fix sso login failure 2

.gitea/workflows/desktop.yml

@@ -161,63 +161,25 @@ jobs:
           $NavigationPattern = "webContents\.on\('will-navigate', \(event, url\) => \{\r?\n\s*if \(!isTrustedOrigin\(url\)\) \{\r?\n\s*event\.preventDefault\(\);\r?\n\s*\}\r?\n\s*\}\);"
 
           $NavigationReplacementLines = @(
-            "let externalSsoNavigationActive = false;"
+            "const isAllowedSsoOrigin = (url: string): boolean => {"
+            "`ttry {"
+            "`t`treturn new URL(url).origin === 'https://sso.gandc.ru';"
+            "`t} catch {"
+            "`t`treturn false;"
+            "`t}"
+            "};"
             ""
-            "`twebContents.on('will-navigate', (event, url) => {"
+            "`tconst allowTrustedOrSsoNavigation = (event: Electron.Event, url: string): void => {"
-            "`t`tif (isTrustedOrigin(url)) {"
+            "`t`tif (isTrustedOrigin(url) || isAllowedSsoOrigin(url)) {"
-            "`t`t`tif (externalSsoNavigationActive) {"
-            "`t`t`t`tlogger.info('SSO navigation returned to trusted origin', {url});"
-            "`t`t`t}"
-            "`t`t`texternalSsoNavigationActive = false;"
             "`t`t`treturn;"
             "`t`t}"
             ""
-            "`t`ttry {"
+            "`t`tlogger.warn('Blocked navigation outside trusted and SSO origins', {url});"
-            "`t`t`tconst target = new URL(url);"
-            ""
-            "`t`t`tif (externalSsoNavigationActive) {"
-            "`t`t`t`tif (target.protocol === 'https:' || target.protocol === 'http:') {"
-            "`t`t`t`t`tlogger.info('Allowing active SSO navigation', {"
-            "`t`t`t`t`t`torigin: target.origin,"
-            "`t`t`t`t`t});"
-            "`t`t`t`t`treturn;"
-            "`t`t`t`t}"
-            ""
-            "`t`t`t`tlogger.warn('Blocked non-HTTP navigation during SSO', {"
-            "`t`t`t`t`turl,"
-            "`t`t`t`t});"
-            "`t`t`t`tevent.preventDefault();"
-            "`t`t`t`treturn;"
-            "`t`t`t}"
-            ""
-            "`t`t`tconst isKeycloakAuthorization ="
-            "`t`t`t`ttarget.protocol === 'https:' &&"
-            "`t`t`t`ttarget.pathname.includes('/protocol/openid-connect/auth') &&"
-            "`t`t`t`ttarget.searchParams.has('client_id') &&"
-            "`t`t`t`ttarget.searchParams.has('redirect_uri') &&"
-            "`t`t`t`ttarget.searchParams.has('state');"
-            ""
-            "`t`t`tif ("
-            "`t`t`t`tisKeycloakAuthorization &&"
-            "`t`t`t`tisTrustedOrigin(webContents.getURL())"
-            "`t`t`t) {"
-            "`t`t`t`texternalSsoNavigationActive = true;"
-            ""
-            "`t`t`t`tlogger.info('Allowing Keycloak SSO navigation', {"
-            "`t`t`t`t`torigin: target.origin,"
-            "`t`t`t`t});"
-            ""
-            "`t`t`t`treturn;"
-            "`t`t`t}"
-            "`t`t} catch (error) {"
-            "`t`t`tlogger.warn('Failed to parse navigation URL', {"
-            "`t`t`t`turl,"
-            "`t`t`t`terror,"
-            "`t`t`t});"
-            "`t`t}"
-            ""
             "`t`tevent.preventDefault();"
-            "`t});"
+            "`t};"
+            ""
+            "`twebContents.on('will-navigate', allowTrustedOrSsoNavigation);"
+            "`twebContents.on('will-redirect', allowTrustedOrSsoNavigation);"
           )
 
           $NavigationReplacement = $NavigationReplacementLines -join "`n"
@@ -239,11 +201,11 @@ jobs:
             -NoNewline `
             -Encoding utf8
 
-          Write-Host "SSO navigation patch applied"
+          Write-Host "SSO navigation allowlist patch applied"
 
