Picks up BitLogin's login-surface expansion (NIP-07 extension, NIP-46
remote signer with nostrconnect QR, passkey sign-in), three rounds of
adversarial-audit fixes, and the mandatory recovery-phrase ceremony for
passkey-created accounts. Vendored via scripts/build-bitlogin-widget.mjs,
which pins the source commit in vendor/bitlogin.integrity.json; the
shared-chunk hashes changed, so three old chunks are removed and three
new ones added.
CSP fix, required for sign-in to work at all: BitLogin's crypto worker
compiles an Argon2id WASM module, and index.html's script-src had no
'wasm-unsafe-eval', so WebAssembly.compile would be blocked and every
BitLogin password flow would fail -- silently, because the page still
loads. This exact omission broke sign-in on bitlogin.network for four
days. The keyword permits WASM compilation only; JS eval stays blocked,
and the CSP comment's stale "no bundle uses wasm" claim is corrected.
tests/csp-policy.test.mjs now pins the keyword for index.html so it
cannot be dropped again. Baseline verified unchanged: npm run test:unit
green, npm run lint clean, and the raw tests/*.test.mjs glob fails the
same 10 pre-existing files before and after this change.
test_integrity_note:
change_type: ["new_tests"]
scenarios:
- id: SCN-csp-allows-wasm-for-bitlogin
given: "index.html mounts <bitlogin-auth>, whose worker compiles an Argon2id WASM module"
when: "the page's Content-Security-Policy script-src is evaluated"
then: "'wasm-unsafe-eval' is present, so WebAssembly.compile is permitted while 'unsafe-eval' remains absent"
observable_outcomes:
- "script-src directive parsed from the index.html CSP meta tag contains 'wasm-unsafe-eval'"
- "existing assertions still forbid 'unsafe-inline' and 'unsafe-eval'"
determinism_controls:
- "pure static parse of a committed HTML file; no clock, network, or browser"
anti_cheat_rationale:
prevents:
- "silently relaxing script-src to make sign-in work"
- "dropping the keyword and shipping a login page that cannot run Argon2id"
relaxation:
did_relax_any_assertion: false
if_true_explain_spec_basis: ""
Defense-in-depth against XSS for a client that holds storage credentials in
memory. The critical directive is a strict script-src: 'self' + the hash of the
inline theme-bootstrap + the nostr-tools CDN fallbacks, with no 'unsafe-inline'
or 'unsafe-eval' (verified no bundle uses eval/Function/wasm). This blocks
injected script/object elements, inline handlers, and base-tag hijack, so an
injected payload cannot run and read the in-memory storage master key, the
signer, or DM plaintext. connect/img/media stay broad because relays, R2/S3
endpoints, and video/thumbnail URLs are user/content defined; worker-src allows
blob: for the WebTorrent module worker. Applied to index.html and embed.html.
Test (tests/csp-policy.test.mjs) locks the inline-script hash to script-src and
asserts script-src stays strict (no unsafe-inline/eval) with object-src 'none'
and base-uri 'self'.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
thePR0M3TH3AN