From 85a6ac5bb07adb880d36fe184e5f7d0c2c0889b6 Mon Sep 17 00:00:00 2001
From: martbost <martybostick@gmail.com>
Date: Mon, 7 Sep 2026 06:58:12 -0500
Subject: [PATCH] Wallet: fix Trust Wallet chain-add + personal_sign ("invalid
 method parameters")
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- wallet_addEthereumChain omits blockExplorerUrls when the config explorer is
  empty (rehearsal has none) — an empty-string URL made Trust Wallet reject the
  add with "invalid method parameters", blocking new users from adding the chain.
- personal_sign now hex-encodes the SIWE message (Trust Wallet requires hex;
  MetaMask took raw). Signed bytes are identical so server recovery is unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 public/assets/wallet.js | 14 +++++++++++---
 public/index.html       |  2 +-
 public/my.html          |  2 +-
 3 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/public/assets/wallet.js b/public/assets/wallet.js
index 890562c..8023270 100644
--- a/public/assets/wallet.js
+++ b/public/assets/wallet.js
@@ -17,9 +17,13 @@ window.IAPWallet = (function () {
       await eth().request({ method: 'wallet_switchEthereumChain', params: [{ chainId: want }] });
     } catch (e) {
       if (e.code !== 4902) throw e;
-      await eth().request({ method: 'wallet_addEthereumChain', params: [{
+      const addParams = {
         chainId: want, chainName: c.chainName, nativeCurrency: { name: 'POL', symbol: 'POL', decimals: 18 },
-        rpcUrls: [c.rpc], blockExplorerUrls: [c.explorer] }] });
+        rpcUrls: [c.rpc] };
+      // only include a block explorer when it's a real URL — an empty string here
+      // makes wallets (Trust Wallet especially) reject with "invalid method parameters"
+      if (c.explorer && /^https?:\/\//i.test(c.explorer)) addParams.blockExplorerUrls = [c.explorer];
+      await eth().request({ method: 'wallet_addEthereumChain', params: [addParams] });
     }
   }
   async function connect() {
@@ -34,7 +38,11 @@ window.IAPWallet = (function () {
     const ch = await (await fetch('/api/auth/challenge', { method: 'POST',
       headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ address: addr }) })).json();
     if (ch.error) throw new Error(ch.error);
-    const sig = await eth().request({ method: 'personal_sign', params: [ch.message, addr] });
+    // hex-encode the message: MetaMask accepts a raw string, but Trust Wallet and
+    // others require hex for personal_sign (else "invalid method parameters").
+    // The signed bytes are identical, so server-side recovery is unchanged.
+    const hexMsg = '0x' + Array.from(new TextEncoder().encode(ch.message)).map(b => b.toString(16).padStart(2, '0')).join('');
+    const sig = await eth().request({ method: 'personal_sign', params: [hexMsg, addr] });
     const r = await (await fetch('/api/auth/verify', { method: 'POST',
       headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ address: addr, signature: sig }) })).json();
     if (r.error) throw new Error(r.error);
diff --git a/public/index.html b/public/index.html
index a434e3f..0581a84 100644
--- a/public/index.html
+++ b/public/index.html
@@ -438,7 +438,7 @@
 </section>
 
 <script src="/assets/common.js?v=20260906m"></script>
-<script src="/assets/wallet.js?v=20260906m"></script>
+<script src="/assets/wallet.js?v=20260907f"></script>
 <script src="/assets/home.js?v=20260906m"></script>
 <script src="/assets/chat.js?v=20260906m"></script>
 </body>
diff --git a/public/my.html b/public/my.html
index 5242981..9355e45 100644
--- a/public/my.html
+++ b/public/my.html
@@ -634,7 +634,7 @@
   </div>
 </div>
 <script src="/assets/common.js?v=20260907e"></script>
-<script src="/assets/wallet.js?v=20260907e"></script>
+<script src="/assets/wallet.js?v=20260907f"></script>
 <script src="/assets/my.js?v=20260907e"></script>
 <script src="/assets/chat.js?v=20260907e"></script>
 </body>