From 58ca8281523126ad90621fd776b396235a898685 Mon Sep 17 00:00:00 2001 From: scopuli-dev Date: Thu, 2 Jul 2026 16:46:26 +0300 Subject: [PATCH 1/2] Add token signing backwards compatibility option to devtools WE2-1158 Signed-off-by: Sten Anderson --- src/background/background.ts | 8 +++----- src/content/content.ts | 20 +++++++++++++------ src/shared/configManager.ts | 7 +++++-- src/shared/devToolsBridge.ts | 4 ++-- .../views/devtools/panels/webeid-settings.js | 3 ++- 5 files changed, 26 insertions(+), 16 deletions(-) diff --git a/src/background/background.ts b/src/background/background.ts index 65c3d21..010077d 100644 --- a/src/background/background.ts +++ b/src/background/background.ts @@ -14,9 +14,7 @@ import sign from "./actions/sign"; import status from "./actions/status"; import Logger from "../shared/Logger"; -import { loadConfigFromStorage } from "../shared/configManager"; - -const configLoaded = loadConfigFromStorage(); +import { configInitialized } from "../shared/configManager"; async function onAction(message: ExtensionRequest, sender: MessageSender): Promise { switch (message.action) { @@ -102,7 +100,7 @@ browser.runtime.onMessage.addListener((message, sender, sendResponse) => { // Fire-and-forget: DevTools logging must not block message handling, using void to ignore Promise is the standard solution. void logger.devToolsEvent("request", "Extension (content)", "Extension (background)", message); - void configLoaded + void configInitialized .then(() => onAction(message, sender)) .then((response) => { void logger.devToolsEvent("response", "Extension (content)", "Extension (background)", response); @@ -117,7 +115,7 @@ browser.runtime.onMessage.addListener((message, sender, sendResponse) => { } else if ((message as TokenSigningMessage).type) { void logger.devToolsEvent("request", "Extension (content)", "Extension (background)", message); - void configLoaded + void configInitialized .then(() => onTokenSigningAction(message, sender)) .then((response) => { void logger.devToolsEvent("response", "Extension (content)", "Extension (background)", response); diff --git a/src/content/content.ts b/src/content/content.ts index 3d386c5..6c9dc99 100644 --- a/src/content/content.ts +++ b/src/content/content.ts @@ -4,8 +4,8 @@ import Action from "@web-eid.js/models/Action"; import ContextInsecureError from "@web-eid.js/errors/ContextInsecureError"; +import { config, configInitialized } from "../shared/configManager"; import { TokenSigningErrorResponse } from "../models/TokenSigning/TokenSigningResponse"; -import config from "../config"; import injectPageScript from "./TokenSigning/injectPageScript"; import tokenSigningResponse from "../shared/tokenSigningResponse"; @@ -56,7 +56,7 @@ async function ack( window.postMessage(message, origin); } -window.addEventListener("message", async (event) => { +async function handleMessage(event: MessageEvent): Promise { if (isWebeidEvent(event)) { if (isWebeidResponseEvent(event)) return; @@ -126,9 +126,17 @@ window.addEventListener("message", async (event) => { window.postMessage(response, event.origin); } } -}); +} + +async function initializeContentScript(): Promise { + await configInitialized; + + window.addEventListener("message", handleMessage); -// --[ chrome-token-signing backwards compatibility ]--------------------------- -if (config.TOKEN_SIGNING_BACKWARDS_COMPATIBILITY) { - injectPageScript(); + // --[ chrome-token-signing backwards compatibility ]------------------------- + if (config.TOKEN_SIGNING_BACKWARDS_COMPATIBILITY) { + injectPageScript(); + } } + +void initializeContentScript(); diff --git a/src/shared/configManager.ts b/src/shared/configManager.ts index 71e2a83..1c8da86 100644 --- a/src/shared/configManager.ts +++ b/src/shared/configManager.ts @@ -5,14 +5,16 @@ import defaultConfig from "../config"; import isBrowserStorageEnabled from "./utils/isBrowserStorageEnabled"; type Config = { - -readonly [key in keyof typeof defaultConfig]: typeof defaultConfig[key]; + -readonly [key in keyof typeof defaultConfig]: (typeof defaultConfig)[key]; }; const config = JSON.parse(JSON.stringify(defaultConfig)) as Config; +const configInitialized = loadConfigFromStorage(); const overrideableConfigKeys: Array = [ "NATIVE_MESSAGE_MAX_BYTES", "NATIVE_GRACEFUL_DISCONNECT_TIMEOUT", + "TOKEN_SIGNING_BACKWARDS_COMPATIBILITY", "TOKEN_SIGNING_USER_INTERACTION_TIMEOUT", "ALLOW_HTTP_LOCALHOST" ]; @@ -67,7 +69,8 @@ async function saveToStorageOrRemoveOnNull export { config, + configInitialized, defaultConfig, loadConfigFromStorage, - setConfigOverride, + setConfigOverride }; diff --git a/src/shared/devToolsBridge.ts b/src/shared/devToolsBridge.ts index 4f97331..bcf25cf 100644 --- a/src/shared/devToolsBridge.ts +++ b/src/shared/devToolsBridge.ts @@ -1,7 +1,7 @@ // SPDX-FileCopyrightText: Estonian Information System Authority // SPDX-License-Identifier: MIT -import { config, defaultConfig, loadConfigFromStorage, setConfigOverride } from "./configManager"; +import { config, configInitialized, defaultConfig, setConfigOverride } from "./configManager"; import { Port } from "../models/Browser/Runtime"; class DevToolsBridge extends EventTarget { @@ -39,7 +39,7 @@ class DevToolsBridge extends EventTarget { this.devToolPorts = this.devToolPorts.filter((connectedPort) => connectedPort !