Repository navigation
fix(auth): never sign as a conflicting source when the pin is missing - #3094
Draft
aristidesstaffieri wants to merge 1 commit into
Draft
aristidesstaffieri wants to merge 1 commit into
aristidesstaffieri wants to merge 1 commit into
Conversation
Contributor
|
PR Preview build is ready: https://github.com/stellar/freighter/releases/tag/untagged-d46934ab57f8ae4cdd0b |
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues were identified for the fallback signer-selection change.
No open issues 🎉
What changed in this PR
This PR makes Freighter’s background authentication fallback safer when the pinned signing source is unavailable, preventing fallback requests from signing as a source marked as belonging to another user.
Changes:
- Prefer held sources marked
linked, then sources without a recorded status, preserving phrase-first ordering within each tier. - Return
nullwhen every held source is markedconflict, without changing the pin. - Add tests for fallback selection, all-conflict behavior, and a held pin without a recorded status.
| File | Description |
|---|---|
extension/src/background/helpers/signing-identity.ts |
Rank fallback signers by link status and exclude conflicting sources. |
extension/src/background/helpers/__tests__/signing-identity.test.ts |
Test fallback priorities, conflict exclusion, and held-pin behavior. |
Review effort: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
When the pinned source isn't held,
getSigningIdentitynow picks the fallback signer by link status: a held source the server listed aslinked, then one it hasn't answered for yet, with phrases first in each tier. It never signs with a source the server reported as aconflict, and if only those are held it returnsnullso requests go out anonymously. It still never writes the pin. New tests cover each tier, the all-conflict case, and a held pin that has no status.Why
The fallback signed with the first held source. If the server had marked that source as another user's, every request would resolve to that user and the analytics reconcile from stellar/freighter-private#69 would cache their canonical id. The link status map from stellar/freighter-private#68 already records which sources are in this wallet's cluster, so the fallback can rank by it without another request. This covers the conflict half of the re-pin that stellar/freighter-private#66 asked for. Today the pinned source goes missing only when it fails to derive at unlock, since recovery wipes the wallet and nothing removes accounts.
Screenshots / video
N/A, background only.
Checklist