Skip to content

fix(forge): add missing bio_signMessage permission - #202

Merged
Gaubee merged 1 commit into
mainfrom
fix/forge-missing-permission
Jan 10, 2026
Merged

Gaubee merged 1 commit into
mainfrom
fix/forge-missing-permission

Conversation

@Gaubee

@Gaubee Gaubee commented Jan 10, 2026

Copy link
Copy Markdown
Contributor

Problem

The forge miniapp cannot complete the wallet connection flow because the bio_signMessage permission is not declared in its manifest.

Root Cause

In useForge.ts, the hook calls bio_signMessage to sign the internal chain recharge message:

const signResult = await window.bio.request<{ signature: string; publicKey: string }>({
  method: 'bio_signMessage',
  params: [{ message: messageToSign, address: internalAccount.address }],
})

However, bio_signMessage was not declared in manifest.json. The bridge validates permissions against the manifest and rejects undeclared methods with:

"Permission not declared in manifest: bio_signMessage"

Solution

Added bio_signMessage to the permissions array in miniapps/forge/manifest.json.

Testing

  • All forge miniapp tests pass (38/38)
  • Typecheck passes

The forge miniapp's useForge hook calls bio_signMessage to sign the
internal chain recharge message, but this permission was not declared
in the manifest. The bridge rejects undeclared permissions, causing
the wallet connection flow to fail.

Added bio_signMessage to the permissions array in manifest.json.
@Gaubee
Gaubee merged commit 026d0d5 into main Jan 10, 2026
5 checks passed
@Gaubee
Gaubee deleted the fix/forge-missing-permission branch January 10, 2026 14:05
Gaubee added a commit that referenced this pull request Jan 10, 2026
Add tests documenting the manifest permission validation behavior:
- Verify attach stores manifest permissions correctly
- Document permission rules (account method mapping, system method bypass)
- Reference PR #202 fix for forge miniapp bio_signMessage issue
Gaubee added a commit that referenced this pull request Jan 10, 2026
* test(bridge): add permission validation tests

Add tests documenting the manifest permission validation behavior:
- Verify attach stores manifest permissions correctly
- Document permission rules (account method mapping, system method bypass)
- Reference PR #202 fix for forge miniapp bio_signMessage issue

* chore(e2e): add Mobile Safari screenshot baselines

Generate baseline screenshots for Mobile Safari E2E tests.
This complements PR #200 which added Safari test configuration.

Note: Some tests are skipped or flaky on Safari due to:
- Forge miniapp API loading differences
- Input clearing behavior differences

The CI currently runs only Mobile Chrome for speed, but these
baselines enable local Safari testing for visual regression.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant