Fix: Remove blocking webRequest listeners (Manifest V3 incompatible)

- Remove blocking webRequest listeners that require webRequestBlocking permission
- Implement JavaScript-level interception via fetch/XMLHttpRequest patching
- Add CREATE_NIP98_AUTH_HEADER message handler
- Intercept fetch and XMLHttpRequest in content script
- Handle 401 responses with automatic retry

Fixes Chrome extension error about webRequestBlocking permission

Author: melvincarvalho

src/background.js

@@ -83,6 +83,13 @@ async function handleMessage (message, sender) {
     case 'NIP04_DECRYPT':
       throw new Error('NIP-04 encryption not yet implemented');
 
+    case 'CREATE_NIP98_AUTH_HEADER':
+      return await createNip98AuthHeader(
+        message.url,
+        message.method,
+        message.body
+      );
+
     default:
       throw new Error(`Unknown message type: ${type}`);
   }
@@ -297,62 +304,6 @@ function formatEventForPrompt (event) {
   return lines.join('\n');
 }
 
-/**
- * Create NIP-98 authentication event for an HTTP request
- * @param {object} requestDetails - Chrome webRequest details
- * @returns {Promise<object>} Unsigned NIP-98 event
- */
-async function createNip98AuthEvent (requestDetails) {
-  const event = {
-    kind: 27235,
-    content: '',
-    created_at: Math.floor(Date.now() / 1000),
-    tags: [
-      ['u', requestDetails.url], // Full URL including query params
-      ['method', requestDetails.method]
-    ]
-  };
-
-  // If request has body, add payload tag with SHA-256 hash
-  if (requestDetails.requestBody) {
-    const bodyHash = await hashRequestBody(requestDetails.requestBody);
-    event.tags.push(['payload', bodyHash]);
-  }
-
-  return event;
-}
-
-/**
- * Hash request body for NIP-98 payload tag
- * @param {object} requestBody - Chrome webRequest requestBody
- * @returns {Promise<string>} SHA-256 hash as hex string
- */
-async function hashRequestBody (requestBody) {
-  let bodyBytes;
-
-  if (requestBody.raw) {
-    // ArrayBuffer[] format from Chrome
-    const chunks = requestBody.raw;
-    const totalLength = chunks.reduce((sum, chunk) => sum + chunk.bytes.byteLength, 0);
-    const combined = new Uint8Array(totalLength);
-    let offset = 0;
-    for (const chunk of chunks) {
-      combined.set(new Uint8Array(chunk.bytes), offset);
-      offset += chunk.bytes.byteLength;
-    }
-    bodyBytes = combined;
-  } else if (requestBody.formData) {
-    // FormData - convert to string representation
-    const formDataStr = JSON.stringify(requestBody.formData);
-    bodyBytes = new TextEncoder().encode(formDataStr);
-  } else {
-    // Fallback: treat as empty
-    bodyBytes = new Uint8Array(0);
-  }
-
-  const hash = sha256(bodyBytes);
-  return bytesToHex(hash);
-}
 
 /**
  * Encode signed event to Authorization header value
@@ -365,185 +316,85 @@ function encodeNip98Header (signedEvent) {
   return btoa(eventJson);
 }
 
-/**
- * Check if request should have NIP-98 auth added
- * @param {object} requestDetails - Chrome webRequest details
- * @returns {Promise<boolean>}
- */
-async function shouldAddNip98Auth (requestDetails) {
-  // Check if keypair exists
-  const keyExists = await hasKeypair();
-  if (!keyExists) {
-    return false;
-  }
-
-  // Check if origin is trusted
-  const origin = new URL(requestDetails.url).origin;
-  const trusted = await isTrustedOrigin(origin);
-  if (!trusted) {
-    return false;
-  }
-
-  // Check if auto-sign is enabled
-  const autoSign = await getAutoSign();
-  if (!autoSign) {
-    return false;
-  }
-
-  // Don't add auth if request already has Authorization header (unless it's a retry)
-  const hasAuth = requestDetails.requestHeaders?.some(
-    h => h.name.toLowerCase() === 'authorization'
-  );
-  if (hasAuth && !retryState.has(requestDetails.requestId)) {
-    return false;
-  }
-
-  return true;
-}
 
 /**
- * Intercept requests and add NIP-98 auth if needed
- * @param {object} details - Chrome webRequest details
- * @returns {object|undefined} Modified request headers or undefined
+ * Create NIP-98 auth header for a request (called from content script)
+ * @param {string} url - Request URL
+ * @param {string} method - HTTP method
+ * @param {string|ArrayBuffer|Blob|null} body - Request body
+ * @returns {Promise<string>} Authorization header value
  */
-async function interceptRequest (details) {
+async function createNip98AuthHeader (url, method, body = null) {
   try {
-    // Only process XMLHttpRequest and fetch requests
-    if (!['xmlhttprequest', 'main_frame', 'sub_frame'].includes(details.type)) {
-      return;
+    // Check if we should add auth
+    const origin = new URL(url).origin;
+    const trusted = await isTrustedOrigin(origin);
+    const autoSign = await getAutoSign();
+    const keyExists = await hasKeypair();
+
+    if (!keyExists || !trusted || !autoSign) {
+      return null;
     }
 
-    const shouldAuth = await shouldAddNip98Auth(details);
-    if (!shouldAuth) {
-      return;
+    // Hash body if present
+    let bodyHash = '';
+    if (body) {
+      if (typeof body === 'string') {
+        bodyHash = bytesToHex(sha256(new TextEncoder().encode(body)));
+      } else if (body instanceof ArrayBuffer) {
+        bodyHash = bytesToHex(sha256(new Uint8Array(body)));
+      } else if (body instanceof Blob) {
+        const arrayBuffer = await body.arrayBuffer();
+        bodyHash = bytesToHex(sha256(new Uint8Array(arrayBuffer)));
+      }
     }
 