           Select-String `
             -Path $WindowPath `
-            -Pattern "externalSsoNavigationActive|Allowing Keycloak SSO navigation"
+            -Pattern "sso.gandc.ru|will-redirect|allowTrustedOrSsoNavigation"
 
 
       - name: Install dependencies
@@ -683,63 +645,25 @@ jobs:
           )
 
           replacement = "\n".join([
-              "let externalSsoNavigationActive = false;",
+              "const isAllowedSsoOrigin = (url: string): boolean => {",
+              "\ttry {",
+              "\t\treturn new URL(url).origin === 'https://sso.gandc.ru';",
+              "\t} catch {",
+              "\t\treturn false;",
+              "\t}",
+              "};",
               "",
-              "\twebContents.on('will-navigate', (event, url) => {",
+              "\tconst allowTrustedOrSsoNavigation = (event: Electron.Event, url: string): void => {",
-              "\t\tif (isTrustedOrigin(url)) {",
+              "\t\tif (isTrustedOrigin(url) || isAllowedSsoOrigin(url)) {",
-              "\t\t\tif (externalSsoNavigationActive) {",
-              "\t\t\t\tlogger.info('SSO navigation returned to trusted origin', {url});",
-              "\t\t\t}",
-              "\t\t\texternalSsoNavigationActive = false;",
               "\t\t\treturn;",
               "\t\t}",
               "",
-              "\t\ttry {",
+              "\t\tlogger.warn('Blocked navigation outside trusted and SSO origins', {url});",
-              "\t\t\tconst target = new URL(url);",
-              "",
-              "\t\t\tif (externalSsoNavigationActive) {",
-              "\t\t\t\tif (target.protocol === 'https:' || target.protocol === 'http:') {",
-              "\t\t\t\t\tlogger.info('Allowing active SSO navigation', {",
-              "\t\t\t\t\t\torigin: target.origin,",
-              "\t\t\t\t\t});",
-              "\t\t\t\t\treturn;",
-              "\t\t\t\t}",
-              "",
-              "\t\t\t\tlogger.warn('Blocked non-HTTP navigation during SSO', {",
-              "\t\t\t\t\turl,",
-              "\t\t\t\t});",
-              "\t\t\t\tevent.preventDefault();",
-              "\t\t\t\treturn;",
-              "\t\t\t}",
-              "",
-              "\t\t\tconst isKeycloakAuthorization =",
-              "\t\t\t\ttarget.protocol === 'https:' &&",
-              "\t\t\t\ttarget.pathname.includes('/protocol/openid-connect/auth') &&",
-              "\t\t\t\ttarget.searchParams.has('client_id') &&",
-              "\t\t\t\ttarget.searchParams.has('redirect_uri') &&",
-              "\t\t\t\ttarget.searchParams.has('state');",
-              "",
-              "\t\t\tif (",
-              "\t\t\t\tisKeycloakAuthorization &&",
-              "\t\t\t\tisTrustedOrigin(webContents.getURL())",
-              "\t\t\t) {",
-              "\t\t\t\texternalSsoNavigationActive = true;",
-              "",
-              "\t\t\t\tlogger.info('Allowing Keycloak SSO navigation', {",
-              "\t\t\t\t\torigin: target.origin,",
-              "\t\t\t\t});",
-              "",
-              "\t\t\t\treturn;",
-              "\t\t\t}",
-              "\t\t} catch (error) {",
-              "\t\t\tlogger.warn('Failed to parse navigation URL', {",
-              "\t\t\t\turl,",
-              "\t\t\t\terror,",
-              "\t\t\t});",
-              "\t\t}",
-              "",
               "\t\tevent.preventDefault();",
-              "\t});",
+              "\t};",
+              "",
+              "\twebContents.on('will-navigate', allowTrustedOrSsoNavigation);",
+              "\twebContents.on('will-redirect', allowTrustedOrSsoNavigation);",
           ])
 
           data, count = pattern.subn(
@@ -758,11 +682,11 @@ jobs:
               encoding="utf-8",
           )
 
-          print("SSO navigation patch applied")
+          print("SSO navigation allowlist patch applied")
           PY
 
           grep -n \
-            -E 'externalSsoNavigationActive|Allowing Keycloak SSO navigation' \
+            -E 'sso\.gandc\.ru|will-redirect|allowTrustedOrSsoNavigation' \
             fluxer-src/fluxer_desktop/src/main/Window.ts