== port); }); - await loadConfigFromStorage(); + await configInitialized; port.postMessage({ devtools: "settings", config, defaultConfig }); } diff --git a/static/views/devtools/panels/webeid-settings.js b/static/views/devtools/panels/webeid-settings.js index b6f29b9..f632072 100644 --- a/static/views/devtools/panels/webeid-settings.js +++ b/static/views/devtools/panels/webeid-settings.js @@ -4,8 +4,9 @@ const includedSettings = [ "NATIVE_MESSAGE_MAX_BYTES", "NATIVE_GRACEFUL_DISCONNECT_TIMEOUT", + "TOKEN_SIGNING_BACKWARDS_COMPATIBILITY", "TOKEN_SIGNING_USER_INTERACTION_TIMEOUT", - "ALLOW_HTTP_LOCALHOST" + "ALLOW_HTTP_LOCALHOST", ]; const ui = { From e77fcda6ac73df5c6c4531acf432ecada7f53716 Mon Sep 17 00:00:00 2001 From: scopuli-dev Date: Thu, 2 Jul 2026 17:03:11 +0300 Subject: [PATCH 2/2] Remove token signing backwards compatibility from being configurable by env WE2-1158 Signed-off-by: Sten Anderson --- .github/workflows/build.yml | 1 - README.md | 5 ----- rollup.config.mjs | 7 ------- scripts/build.mjs | 4 ---- src/config.ts | 2 +- 5 files changed, 1 insertion(+), 18 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index b5f2a05..8e045aa 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -34,7 +34,6 @@ jobs: - name: Build run: | export SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct) - export TOKEN_SIGNING_BACKWARDS_COMPATIBILITY=true npm run test clean build package - name: Generate SBOM diff --git a/README.md b/README.md index e1b36c2..14e9bfc 100644 --- a/README.md +++ b/README.md @@ -43,11 +43,6 @@ The Web eID extension for Safari is built as a [Safari web extension](https://de SOURCE_DATE_EPOCH=$(cat ../previous-build/dist/firefox/SOURCE_DATE_EPOCH) npm run clean build package ``` - For backwards compatibility with TokenSigning API, set the `TOKEN_SIGNING_BACKWARDS_COMPATIBILITY` environment variable to `true`. - ```bash - TOKEN_SIGNING_BACKWARDS_COMPATIBILITY=true npm run clean build package - ``` - 5. Load in Firefox as a Temporary Extension 1. Open `about:debugging#/runtime/this-firefox` 2. Click "Load temporary Add-on..." and open `/web-eid-webextension/dist/manifest.json` diff --git a/rollup.config.mjs b/rollup.config.mjs index 8e42a2d..1256bba 100644 --- a/rollup.config.mjs +++ b/rollup.config.mjs @@ -6,7 +6,6 @@ import { fileURLToPath } from "url"; import alias from "@rollup/plugin-alias"; import cleanup from "rollup-plugin-cleanup"; -import injectProcessEnv from "rollup-plugin-inject-process-env"; import license from "rollup-plugin-license"; import polyfill from "rollup-plugin-polyfill"; import resolve from "@rollup/plugin-node-resolve"; @@ -14,10 +13,6 @@ import resolve from "@rollup/plugin-node-resolve"; // List of browsers to build for. const browsers = ["chrome", "firefox", "safari"]; -const processEnvConf = { - TOKEN_SIGNING_BACKWARDS_COMPATIBILITY: process.env.TOKEN_SIGNING_BACKWARDS_COMPATIBILITY, -} - const pluginsConf = (environment) => [ alias({ entries: [{ @@ -37,7 +32,6 @@ const pluginsConf = (environment) => [ }), ...(environment === "chrome" ? [ polyfill(["webextension-polyfill"]) ] : []), - ...(environment !== "page-script" ? [ injectProcessEnv(processEnvConf) ] : []), ]; // Use flatMap() to create a configuration for each browser and each of the "content" and "background" scripts. @@ -63,7 +57,6 @@ const tokenSigningPageConfig = { file: `dist/${browser}/token-signing-page-script.js`, format: "iife", })), - plugins: pluginsConf("page-script"), context: "window", }; diff --git a/scripts/build.mjs b/scripts/build.mjs index 6d3aedc..2e7ecc2 100644 --- a/scripts/build.mjs +++ b/scripts/build.mjs @@ -81,10 +81,6 @@ const targets = { }, async build() { - rem( - "Environment variables affecting the build:", - `TOKEN_SIGNING_BACKWARDS_COMPATIBILITY=${process.env.TOKEN_SIGNING_BACKWARDS_COMPATIBILITY?.toUpperCase() === "TRUE"} (hwcrypto support enabled)` - ); await this.compile(); await this.bundle(); diff --git a/src/config.ts b/src/config.ts index 9355424..5f34287 100644 --- a/src/config.ts +++ b/src/config.ts @@ -26,7 +26,7 @@ export default Object.freeze({ * @see https://github.com/open-eid/chrome-token-signing * @see https://github.com/hwcrypto/hwcrypto.js/wiki */ - TOKEN_SIGNING_BACKWARDS_COMPATIBILITY: process.env.TOKEN_SIGNING_BACKWARDS_COMPATIBILITY?.toUpperCase() === "TRUE", + TOKEN_SIGNING_BACKWARDS_COMPATIBILITY: true as boolean, TOKEN_SIGNING_USER_INTERACTION_TIMEOUT: 1000 * 60 * 5, // 5 minutes /**