-    // Check cache first
-    const bodyHash = details.requestBody ? await hashRequestBody(details.requestBody) : '';
-    const cacheKey = `${details.url}:${details.method}:${bodyHash}`;
+    // Check cache
+    const cacheKey = `${url}:${method}:${bodyHash}`;
     const cached = nip98Cache.get(cacheKey);
 
     let signedEvent;
     if (cached && cached.expires > Date.now()) {
-      // Use cached event
       signedEvent = cached.event;
       console.log('[Podkey] Using cached NIP-98 auth event');
     } else {
-      // Create and sign new event
-      const event = await createNip98AuthEvent(details);
+      // Create and sign event
+      const event = {
+        kind: 27235,
+        content: '',
+        created_at: Math.floor(Date.now() / 1000),
+        tags: [
+          ['u', url],
+          ['method', method]
+        ]
+      };
+
+      if (bodyHash) {
+        event.tags.push(['payload', bodyHash]);
+      }
+
       const keypair = await getKeypair();
       signedEvent = await signEvent(event, keypair.privateKey);
 
-      // Cache the signed event
+      // Cache
       nip98Cache.set(cacheKey, {
         event: signedEvent,
         expires: Date.now() + CACHE_TTL
       });
 
-      console.log('[Podkey] Created and signed NIP-98 auth event for', details.url);
+      console.log('[Podkey] Created and signed NIP-98 auth event for', url);
     }
 
-    // Encode to Authorization header
-    const authHeader = encodeNip98Header(signedEvent);
-
-    // Add or replace Authorization header
-    const headers = details.requestHeaders || [];
-    const authIndex = headers.findIndex(h => h.name.toLowerCase() === 'authorization');
-
-    if (authIndex >= 0) {
-      headers[authIndex].value = `Nostr ${authHeader}`;
-    } else {
-      headers.push({
-        name: 'Authorization',
-        value: `Nostr ${authHeader}`
-      });
-    }
-
-    return { requestHeaders: headers };
+    return `Nostr ${encodeNip98Header(signedEvent)}`;
   } catch (error) {
-    console.error('[Podkey] Error intercepting request:', error);
-    // Don't block the request if auth fails
-    return;
+    console.error('[Podkey] Error creating NIP-98 auth header:', error);
+    return null;
   }
 }
 
-/**
- * Handle 401 response - create auth and retry
- * @param {object} details - Chrome webRequest details
- * @returns {object|undefined} Modified response or undefined
- */
-async function handle401Response (details) {
-  // Only retry on 401 Unauthorized
-  if (details.statusCode !== 401) {
-    return;
-  }
-
-  // Prevent infinite retry loops
-  if (retryState.has(details.requestId)) {
-    console.log('[Podkey] Already retried this request, skipping');
-    return;
-  }
-
-  try {
-    // Check if we should auto-auth this origin
-    const origin = new URL(details.url).origin;
-    const trusted = await isTrustedOrigin(origin);
-    const autoSign = await getAutoSign();
-
-    if (!trusted || !autoSign) {
-      console.log('[Podkey] Origin not trusted or auto-sign disabled, not retrying');
-      return;
-    }
-
-    // Mark as retrying
-    retryState.set(details.requestId, true);
-
-    // Create NIP-98 auth event
-    const event = await createNip98AuthEvent({
-      url: details.url,
-      method: details.method,
-      requestBody: details.requestBody
-    });
-
-    const keypair = await getKeypair();
-    const signedEvent = await signEvent(event, keypair.privateKey);
-    const authHeader = encodeNip98Header(signedEvent);
-
-    console.log('[Podkey] 401 detected, created NIP-98 auth for retry:', details.url);
-
-    // Retry the request with auth header
-    // Note: Chrome webRequest API doesn't support retrying directly
-    // The page/script needs to retry, but we can log the auth header
-    // For now, we'll rely on the onBeforeSendHeaders interceptor for the retry
-    // This is a limitation - we'd need to use fetch() API to actually retry
-
-    // Clean up retry state after a delay
-    setTimeout(() => {
-      retryState.delete(details.requestId);
-    }, 5000);
-  } catch (error) {
-    console.error('[Podkey] Error handling 401 response:', error);
-    retryState.delete(details.requestId);
-  }
-}
+// Note: Blocking webRequest listeners require webRequestBlocking permission,
+// which is deprecated in Manifest V3 and only available for enterprise extensions.
+// Instead, we use JavaScript-level interception via content scripts.
+// See src/injected.js for fetch/XMLHttpRequest interception.
 
-// Set up webRequest listeners for NIP-98 auto-auth
-chrome.webRequest.onBeforeSendHeaders.addListener(
-  interceptRequest,
-  {
-    urls: ['<all_urls>'],
-    types: ['xmlhttprequest', 'main_frame', 'sub_frame']
-  },
-  ['requestHeaders', 'blocking']
-);
-
-chrome.webRequest.onHeadersReceived.addListener(
-  handle401Response,
-  {
-    urls: ['<all_urls>'],
-    types: ['xmlhttprequest', 'main_frame', 'sub_frame']
-  },
-  ['responseHeaders']
-);
-
-console.log('[Podkey] NIP-98 auto-auth listeners registered');
+console.log('[Podkey] NIP-98 auto-auth: Using JavaScript-level interception (see injected.js)');