Don't overwrite existing Authorization headers (#5)

Podkey's fetch/XHR interceptors unconditionally set Authorization on
every outbound request, replacing whatever the page already put there.
Pages using Solid-OIDC (Authorization: DPoP <token>) have their auth
silently swapped for Podkey's NIP-98 signature — the server then
authenticates as did:nostr:<podkey-key>, doesn't match the user's
real WebID, and denies access. User gets 403 on their own pod.

Fix: before injecting NIP-98, check whether the page already set
Authorization. If yes, step aside and let the page authenticate
itself. If that auth gets a 401, the existing retry-on-401 path
still tries NIP-98 as a fallback.

Covers both fetch (options.headers across Headers/object/array shapes)
and XHR (via a setRequestHeader override that tags the request).

New hasAuthorizationHeader helper is canonical in src/auth-header-utils.js
with unit tests. The in-page scripts duplicate it because they load as
classic scripts without ESM imports.

Author: melvincarvalho

src/auth-header-utils.js

@@ -0,0 +1,103 @@
+/**
+ * Utility: detect whether a fetch-options / headers shape already carries
+ * an Authorization header. Podkey's interceptors must not overwrite an
+ * Authorization header the page already set (e.g., Solid-OIDC DPoP),
+ * otherwise the request ends up authenticated as Podkey's NIP-98 identity
+ * and ACLs reject the real user (see issue #5).
+ *
+ * Handles all three shapes `options.headers` can take per the fetch spec:
+ *   - `Headers` instance
+ *   - plain object { 'Authorization': '...' }
+ *   - array of [name, value] tuples
+ */
+export function hasAuthorizationHeader(headers) {
+  if (!headers) return false;
+
+  if (typeof Headers !== 'undefined' && headers instanceof Headers) {
+    return headers.has('authorization');
+  }
+
+  if (Array.isArray(headers)) {
+    return headers.some((entry) =>
+      Array.isArray(entry) && typeof entry[0] === 'string' &&
+      entry[0].toLowerCase() === 'authorization'
+    );
+  }
+
+  if (typeof headers === 'object') {
+    for (const key of Object.keys(headers)) {
+      if (key.toLowerCase() === 'authorization') return true;
+    }
+  }
+
+  return false;
+}
+
+/**
+ * Detect whether a `fetch(input, init)` call already carries an Authorization
+ * header anywhere — either on `init.headers` or on the input when it is a
+ * `Request` object.
+ */
+export function fetchCallHasAuthorization(input, init) {
+  if (hasAuthorizationHeader(init?.headers)) return true;
+  if (typeof Request !== 'undefined' && input instanceof Request) {
+    return hasAuthorizationHeader(input.headers);
+  }
+  return false;
+}
+
+/**
+ * Extract `{ url, method, body }` from a `fetch(input, init)` call so
+ * downstream signers (NIP-98) see the actual URL/method regardless of
+ * whether the caller used `fetch(url, init)` or `fetch(new Request(...))`.
+ *
+ * Per the fetch spec, when input is a Request and init supplies a method,
+ * init's method wins. Body is read from init when provided; we do not read
+ * from Request.body here because that consumes the stream — callers that
+ * need body-hashing for Request inputs should clone before signing.
+ */
+export function normalizeFetchCall(input, init) {
+  if (typeof Request !== 'undefined' && input instanceof Request) {
+    return {
+      url: input.url,
+      method: init?.method || input.method || 'GET',
+      body: init?.body
+    };
+  }
+  return {
+    url: typeof input === 'string' ? input : String(input),
+    method: init?.method || 'GET',
+    body: init?.body
+  };
+}
+
+/**
+ * Set an Authorization header on `options.headers`, normalizing any of the
+ * three supported shapes so the assignment actually takes effect:
+ *   - `Headers` instance → `.set('Authorization', value)`
+ *   - plain object       → `headers.Authorization = value`
+ *   - array of tuples    → normalized to `Headers` (so the array shape
+ *                          doesn't silently swallow the injection)
+ * Mutates `options` in place and returns the updated headers for clarity.
+ */
+export function setAuthorizationOnOptions(options, value) {
+  options.headers = options.headers || {};
+  if (typeof Headers !== 'undefined' && options.headers instanceof Headers) {
+    options.headers.set('Authorization', value);
+  } else if (Array.isArray(options.headers)) {
+    // Assigning an 'Authorization' property to an array would not add a
+    // header, so normalize to `Headers` first.
+    const normalized = new Headers(options.headers);
+    normalized.set('Authorization', value);
+    options.headers = normalized;
+  } else {
+    // Delete any existing case-insensitive match before setting the new
+    // value; otherwise fetch may see both keys and merge them into a
+    // "DPoP …, Nostr …" comma-joined header.
+    for (const key of Object.keys(options.headers)) {
+      if (key.toLowerCase() === 'authorization') delete options.headers[key];
+    }
+    options.headers['Authorization'] = value;
+  }
+  return options.headers;
+}

