fix(security): harden authentication and secret handling

- Keep Memos credentials inside the background worker and fail closed when account verification is unavailable.
- Prevent OAuth session races, restrict image downloads, and clear session-derived caches on sign-out.
- Make store packaging reproducible and update browser support and reviewer documentation.

Author: johnnyjoygh

.github/workflows/ci.yml

@@ -27,3 +27,5 @@ jobs:
       - run: pnpm lint
       - run: pnpm test
       - run: pnpm build
+      - run: pnpm audit --prod
+      - run: node scripts/package.mjs firefox

README.md

@@ -1,6 +1,6 @@
 # Memos Web Clipper
 
-Save pages, selections, and images directly to your Memos instance. Available for Chrome and Firefox.
+Save pages, selections, and images directly to your Memos instance. Available for Chromium-based browsers and Firefox.
 
 ## Install
 
@@ -32,14 +32,6 @@ Browser-owned pages, such as extension stores and internal browser URLs, may blo
 
 ## Browser support
 
-- Google Chrome
+- Chromium-based browsers that support Chrome extensions, including Google Chrome, Microsoft Edge, Brave, and Arc
 - Mozilla Firefox 142 or later
 - Memos 0.26.0 or later in the 0.x series
-
-## Privacy
-
-Memos Web Clipper does not include analytics, advertising, or telemetry. It captures page content only after you open the extension or use its context-menu action.
-
-The extension communicates with usememos.com for sign-in and with your Memos instance when saving a clip. OAuth session data, the clip template, visibility preference, and small connection caches are stored in browser-local extension storage. Signing out removes the local OAuth session.
-
-The extension requests page access to capture the active page, work with selections, reach self-hosted Memos instances, and download selected images from their original hosts.

docs/FIREFOX_REVIEW.md

@@ -9,7 +9,7 @@ This extension is written in TypeScript and bundled with Vite, so the matching s
 - pnpm 11.10.0 (the version pinned in `package.json`)
 - The system `zip` command
 
-The source archive contains a `.env` file with only the public OAuth client ID, issuer URL, and web app URL used for the submitted package. No OAuth client secret or server-side Clerk secret is included or needed.
+The source archive contains a `.env` file with only the public OAuth client ID, issuer URL, and web app URL used for the submitted package. No OAuth client secret or server-side Clerk secret is included or needed. It also contains `.memos-amo-source.json`, a generated marker identifying the package version and source commit; this lets the extracted reviewer archive build without a `.git` directory.
 
 ## Reproduce the submitted Firefox package
 
@@ -21,6 +21,8 @@ pnpm package:firefox
 
 The package to compare with the AMO upload is written to `artifacts/memos-web-clipper-firefox-v<version>.zip`. The packaging command also runs Mozilla's `web-ext lint` before creating the ZIP.
 
+When run from the reviewer archive, the command creates the Firefox binary only; it does not create another nested source archive. Publisher builds run from a clean Git checkout and additionally create `artifacts/memos-web-clipper-firefox-source-v<version>.zip`. A dirty publisher checkout is rejected before any store artifact is changed.
+
 ## Validator warnings
 
 `web-ext lint` currently reports two `UNSAFE_VAR_ASSIGNMENT` warnings in the generated

docs/OAUTH_SETUP.md

@@ -17,6 +17,12 @@ Create one OAuth application for the web clipper with these settings:
 unsafe metadata. The extension reads `unsafe_metadata.memos` from `/oauth/userinfo`; it never
 writes Clerk metadata. Connection changes remain on usememos.com.
 
+The complete userinfo response is background-only. Popup and Options messages receive only a
+display identity or sanitized connection diagnostics, never `unsafe_metadata` or the Memos access
+token. Local OAuth session V2 persists only the OAuth access/refresh token set and expiry; an
+existing V1 session is migrated without its cached userinfo. If live userinfo verification is
+unavailable, privileged writes fail closed instead of falling back to cached connection metadata.
+
 ## Redirect URIs
 
 Chromium redirect URIs use this shape:
@@ -60,7 +66,8 @@ required in the extension.
 2. Build/load each store variant and collect its exact redirect URI.
 3. Register all redirect URIs in Clerk.
 4. Set the public OAuth client ID in `.env`.
-5. Run `pnpm package` and test sign-in from all three packaged variants.
-6. Once the OAuth release is live, remove legacy extension URLs from Clerk `allowed_origins`.
+5. Commit the release source so the Git working tree is clean.
+6. Run `pnpm package` and test sign-in from all three packaged variants.
+7. Once the OAuth release is live, remove legacy extension URLs from Clerk `allowed_origins`.
 
