mirror of
https://github.com/PR0M3TH3AN/bitvid.git
synced 2026-11-04 11:52:25 +00:00
thePR0M3TH3AN
1ddfa95a84
Picks up BitLogin's login-surface expansion (NIP-07 extension, NIP-46
remote signer with nostrconnect QR, passkey sign-in), three rounds of
adversarial-audit fixes, and the mandatory recovery-phrase ceremony for
passkey-created accounts. Vendored via scripts/build-bitlogin-widget.mjs,
which pins the source commit in vendor/bitlogin.integrity.json; the
shared-chunk hashes changed, so three old chunks are removed and three
new ones added.
CSP fix, required for sign-in to work at all: BitLogin's crypto worker
compiles an Argon2id WASM module, and index.html's script-src had no
'wasm-unsafe-eval', so WebAssembly.compile would be blocked and every
BitLogin password flow would fail -- silently, because the page still
loads. This exact omission broke sign-in on bitlogin.network for four
days. The keyword permits WASM compilation only; JS eval stays blocked,
and the CSP comment's stale "no bundle uses wasm" claim is corrected.
tests/csp-policy.test.mjs now pins the keyword for index.html so it
cannot be dropped again. Baseline verified unchanged: npm run test:unit
green, npm run lint clean, and the raw tests/*.test.mjs glob fails the
same 10 pre-existing files before and after this change.
test_integrity_note:
change_type: ["new_tests"]
scenarios:
- id: SCN-csp-allows-wasm-for-bitlogin
given: "index.html mounts <bitlogin-auth>, whose worker compiles an Argon2id WASM module"
when: "the page's Content-Security-Policy script-src is evaluated"
then: "'wasm-unsafe-eval' is present, so WebAssembly.compile is permitted while 'unsafe-eval' remains absent"
observable_outcomes:
- "script-src directive parsed from the index.html CSP meta tag contains 'wasm-unsafe-eval'"
- "existing assertions still forbid 'unsafe-inline' and 'unsafe-eval'"
determinism_controls:
- "pure static parse of a committed HTML file; no clock, network, or browser"
anti_cheat_rationale:
prevents:
- "silently relaxing script-src to make sign-in work"
- "dropping the keyword and shipping a login page that cannot run Argon2id"
relaxation:
did_relax_any_assertion: false
if_true_explain_spec_basis: ""
38 lines
1.1 KiB
JSON
38 lines
1.1 KiB
JSON
{
|
|
"package": "@bitlogin/widget",
|
|
"version": "0.1.0",
|
|
"source": {
|
|
"repository": "https://github.com/PR0M3TH3AN/bitlogin.git",
|
|
"commit": "30b4f34300f0cb6195f4bd54652ec75e814889dd",
|
|
"commitDate": "2026-08-04T15:41:24-04:00",
|
|
"dirty": false,
|
|
"provenance": "attributed",
|
|
"toolchain": {
|
|
"node": "v22.23.1",
|
|
"vite": "^6.1.0"
|
|
}
|
|
},
|
|
"files": {
|
|
"bitlogin-shared-CEfP5Eg9.js": {
|
|
"sha256": "6e19179b46deab241ffa9baded2ab0245122cf88e5b4191fcd4ca905b81a67be",
|
|
"bytes": 289142
|
|
},
|
|
"bitlogin-shared-Co4_WTb5.js": {
|
|
"sha256": "ffecf43e4856105d485402c7d46ca6950b621965a85c5962daf0177f0e538237",
|
|
"bytes": 545712
|
|
},
|
|
"bitlogin-shared-DeDxZ3Jc.js": {
|
|
"sha256": "290c293f288a16f5c753d19b0eecee795ea07b5fe31219812f260aae407de29b",
|
|
"bytes": 483718
|
|
},
|
|
"bitlogin.js": {
|
|
"sha256": "823e4ec24a8e34d96428d0c933cf16be1755a80ff105dcf52dd96391e52da513",
|
|
"bytes": 146039
|
|
},
|
|
"cryptoWorker.js": {
|
|
"sha256": "adea9e4934e7b6df024cc97385ce227ad4870dad436ee8266fbe644cd5cec5b5",
|
|
"bytes": 126329
|
|
}
|
|
}
|
|
}
|