mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
Claude
dab4d73e09
The REST path previously used tauri-plugin-http with danger.acceptInvalidCerts, so it accepted ANY certificate while the WS and LiveKit paths were TOFU-pinned in Rust — and the bearer token rides every REST request. This routes REST through a new Rust loopback TCP->TLS proxy that pins the server certificate to the same trust-on-first-use fingerprint as the WS proxy. Rust (src-tauri): - New http_proxy.rs: per-host loopback tunnels (HttpProxyState map); per-connection TOFU via CaptureVerifier + tofu_check, sharing ws_proxy's cert store (cert_store_key) and emitting the same cert-tofu events (first-use banner / mismatch modal). First request's Host is rewritten and Connection: close injected so one request rides each connection. Mismatch returns a clean 502 to the loopback fetch. - Register HttpProxyState + start_http_proxy/stop_http_proxy in lib.rs. - Drop the dangerous-settings feature from tauri-plugin-http. TypeScript (src): - New lib/httpProxy.ts: ensureHttpProxy(host) (per-host cache + concurrent-start dedup) / stopHttpProxy(host). - api.ts, profiles.ts (health), attachments.ts (image + download) resolve server URLs to http://127.0.0.1:{port}; remove the allowSelfSigned config field and every acceptInvalidCerts block. External hosts (CDNs, OG previews, YouTube) keep normal TLS validation. - main.ts constructs the API client without allowSelfSigned. - capabilities/default.json: allow http://127.0.0.1:* fetch scope. Tests: - New tests/unit/http-proxy.test.ts (cache, dedup, stop/restart). - api.test.ts and attachments-render.test.ts: mock httpProxy, replace the acceptInvalidCerts assertions with proxy-origin assertions. Verified: tsc --noEmit clean; new + affected vitest suites green (176 tests); the http_proxy pure logic (host validation, header rewrite) passes as standalone Rust unit tests; oxlint/eslint counts unchanged from HEAD; prettier clean. The full Tauri build (cargo) requires GUI system libs not present in this environment and runs on CI/real runners. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UA17KPvqGBX3XbXYnMf1rA
142 lines
2.8 KiB
JSON
142 lines
2.8 KiB
JSON
{
|
|
"identifier": "default",
|
|
"description": "Default capability granting core permissions to the main window",
|
|
"windows": [
|
|
"main"
|
|
],
|
|
"permissions": [
|
|
"core:default",
|
|
"core:event:default",
|
|
"core:window:default",
|
|
"core:window:allow-show",
|
|
"core:window:allow-hide",
|
|
"core:window:allow-set-focus",
|
|
"core:window:allow-is-visible",
|
|
"core:window:allow-set-position",
|
|
"core:window:allow-set-size",
|
|
"core:window:allow-maximize",
|
|
"core:window:allow-is-maximized",
|
|
"core:window:allow-is-minimized",
|
|
"core:window:allow-outer-position",
|
|
"core:window:allow-outer-size",
|
|
"core:window:allow-available-monitors",
|
|
"store:default",
|
|
"global-shortcut:default",
|
|
"global-shortcut:allow-register",
|
|
"global-shortcut:allow-unregister",
|
|
"global-shortcut:allow-unregister-all",
|
|
"global-shortcut:allow-is-registered",
|
|
"notification:default",
|
|
"notification:allow-notify",
|
|
"notification:allow-request-permission",
|
|
"notification:allow-is-permission-granted",
|
|
{
|
|
"identifier": "http:allow-fetch",
|
|
"allow": [
|
|
{
|
|
"url": "https://*:*"
|
|
},
|
|
{
|
|
"url": "https://*"
|
|
},
|
|
{
|
|
"url": "http://127.0.0.1:*"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "http:allow-fetch-send",
|
|
"allow": [
|
|
{
|
|
"url": "https://*:*"
|
|
},
|
|
{
|
|
"url": "https://*"
|
|
},
|
|
{
|
|
"url": "http://127.0.0.1:*"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "http:allow-fetch-read-body",
|
|
"allow": [
|
|
{
|
|
"url": "https://*:*"
|
|
},
|
|
{
|
|
"url": "https://*"
|
|
},
|
|
{
|
|
"url": "http://127.0.0.1:*"
|
|
}
|
|
]
|
|
},
|
|
"http:allow-fetch-cancel",
|
|
"opener:default",
|
|
"dialog:default",
|
|
"updater:default",
|
|
"process:allow-restart",
|
|
"fs:default",
|
|
{
|
|
"identifier": "fs:allow-write-file",
|
|
"allow": [
|
|
{
|
|
"path": "$APPDATA/**"
|
|
},
|
|
{
|
|
"path": "$APPLOG/**"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "fs:allow-write-text-file",
|
|
"allow": [
|
|
{
|
|
"path": "$APPLOG/**"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "fs:allow-mkdir",
|
|
"allow": [
|
|
{
|
|
"path": "$APPLOG/**"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "fs:allow-exists",
|
|
"allow": [
|
|
{
|
|
"path": "$APPLOG/**"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "fs:allow-read-dir",
|
|
"allow": [
|
|
{
|
|
"path": "$APPLOG/**"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "fs:allow-remove",
|
|
"allow": [
|
|
{
|
|
"path": "$APPLOG/**"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "fs:allow-read-text-file",
|
|
"allow": [
|
|
{
|
|
"path": "$APPLOG/**"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|