88 lines
2.8 KiB
Markdown
88 lines
2.8 KiB
Markdown
# nsigner Browser Extension — NIP-07 frontend over nsigner
|
|
|
|
> **Project:** subtree of `n_signer` at `browser-extension/` (may spin out later).
|
|
>
|
|
> **Status:** Planning. This document describes a WebExtension that exposes [NIP-07](https://github.com/nostr-protocol/nips/blob/master/07.md) `window.nostr` and forwards calls to a running `nsigner` instance.
|
|
>
|
|
> **Authoritative signer behavior:** [`../README.md`](../README.md)
|
|
|
|
## 1. What this is
|
|
|
|
A Chrome/Firefox/Brave WebExtension (Manifest V3) that:
|
|
|
|
1. injects a standard NIP-07-compatible `window.nostr` surface
|
|
2. forwards each call to `nsigner` over native-messaging, TLS, or relay fallback transport
|
|
3. applies per-origin permission policy and per-origin role pinning
|
|
|
|
The extension is not a wallet and holds no private keys.
|
|
|
|
## 2. Important compatibility note with multi-purpose roles
|
|
|
|
`nsigner` role entries now carry explicit purpose/curve metadata (see [`../README.md`](../README.md)).
|
|
For browser NIP-07 operations, the extension must request only roles whose purpose resolves to `nostr`.
|
|
If a role is configured for another purpose (e.g. bitcoin/ssh/age), extension UI must hide or reject it for NIP-07 signing/encryption calls instead of forwarding an invalid request.
|
|
|
|
## 3. Architecture (unchanged high level)
|
|
|
|
- page -> content script -> service worker
|
|
- service worker -> chosen transport -> `nsigner`
|
|
- policy and user prompts in extension UI
|
|
|
|
## 4. NIP-07 surface mapping
|
|
|
|
Standard NIP-07 calls map to `nsigner` request verbs:
|
|
|
|
- `getPublicKey`
|
|
- `signEvent`
|
|
- `nip04.encrypt` / `nip04.decrypt`
|
|
- `nip44.encrypt` / `nip44.decrypt`
|
|
|
|
The extension attaches role selector options when needed, but role choices must remain purpose-compatible with Nostr operations.
|
|
|
|
## 5. Transport options
|
|
|
|
1. Native messaging bridge (primary)
|
|
2. TLS to local/nearby `nsigner`
|
|
3. Relay-based fallback
|
|
|
|
## 6. Permission model
|
|
|
|
Per-origin policy remains the control point:
|
|
|
|
- allow/deny by verb/kind/origin
|
|
- origin-level role pinning
|
|
- explicit prompts for sensitive operations
|
|
|
|
## 7. Security constraints
|
|
|
|
- no private key/mnemonic persistence in extension storage
|
|
- no plaintext decrypt cache
|
|
- strong defaults for decrypt operations
|
|
- role purpose compatibility checks before forwarding signer requests
|
|
|
|
## 8. Implementation phases (extension-specific)
|
|
|
|
1. native helper
|
|
2. MVP extension with native path
|
|
3. role-aware UI
|
|
4. TLS transport
|
|
5. management/audit UX
|
|
6. relay fallback transport
|
|
7. browser polish and release
|
|
|
|
## 9. Repo location
|
|
|
|
Planned extension subtree remains:
|
|
|
|
- `browser-extension/extension/`
|
|
- `browser-extension/native-bridge/`
|
|
- `browser-extension/install/`
|
|
- `browser-extension/tests/`
|
|
|
|
## 10. Open questions
|
|
|
|
- extension coexistence with other NIP-07 providers
|
|
- multi-profile signer selection UX
|
|
- mobile constraints without native messaging
|
|
- hardware-token pending-confirmation UX in popup
|