src/injected.js

@@ -12,6 +12,70 @@
   const originalFetch = window.fetch;
   const originalXHROpen = XMLHttpRequest.prototype.open;
   const originalXHRSend = XMLHttpRequest.prototype.send;
+  const originalXHRSetRequestHeader = XMLHttpRequest.prototype.setRequestHeader;
+
+  // Duplicate of src/auth-header-utils.js — keep in sync. The canonical
+  // module is imported by unit tests; this copy runs in content-script
+  // context where classic scripts can't use ESM imports. Build-time
+  // bundling to drop the duplication is tracked in #7.
+  function hasAuthorizationHeader (headers) {
+    if (!headers) return false;
+    if (typeof Headers !== 'undefined' && headers instanceof Headers) {
+      return headers.has('authorization');
+    }
+    if (Array.isArray(headers)) {
+      return headers.some((entry) =>
+        Array.isArray(entry) && typeof entry[0] === 'string' &&
+        entry[0].toLowerCase() === 'authorization'
+      );
+    }
+    if (typeof headers === 'object') {
+      for (const key of Object.keys(headers)) {
+        if (key.toLowerCase() === 'authorization') return true;
+      }
+    }
+    return false;
+  }
+
+  function fetchCallHasAuthorization (input, init) {
+    if (hasAuthorizationHeader(init?.headers)) return true;
+    if (typeof Request !== 'undefined' && input instanceof Request) {
+      return hasAuthorizationHeader(input.headers);
+    }
+    return false;
+  }
+
+  function setAuthorizationOnOptions (options, value) {
+    options.headers = options.headers || {};
+    if (typeof Headers !== 'undefined' && options.headers instanceof Headers) {
+      options.headers.set('Authorization', value);
+    } else if (Array.isArray(options.headers)) {
+      const normalized = new Headers(options.headers);
+      normalized.set('Authorization', value);
+      options.headers = normalized;
+    } else {
+      for (const key of Object.keys(options.headers)) {
+        if (key.toLowerCase() === 'authorization') delete options.headers[key];
+      }
+      options.headers['Authorization'] = value;
+    }
+    return options.headers;
+  }
+
+  function normalizeFetchCall (input, init) {
+    if (typeof Request !== 'undefined' && input instanceof Request) {
+      return {
+        url: input.url,
+        method: init?.method || input.method || 'GET',
+        body: init?.body
+      };
+    }
+    return {
+      url: typeof input === 'string' ? input : String(input),
+      method: init?.method || 'GET',
+      body: init?.body
+    };
+  }
 
