PLAY_CELEBRATION": { const should = await shouldPlayCelebration(); return { ok: true, data: should }; } case "MARK_CELEBRATION_PLAYED": { await markCelebrationPlayed(); return { ok: true }; } case "OPEN_PRO_GATE": { // Content script requests: open popup and navigate to License section. const { feature } = (msg.payload ?? {}) as { feature?: string }; if (chrome.storage.session) { await chrome.storage.session.set({ pendingProGate: { feature: feature ?? "passkeys" } }); } try { await chrome.action.openPopup(); } catch { /* badge fallback */ } return { ok: true }; } case "GET_IDENTITIES": { if (!vault.isUnlocked()) return { ok: false, error: "vault locked" }; return { ok: true, data: vault.getIdentities() }; } case "GET_ADVANCED_HEALTH_REPORT": { const gate = await requirePro("advanced_health"); if (!gate.allowed) return { ok: false, error: "pro_required" }; if (!vault.isUnlocked()) return { ok: false, error: "vault locked" }; const report = await buildAdvancedHealthReport(vault.getEntries()); return { ok: true, data: report }; } case "INITIATE_PASSWORD_CHANGE": { const gate = await requirePro("smart_password_change"); if (!gate.allowed) return { ok: false, error: "pro_required" }; if (!vault.isUnlocked()) return { ok: false, error: "vault locked" }; const { id } = msg.payload as { id: string }; const entry = vault.getEntryById(id); if (!entry) return { ok: false, error: "entry not found" }; const url = resolveResetUrl(entry); if (!url) return { ok: false, error: "no reset url" }; try { await chrome.tabs.create({ url }); return { ok: true, data: { url } }; } catch (err) { return { ok: false, error: err instanceof Error ? err.message : "failed to open tab", }; } } case "IS_DURESS_ENABLED": { const enabled = await vault.isDuressEnabled(); return { ok: true, data: enabled }; } case "SETUP_DURESS": { const { duressPassword } = msg.payload as { duressPassword: string }; await vault.setupDuress(duressPassword); return { ok: true }; } case "DISABLE_DURESS": { await vault.disableDuress(); return { ok: true }; } case "VERIFY_MAIN_PASSWORD": { const { password } = msg.payload as { password: string }; const ok = await vault.verifyMainPassword(password); return { ok: true, data: ok }; } case "CHANGE_PASSWORD": { const { currentPassword, newPassword } = msg.payload as { currentPassword: string; newPassword: string; }; const changed = await vault.changePassword(currentPassword, newPassword); return changed ? { ok: true } : { ok: false, error: "incorrect current password" }; } case "GET_SITE_PASSWORD_POLICY": { const [tab] = await chrome.tabs.query({ active: true, currentWindow: true }); if (!tab?.id) return { ok: true, data: null }; try { const response = await chrome.tabs.sendMessage(tab.id, { type: "GET_SITE_PASSWORD_POLICY", }); return (response as MessageResponse) ?? { ok: true, data: null }; } catch { return { ok: true, data: null }; } } case "GET_SYNC_STATE": { const { getPairedDevices, getTrustedNetworks } = await import('./sync-storage'); const { isOnTailscale } = await import('./sync-network'); const { isProUser } = await import('./license'); const { storageGet } = await import('../shared/storage'); const pairedDevices = await getPairedDevices(); const trustedNetworks = await getTrustedNetworks(); const tailscale = await isOnTailscale(); const pro = await isProUser(); let status: SyncStatus = "offline"; if (tailscale || trustedNetworks.some((n: { isTailscale?: boolean }) => !n.isTailscale)) { if (pairedDevices.length === 0) { status = "no_peers"; } else { status = "synced"; } } else { status = "not_trusted"; } const lastSyncRaw = await storageGet("peach_last_sync_at"); const lastSyncParsed = lastSyncRaw ? Number.parseInt(lastSyncRaw, 10) : NaN; const lastSyncAt = Number.isFinite(lastSyncParsed) ? lastSyncParsed : undefined; return { ok: true, data: { pairedDevices, trustedNetworks, status, lastSyncAt, isPro: pro } }; } case "TRIGGER_SYNC": { const gate = await requirePro("sync"); if (!gate.allowed) return { ok: false, error: "pro_required" }; if (!vault.isUnlocked()) return { ok: false, error: "vault_locked" }; const { getPairedDevices, updatePairedDevice } = await import('./sync-storage'); const paired = await getPairedDevices(); if (paired.length === 0) return { ok: false, error: "no_paired_devices" }; const lifecycle = await import('./sync-lifecycle'); const sync = await import('./sync'); const { storageGet, storageSet } = await import('../shared/storage'); const { createNativeSyncTransport, runBlobSyncSession } = await import('./sync-coordinator'); const discovered = lifecycle.getDiscoveredPeerCache(); const reachable = paired.filter((device) => discovered.some((peer) => peer.x25519PublicKey === device.x25519PublicKey), ); if (reachable.length === 0) return { ok: false, error: "no_devices_reachable" }; // Sequential — each session may update peach_vault_a, and the next // peer should receive the freshest blob (which may already include // changes from the previous device in this same pass). const results: Array<{ deviceName: string; status: "completed" | "errored" | "closed"; error?: string; }> = []; for (const device of reachable) { const peer = discovered.find((p) => p.x25519PublicKey === device.x25519PublicKey)!; try { const connectionId = await sync.connectToPeer(peer.host, peer.port, peer.x25519PublicKey); const transport = await createNativeSyncTransport(connectionId); const result = await runBlobSyncSession("initiator", transport, { isPro: async () => true, isUnlocked: () => vault.isUnlocked(), getVaultBlobs: async () => ({ vault_a: (await storageGet("peach_vault_a")) ?? "", vault_b: (await storageGet("peach_vault_b")) ?? "", }), }); results.push({ deviceName: device.displayName, status: result.status, error: result.error, }); if (result.status === "completed") { await updatePairedDevice(device.deviceId, { lastSeenAt: Date.now(), lastSyncAt: Date.now(), }); } } catch (err) { results.push({ deviceName: device.displayName, status: "errored", error: err instanceof Error ? err.message : String(err), }); } } await storageSet("peach_last_sync_at", String(Date.now())); return { ok: true, data: { results, syncedCount: results.filter((r) => r.status === "completed").length, totalReachable: reachable.length, }, }; } case "START_PAIRING": { const gate = await requirePro("sync"); if (!gate.allowed) return { ok: false, error: "pro_required" }; return { ok: true }; } case "CANCEL_PAIRING": { return { ok: true }; } case "ACCEPT_PAIRING": { const gate = await requirePro("sync"); if (!gate.allowed) return { ok: false, error: "pro_required" }; return { ok: true }; } case "REMOVE_PAIRED_DEVICE": { const { deviceId } = msg.payload as { deviceId: string }; const { removePairedDevice } = await import('./sync-storage'); await removePairedDevice(deviceId); return { ok: true }; } case "REMOVE_TRUSTED_NETWORK": { const { ssid, bssid, isTailscale } = msg.payload as any; const { removeTrustedNetwork, getTrustedNetworks } = await import('./sync-storage'); const networks = await getTrustedNetworks(); const network = networks.find((n: { ssid?: string; bssid?: string; isTailscale?: boolean }) => (isTailscale ? n.isTailscale : n.ssid === ssid) && (!bssid || n.bssid === bssid) ); if (network) { await removeTrustedNetwork(network.addedAt); } return { ok: true }; } case "MARK_NETWORK_TRUSTED": { const { addTrustedNetwork } = await import('./sync-storage'); const { getCurrentNetwork } = await import('./sync-network'); const network = await getCurrentNetwork(); await addTrustedNetwork({ ssid: network.ssid, bssid: network.bssid, isTailscale: network.isTailscale, addedAt: Date.now(), }); return { ok: true }; } case "GET_INCOMING_PAIRING_REQUEST": { const { getIncomingPairingRequest } = await import('./sync-storage'); const request = await getIncomingPairingRequest(); return { ok: true, data: request }; } case "RESPOND_INCOMING_PAIRING": { const { accept } = msg.payload as { accept: boolean }; const { getIncomingPairingRequest, clearIncomingPairingRequest, addPairedDevice } = await import('./sync-storage'); const request = await getIncomingPairingRequest(); if (!request) return { ok: false, error: "no_pending_request" }; if (Date.now() > request.expiresAt) { await clearIncomingPairingRequest(); return { ok: false, error: "expired" }; } const sync = await import('./sync'); const { encodeSyncMessage } = await import('../shared/sync-wire'); // Always clear the pending request — UI must not show the banner twice // even if the wire-level send below fails. await clearIncomingPairingRequest(); if (request.connectionId) { try { if (accept) { const ourKey = await sync.getIdentityPublicKey(); const ourName = await getLocalDeviceName(); sync.sendSyncData( request.connectionId, encodeSyncMessage({ type: "PAIR_ACCEPT", public_key_hex: ourKey, device_name: ourName, }), ); await sync.trustDevice(request.publicKeyHex, request.deviceName); await addPairedDevice({ deviceId: request.publicKeyHex, displayName: request.deviceName, x25519PublicKey: request.publicKeyHex, pairedAt: Date.now(), lastSeenAt: Date.now(), }); } else { sync.sendSyncData( request.connectionId, encodeSyncMessage({ type: "PAIR_REJECT", reason: "user_declined" }), ); } } catch (err) { // Wire failure is non-fatal for the local trust update — the // initiator will time out cleanly on its end. void err; } try { sync.disconnectFromPeer(request.connectionId); } catch { /* best-effort */ } } else if (accept) { // Test-injected request without a real connection: still record local trust. try { await sync.trustDevice(request.publicKeyHex, request.deviceName); } catch { // Native host may not be installed in test contexts. } } return { ok: true, data: { accepted: accept, deviceName: request.deviceName } }; } case "START_PEER_DISCOVERY": { const gate = await requirePro("sync"); if (!gate.allowed) return { ok: false, error: "pro_required" }; try { await startPeerDiscoveryForPopup(); return { ok: true }; } catch (err) { return { ok: false, error: err instanceof Error ? err.message : "discovery_failed" }; } } case "STOP_PEER_DISCOVERY": { try { await stopPeerDiscoveryForPopup(); } catch { // best-effort cleanup } return { ok: true }; } case "START_PAIRING_SERVER": { if (Capacitor.isNativePlatform()) { const gate = await requirePro("sync"); if (!gate.allowed) return { ok: false, error: "pro_required" }; try { const { getAndroidSyncIdentity } = await import("../shared/android-sync-identity"); const { getOrCreateLocalDeviceId } = await import("./sync-identity-glue"); const { startCapacitorPairingServer } = await import( "../shared/capacitor-pairing-server" ); const { addPairedDevice } = await import("./sync-storage"); const { setActivePairingToken, setRecentPairing } = await import( "./pairing-server-state" ); const identity = await getAndroidSyncIdentity(); const publicKeyHex = Array.from(identity.publicKey, (b) => b.toString(16).padStart(2, "0"), ).join(""); const deviceId = await getOrCreateLocalDeviceId(); const name = await getLocalDeviceName(); const token = generateSixDigitToken(); const expiresAt = Date.now() + PAIRING_TOKEN_TTL_MS; const handle = await startCapacitorPairingServer({ privateKey: identity.privateKey, publicKey: identity.publicKey, publicKeyHex, deviceId, deviceName: name, token, onPaired: async (paired) => { try { await addPairedDevice({ deviceId: paired.deviceId, displayName: paired.displayName, x25519PublicKey: paired.publicKeyHex, pairedAt: Date.now(), lastSeenAt: Date.now(), }); } catch { // Already paired — idempotent. } await setRecentPairing({ deviceName: paired.displayName, pairedAt: Date.now(), side: "showing", }); await setActivePairingToken(null); activeAndroidPairingHandle = null; }, }); activeAndroidPairingHandle = handle; await setActivePairingToken({ token, expiresAt }); return { ok: true, data: { token, expiresAt } }; } catch (err) { return { ok: false, error: err instanceof Error ? err.message : "pairing_server_failed" }; } } const gate = await requirePro("sync"); if (!gate.allowed) return { ok: false, error: "pro_required" }; try { const sync = await import('./sync'); const { setActivePairingToken } = await import('./pairing-server-state'); const { getOrCreateLocalDeviceId } = await import('./sync-identity-glue'); sync.connectSyncHost(); const token = generateSixDigitToken(); const expiresAt = Date.now() + PAIRING_TOKEN_TTL_MS; const deviceId = await getOrCreateLocalDeviceId(); const name = await getLocalDeviceName(); await sync.startPairingServer({ token, deviceId, name }); await setActivePairingToken({ token, expiresAt }); return { ok: true, data: { token, expiresAt } }; } catch (err) { return { ok: false, error: err instanceof Error ? err.message : "pairing_server_failed" }; } } case "STOP_PAIRING_SERVER": { if (Capacitor.isNativePlatform()) { try { const { setActivePairingToken } = await import("./pairing-server-state"); await setActivePairingToken(null); if (activeAndroidPairingHandle) { await activeAndroidPairingHandle.stop(); activeAndroidPairingHandle = null; } } catch { // best-effort cleanup } return { ok: true }; } try { const sync = await import('./sync'); const { setActivePairingToken } = await import('./pairing-server-state'); await setActivePairingToken(null); if (sync.isHostConnected()) { await sync.stopPairingServer(); } } catch { // best-effort cleanup } return { ok: true }; } case "CONNECT_WITH_CODE": { if (Capacitor.isNativePlatform()) { const gate = await requirePro("sync"); if (!gate.allowed) return { ok: false, error: "pro_required" }; const { token: rawToken } = msg.payload as { token: string }; const token = String(rawToken).replace(/\D/g, ""); if (token.length !== 6) return { ok: false, error: "invalid_code" }; try { const { registerPlugin } = await import("@capacitor/core"); const Sync = registerPlugin<{ resolvePeerByCode(opts: { token: string; timeoutMs?: number }): Promise<{ host: string; tcpPort: number; wsPort?: number; x25519PublicKey: string; deviceId: string; name: string; }>; }>("Sync"); const resolved = await Sync.resolvePeerByCode({ token, timeoutMs: 8_000 }); if (resolved.wsPort === undefined) { return { ok: false, error: "peer_missing_ws_port" }; } const peer = { deviceId: resolved.deviceId, deviceName: resolved.name, host: resolved.host, port: resolved.tcpPort, wsPort: resolved.wsPort, x25519PublicKey: resolved.x25519PublicKey, alreadyPaired: false, }; const { getAndroidSyncIdentity } = await import("../shared/android-sync-identity"); const identity = await getAndroidSyncIdentity(); const ourPublicKeyHex = Array.from(identity.publicKey, (b) => b.toString(16).padStart(2, "0"), ).join(""); const ourDeviceName = await getLocalDeviceName(); const { runCapacitorPairingHandshake } = await import( "../shared/capacitor-pairing-handshake" ); const { addPairedDevice } = await import("./sync-storage"); const { setRecentPairing } = await import("./pairing-server-state"); const result = await runCapacitorPairingHandshake( peer, identity.privateKey, identity.publicKey, ourPublicKeyHex, ourDeviceName, ); await addPairedDevice({ deviceId: peer.deviceId, displayName: result.deviceName || peer.deviceName, x25519PublicKey: result.publicKeyHex, pairedAt: Date.now(), lastSeenAt: Date.now(), }); await setRecentPairing({ deviceName: result.deviceName || peer.deviceName, pairedAt: Date.now(), side: "entering", }); return { ok: true, data: { deviceName: result.deviceName || peer.deviceName } }; } catch (err) { const msg = err instanceof Error ? err.message : String(err); if (msg.startsWith("pair_rejected:")) { return { ok: false, error: "pair_rejected", data: { reason: msg.slice("pair_rejected:".length) } }; } if (msg.includes("no peer responded") || msg.includes("resolve failed")) { return { ok: false, error: msg }; } return { ok: false, error: msg || "connect_failed" }; } } const gate = await requirePro("sync"); if (!gate.allowed) return { ok: false, error: "pro_required" }; const { token: rawToken } = msg.payload as { token: string }; const token = String(rawToken).replace(/\D/g, ""); if (token.length !