 Keep the normal usememos.com web origins configured for the web app itself.

scripts/package.mjs

@@ -14,6 +14,7 @@ import { loadEnv } from "vite";
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const DIST = join(ROOT, "dist");
 const ARTIFACTS = join(ROOT, "artifacts");
+const REVIEW_SOURCE_MARKER = ".memos-amo-source.json";
 const FIREFOX_ADDON_ID = "web-clipper@usememos.com";
 // Firefox desktop gained built-in data consent in 140; Android gained it in 142.
 // `gecko.strict_min_version` covers both unless a separate Android manifest is used.
@@ -26,6 +27,31 @@ if (!VALID_TARGETS.has(requestedTarget)) {
 }
 
 const packageJson = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8"));
+
+const requireTrustedSourceTree = () => {
+  if (existsSync(join(ROOT, ".git"))) {
+    const status = execFileSync("git", ["status", "--porcelain", "--untracked-files=normal"], {
+      cwd: ROOT,
+      encoding: "utf8",
+    });
+    if (status.trim()) throw new Error("Refusing to package a dirty working tree. Commit or stash all tracked and untracked files first.");
+    return true;
+  }
+
+  const markerPath = join(ROOT, REVIEW_SOURCE_MARKER);
+  if (!existsSync(markerPath))
+    throw new Error("Packaging requires either a clean Git checkout or an official AMO reviewer source archive.");
+  const marker = JSON.parse(readFileSync(markerPath, "utf8"));
+  if (marker.format !== 1 || marker.version !== packageJson.version || !/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/.test(marker.commit)) {
+    throw new Error("The AMO reviewer source marker is invalid or does not match package.json.");
+  }
+  return false;
+};
+
+// Every store archive must correspond to one reproducible tracked source tree.
+// Official reviewer archives carry a generated marker because they intentionally omit .git.
+const isGitCheckout = requireTrustedSourceTree();
+
 const baseManifestPath = join(DIST, "manifest.json");
 if (!existsSync(baseManifestPath)) throw new Error("dist/manifest.json is missing; run `pnpm build` first.");
 
@@ -112,9 +138,9 @@ const packageFirefoxSource = () => {
   const sourcePath = join(ARTIFACTS, `memos-web-clipper-firefox-source-v${packageJson.version}.zip`);
 
   try {
-    // Include committed and non-ignored working-tree files so the archive matches the
-    // exact source used for this local build, while naturally excluding .env and output.
-    const files = execFileSync("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+    // Reviewer source is an exact tracked tree. Local and untracked files must never
+    // enter a store upload, even when they are not covered by .gitignore.
+    const files = execFileSync("git", ["ls-files", "-z", "--cached"], {
       cwd: ROOT,
       encoding: "utf8",
     })
@@ -133,6 +159,8 @@ const packageFirefoxSource = () => {
     // lets AMO reproduce the bundle without leaking CLERK_SECRET_KEY or other secrets.
     const viteEnv = publicViteEnvironment();
     if (viteEnv) writeFileSync(join(stage, ".env"), `# Public build-time values used for this submission.\n${viteEnv}\n`);
+    const commit = execFileSync("git", ["rev-parse", "HEAD"], { cwd: ROOT, encoding: "utf8" }).trim();
+    writeFileSync(join(stage, REVIEW_SOURCE_MARKER), `${JSON.stringify({ format: 1, version: packageJson.version, commit }, null, 2)}\n`);
 
     zipDirectory(stage, sourcePath);
   } finally {
@@ -157,7 +185,7 @@ const packageFirefox = () => {
     rmSync(stage, { recursive: true, force: true });
   }
 
-  return { firefoxPath, sourcePath: packageFirefoxSource() };
+  return { firefoxPath, sourcePath: isGitCheckout ? packageFirefoxSource() : null };
 };
 
 const created = [];
@@ -166,7 +194,8 @@ if (requestedTarget === "all" || requestedTarget === "chrome" || requestedTarget
 }
 if (requestedTarget === "all" || requestedTarget === "firefox") {
   const { firefoxPath, sourcePath } = packageFirefox();
-  created.push(firefoxPath, sourcePath);
+  created.push(firefoxPath);
+  if (sourcePath) created.push(sourcePath);
 }
 
 console.log("\nCreated store artifacts:");