   // Helper to get auth header (will be async, but we'll handle that)
   let getAuthHeaderFn = null;
@@ -24,26 +88,28 @@
   // Intercept fetch - MUST replace immediately to catch all calls
   // This runs synchronously, so it catches fetch even if called immediately
   window.fetch = function (url, options = {}) {
-    const urlString = typeof url === 'string' ? url : url.toString();
-    const method = options?.method || 'GET';
+    // Normalize once — handles fetch(url, init) and fetch(new Request(...))
+    // so downstream signing sees the real URL/method, not "[object Request]".
+    const { url: urlString, method, body } = normalizeFetchCall(url, options);
     console.log('[Podkey] 🔍 fetch() intercepted:', urlString, method);
 
+    // Respect an Authorization header the page already set — on either
+    // options.headers or a Request input (e.g. Solid-OIDC DPoP). Overwriting
+    // would re-identify the request as Podkey's NIP-98 and break the page's
+    // own auth. If it fails with 401, the retry path below still injects
+    // NIP-98. See issue #5.
+    const pageSetAuth = fetchCallHasAuthorization(url, options);
+
     // If we have the auth function, use it
-    if (authFunctionReady && getAuthHeaderFn) {
+    if (getAuthHeaderFn && !pageSetAuth) {
       console.log('[Podkey] ✅ Auth function ready, adding header...');
       const promise = (async () => {
         try {
-          const authHeader = await getAuthHeaderFn(url, options.method || 'GET', options.body);
+          const authHeader = await getAuthHeaderFn(urlString, method, body);
           if (authHeader) {
             options = options || {};
-            options.headers = options.headers || {};
-            if (options.headers instanceof Headers) {
-              options.headers.set('Authorization', authHeader);
-              console.log('[Podkey] ✅ Added NIP-98 auth header (Headers)');
-            } else {
-              options.headers['Authorization'] = authHeader;
-              console.log('[Podkey] ✅ Added NIP-98 auth header (object)');
-            }
+            setAuthorizationOnOptions(options, authHeader);
+            console.log('[Podkey] ✅ Added NIP-98 auth header');
           } else {
             console.log('[Podkey] ⚠️ No auth header returned (will retry on 401)');
           }
@@ -59,15 +125,10 @@
           console.log('[Podkey] 🔄 401 detected, retrying with auth...');
           return (async () => {
             try {
-              const authHeader = await getAuthHeaderFn(url, options.method || 'GET', options.body);
+              const authHeader = await getAuthHeaderFn(urlString, method, body);
               if (authHeader) {
                 const retryOptions = { ...options };
-                retryOptions.headers = retryOptions.headers || {};
-                if (retryOptions.headers instanceof Headers) {
-                  retryOptions.headers.set('Authorization', authHeader);
-                } else {
-                  retryOptions.headers['Authorization'] = authHeader;
-                }
+                setAuthorizationOnOptions(retryOptions, authHeader);
                 console.log('[Podkey] 🔄 Retrying with NIP-98 auth...');
                 const retryResponse = await originalFetch.call(this, url, retryOptions);
                 if (retryResponse.status === 200 || retryResponse.status === 201) {
@@ -87,35 +148,55 @@
       });
     }
 
-    // Fallback if auth function not ready yet - but still try to get auth
-    console.log('[Podkey] ⚠️ Auth function not ready yet, making request...');
+    // Fall-through branch: we're here because either the page set its own
+    // Authorization (and we deliberately skipped initial injection) or the
+    // auth function isn't wired up yet. Send the request as-is; on 401,
+    // retry with NIP-98 — either immediately if ready, or after waiting
+    // for setup (with a hard deadline so we don't hang forever).
+    if (pageSetAuth) {
+      console.log('[Podkey] ⏭️ Page already set Authorization — skipping initial injection');
+    } else {
+      console.log('[Podkey] ⚠️ Auth function not ready yet, making request...');
+    }
 
-    // Even if not ready, try to get auth header asynchronously and retry on 401
     const requestPromise = originalFetch.call(this, url, options);
 
