force ice all v4

This reverts commit 6c7a87994e.

.gitea/workflows/desktop.yml

@@ -68,41 +68,17 @@ jobs:
           node --version
           pnpm --version
 
-
       - name: Setup Rust
-        shell: bash
+        shell: powershell
         run: |
-          set -euxo pipefail
+          $ErrorActionPreference = "Stop"
 
-          RUST_VERSION="1.98.1"
-
-          rm -f /tmp/rustup-init
-
-          curl \
-            --fail \
-            --location \
-            --retry 5 \
-            --retry-delay 3 \
-            --retry-all-errors \
-            --connect-timeout 20 \
-            https://static.rust-lang.org/rustup/dist/x86_64-unknown-linux-gnu/rustup-init \
-            -o /tmp/rustup-init
-
-          chmod +x /tmp/rustup-init
-
-          /tmp/rustup-init \
-            -y \
-            --profile minimal \
-            --default-toolchain "${RUST_VERSION}" \
-            --default-host x86_64-unknown-linux-gnu \
-            --no-modify-path
-
-          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
-
-          "$HOME/.cargo/bin/rustc" --version
-          "$HOME/.cargo/bin/cargo" --version
-          "$HOME/.cargo/bin/rustup" --version
+          rustup update stable
+          rustup default stable
+          rustup target add x86_64-pc-windows-msvc
 
+          rustc --version
+          cargo --version
 
       - name: Show build tools
         shell: powershell
@@ -174,6 +150,114 @@ jobs:
             throw "CANARY_APP_URL was not configured"
           }
 
+          $WindowPath = "fluxer-src\fluxer_desktop\src\main\Window.ts"
+
+          if (-not (Test-Path $WindowPath)) {
+            throw "Window.ts not found at $WindowPath"
+          }
+
+          $WindowContent = Get-Content $WindowPath -Raw
+
+          $NavigationPattern = "webContents\.on\('will-navigate', \(event, url\) => \{\r?\n\s*if \(!isTrustedOrigin\(url\)\) \{\r?\n\s*event\.preventDefault\(\);\r?\n\s*\}\r?\n\s*\}\);"
+
+          $NavigationReplacementLines = @(
+            "const isAllowedSsoOrigin = (url: string): boolean => {"
+            "`ttry {"
+            "`t`treturn new URL(url).origin === 'https://sso.gandc.ru';"
+            "`t} catch {"
+            "`t`treturn false;"
+            "`t}"
+            "};"
+            ""
+            "`tconst allowTrustedOrSsoNavigation = (event: Electron.Event, url: string): void => {"
+            "`t`tif (isTrustedOrigin(url) || isAllowedSsoOrigin(url)) {"
+            "`t`t`treturn;"
+            "`t`t}"
+            ""
+            "`t`tlogger.warn('Blocked navigation outside trusted and SSO origins', {url});"
+            "`t`tevent.preventDefault();"
+            "`t};"
+            ""
+            "`twebContents.on('will-navigate', allowTrustedOrSsoNavigation);"
+            "`twebContents.on('will-redirect', allowTrustedOrSsoNavigation);"
+          )
+
+          $NavigationReplacement = $NavigationReplacementLines -join "`n"
+
+          $PatchedWindowContent = [regex]::Replace(
+            $WindowContent,
+            $NavigationPattern,
+            $NavigationReplacement,
+            1
+          )
