selimaj-devandclaude
56a2ff9930
Auth now goes through an actual connected Solana wallet instead of a locally-generated ed25519 keypair. Phantom's window.solana provider is only reachable from a page's own JS world, not an isolated-world content script, so this adds a second world:'MAIN' content script (wallet-bridge.content.ts + wallet-bridge/inject.ts) that talks to window.solana directly and relays to the isolated world via window CustomEvents (wallet-bridge/relay.ts), matched by request id. wallet-connect.ts orchestrates: try a silent onlyIfTrusted connect on load; if that fails, show an on-page banner (wallet-bridge/banner.ts) whose click handler is what actually calls connect() -- Phantom requires a real user gesture for the approval popup on a first-ever connect, which a click relayed from the extension popup wouldn't count as by the time it reaches the wallet. background/wallet-auth.ts runs the REST auth flow (nonce -> ask the tab's content script to sign it -> verify -> store session token) once a wallet reports connected. ws-client.ts no longer force-retries with a known-bad token on auth failure; it calls onAuthExpired instead (which clears the token and prompts a silent wallet reconnect) and exposes reconnectNow() so background.ts can short-circuit the backoff wait once a fresh token exists. identity.ts and its tweetnacl dependency are gone -- no more stub signer. Untested against real Phantom (no browser automation available this session) -- flagged in CLAUDE.md as needing manual verification, along with a note that world:'MAIN' needs Firefox 128+. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01YXiHuScXrjxBh7yFGAPq3B
25 lines
977 B
TypeScript
25 lines
977 B
TypeScript
import { browser } from 'wxt/browser';
|
|
|
|
const SESSION_TOKEN_STORAGE_KEY = 'nexa:sessionToken';
|
|
|
|
/**
|
|
* Session token storage. The token itself is obtained by wallet-auth.ts
|
|
* (nonce -> Phantom signature -> verify) once a wallet connects — this
|
|
* module just persists/retrieves it, since ws-client.ts and popup code
|
|
* shouldn't know how a token was obtained.
|
|
*/
|
|
export async function getSessionToken(): Promise<string> {
|
|
const stored = await browser.storage.local.get(SESSION_TOKEN_STORAGE_KEY);
|
|
const token = stored[SESSION_TOKEN_STORAGE_KEY] as string | undefined;
|
|
if (!token) throw new Error('Not authenticated yet — connect a wallet on a supported trading site.');
|
|
return token;
|
|
}
|
|
|
|
export async function storeSessionToken(token: string): Promise<void> {
|
|
await browser.storage.local.set({ [SESSION_TOKEN_STORAGE_KEY]: token });
|
|
}
|
|
|
|
export async function clearSessionToken(): Promise<void> {
|
|
await browser.storage.local.remove(SESSION_TOKEN_STORAGE_KEY);
|
|
}
|