+    const AUTH_READY_DEADLINE_MS = 5000;
+
     // If we get a 401 and auth becomes available, retry
     return requestPromise.then(response => {
       if (response.status === 401) {
         console.log('[Podkey] 🔄 Got 401, checking if auth function is ready now...');
-        // Wait a bit for auth function to be ready, then retry
+        // Wait for auth function to be ready, bounded by deadline. Every
+        // async step below has an error handler so the outer promise is
+        // guaranteed to settle (otherwise the caller would hang).
         return new Promise((resolve) => {
+          const deadline = Date.now() + AUTH_READY_DEADLINE_MS;
           const checkAuth = () => {
-            if (authFunctionReady && getAuthHeaderFn) {
+            if (getAuthHeaderFn) {
               console.log('[Podkey] 🔄 Auth function now ready, retrying with NIP-98...');
-              getAuthHeaderFn(url, method, options?.body).then(authHeader => {
-                if (authHeader) {
-                  const retryOptions = { ...options };
-                  retryOptions.headers = retryOptions.headers || {};
-                  if (retryOptions.headers instanceof Headers) {
-                    retryOptions.headers.set('Authorization', authHeader);
+              getAuthHeaderFn(urlString, method, body)
+                .then(authHeader => {
+                  if (authHeader) {
+                    const retryOptions = { ...options };
+                    setAuthorizationOnOptions(retryOptions, authHeader);
+                    originalFetch.call(this, url, retryOptions)
+                      .then(resolve)
+                      .catch(err => {
+                        console.error('[Podkey] Retry fetch failed:', err);
+                        resolve(response);
+                      });
                   } else {
-                    retryOptions.headers['Authorization'] = authHeader;
+                    resolve(response);
                   }
-                  originalFetch.call(this, url, retryOptions).then(resolve);
-                } else {
+                })
+                .catch(err => {
+                  console.error('[Podkey] Error getting auth header for retry:', err);
                   resolve(response);
-                }
-              });
+                });
+            } else if (Date.now() >= deadline) {
+              console.log('[Podkey] ⚠️ Auth function still not ready after deadline, giving up');
+              resolve(response);
             } else {
               // Check again in 100ms
               setTimeout(checkAuth, 100);
@@ -132,23 +213,38 @@
   XMLHttpRequest.prototype.open = function (method, url, ...args) {
     this._podkeyMethod = method;
     this._podkeyUrl = url;
+    this._podkeyHasPageAuth = false;
     return originalXHROpen.apply(this, [method, url, ...args]);
   };
 
+  // Track a page-set Authorization on XHR so send() can respect it.
+  XMLHttpRequest.prototype.setRequestHeader = function (name, value) {
+    if (typeof name === 'string' && name.toLowerCase() === 'authorization') {
+      this._podkeyHasPageAuth = true;
+    }
+    return originalXHRSetRequestHeader.apply(this, arguments);
+  };
+
   XMLHttpRequest.prototype.send = function (body) {
-    if (getAuthHeaderFn && this._podkeyUrl) {
-      (async () => {
-        try {
-          const authHeader = await getAuthHeaderFn(this._podkeyUrl, this._podkeyMethod, body);
+    // setRequestHeader must run before send(); defer originalXHRSend until
+    // the header is applied (or skipped), else the async setRequestHeader
+    // would fire after the request is already in-flight and throw
+    // InvalidStateError.
+    const runSend = () => originalXHRSend.apply(this, [body]);
+    if (getAuthHeaderFn && this._podkeyUrl && !this._podkeyHasPageAuth) {
+      getAuthHeaderFn(this._podkeyUrl, this._podkeyMethod, body)
+        .then(authHeader => {
           if (authHeader) {
-            this.setRequestHeader('Authorization', authHeader);
+            originalXHRSetRequestHeader.call(this, 'Authorization', authHeader);
           }
-        } catch (e) {
+        })
+        .catch(e => {
           console.error('[Podkey] Error in XHR interceptor:', e);
-        }
-      })();
+        })
+        .finally(runSend);
+    } else {
+      runSend();
     }
-    return originalXHRSend.apply(this, [body]);
   };
 
   // Expose setter for the auth function