Bind DECISION_MADE messages to the originating popup, tab, and frame

[knytcomics-ui]

Category

Intermediate

Summary

Ensure only the review popup created for a pending request can resolve that request.

Current Behavior

background.ts stores resolvers by request ID and ignores sender metadata from chrome.runtime.onMessage. The popup sends only the request ID and decision.

Problem

A stale or unauthorized extension page with a known request ID could submit a decision for another pending request.

Why This Matters

Decision binding is central to the integrity of the warning shown to the user.

Proposed Scope

Record popup window and originating tab/frame metadata, validate sender ownership, enforce one-shot decisions, and reject stale or mismatched messages.

Acceptance Criteria

• The expected popup resolves the matching request.
• Unrelated tabs, frames, or extension pages are ignored.
• Duplicate decisions are idempotent.
• Stale IDs cannot affect newer requests.
• Browser tests cover valid and mismatched senders.

Technical Considerations

Relevant modules: src/background/background.ts, src/popup/App.tsx, and src/intercept/protocol.ts.

Testing Requirements

Test valid metadata, wrong window IDs, wrong tabs/frames, duplicate decisions, and stale requests.

Cross-Repository Impact

None identified.

Out of Scope

Redesigning page-visible postMessage authentication or MV3 worker persistence.

Complexity

Intermediate — spans popup creation, sender metadata, pending state, and browser tests.

Impact

Critical — protects the user’s actual decision.

Suggested Labels

intermediate, security, architecture

[Hollujay]

I would like to work on this issue because I will get it done @knytcomics-ui