mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
Claude
dab4d73e09
The REST path previously used tauri-plugin-http with danger.acceptInvalidCerts, so it accepted ANY certificate while the WS and LiveKit paths were TOFU-pinned in Rust — and the bearer token rides every REST request. This routes REST through a new Rust loopback TCP->TLS proxy that pins the server certificate to the same trust-on-first-use fingerprint as the WS proxy. Rust (src-tauri): - New http_proxy.rs: per-host loopback tunnels (HttpProxyState map); per-connection TOFU via CaptureVerifier + tofu_check, sharing ws_proxy's cert store (cert_store_key) and emitting the same cert-tofu events (first-use banner / mismatch modal). First request's Host is rewritten and Connection: close injected so one request rides each connection. Mismatch returns a clean 502 to the loopback fetch. - Register HttpProxyState + start_http_proxy/stop_http_proxy in lib.rs. - Drop the dangerous-settings feature from tauri-plugin-http. TypeScript (src): - New lib/httpProxy.ts: ensureHttpProxy(host) (per-host cache + concurrent-start dedup) / stopHttpProxy(host). - api.ts, profiles.ts (health), attachments.ts (image + download) resolve server URLs to http://127.0.0.1:{port}; remove the allowSelfSigned config field and every acceptInvalidCerts block. External hosts (CDNs, OG previews, YouTube) keep normal TLS validation. - main.ts constructs the API client without allowSelfSigned. - capabilities/default.json: allow http://127.0.0.1:* fetch scope. Tests: - New tests/unit/http-proxy.test.ts (cache, dedup, stop/restart). - api.test.ts and attachments-render.test.ts: mock httpProxy, replace the acceptInvalidCerts assertions with proxy-origin assertions. Verified: tsc --noEmit clean; new + affected vitest suites green (176 tests); the http_proxy pure logic (host validation, header rewrite) passes as standalone Rust unit tests; oxlint/eslint counts unchanged from HEAD; prettier clean. The full Tauri build (cargo) requires GUI system libs not present in this environment and runs on CI/real runners. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UA17KPvqGBX3XbXYnMf1rA
54 lines
1.8 KiB
TOML
54 lines
1.8 KiB
TOML
[package]
|
|
name = "owncord-client"
|
|
version = "1.1.0-alpha.2"
|
|
edition = "2021"
|
|
description = "OwnCord Desktop Client"
|
|
|
|
[lib]
|
|
name = "owncord_client_lib"
|
|
crate-type = ["lib", "cdylib", "staticlib"]
|
|
|
|
[build-dependencies]
|
|
tauri-build = { version = "2", features = [] }
|
|
tauri-typegen = "0.5"
|
|
|
|
[features]
|
|
default = []
|
|
devtools = ["tauri/devtools"]
|
|
|
|
[dependencies]
|
|
tauri = { version = "2", features = ["tray-icon"] }
|
|
tauri-plugin-store = "2"
|
|
tauri-plugin-global-shortcut = "2"
|
|
tauri-plugin-notification = "2"
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
# Self-signed server certificates are handled by the Rust TOFU proxies
|
|
# (ws_proxy, livekit_proxy, http_proxy), NOT by the plugin's dangerous-settings
|
|
# feature — REST traffic is tunneled through http_proxy which pins the cert to
|
|
# the trust-on-first-use fingerprint. The plugin therefore does default TLS
|
|
# validation (used only for external hosts: image CDNs, OG previews, YouTube).
|
|
tauri-plugin-http = { version = "2.5.7", features = ["rustls-tls"] }
|
|
tauri-plugin-opener = "2"
|
|
tauri-plugin-dialog = "2"
|
|
tauri-plugin-fs = "2"
|
|
tauri-plugin-updater = "2"
|
|
tauri-plugin-process = "2"
|
|
url = "2"
|
|
tokio-tungstenite = { version = "0.28.0", features = ["rustls-tls-webpki-roots"] }
|
|
futures-util = "0.3.32"
|
|
tokio = { version = "1", features = ["sync", "net", "io-util", "rt", "macros"] }
|
|
tokio-rustls = { version = "0.26", default-features = false }
|
|
rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
|
|
ring = "0.17"
|
|
log = "0.4"
|
|
env_logger = "0.11"
|
|
keyring = "3"
|
|
rfd = { version = "0.16", default-features = false }
|
|
|
|
[target.'cfg(windows)'.dependencies]
|
|
windows = { version = "0.58", features = ["Win32_UI_Input_KeyboardAndMouse"] }
|
|
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
device_query = "2"
|