archipelago
3347b8b8b9
Three launcher/bridge defects combined to make HTTPS dashboards look
broken while HTTP ones worked:
1. portAuth() looked the launch port up under the name the user clicks
('mempool-web', 'lnd', 'bitcoin-knots'…), but the signed catalog
declares those ports under the manifest id that owns them
(archy-mempool-web, lnd-ui, bitcoin-ui). The lookup missed,
portIsGateFronted answered false, and an HTTPS dashboard handed app
frames http:// URLs — blocked as mixed content: mempool and IndeeHub
'did not connect', bitcoin knots/core opened http:// in a new tab.
Resolution now follows launch aliases, then a port-wide catalog scan
that only answers when every declarer of that port agrees (a port
any app publishes as plain HTTP is never upgraded to https).
2. The signed-catalog cache was only warmed by the Store/Discover
views, so a user who went straight to My Apps launched apps with an
empty cache. Warmed at dashboard mount now — fetchAppCatalog()
already memoizes with a 1h TTL.
3. The NIP-07 bridge compared event.origin for strict equality with the
recorded (http) app URL and replied to the recorded URL as the
postMessage targetOrigin — both break the moment a frame is scheme-
upgraded (cached HSTS did exactly that): every nostr request was
silently dropped and replies to the stale origin threw. The bridge
now matches host+port (scheme deliberately ignored) and always
replies to event.origin — the frame's real origin.
Unit tests cover alias resolution (incl. bitcoin-knots→8334→https),
the conservative port-scan, and scheme-agnostic sender matching.
64 lines
4.0 KiB
TypeScript
64 lines
4.0 KiB
TypeScript
/** Composable for NIP-07 Nostr signing between parent and iframe apps.
|
|
*
|
|
* Replies always target event.origin — the frame's REAL origin. The app's
|
|
* recorded URL can carry a stale scheme (HSTS-upgraded http app on an HTTPS
|
|
* dashboard); targeting it makes postMessage throw and the app never sees
|
|
* its response. */
|
|
|
|
import { rpcClient } from '@/api/rpc-client'
|
|
import type { SelectedIdentity } from './useAppIdentity'
|
|
|
|
export function useNostrBridge(
|
|
getStoredIdentity: () => SelectedIdentity | null,
|
|
) {
|
|
async function handleNostrRequest(event: MessageEvent) {
|
|
const { id, method, params } = event.data
|
|
const source = event.source as Window | null
|
|
if (!source) return
|
|
const storedIdentity = getStoredIdentity()
|
|
const identityId = storedIdentity?.id || null
|
|
if (import.meta.env.DEV) console.log(`[NIP-07] ${method} identityId=${identityId} storedPubkey=${storedIdentity?.nostr_pubkey?.slice(0, 12) || 'none'}`)
|
|
|
|
try {
|
|
let result: unknown
|
|
if (method === 'getPublicKey') {
|
|
// Use stored nostr_pubkey directly if available (avoids RPC call that may 401)
|
|
if (storedIdentity?.nostr_pubkey) {
|
|
result = storedIdentity.nostr_pubkey
|
|
if (import.meta.env.DEV) console.log('[NIP-07] getPublicKey from stored identity:', (result as string).slice(0, 12))
|
|
} else if (identityId) {
|
|
const res = await rpcClient.call<{ nostr_pubkey: string }>({ method: 'identity.get', params: { id: identityId } })
|
|
result = res.nostr_pubkey
|
|
} else {
|
|
const res = await rpcClient.call<{ nostr_pubkey: string }>({ method: 'node.nostr-pubkey' })
|
|
result = res.nostr_pubkey
|
|
}
|
|
} else if (method === 'signEvent') {
|
|
if (import.meta.env.DEV) console.log(`[NIP-07] signEvent kind=${params.event?.kind} using identity=${identityId || 'node-default'}`)
|
|
if (identityId) {
|
|
result = await rpcClient.call<unknown>({ method: 'identity.nostr-sign', params: { id: identityId, event: params.event } })
|
|
} else {
|
|
result = await rpcClient.call<unknown>({ method: 'node.nostr-sign', params: { event: params.event } })
|
|
}
|
|
if (import.meta.env.DEV) console.log('[NIP-07] signEvent OK')
|
|
} else if (method === 'getRelays') { result = {} }
|
|
else if (method === 'nip04.encrypt') { result = (await rpcClient.call<{ ciphertext: string }>({ method: 'identity.nostr-encrypt-nip04', params: { id: identityId || undefined, pubkey: params.pubkey, plaintext: params.plaintext } })).ciphertext }
|
|
else if (method === 'nip04.decrypt') { result = (await rpcClient.call<{ plaintext: string }>({ method: 'identity.nostr-decrypt-nip04', params: { id: identityId || undefined, pubkey: params.pubkey, ciphertext: params.ciphertext } })).plaintext }
|
|
else if (method === 'nip44.encrypt') { result = (await rpcClient.call<{ ciphertext: string }>({ method: 'identity.nostr-encrypt-nip44', params: { id: identityId || undefined, pubkey: params.pubkey, plaintext: params.plaintext } })).ciphertext }
|
|
else if (method === 'nip44.decrypt') { result = (await rpcClient.call<{ plaintext: string }>({ method: 'identity.nostr-decrypt-nip44', params: { id: identityId || undefined, pubkey: params.pubkey, ciphertext: params.ciphertext } })).plaintext }
|
|
else { throw new Error(`Unsupported NIP-07 method: ${method}`) }
|
|
// Reply to the sender's REAL origin, never to the stored app URL:
|
|
// a scheme-upgraded frame (HSTS, or any future upgrade) makes the
|
|
// stored http:// URL a stale targetOrigin — postMessage then throws
|
|
// and the app never receives its response. nostr sign-in on IndeeHub
|
|
// over HTTPS died exactly there (2026-09-01).
|
|
source.postMessage({ type: 'nostr-response', id, result }, event.origin || '*')
|
|
} catch (err) {
|
|
if (import.meta.env.DEV) console.error(`[NIP-07] ${method} FAILED:`, err instanceof Error ? err.message : err)
|
|
source.postMessage({ type: 'nostr-response', id, error: err instanceof Error ? err.message : 'Unknown error' }, event.origin || '*')
|
|
}
|
|
}
|
|
|
|
return { handleNostrRequest }
|
|
}
|