+
+          if ($PatchedWindowContent -eq $WindowContent) {
+            throw "Unable to patch Window.ts SSO navigation handler"
+          }
+
+          Set-Content `
+            -Path $WindowPath `
+            -Value $PatchedWindowContent `
+            -NoNewline `
+            -Encoding utf8
+
+          Write-Host "SSO navigation allowlist patch applied"
+
+          Select-String `
+            -Path $WindowPath `
+            -Pattern "sso.gandc.ru|will-redirect|allowTrustedOrSsoNavigation"
+
+
+      - name: Force WebRTC ICE policy to all
+        shell: powershell
+        run: |
+          $ErrorActionPreference = "Stop"
+
+          $Path = "fluxer-src\fluxer_desktop\src\preload\index.ts"
+
+          if (-not (Test-Path $Path)) {
+            throw "Desktop preload not found at $Path"
+          }
+
+          $Content = Get-Content $Path -Raw
+          $Anchor = "import {contextBridge, ipcRenderer, webFrame} from 'electron';"
+
+          if ($Content -notmatch [regex]::Escape($Anchor)) {
+            throw "Unable to locate Electron preload import"
+          }
+
+          if ($Content -match "installForceAllIceTransportPolicy") {
+            throw "WebRTC ICE policy patch is already present"
+          }
+
+          $Patch = [Text.Encoding]::UTF8.GetString(
+            [Convert]::FromBase64String(
+              "aW1wb3J0IHtjb250ZXh0QnJpZGdlLCBpcGNSZW5kZXJlciwgd2ViRnJhbWV9IGZyb20gJ2VsZWN0cm9uJzsKCmZ1bmN0aW9uIGluc3RhbGxGb3JjZUFsbEljZVRyYW5zcG9ydFBvbGljeSgpOiB2b2lkIHsKCWNvbnRleHRCcmlkZ2UuZXhlY3V0ZUluTWFpbldvcmxkKHsKCQlmdW5jOiAoKSA9PiB7CgkJCWNvbnN0IE5hdGl2ZVJUQ1BlZXJDb25uZWN0aW9uID0gd2luZG93LlJUQ1BlZXJDb25uZWN0aW9uOwoKCQkJaWYgKHR5cGVvZiBOYXRpdmVSVENQZWVyQ29ubmVjdGlvbiAhPT0gJ2Z1bmN0aW9uJykgewoJCQkJcmV0dXJuOwoJCQl9CgoJCQl3aW5kb3cuUlRDUGVlckNvbm5lY3Rpb24gPSBuZXcgUHJveHkoTmF0aXZlUlRDUGVlckNvbm5lY3Rpb24sIHsKCQkJCWNvbnN0cnVjdChUYXJnZXQsIGFyZ3MsIG5ld1RhcmdldCkgewoJCQkJCWNvbnN0IGNvbmZpZyA9IGFyZ3NbMF0gYXMgUlRDQ29uZmlndXJhdGlvbiB8IHVuZGVmaW5lZDsKCgkJCQkJaWYgKGNvbmZpZz8uaWNlVHJhbnNwb3J0UG9saWN5ID09PSAncmVsYXknKSB7CgkJCQkJCWFyZ3NbMF0gPSB7CgkJCQkJCQkuLi5jb25maWcsCgkJCQkJCQlpY2VUcmFuc3BvcnRQb2xpY3k6ICdhbGwnLAoJCQkJCQl9OwoJCQkJCX0KCgkJCQkJcmV0dXJuIFJlZmxlY3QuY29uc3RydWN0KFRhcmdldCwgYXJncywgbmV3VGFyZ2V0KTsKCQkJCX0sCgkJCX0pOwoKCQkJY29uc29sZS5pbmZvKCdbRmx1eGVyIERlc2t0b3BdIFdlYlJUQyBpY2VUcmFuc3BvcnRQb2xpY3kgZm9yY2VkIHRvIGFsbCcpOwoJCX0sCgl9KTsKfQoKaW5zdGFsbEZvcmNlQWxsSWNlVHJhbnNwb3J0UG9saWN5KCk7"
+            )
+          )
+
+          $Content = $Content.Replace(
+            $Anchor,
+            $Patch
+          )
+
+          Set-Content `
+            -Path $Path `
+            -Value $Content `
+            -NoNewline `
+            -Encoding utf8
+
+          $Result = Get-Content $Path -Raw
+
+          if ($Result -notmatch "installForceAllIceTransportPolicy") {
+            throw "WebRTC ICE policy patch verification failed"
+          }
+
+          Write-Host "Installed preload WebRTC ICE policy override"
+
+          Select-String `
+            -Path $Path `
+            -Pattern "installForceAllIceTransportPolicy|iceTransportPolicy forced to all"
 
