feat: session storage

lnbits/static/js/wasm-extension-component.js

@@ -513,6 +513,26 @@ window.WasmExtensionComponent = {
       this.newTabPrompt = this.emptyNewTabPrompt()
       reject?.(new Error(message))
     },
+    bridgeSessionStorageKey(rawKey) {
+      const key = String(rawKey || '').trim()
+      if (!key || key.length > 128 || !/^[A-Za-z0-9._:-]+$/.test(key)) {
+        throw new Error('Invalid extension session key.')
+      }
+      return `lnbits.ext.session.${this.bridge.extensionId}.${key}`
+    },
+    getBridgeSessionValue(message) {
+      const key = this.bridgeSessionStorageKey(message.key)
+      return {value: window.sessionStorage.getItem(key) || ''}
+    },
+    setBridgeSessionValue(message) {
+      const key = this.bridgeSessionStorageKey(message.key)
+      const value = String(message.value || '')
+      if (value.length > 4096) {
+        throw new Error('Extension session value is too large.')
+      }
+      window.sessionStorage.setItem(key, value)
+      return {ok: true}
+    },
     async callApi(message) {
       const method = String(message.method || 'GET').toUpperCase()
       const path = String(message.path || '')
@@ -1234,6 +1254,22 @@ window.WasmExtensionComponent = {
           return
         }
 
+        if (message.action === 'storage.session.get') {
+          this.sendResponse(reply, message.id, {
+            ok: true,
+            data: this.getBridgeSessionValue(message)
+          })
+          return
+        }
+
+        if (message.action === 'storage.session.set') {
+          this.sendResponse(reply, message.id, {
+            ok: true,
+            data: this.setBridgeSessionValue(message)
+          })
+          return
+        }
+
         if (message.action === 'ui.scan_qr') {
           this.sendResponse(reply, message.id, {
             ok: true,

tests/unit/test_wasm_extension_frontend.py

@@ -49,6 +49,10 @@ def test_wasm_frontend_bridge_restricts_api_routes_and_realtime_actions():
     assert "window.open(prompt.url, '_blank', 'noopener,noreferrer')" in bridge
     assert "Only HTTP and HTTPS links can be opened." in bridge
     assert "This link is not on the same domain as this LNbits page." in bridge
+    assert "message.action === 'storage.session.get'" in bridge
+    assert "message.action === 'storage.session.set'" in bridge
+    assert "bridgeSessionStorageKey(rawKey)" in bridge
+    assert "lnbits.ext.session.${this.bridge.extensionId}.${key}" in bridge
     assert "hasBridgePermission('websocket.subscribe')" in bridge
     assert "/api/v1/ext/ws/${encodeURIComponent(" in bridge
     assert "/api/v1/ws/${encodeURIComponent(paymentHash)}" in bridge