# Local EIP-1193 bridge

The Rust process binds only to `127.0.0.1` (default `ws://127.0.0.1:21337/ws`). Clients must supply the random/operator-provided token as the `token` query parameter or a bearer header. Browser origins can be restricted with repeatable/comma-delimited `--allowed-origin` values.

At startup the bridge resolves the configured RPC chain ID and fixes that as the active chain context. It does not switch RPCs at a dapp's request.

## Supported methods

Wallet methods:

- `eth_accounts` — returns the account only after account access was approved.
- `eth_requestAccounts` — deny-by-default CLI approval; emits `accountsChanged` after approval.
- `eth_chainId` — the configured RPC's startup chain ID.
- `personal_sign` — validates the unlocked account and shows message format, byte length, and a bounded preview.
- `eth_signTypedData_v4` — validates the account and, when present, the EIP-712 domain chain ID; shows domain and message details.
- `eth_sendTransaction` — requires `from`, validates account and optional chain ID, shows destination/value/calldata/fee fields, then signs and broadcasts through the configured RPC.
- `wallet_switchEthereumChain` — succeeds only when the requested chain already equals the fixed active chain; otherwise returns `4901`.

Read-only RPC forwarding allowlist:

- `eth_blockNumber`, `eth_call`, `eth_estimateGas`, `eth_feeHistory`, `eth_gasPrice`
- `eth_getBalance`, `eth_getBlockByHash`, `eth_getBlockByNumber`, `eth_getCode`, `eth_getLogs`, `eth_getStorageAt`
- `eth_getTransactionByHash`, `eth_getTransactionCount`, `eth_getTransactionReceipt`
- `eth_maxPriorityFeePerGas`, `eth_syncing`, `net_version`, `web3_clientVersion`

Everything else returns `-32601`; malformed parameters return `-32602`; unauthorized account operations return `4100`; unsupported chains return `4901`; user rejection returns `4001`. Upstream RPC failures preserve their JSON-RPC code/message when possible.

## Approval and security model

Signatures and transactions always take the serialized prompt lock and require an interactive CLI confirmation defaulting to **No**. `--auto-approve` applies only to the account-access prompt and cannot bypass a signature or transaction prompt. The TypeScript bridge exposes only EIP-1193 requests; no method returns key material or accepts a raw digest for signing.

For the demo, use an explicit browser origin:

```bash
cargo run -- --serve --wallet 0xYourAccount \
  --rpc-url https://your-sepolia-rpc.example \
  --allowed-origin http://127.0.0.1:5173
```

The token travels in the WebSocket URL because browser WebSocket APIs cannot set an authorization header. Treat it as an ephemeral local capability: do not reuse it, paste it into dapps, or expose browser history/debug output.