== 6) return { ok: false, error: "invalid_code" }; const sync = await import('./sync'); const { encodeSyncMessage } = await import('../shared/sync-wire'); const { waitForPairingResponse } = await import('./sync-coordinator'); const { addPairedDevice } = await import('./sync-storage'); const { setRecentPairing } = await import('./pairing-server-state'); sync.connectSyncHost(); let connectionId: string | undefined; try { const peer = await sync.resolvePeerByCode(token, 8_000); connectionId = await sync.connectToPeer(peer.host, peer.port, peer.x25519PublicKey); const ourPublicKeyHex = await sync.getIdentityPublicKey(); const deviceName = await getLocalDeviceName(); sync.sendSyncData( connectionId, encodeSyncMessage({ type: "PAIR_REQUEST", public_key_hex: ourPublicKeyHex, device_name: deviceName, }), ); const response = await waitForPairingResponse(connectionId, 30_000); if (response.type === "PAIR_ACCEPT") { await sync.trustDevice(response.public_key_hex, response.device_name); await addPairedDevice({ deviceId: peer.deviceId, displayName: response.device_name || peer.name, x25519PublicKey: response.public_key_hex, pairedAt: Date.now(), lastSeenAt: Date.now(), }); sync.disconnectFromPeer(connectionId); // Stash for the popup so a popup-close mid-handshake still surfaces // a confirmation on next open. await setRecentPairing({ deviceName: response.device_name || peer.name, pairedAt: Date.now(), side: "entering", }); return { ok: true, data: { deviceName: response.device_name || peer.name } }; } if (response.type === "PAIR_REJECT") { sync.disconnectFromPeer(connectionId); return { ok: false, error: "pair_rejected", data: { reason: response.reason } }; } sync.disconnectFromPeer(connectionId); return { ok: false, error: "unexpected_response" }; } catch (err) { if (connectionId) { try { sync.disconnectFromPeer(connectionId); } catch { /* best-effort */ } } return { ok: false, error: err instanceof Error ? err.message : "connect_failed" }; } } case "GET_RECENT_PAIRING": { const { consumeRecentPairing } = await import('./pairing-server-state'); const recent = await consumeRecentPairing(); return { ok: true, data: recent }; } case "INITIATE_PAIR_WITH_PEER": { const gate = await requirePro("sync"); if (!gate.allowed) return { ok: false, error: "pro_required" }; const { peer } = msg.payload as { peer: { deviceId: string; deviceName: string; host: string; port: number; x25519PublicKey: string }; }; const sync = await import('./sync'); const { encodeSyncMessage } = await import('../shared/sync-wire'); const { waitForPairingResponse } = await import('./sync-coordinator'); const { addPairedDevice } = await import('./sync-storage'); let connectionId: string | undefined; try { // The responder accepts this connection only because pairing mode is // active on its side — Noise NK still authenticates the *transport*, // and the responder verifies our auth proof, but our public key is // not yet in their trust store. The PAIR_ACCEPT we receive is the // user's confirmation on the peer device that we should be added. connectionId = await sync.connectToPeer(peer.host, peer.port, peer.x25519PublicKey); const ourPublicKeyHex = await sync.getIdentityPublicKey(); const deviceName = await getLocalDeviceName(); sync.sendSyncData( connectionId, encodeSyncMessage({ type: "PAIR_REQUEST", public_key_hex: ourPublicKeyHex, device_name: deviceName, }), ); const response = await waitForPairingResponse(connectionId, 30_000); if (response.type === "PAIR_ACCEPT") { await sync.trustDevice(response.public_key_hex, response.device_name); await addPairedDevice({ deviceId: peer.deviceId, displayName: response.device_name || peer.deviceName, x25519PublicKey: response.public_key_hex, pairedAt: Date.now(), lastSeenAt: Date.now(), }); sync.disconnectFromPeer(connectionId); return { ok: true, data: { connectionId, deviceName: response.device_name } }; } if (response.type === "PAIR_REJECT") { sync.disconnectFromPeer(connectionId); return { ok: false, error: "pair_rejected", data: { reason: response.reason } }; } sync.disconnectFromPeer(connectionId); return { ok: false, error: "unexpected_response" }; } catch (err) { if (connectionId) { try { sync.disconnectFromPeer(connectionId); } catch { /* best-effort */ } } return { ok: false, error: err instanceof Error ? err.message : "pair_failed" }; } } case "DEBUG_INJECT_INCOMING_PAIRING": { // Manual E2E rehearsal hook. Inserts a synthetic incoming pairing // request into session storage so Phase 7 banner UX can be exercised // without a live native host. No Pro gate — this is a no-op in // production unless explicitly invoked from a Settings debug action. const { deviceName, publicKeyHex } = (msg.payload ?? {}) as { deviceName?: string; publicKeyHex?: string; }; if (!deviceName || !publicKeyHex) { return { ok: false, error: "missing_payload" }; } const { setIncomingPairingRequest } = await import('./sync-storage'); const now = Date.now(); await setIncomingPairingRequest({ deviceName, publicKeyHex, receivedAt: now, expiresAt: now + 60_000, }); return { ok: true }; } case "RESET_SYNC_IDENTITY": { const gate = await requirePro("sync"); if (!gate.allowed) return { ok: false, error: "pro_required" }; const { getPairedDevices, removePairedDevice } = await import('./sync-storage'); const devices = await getPairedDevices(); for (const device of devices) { await removePairedDevice(device.deviceId); } // Native rotation is best-effort: when the native messaging host is // not yet installed (Phase 9), connectNative throws and we still // honour the local clear so the UI reflects the reset. The native // identity rotates the next time the host starts cleanly anyway. let nativePublicKey: string | null = null; try { const { rotateNativeIdentity, disconnectSyncHost } = await import('./sync'); nativePublicKey = await rotateNativeIdentity(); disconnectSyncHost(); } catch { nativePublicKey = null; } return { ok: true, data: { removedDevices: devices.length, nativePublicKey } }; } case "RECORD_MANUAL_SUMMON": { const { domain } = msg.payload as { domain: string }; const settings = vault.getSettings(); const existing = settings.manualSummonDomains?.[domain]; const now = Date.now(); await vault.updateSettings({ manualSummonDomains: { ...settings.manualSummonDomains, [domain]: { firstSummonedAt: existing?.firstSummonedAt ?? now, summonCount: (existing?.summonCount ?? 0) + 1, lastSummonedAt: now, }, }, }); return { ok: true }; } case "DECLINE_CARD_SAVE": { const { last4, expMonth, expYear } = msg.payload as { last4: string; expMonth: string; expYear: string }; await vault.declineCardSaveOffer(last4, expMonth, expYear); return { ok: true }; } case "IS_CARD_DECLINED": { const { last4, expMonth, expYear } = msg.payload as { last4: string; expMonth: string; expYear: string }; const declined = await vault.isCardDeclined(last4, expMonth, expYear); return { ok: true, data: declined }; } case "INITIATE_FIREFOX_PASSKEY_CREATE": { const { rpId, rpName, userName, userDisplayName } = (msg.payload ?? {}) as { rpId?: string; rpName?: string; userName?: string; userDisplayName?: string; }; if (!rpId || !userName) return { ok: false, error: "rpId and userName required" }; return await initiateFirefoxPasskeyCreate({ rpId, rpName: rpName ?? rpId, userName, userDisplayName, }); } case "COMPLETE_FIREFOX_PASSKEY_CREATE": { const payload = msg.payload as Parameters[0] | undefined; if (!payload) return { ok: false, error: "missing payload" }; return await completeFirefoxPasskeyCreate(payload); } case "PASSKEY_OFFER_DECLINE": { const { domain } = (msg.payload ?? {}) as { domain?: string }; if (!domain) return { ok: false, error: "domain required" }; await recordPasskeyOfferDecline(domain); return { ok: true }; } case "GET_PASSKEY_OFFER_DECLINED": { const { domain } = (msg.payload ?? {}) as { domain?: string }; if (!domain) return { ok: false, error: "domain required" }; return { ok: true, data: await isPasskeyOfferDeclined(domain) }; } case "PASSKEY_HAS_CREDENTIALS": { const payload = msg.payload as { rpId?: string; allowCredentials?: Array<{ id: string; type?: string }>; } | undefined; if (!payload?.rpId) return { ok: false, error: "rpId required" }; return await handlePasskeyHasCredentials({ rpId: payload.rpId, allowCredentials: payload.allowCredentials ?? [], }); } case "PASSKEY_CREATE": { const payload = msg.payload as Parameters[0] | undefined; if (!payload?.rpId || !payload?.userName) { return { ok: false, error: "rpId and userName required" }; } return await handleFirefoxPasskeyCreate(payload); } case "PASSKEY_GET": { const payload = msg.payload as Parameters[0] | undefined; if (!payload?.rpId) return { ok: false, error: "rpId required" }; return await handleFirefoxPasskeyGet(payload); } case "GET_PASSKEY_FOR_DOMAIN": { const { domain } = (msg.payload ?? {}) as { domain?: string }; if (!domain) return { ok: false, error: "domain required" }; if (!vault.isUnlocked()) return { ok: true, data: null }; const match = vault .getEntries() .find((entry) => entry.passkey?.rpId === domain); if (!match || !match.passkey) return { ok: true, data: null }; // Slim shape — only the fields State 11 needs. Never expose private // key material, even though this is locked behind isUnlocked. return { ok: true, data: { rpId: match.passkey.rpId, userName: match.passkey.userName, browser: match.passkey.browser, }, }; } case "DESTROY_VAULT": { // Irreversible by design. Lock zeroes the derived key + in-memory entries; // storage.local.clear() wipes every Peach key (slots, settings, license, // onboarded flag, history, sync state, declined cards, recall, etc.); // session.clear() wipes pending passkey requests + pro-notice queues. // Caller (Panic.tsx) handles UI navigation back to onboarding. vault.lock(); await storageClear(); // Belt-and-suspenders: storage.local.clear() already wipes // peach_vault_history, but if storage.ts ever routes history to a // different backend (e.g. Capacitor secure storage on Android) the // explicit clear keeps the invariant that Panic leaves no recoverable // vault state behind. await vault.clearVaultHistory(); if (!Capacitor.isNativePlatform() && chrome.storage.session) { await chrome.storage.session.clear(); } return { ok: true }; } case "SUBMIT_FEEDBACK": { const { category, message, version, browser } = msg.payload as { category: string; message: string; version: string; browser: string; }; if (!message.trim()) return { ok: false, error: "message is empty" }; if (!FEEDBACK_ENDPOINT) return { ok: true }; if (!isAllowedCanaryWebhookUrl(FEEDBACK_ENDPOINT)) { return { ok: false, error: "invalid feedback endpoint" }; } try { const res = await fetch(FEEDBACK_ENDPOINT, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ category, message, version, browser, source: "peach-extension" }), }); return { ok: res.ok, error: res.ok ? undefined : `HTTP ${res.status}` }; } catch (err) { return { ok: false, error: err instanceof Error ? err.message : "network error" }; } } default: return { ok: false, error: "unknown message type" }; } } catch (err) { return { ok: false, error: err instanceof Error ? err.message : "operation failed", }; } } /** Notify all content scripts that the vault just became available. */ function broadcastToContentScripts(message: { type: string }): void { if (Capacitor.isNativePlatform() || !chrome.tabs?.query) return; chrome.tabs.query({}, (tabs) => { for (const tab of tabs) { if (tab.id !== undefined) { chrome.tabs.sendMessage(tab.id, message).catch(() => { // Tab may not have a content script — silently ignore }); } } }); } function shouldRefreshAutoLock(type: MessageType): boolean { return ( type !== "HAS_VAULT" && type !== "IS_UNLOCKED" && type !== "GET_VAULT_STATUS" && type !== "LOCK" && type !== "UPDATE_SETTINGS" && type !== "GET_PENDING_PASSKEY" && type !== "GET_PASSKEY_PROVIDER_STATE" && type !== "DECLINE_CARD_SAVE" && type !== "IS_CARD_DECLINED" && type !== "SUBMIT_FEEDBACK" ); } function isAllowedCanaryWebhookUrl(value: string): boolean { try { const url = new URL(value); if (url.protocol !== "https:") return false; const hostname = url.hostname.toLowerCase(); if ( hostname === "localhost" || hostname.endsWith(".localhost") || isPrivateIpv4(hostname) || isPrivateIpv6(hostname) ) { return false; } return true; } catch { return false; } } function isPrivateIpv4(hostname: string): boolean { if (PRIVATE_IPV4_RANGES.some((range) => hostname.startsWith(range.prefix))) { return true; } const octets = hostname.split(".").map((part) => Number(part)); if (octets.length !== 4 || octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) { return false; } return octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31; } function isPrivateIpv6(hostname: string): boolean { const normalized = hostname.replace(/^\[|\]$/g, "").toLowerCase(); return ( normalized === "::1" || normalized.startsWith("fc") || normalized.startsWith("fd") || normalized.startsWith("fe80:") ); }