fix(consent): default auto-sign OFF so first-run installs never silently trust

getAutoSign() defaulted to `true`, which made the silent NIP-98 path in
createNip98AuthHeader (background.js: `!trusted && isSolid && autoSign`)
active out of the box: a freshly installed extension visiting any of the
hardcoded Solid hosts (solid.social, solidcommunity.net, inrupt.net,
solidweb.org) would mint a NIP-98 Authorization header AND persist the
origin to trusted-origins with zero user interaction -- a silent
auto-approve / auto-trust on install.

Flip the default to OFF in storage.getAutoSign so the trusted-origin
Solid (kind 27235) auto-sign and the Solid NIP-98 auto-trust are strictly
opt-in: the user enables "Auto-sign for Solid" from the popup
deliberately. Untrusted-origin signing was already prompt-gated and is
unaffected.

Align the popup default-display accordingly: popup.js reads the same OFF
default, and the popup.html toggle drops its hardcoded `checked` so the
markup matches the real (off) state instead of flashing on at load.

No test pins the autoSign default (storage.test only asserts it is a
boolean; the consent/NIP-98 suites set it explicitly), so the full
133-test suite, build and lint remain green.

Co-Authored-By: jjohare <github@thedreamlab.uk>

Author: jjohare

popup/popup.html

@@ -148,7 +148,7 @@ <h1>Podkey</h1>
             <div class="settings-desc">Silently authenticate to trusted Solid servers.</div>
           </div>
           <label class="toggle">
-            <input type="checkbox" id="autoSignToggle" checked />
+            <input type="checkbox" id="autoSignToggle" />
             <span class="slider"></span>
           </label>
         </div>

popup/popup.js

@@ -76,8 +76,9 @@ async function showMainScreen(status) {
   // Load trusted sites
   await loadTrustedSites();
 
-  // Load auto-sign setting
-  const { podkey_auto_sign: autoSign = true } = await chrome.storage.local.get(['podkey_auto_sign']);
+  // Load auto-sign setting (defaults OFF — must match storage.getAutoSign,
+  // which keeps silent trusted-origin Solid / NIP-98 signing strictly opt-in).
+  const { podkey_auto_sign: autoSign = false } = await chrome.storage.local.get(['podkey_auto_sign']);
   document.getElementById('autoSignToggle').checked = autoSign;
 }
 

src/storage.js

@@ -159,11 +159,15 @@ export async function getTrustedOrigins() {
 }
 
 /**
- * Get auto-sign setting
+ * Get auto-sign setting.
+ * Defaults to OFF: a freshly installed extension must not silently sign or
+ * auto-trust any origin (including recognised Solid hosts) until the user
+ * deliberately enables auto-sign from the popup. This keeps the silent
+ * trusted-origin Solid / NIP-98 path strictly opt-in.
  * @returns {Promise<boolean>}
  */
 export async function getAutoSign() {
-  const { [STORAGE_KEYS.AUTO_SIGN]: autoSign = true } =
+  const { [STORAGE_KEYS.AUTO_SIGN]: autoSign = false } =
     await chrome.storage.local.get([STORAGE_KEYS.AUTO_SIGN]);
 
   return autoSign;