src/__tests__/background.dom.test.ts

@@ -1,5 +1,7 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
+import { SAVE_ATTEMPTS_KEY } from "@/background/memo-save";
 import { VERSION_CACHE_KEY } from "@/lib/instance-version";
+import { POPUP_STATE_KEY } from "@/lib/popup-state";
 import { CLIP_TEMPLATE_KEY } from "@/lib/template-settings";
 import { browserMock, seedStorage } from "@/test/browser-mock";
 import { jsonResponse, testCreds } from "@/test/fixtures";
@@ -22,11 +24,23 @@ const oauthMocks = vi.hoisted(() => ({
   beginOAuthSignIn: vi.fn(async () => undefined),
   clearOAuthSession: vi.fn(async () => undefined),
   getOAuthUser: vi.fn(),
+  OAuthUnavailableError: class OAuthUnavailableError extends Error {
+    constructor() {
+      super("OAuth unavailable");
+      this.name = "OAuthUnavailableError";
+    }
+  },
 }));
 vi.mock("@/auth/oauth-session", () => ({
   beginOAuthSignIn: oauthMocks.beginOAuthSignIn,
   clearOAuthSession: oauthMocks.clearOAuthSession,
   getOAuthUser: oauthMocks.getOAuthUser,
+  OAuthUnavailableError: oauthMocks.OAuthUnavailableError,
+  toOAuthIdentity: (user: { id: string; displayName: string; imageUrl?: string }) => ({
+    id: user.id,
+    displayName: user.displayName,
+    ...(user.imageUrl ? { imageUrl: user.imageUrl } : {}),
+  }),
 }));
 
 const memos = (extra: Record<string, unknown> = {}) => ({
@@ -38,6 +52,7 @@ const ready = () => {
 };
 const expected = { expectedUserId: "user_123", expectedInstanceUrl: testCreds.instanceUrl };
 const popupSender = { id: "test-id", url: "chrome-extension://test-id/src/popup/index.html" };
+const optionsSender = { id: "test-id", url: "chrome-extension://test-id/src/options/index.html" };
 const emitRuntime = (message: unknown, sender = popupSender) => browserMock.runtime.onMessage.emitFirst(message, sender);
 
 // Import once: the module registers its listeners on the shared browser mock at load.
@@ -57,6 +72,12 @@ beforeEach(async () => {
   await import("@/background");
 });
 
+describe("background — storage isolation", () => {
+  it("restricts storage.local to trusted extension contexts", () => {
+    expect(browserMock.storage.local.setAccessLevel).toHaveBeenCalledWith({ accessLevel: "TRUSTED_CONTEXTS" });
+  });
+});
+
 describe("background — SAVE_MEMO message", () => {
   beforeEach(ready);
 
@@ -155,12 +176,98 @@ describe("background — SAVE_MEMO message", () => {
     vi.unstubAllGlobals();
   });
 
+  it("does not fetch an image from a private or loopback address", async () => {
+    const privateImage = "https://127.0.0.1/admin.png";
+    const mappedLoopbackImage = "https://[::ffff:127.0.0.1]/admin.png";
+    const fetchMock = vi.fn((url: unknown) => {
+      if (String(url).endsWith("/api/v1/memos")) return Promise.resolve(jsonResponse({ name: "memos/7", uid: "xy" }));
+      return Promise.resolve(new Response(null, { status: 404 }));
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    const result = await emitRuntime({
+      type: "SAVE_MEMO",
+      content: "hello",
+      visibility: "PRIVATE",
+      ...expected,
+      images: [privateImage, mappedLoopbackImage],
+    });
+
+    expect(result).toEqual({ ok: true, webUrl: "https://memos.example.com/memos/xy", failedImages: 2 });
+    expect(fetchMock.mock.calls.some(([url]) => [privateImage, mappedLoopbackImage].includes(String(url)))).toBe(false);
+    vi.unstubAllGlobals();
+  });
+
+  it("rejects an oversized image before buffering or uploading it", async () => {
+    const fetchMock = vi.fn((url: unknown) => {
+      const value = String(url);
+      if (value === "https://cdn.example.com/huge.png") {
+        return Promise.resolve(
+          new Response(new Uint8Array([1]), {
+            headers: { "content-type": "image/png", "content-length": String(10 * 1024 * 1024 + 1) },
+          }),
+        );
+      }
+      if (value.endsWith("/api/v1/memos")) return Promise.resolve(jsonResponse({ name: "memos/7", uid: "xy" }));
+      return Promise.resolve(new Response(null, { status: 404 }));
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    const result = await emitRuntime({
+      type: "SAVE_MEMO",
+      content: "hello",
+      visibility: "PRIVATE",
+      ...expected,
+      images: ["https://cdn.example.com/huge.png"],
+    });
+
+    expect(result).toEqual({ ok: true, webUrl: "https://memos.example.com/memos/xy", failedImages: 1 });
+    expect(fetchMock.mock.calls.some(([url]) => String(url).endsWith("/api/v1/attachments"))).toBe(false);
+    vi.unstubAllGlobals();
+  });
+
+  it("rejects active SVG content instead of uploading it as an attachment", async () => {
+    const fetchMock = vi.fn((url: unknown) => {
+      const value = String(url);
+      if (value === "https://cdn.example.com/active.svg") {
+        return Promise.resolve(new Response("<svg><script>alert(1)</script></svg>", { headers: { "content-type": "image/svg+xml" } }));
+      }
+      if (value.endsWith("/api/v1/memos")) return Promise.resolve(jsonResponse({ name: "memos/7", uid: "xy" }));
+      return Promise.resolve(new Response(null, { status: 404 }));
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    const result = await emitRuntime({
+      type: "SAVE_MEMO",
+      content: "hello",
+      visibility: "PRIVATE",
+      ...expected,
+      images: ["https://cdn.example.com/active.svg"],
+    });
+
+    expect(result).toEqual({ ok: true, webUrl: "https://memos.example.com/memos/xy", failedImages: 1 });
+    expect(fetchMock.mock.calls.some(([url]) => String(url).endsWith("/api/v1/attachments"))).toBe(false);
+    vi.unstubAllGlobals();
+  });
+
   it("returns not-configured when there is no Memos connection", async () => {
     mockUser = { id: "user_123", unsafeMetadata: {} };
     const result = await emitRuntime({ type: "SAVE_MEMO", content: "hi", visibility: "PRIVATE", ...expected });
     expect(result).toEqual({ ok: false, errorKind: "not-configured" });
   });
 
