| … | … | @@ -175,7 +175,7 @@ class Contacts { |
| 175 | 175 | } |
| 176 | 176 | |
| 177 | 177 | /** |
| 178 | * Parse a `pear://contact?pk=<hex>&name=<url-encoded>&sig=<hex>` URL | |
| 178 | * Parse a `p2p-contact://invite?pk=<hex>&name=<url-encoded>&sig=<hex>` URL | |
| 179 | 179 | * into a contact record. `sig` is optional (ed25519 signature over |
| 180 | 180 | * `pear.contact:<pubkey>:<displayName>` by the contact's root key — |
| 181 | 181 | * proves the QR wasn't tampered with). If sig is present + invalid |
| … | … | @@ -184,8 +184,7 @@ class Contacts { |
| 184 | 184 | static parseInviteURL (url) { |
| 185 | 185 | try { |
| 186 | 186 | const u = new URL(url) |
| 187 | if (u.protocol !== 'pear:') return null | |
| 188 | if (u.hostname !== 'contact' && u.pathname.replace('//', '') !== 'contact') return null | |
| 187 | if (u.protocol !== 'p2p-contact:' || u.hostname !== 'invite') return null | |
| 189 | 188 | const pk = u.searchParams.get('pk') |
| 190 | 189 | const name = u.searchParams.get('name') || '' |
| 191 | 190 | const sig = u.searchParams.get('sig') |
| … | … | @@ -1951,7 +1951,7 @@ rpc.handle(C.CMD_CONTACTS_MY_INVITE, async () => { |
| 1951 | 1951 | const bindingKey = b4a.toString(id.getAppKeypair('lighthouse-binding').publicKey, 'hex') |
| 1952 | 1952 | // sign name AND binding key, so neither can be swapped in transit (add() binds both) |
| 1953 | 1953 | const sig = id.sign(`pear.contact:${rootHex}:${displayName}:${bindingKey}`).signature |
| 1954 | const url = `pear://contact?pk=${rootHex}&name=${encodeURIComponent(displayName)}&sig=${sig}&bk=${bindingKey}` | |
| 1954 | const url = `p2p-contact://invite?pk=${rootHex}&name=${encodeURIComponent(displayName)}&sig=${sig}&bk=${bindingKey}` | |
| 1955 | 1955 | return { url, pubkey: rootHex, displayName, bindingKey } |
| 1956 | 1956 | }) |
| 1957 | 1957 |
| … | … | @@ -201,7 +201,7 @@ test('a full signed invite URL (pk+name+sig+bk) round-trips through parse + add, |
| 201 | 201 | const { pubHex, sk } = newKeypair() |
| 202 | 202 | const bindingKey = 'ef'.repeat(32) |
| 203 | 203 | const sig = signMsg(inviteMessageBk(pubHex, 'Carol', bindingKey), sk) |
| 204 | const url = `pear://contact?pk=${pubHex}&name=${encodeURIComponent('Carol')}&sig=${sig}&bk=${bindingKey}` | |
| 204 | const url = `p2p-contact://invite?pk=${pubHex}&name=${encodeURIComponent('Carol')}&sig=${sig}&bk=${bindingKey}` | |
| 205 | 205 | const parsed = Contacts.parseInviteURL(url) |
| 206 | 206 | assert.equal(parsed.bindingKey, bindingKey) |
| 207 | 207 | const rec = await contacts.add(parsed) |
| … | … | @@ -216,7 +216,7 @@ test('a signed invite with a tampered name is rejected at add (invite integrity) |
| 216 | 216 | const { pubHex, sk } = newKeypair() |
| 217 | 217 | const bindingKey = 'ef'.repeat(32) |
| 218 | 218 | const sig = signMsg(inviteMessageBk(pubHex, 'Carol', bindingKey), sk) // signed for "Carol" |
| 219 | const url = `pear://contact?pk=${pubHex}&name=Mallory&sig=${sig}&bk=${bindingKey}` | |
| 219 | const url = `p2p-contact://invite?pk=${pubHex}&name=Mallory&sig=${sig}&bk=${bindingKey}` | |
| 220 | 220 | await assert.rejects(() => contacts.add(Contacts.parseInviteURL(url)), /signature invalid/) |
| 221 | 221 | }) |
| 222 | 222 | }) |
| … | … | @@ -227,7 +227,7 @@ test('a swapped binding key is rejected at add (bk is bound by the signature)', |
| 227 | 227 | const realBk = 'ef'.repeat(32) |
| 228 | 228 | const attackerBk = 'ab'.repeat(32) |
| 229 | 229 | const sig = signMsg(inviteMessageBk(pubHex, 'Carol', realBk), sk) // signed for realBk |
| 230 | const url = `pear://contact?pk=${pubHex}&name=Carol&sig=${sig}&bk=${attackerBk}` // bk swapped | |
| 230 | const url = `p2p-contact://invite?pk=${pubHex}&name=Carol&sig=${sig}&bk=${attackerBk}` // bk swapped | |
| 231 | 231 | await assert.rejects(() => contacts.add(Contacts.parseInviteURL(url)), /signature invalid/) |
| 232 | 232 | }) |
| 233 | 233 | }) |
| … | … | @@ -3722,7 +3722,7 @@ function TrustedPeers ({ rpc, C }) { |
| 3722 | 3722 | <div className="tp-field"> |
| 3723 | 3723 | <label>Add a peer</label> |
| 3724 | 3724 | <div className="tp-row"> |
| 3725 | <input className="profile-input" placeholder="Paste a pear://contact invite…" value=${addUrl} | |
| 3725 | <input className="profile-input" placeholder="Paste a p2p-contact://invite…" value=${addUrl} | |
| 3726 | 3726 | onInput=${(e) => setAddUrl(e.target.value)} onKeyDown=${(e) => e.key === 'Enter' && add()} /> |
| 3727 | 3727 | <button className="btn small primary" onClick=${add} disabled=${!addUrl.trim()}>Add</button> |
| 3728 | 3728 | </div> |