feat(wallet): session-scoped read/sign/submit permissions (#1194)

[robertocarlous]

Closes #1194

What

Adds session-scoped read / sign / submit permissions for a connected wallet. A fresh session grants all three (preserving existing behaviour); the user can revoke any of them from Wallet → Session permissions for the rest of the browser session. Revocations are enforced end to end and reset when the session ends.

Behaviour

• read — gates account/chain data fetching (wallet connect and the Freighter background account refresh).
• sign — enforced centrally in createAdapter (src/lib/wallet/adapters.ts), before any network or XDR work, so a revoked session never reaches the wallet. Covers signTransaction and signAuthEntry.
• submit — enforced in useWriteGuard().guard(...), which now exposes a permissionDenied result instead of calling onConfirm.

Permissions are stored in sessionStorage (stellar-dash:wallet-session-permissions) and the in-memory session slice. They are deliberately not in PERSIST_KEYS, are cleared on disconnectWallet() / revokeWalletSession(), and fail closed on corrupt storage (read kept, sign/submit denied).

Files

• src/lib/wallet/sessionPermissions.ts (new) — framework-free validation, persistence and enforcement core.
• src/lib/store.ts — walletSessionPermissions + grant/revoke actions; reset/clear on disconnect and revoke; installs the checker.
• src/lib/wallet/adapters.ts — signing gate.
• src/lib/wallet/sessionListeners.ts — read gate for background refresh.
• src/hooks/useWriteGuard.ts — submit gate.
• src/hooks/useWalletPermissions.ts (new), src/components/settings/WalletSessionPermissions.tsx (new) — UI/hook surface.
• src/components/dashboard/WalletConnect.tsx — mounts the settings control.
• docs/security/wallet-session-permissions.md (new), SECURITY.md.

Tests (happy path / boundary / failure)

• src/lib/wallet/__tests__/sessionPermissions.test.ts — normalization, persistence round-trip, corrupt-JSON/shape/blocked-storage fallbacks, flag coercion boundary, throwing checker.
• src/lib/wallet/__tests__/sessionPermissions.store.test.ts — grant/revoke wiring and disconnect/revoke reset + storage clear.
• src/lib/wallet/__tests__/sessionPermissions.enforcement.test.ts — adapter signing gate for signTransaction and signAuthEntry, plus the granted control case.

Verification (all pass):

pnpm exec vitest run --config vitest.config.js \
  src/lib/wallet/__tests__/sessionPermissions.test.ts \
  src/lib/wallet/__tests__/sessionPermissions.store.test.ts \
  src/lib/wallet/__tests__/sessionPermissions.enforcement.test.ts
# 25 passed
pnpm exec vitest run --config vitest.config.js tests/unit/hooks/useWriteGuard.test.ts  # 9 passed

Security, privacy, accessibility, network safety

• Fails closed: a corrupt/unreadable record denies sign/submit rather than re-granting them; a throwing checker fails closed for privileged actions.
• Signing is refused before any wallet/network call, removing an accidental-approval path.
• Not a cryptographic boundary (the wallet still confirms every signature); see the doc.
• No data egress — the record holds three booleans in sessionStorage.
• The control uses labelled role="switch" toggles, aria-checked, reduced-motion and high-contrast support.

Notes

• Pre-existing repo issues untouched: src/components/dashboard/AuditLog.tsx has type errors and src/lib/wallet/__tests__/adapters.test.ts fails on master (invalid test public key / unbuilt @stellar-dev-dashboard/core in this checkout); neither is related to or affected by this change.
• Only files related to [2026 Wallet] Add session-scoped permissions for read, sign and submit actions #1194 are changed.

[vercel]

@robertocarlous is attempting to deploy a commit to the nanle-code's projects Team on Vercel.

A member of the Team first needs to authorize it.