+  it("fails closed when the OAuth identity service is temporarily unavailable", async () => {
+    oauthMocks.getOAuthUser.mockRejectedValueOnce(new oauthMocks.OAuthUnavailableError());
+    const fetchMock = vi.fn();
+    vi.stubGlobal("fetch", fetchMock);
+
+    const result = await emitRuntime({ type: "SAVE_MEMO", content: "hi", visibility: "PRIVATE", ...expected });
+
+    expect(result).toEqual({ ok: false, errorKind: "auth-unavailable" });
+    expect(fetchMock).not.toHaveBeenCalled();
+    vi.unstubAllGlobals();
+  });
+
   it("maps an InstanceError to its kind (401 -> unauthorized)", async () => {
     vi.stubGlobal("fetch", vi.fn().mockResolvedValue(jsonResponse({}, 401)));
     const result = await emitRuntime({ type: "SAVE_MEMO", content: "hi", visibility: "PRIVATE", ...expected });
@@ -268,6 +375,49 @@ describe("background — popup state", () => {
   });
 });
 
+describe("background — sanitized options protocol", () => {
+  beforeEach(ready);
+
+  it("returns identity fields without unsafe metadata or either access token", async () => {
+    const result = await emitRuntime({ type: "GET_AUTH_USER" }, optionsSender);
+
+    expect(result).toEqual({ id: "user_123", displayName: "Steven Li" });
+    expect(JSON.stringify(result)).not.toContain("unsafeMetadata");
+    expect(JSON.stringify(result)).not.toContain(testCreds.accessToken);
+  });
+
+  it("returns only sanitized connection diagnostics", async () => {
+    const result = await emitRuntime({ type: "GET_CONNECTION_STATE", refresh: false }, optionsSender);
+
+    expect(result).toEqual({
+      instanceUrl: testCreds.instanceUrl,
+      version: "0.29.1",
+      status: "ready",
+      verificationError: null,
+      isUsingCachedVersion: true,
+    });
+    expect(JSON.stringify(result)).not.toContain(testCreds.accessToken);
+  });
+});
+
+describe("background — sign-out", () => {
+  beforeEach(ready);
+
+  it("clears popup, version, and ambiguous-save caches before broadcasting", async () => {
+    seedStorage({
+      [POPUP_STATE_KEY]: { status: "ready" },
+      [VERSION_CACHE_KEY]: { instanceUrl: testCreds.instanceUrl, version: "0.29.1" },
+      [SAVE_ATTEMPTS_KEY]: { request_1: { fingerprint: "x", startedAt: Date.now() } },
+    });
+
+    await emitRuntime({ type: "SIGN_OUT" }, optionsSender);
+
+    await expect(browserMock.storage.local.get([POPUP_STATE_KEY, VERSION_CACHE_KEY, SAVE_ATTEMPTS_KEY])).resolves.toEqual({});
+    expect(oauthMocks.clearOAuthSession).toHaveBeenCalledOnce();
+    expect(browserMock.runtime.sendMessage).toHaveBeenCalledWith({ type: "AUTH_CHANGED" });
+  });
+});
+
 describe("background — sign-in flow", () => {
   it("runs OAuth PKCE, refreshes state, and returns to options", async () => {
     ready();