feat(portal-framework-auth): deterministic wallet logos with validated fallbacks

[pcfreak30]

Adds deterministic logo treatment for detected wallets in the wallet-login
picker (WalletLogin), replacing the ad-hoc announced-icon-or-initial chip.

A curated brand map keyed by EIP-6963 rdns (EVM) and the Solana probe ids
gives known wallets a brand-colour monogram disc, with an archived inline-SVG
mark where the official vector is vendorable (Coinbase Wallet). The new
WalletLogo component resolves curated SVG → validated announced icon →
curated monogram → neutral disc, which also gives Solana wallets a logo row
for the first time.

The EIP-6963 info.icon path is hardened before render: base64 raster
data-URI only, 32 KiB cap, rejecting SVG (XSS) and remote URLs. Brand colours
were audited against public sources; unverified hues are omitted rather than
invented.

---

Summary

Introduces deterministic, secure logo rendering for the wallet login picker, replacing the previous ad-hoc "announced icon or generic initial" logic with a curated prioritization order and input validation.

Changes

• Deterministic logo resolution (WalletLogo.tsx): Renders wallet logos in a fixed priority:

  1. A curated inline-SVG brand mark for wallets with an archived logo (e.g., Coinbase Wallet).
  2. The wallet’s own EIP-6963 announced icon, but only after passing strict sanitization.
  3. A brand-colour monogram disc (colored circle + wallet initial) for known wallets without an SVG.
  4. A neutral grey disc for unknown wallets.

• Icon sanitization (wallet/logos.ts): New sanitizeWalletIcon function validates wallet-provided icon URIs before rendering. It accepts only small base64 raster data URIs (PNG/JPEG/WebP/GIF/AVIF) and rejects:

  • SVG data URIs (XSS/scripting risk)
  • Remote HTTP(S) URLs (privacy/SSRF surface)
  • Oversized blobs (>32 KiB) and malformed/non-image data URIs

• Curated wallet registry (wallet/logos.ts): A new walletLogos map defines brand colours (and optional SVG icons) for common wallets across EVM (EIP-6963 rdns ids) and Solana (probe ids) — MetaMask, Coinbase, Trust, Phantom, Rainbow, OKX, Brave, Exodus, Zerion, Solflare, Backpack. Entries are hand-verified; unconfirmed colours (e.g., Rabby) intentionally fall back to neutral.

• Coinbase Wallet SVG icon (walletLogos/CoinbaseC.tsx): Vendored official Coinbase Wallet inline SVG (blue tile + white mark) to serve as the curated brand icon.

• Integration & tests: The WalletLogin picker now uses WalletLogo directly. Added browser and unit tests covering resolution priority, sanitization rejection cases, and fallback behaviour.

Impact

This change makes wallet logos in the login picker consistent and trustworthy:

• Known wallets get accurate, offline-renderable brand marks without depending on external or unvetted resources.
• Wallet-supplied icons are only displayed when they are safe raster data URIs, eliminating a class of XSS and privacy issues.
• Unknown wallets still render a clear, neutral initial-disc placeholder.

[kody-ai]

Kody Review Complete

Great news! 🎉
No issues were found that match your current review configurations.

Keep up the excellent work! 🚀

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

• Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

​