fix(auth): scope embedded key to parent origin + validate MessageChannel sender (ENG-4596)

[justinformentin]

Summary

This PR ports the INT-697 cross-origin hardening pattern to the auth frame, closing two related vulnerabilities (ENG-4596 / TKA-20260806-016, Medium).

The auth frame is structurally different from export-and-sign: the source is entirely inline in auth/index.html (no src/ directory, no build step). This PR adapts the same security patterns faithfully to the inline-script architecture.

---

Vuln A — MessageChannel gate accepts any sender

Before: The TURNKEY_INIT_MESSAGE_CHANNEL handler gated only on event.ports?.[0], allowing any window (not just the direct parent) to establish the privileged MessageChannel and receive subsequent messages via the port.

// Before
if (
  event.data &&
  event.data["type"] == "TURNKEY_INIT_MESSAGE_CHANNEL" &&
  event.ports?.[0]
)

After: The gate now validates source, origin, and port count — mirroring the INT-697 export-and-sign fix:

// After
if (
  event.data &&
  event.data["type"] == "TURNKEY_INIT_MESSAGE_CHANNEL" &&
  event.source === window.parent &&
  event.origin &&
  event.origin !== "null" &&
  event.ports?.length === 1
)

---

Vuln B — Parent-agnostic embedded key

Before: A single P-256 private key was persisted in localStorage under the fixed name "TURNKEY_EMBEDDED_KEY", created at DOMContentLoaded before any parent origin was known. The same key (and thus the same PUBLIC_KEY_READY public key) was served to every embedder. An attacker could replay an auth bundle encrypted to that key from any origin.

After: The inline TKHQ IIFE now tracks an embeddedKeyState object with two modes:

• persistent — key stored in localStorage under TURNKEY_EMBEDDED_KEY_V2:<encodeURIComponent(origin)>. Each parent origin gets its own isolated key slot.
• ephemeral — key stored in memory only (for legacy @turnkey/iframe-stamper < 2.1.0 clients). Unique to this document; never persisted.

Key new helpers added inline:

• validateParentOrigin(origin) — validates non-empty, non-opaque, valid serialized origin
• purgeLegacyEmbeddedKey() — removes old TURNKEY_EMBEDDED_KEY (never migrated)
• initEmbeddedKey(origin) — now REQUIRES an origin; creates/reuses V2 scoped persistent key
• initEphemeralEmbeddedKey() — creates in-memory-only key; no-ops if persistent key is active
• getBoundOrigin() — returns the currently bound origin
• Updated getEmbeddedKey(), setEmbeddedKey(), resetEmbeddedKey() to dispatch based on state mode

Flow changes:

• Standalone mode (DOMContentLoaded): initEmbeddedKey(window.location.origin)
• Embedded mode (DOMContentLoaded): initEphemeralEmbeddedKey() for legacy clients
• MessageChannel handshake: initEmbeddedKey(event.origin) supersedes ephemeral; rolls back on failure
• Legacy embedded path: binds to first sender origin; rejects different origins

---

Tests

Added/updated in auth/index.test.js (34 total, all passing):

New Vuln B tests: different origins produce different keys, refuses second origin binding, rejects invalid origins, purges legacy key, ephemeral key stays in memory only, getBoundOrigin coverage.

New Vuln A tests (channel gate): rejects non-parent source, empty origin, opaque "null" origin, 0 ports, 2 ports; accepts valid event.

---

Validation Results

prettier:check  — All matched files use Prettier code style!
eslint          — No issues found
jest            — 34 passed, 34 total (5.2s)

No build step exists for the auth frame (inline HTML is the source). No dist artifacts to commit.

---

References

• Linear: ENG-4596 — https://linear.app/turnkey/issue/ENG-4596
• Sibling fix for export-and-sign: INT-697 / PR fix: prevent cross-origin replay #129
• Sibling fix for import: PR fix(import): extend cross-origin MessageChannel validation to import frame (INT-783) #130