Consolidated Podkey security hardening (#22)

Consolidated hardening of the Podkey key-holding signer: brings seven in-flight security/feature branches plus residual gap-fills, a polished CSP-clean UI, a CI build/test/lint gate, and a 133-test suite into one reviewable PR. The fix set was independently re-derived from a full audit of the extension and every item below was verified fixed *in the final tree* by an adversarial review pass (not just claimed).

**Supersedes** (folded in here; safe to close in favour of this PR): #12, #14, #17, #18, #19, #20, #21.

## Security posture — before → after

| Area | Before | After |
|---|---|---|
| Consent | Auto-approve everything (`showPermissionPrompt` hard-returned `true`) | **Explicit per-origin consent** popup that blocks on the user's decision; closing or 60s timeout denies |
| Key at rest | `storage.local` (persisted plaintext) | **`storage.session` only** (in-memory, cleared on browser close); raw key never crosses to the page |
| Crypto | A fake `crypto-browser.js` in the tree (`pubkey = sha256(privkey)`) | Deleted; **real `@noble` crypto** only, with `signEvent` schnorr self-verify before return |
| NIP-98 | Signed-event cache → byte-identical id → replayable | **Fresh per-token 16-byte nonce**, redirect-aware `u` tag, page-side body-hash binding |
| Solid-host trust | Substring match (`inrupt.net.evil.com` accepted) | **Exact-host match**, case-insensitive; lookalikes rejected |
| Interception | Double fetch/XHR interception + double 401-retry | **Single interception path**, one retry |
| Message channel | Page could inject arbitrary fields / origin / `privateKey` | Content script **whitelists 4 message types, forwards only safe fields, enforces the real origin** |
| Provider surface | Advertised `nip04`/`getRelays` that throw / return `{}` | **Honest**: `getPublicKey`, `signEvent`, `nip44.{encrypt,decrypt}` only |
| UI | Inline scripts + `innerHTML` XSS sinks | **CSP `script-src 'self'`**; all DOM via `textContent`/`createElement` |
| Auto-sign | Defaulted **ON** (first-run silent trust + NIP-98 mint) | Defaults **OFF** — silent trusted-origin Solid signing and NIP-98 auto-trust are strictly opt-in |

## Notes for review

- **Consent timeout:** `approve.js` actively sends `approved:false` + closes at the 60s mark (one-shot `decisionSent` guard) so the visible countdown is truthful; the background `chrome.windows` 60s timer remains a backstop. If you'd prefer the popup stay passive and let the background own the timeout, that is the single behavioural line to reconsider — everything else on the UI is restyling.
- The page-context `nip98-interceptor.js` still duplicates a couple of `auth-header-utils.js` helpers because page context can't ESM-import the module; intentional, tracked separately.

## Verification

- `npm run build` ✓ · `npm test` → **133 pass / 0 fail** ✓ · `npm run lint` → **0 errors** (now `no-unused-vars: error`) ✓
- New `.github/workflows/ci.yml` runs build → test → lint on every PR and push to `main`.

🤖 Generated by Claude Code

Author: jjohare

.eslintrc.json

@@ -0,0 +1,41 @@
+{
+  "root": true,
+  "env": {
+    "browser": true,
+    "webextensions": true,
+    "serviceworker": true,
+    "es2022": true
+  },
+  "parserOptions": {
+    "ecmaVersion": 2022,
+    "sourceType": "module"
+  },
+  "extends": "eslint:recommended",
+  "rules": {
+    "no-eval": "error",
+    "no-implied-eval": "error",
+    "no-undef": "error",
+    "no-unused-vars": [
+      "error",
+      {
+        "argsIgnorePattern": "^_",
+        "varsIgnorePattern": "^_",
+        "caughtErrorsIgnorePattern": "^_"
+      }
+    ]
+  },
+  "ignorePatterns": [
+    "node_modules/",
+    "dist/",
+    "**/*.bundle.js"
+  ],
+  "overrides": [
+    {
+      "files": ["test/**/*.js", "scripts/**/*.js"],
+      "env": {
+        "node": true,
+        "browser": false
+      }
+    }
+  ]
+}

.github/workflows/ci.yml

@@ -0,0 +1,47 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  build-test-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Test
+        run: npm test
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Package extension (sideloadable unpacked zip)
+        run: |
+          mkdir -p dist
+          zip -r dist/podkey-extension.zip manifest.json src popup $([ -d icons ] && echo icons) -x '*.test.js'
+
+      - name: Upload extension artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: podkey-extension
+          path: dist/podkey-extension.zip
+          if-no-files-found: error

CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to Podkey will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Added
+
+- **NIP-44 (v2) encryption** — `window.nostr.nip44.encrypt(pubkey, plaintext)`
+  and `window.nostr.nip44.decrypt(pubkey, ciphertext)`, enabling NIP-17 / NIP-59
+  gift-wrapped direct messages. Crypto runs in the background service worker
+  (the private key never reaches the page), reusing the existing message-passing
+  path. Implemented with `@noble/ciphers` (chacha20) + `@noble/hashes`
+  (hkdf/hmac/sha256) + `@noble/secp256k1` (ECDH). Verified against the official
+  NIP-44 spec test vectors.
+
 ## [0.0.7] - 2024-12-XX
 
 ### Changed

README.md

@@ -68,6 +68,7 @@
 - ✅ **Key Generation** - Secure cryptographic key generation using `@noble/secp256k1`
 - ✅ **Key Import** - Import existing 64-char hex private keys
 - ✅ **Event Signing** - Sign Nostr events with Schnorr signatures
+- ✅ **NIP-44 Encryption** - v2 `encrypt`/`decrypt` for NIP-17/NIP-59 gift-wrapped DMs (key never leaves the background)
 - ✅ **Trust Management** - Per-origin permissions with auto-approval
 - ✅ **Beautiful UI** - Soft gradients, smooth animations
 - ✅ **64-char Hex Keys** - Proper did:nostr format compatibility
@@ -261,6 +262,19 @@ const signed = await window.nostr.signEvent({
 })
 ```
 
+### `window.nostr.nip44.encrypt(pubkey, plaintext)` / `window.nostr.nip44.decrypt(pubkey, ciphertext)`
+
+NIP-44 (v2) encryption, used by NIP-17 / NIP-59 gift-wrapped direct messages.
+The private key never leaves the background service worker — encryption is
+performed there and only the resulting base64 payload (or decrypted plaintext)
+crosses to the page, mirroring the existing signing message path.
+
+```javascript
+const peer = '<64-char hex pubkey>'
+const payload = await window.nostr.nip44.encrypt(peer, 'hello')
+const plaintext = await window.nostr.nip44.decrypt(peer, payload)
+```
+
 ### `window.nostr.getRelays()`
 
 Returns relay configuration (coming soon).

package-lock.json

@@ -8,7 +8,7 @@
     "dev": "echo 'Load extension from chrome://extensions in developer mode'",
     "build": "npm run bundle",
     "bundle": "node scripts/bundle.js",
-    "test": "node --test test/**/*.test.js",
+    "test": "node --test test/*.test.js",
     "lint": "eslint src/"
   },
   "keywords": [
@@ -34,6 +34,7 @@
   },
   "homepage": "https://github.com/JavaScriptSolidServer/podkey#readme",
   "dependencies": {
+    "@noble/ciphers": "^2.2.0",
     "@noble/hashes": "^1.3.3",
     "@noble/secp256k1": "^3.0.0"
   },
@@ -44,4 +45,4 @@
   "engines": {
     "node": ">=18.0.0"
   }
-}
+}