diff --git a/public/suite.js b/public/suite.js index 31d9f91..f9311b7 100644 --- a/public/suite.js +++ b/public/suite.js @@ -88,6 +88,8 @@ ev.preventDefault(); sw.textContent = 'signing out…'; try { await fetch('/api/public/signout', { method: 'POST' }); } catch (e) {} + // Tell connect() to force the wallet's account picker on the way back in. + try { sessionStorage.setItem('rmc.switch', '1'); } catch (e) {} location.reload(); }); me = null; pips(); render(); @@ -114,15 +116,40 @@ try { var eth = await window.RMCWallet.pick(); if (!eth) { {var _ia=(window.RMCInApp&&window.RMCInApp.notice('/suite'))||'';if(_ia){err.innerHTML=_ia;if(err.style)err.style.display='block';window.RMCInApp.bind('/suite');}else{err.textContent = 'This browser has no wallet in it. Open this page INSIDE your wallet app instead: open Trust, MetaMask, SafePal or Coinbase, find its Browser (or DApps) tab, and type rmcircle.team/suite into that address bar. On iPhone, Trust no longer has a browser — use MetaMask or SafePal, or ask your sponsor to link you instead.';}} err.style.display = 'block'; btn.disabled = false; btn.textContent = '🔑 Connect wallet — light up my tools'; return; } + // eth_requestAccounts SILENTLY returns whichever account the site is + // already connected to - it never opens the picker. So someone holding + // several positions can switch accounts in MetaMask all day and still be + // handed the first one they ever connected, sign with it, and resolve to + // the same position. Asking for permissions first forces the picker open. + var wantSwitch = false; + try { wantSwitch = sessionStorage.getItem('rmc.switch') === '1'; } catch (e) {} + if (wantSwitch) { + try { await eth.request({ method: 'wallet_requestPermissions', params: [{ eth_accounts: {} }] }); } + catch (pe) { /* wallet may not support it; fall through to the normal request */ } + try { sessionStorage.removeItem('rmc.switch'); } catch (e) {} + } var accs = await eth.request({ method: 'eth_requestAccounts' }); var account = accs[0]; + var shortAcc = account ? account.slice(0, 6) + '…' + account.slice(-4) : ''; try { await window.RMCWallet.ensureChain(eth); } catch (ce) {} var ch = await (await fetch('/api/public/msg-challenge', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ address: account }) })).json(); if (!ch.message) throw new Error(ch.error || 'Could not start sign-in.'); var sig = await eth.request({ method: 'personal_sign', params: [ch.message, account] }); var vr = await (await fetch('/api/public/msg-verify', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ address: account, signature: sig }) })).json(); if (!vr.ok) throw new Error(vr.error || 'Signature check failed.'); + var prevId = null; + try { prevId = sessionStorage.getItem('rmc.lastId'); } catch (e) {} await refreshMe(); + try { + var nowId = (me && me.id) ? String(me.id) : null; // `me` is set by refreshMe() in this same closure + if (nowId) sessionStorage.setItem('rmc.lastId', nowId); + if (prevId && nowId && prevId === nowId) { + err.innerHTML = 'Your wallet handed back the same address (' + shortAcc + '), so this is still position #' + nowId + + '. Wallets keep a site connected to one account: open your wallet, find its connected-sites or permissions list, ' + + 'disconnect rmcircle.team, then tap switch here again and pick the other account.'; + err.style.display = 'block'; + } + } catch (e) {} } catch (e) { var m = String((e && e.message) || e); err.textContent = /not registered|no position/i.test(m)