       - name: Install dependencies
         shell: powershell
@@ -586,6 +670,144 @@ jobs:
           print(result)
           PY
 
+          python3 <<'PY'
+          from pathlib import Path
+          import re
+
+          path = Path(
+              "fluxer-src/fluxer_desktop/src/main/Window.ts"
+          )
+
+          if not path.is_file():
+              raise SystemExit(
+                  f"Window.ts not found: {path}"
+              )
+
+          data = path.read_text(
+              encoding="utf-8"
+          )
+
+          pattern = re.compile(
+              r"webContents\.on\('will-navigate', \(event, url\) => \{\s*"
+              r"if \(!isTrustedOrigin\(url\)\) \{\s*"
+              r"event\.preventDefault\(\);\s*"
+              r"\}\s*"
+              r"\}\);"
+          )
+
+          replacement = "\n".join([
+              "const isAllowedSsoOrigin = (url: string): boolean => {",
+              "\ttry {",
+              "\t\treturn new URL(url).origin === 'https://sso.gandc.ru';",
+              "\t} catch {",
+              "\t\treturn false;",
+              "\t}",
+              "};",
+              "",
+              "\tconst allowTrustedOrSsoNavigation = (event: Electron.Event, url: string): void => {",
+              "\t\tif (isTrustedOrigin(url) || isAllowedSsoOrigin(url)) {",
+              "\t\t\treturn;",
+              "\t\t}",
+              "",
+              "\t\tlogger.warn('Blocked navigation outside trusted and SSO origins', {url});",
+              "\t\tevent.preventDefault();",
+              "\t};",
+              "",
+              "\twebContents.on('will-navigate', allowTrustedOrSsoNavigation);",
+              "\twebContents.on('will-redirect', allowTrustedOrSsoNavigation);",
+          ])
+
+          data, count = pattern.subn(
+              replacement,
+              data,
+              count=1,
+          )
+
+          if count != 1:
+              raise SystemExit(
+                  "Unable to patch Window.ts SSO navigation handler"
+              )
+
+          path.write_text(
+              data,
+              encoding="utf-8",
+          )
+
+          print("SSO navigation allowlist patch applied")
+          PY
+
+          grep -n \
+            -E 'sso\.gandc\.ru|will-redirect|allowTrustedOrSsoNavigation' \
+            fluxer-src/fluxer_desktop/src/main/Window.ts
+
+
+      - name: Force WebRTC ICE policy to all
+        shell: bash
+        run: |
+          set -euxo pipefail
+
+          python3 - <<'PY'
+          from pathlib import Path
+          import base64
+
+          path = Path(
+              "fluxer-src/fluxer_desktop/"
+              "src/preload/index.ts"
+          )
+
+          if not path.is_file():
+              raise SystemExit(
+                  f"Desktop preload not found: {path}"
+              )
+
+          data = path.read_text(
+              encoding="utf-8"
+          )
+
+          anchor = "import {contextBridge, ipcRenderer, webFrame} from 'electron';"
+
+          if anchor not in data:
+              raise SystemExit(
+                  "Unable to locate Electron preload import"
+              )
+
+          if "installForceAllIceTransportPolicy" in data:
+              raise SystemExit(
+                  "WebRTC ICE policy patch is already present"
+              )
+
+          patch = base64.b64decode(
+              "aW1wb3J0IHtjb250ZXh0QnJpZGdlLCBpcGNSZW5kZXJlciwgd2ViRnJhbWV9IGZyb20gJ2VsZWN0cm9uJzsKCmZ1bmN0aW9uIGluc3RhbGxGb3JjZUFsbEljZVRyYW5zcG9ydFBvbGljeSgpOiB2b2lkIHsKCWNvbnRleHRCcmlkZ2UuZXhlY3V0ZUluTWFpbldvcmxkKHsKCQlmdW5jOiAoKSA9PiB7CgkJCWNvbnN0IE5hdGl2ZVJUQ1BlZXJDb25uZWN0aW9uID0gd2luZG93LlJUQ1BlZXJDb25uZWN0aW9uOwoKCQkJaWYgKHR5cGVvZiBOYXRpdmVSVENQZWVyQ29ubmVjdGlvbiAhPT0gJ2Z1bmN0aW9uJykgewoJCQkJcmV0dXJuOwoJCQl9CgoJCQl3aW5kb3cuUlRDUGVlckNvbm5lY3Rpb24gPSBuZXcgUHJveHkoTmF0aXZlUlRDUGVlckNvbm5lY3Rpb24sIHsKCQkJCWNvbnN0cnVjdChUYXJnZXQsIGFyZ3MsIG5ld1RhcmdldCkgewoJCQkJCWNvbnN0IGNvbmZpZyA9IGFyZ3NbMF0gYXMgUlRDQ29uZmlndXJhdGlvbiB8IHVuZGVmaW5lZDsKCgkJCQkJaWYgKGNvbmZpZz8uaWNlVHJhbnNwb3J0UG9saWN5ID09PSAncmVsYXknKSB7CgkJCQkJCWFyZ3NbMF0gPSB7CgkJCQkJCQkuLi5jb25maWcsCgkJCQkJCQlpY2VUcmFuc3BvcnRQb2xpY3k6ICdhbGwnLAoJCQkJCQl9OwoJCQkJCX0KCgkJCQkJcmV0dXJuIFJlZmxlY3QuY29uc3RydWN0KFRhcmdldCwgYXJncywgbmV3VGFyZ2V0KTsKCQkJCX0sCgkJCX0pOwoKCQkJY29uc29sZS5pbmZvKCdbRmx1eGVyIERlc2t0b3BdIFdlYlJUQyBpY2VUcmFuc3BvcnRQb2xpY3kgZm9yY2VkIHRvIGFsbCcpOwoJCX0sCgl9KTsKfQoKaW5zdGFsbEZvcmNlQWxsSWNlVHJhbnNwb3J0UG9saWN5KCk7"
+          ).decode("utf-8")
+
+          data = data.replace(
+              anchor,
+              patch,
+              1,
+          )
+
+          path.write_text(
+              data,
+              encoding="utf-8",
+          )
+
+          result = path.read_text(
+              encoding="utf-8"
+          )
+
+          if "installForceAllIceTransportPolicy" not in result:
+              raise SystemExit(
+                  "WebRTC ICE policy patch verification failed"
+              )
+
+          print(
+              "Installed preload WebRTC ICE policy override"
+          )
+          PY
+
+          grep -n \
+            -E 'installForceAllIceTransportPolicy|iceTransportPolicy forced to all' \
+            fluxer-src/fluxer_desktop/src/preload/index.ts
 
       - name: Install dependencies
         shell: bash