Fix TypeError for non-string action values in postMessage handler

Address code review feedback:
- Add typeof check to reject non-string action values early
- Use startsWith() safely after confirming action is a string
- Add test cases for action as object, number, and array

Author: ErkoRisthein

src/services/WebExtensionService.ts

@@ -44,7 +44,8 @@ export default class WebExtensionService {
   }
 
   private receive(event: { data: ExtensionResponse }): void {
-    if (!event.data?.action?.startsWith("web-eid:")) return;
+    if (typeof event.data?.action !== "string") return;
+    if (!event.data.action.startsWith("web-eid:")) return;
 
     const message       = event.data;
     const suffix        = ["success", "failure", "ack"].find((s) => message.action.endsWith(s));

src/services/__tests__/WebExtensionService-test.ts

@@ -62,6 +62,42 @@ describe("WebExtensionService", () => {
 
       expect(console.warn).not.toHaveBeenCalled();
     });
+
+    it("should ignore messages with action as an object", async () => {
+      jest.spyOn(console, "warn").mockImplementation();
+
+      window.postMessage({ action: { id: "123", _t: "456" } }, "*");
+      await new Promise((resolve) => setTimeout(resolve));
+
+      expect(console.warn).not.toHaveBeenCalled();
+    });
+
+    it("should ignore messages with action as an object with startsWith property", async () => {
+      jest.spyOn(console, "warn").mockImplementation();
+
+      window.postMessage({ action: { startsWith: "2022-10-12", endsWith: "2026-10-12" } }, "*");
+      await new Promise((resolve) => setTimeout(resolve));
+
+      expect(console.warn).not.toHaveBeenCalled();
+    });
+
+    it("should ignore messages with action as a number", async () => {
+      jest.spyOn(console, "warn").mockImplementation();
+
+      window.postMessage({ action: 12345 }, "*");
+      await new Promise((resolve) => setTimeout(resolve));
+
+      expect(console.warn).not.toHaveBeenCalled();
+    });
+
+    it("should ignore messages with action as an array", async () => {
+      jest.spyOn(console, "warn").mockImplementation();
+
+      window.postMessage({ action: ["web-eid:test"] }, "*");
+      await new Promise((resolve) => setTimeout(resolve));
+
+      expect(console.warn).not.toHaveBeenCalled();
+    });
   });
 
   describe("action web-eid:warning", () => {