fix sso login failure 2

.gitea/workflows/desktop.yml

@@ -68,41 +68,17 @@ jobs:
           node --version
           pnpm --version
 
-
       - name: Setup Rust
-        shell: bash
+        shell: powershell
         run: |
-          set -euxo pipefail
+          $ErrorActionPreference = "Stop"
 
-          RUST_VERSION="1.98.1"
-
-          rm -f /tmp/rustup-init
-
-          curl \
-            --fail \
-            --location \
-            --retry 5 \
-            --retry-delay 3 \
-            --retry-all-errors \
-            --connect-timeout 20 \
-            https://static.rust-lang.org/rustup/dist/x86_64-unknown-linux-gnu/rustup-init \
-            -o /tmp/rustup-init
-
-          chmod +x /tmp/rustup-init
-
-          /tmp/rustup-init \
-            -y \
-            --profile minimal \
-            --default-toolchain "${RUST_VERSION}" \
-            --default-host x86_64-unknown-linux-gnu \
-            --no-modify-path
-
-          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
-
-          "$HOME/.cargo/bin/rustc" --version
-          "$HOME/.cargo/bin/cargo" --version
-          "$HOME/.cargo/bin/rustup" --version
+          rustup update stable
+          rustup default stable
+          rustup target add x86_64-pc-windows-msvc
 
+          rustc --version
+          cargo --version
 
       - name: Show build tools
         shell: powershell
@@ -174,6 +150,63 @@ jobs:
             throw "CANARY_APP_URL was not configured"
           }
 
+          $WindowPath = "fluxer-src\fluxer_desktop\src\main\Window.ts"
+
+          if (-not (Test-Path $WindowPath)) {
+            throw "Window.ts not found at $WindowPath"
+          }
+
+          $WindowContent = Get-Content $WindowPath -Raw
+
+          $NavigationPattern = "webContents\.on\('will-navigate', \(event, url\) => \{\r?\n\s*if \(!isTrustedOrigin\(url\)\) \{\r?\n\s*event\.preventDefault\(\);\r?\n\s*\}\r?\n\s*\}\);"
+
+          $NavigationReplacementLines = @(
+            "const isAllowedSsoOrigin = (url: string): boolean => {"
+            "`ttry {"
+            "`t`treturn new URL(url).origin === 'https://sso.gandc.ru';"
+            "`t} catch {"
+            "`t`treturn false;"
+            "`t}"
+            "};"
+            ""
+            "`tconst allowTrustedOrSsoNavigation = (event: Electron.Event, url: string): void => {"
+            "`t`tif (isTrustedOrigin(url) || isAllowedSsoOrigin(url)) {"
+            "`t`t`treturn;"
+            "`t`t}"
+            ""
+            "`t`tlogger.warn('Blocked navigation outside trusted and SSO origins', {url});"
+            "`t`tevent.preventDefault();"
+            "`t};"
+            ""
+            "`twebContents.on('will-navigate', allowTrustedOrSsoNavigation);"
+            "`twebContents.on('will-redirect', allowTrustedOrSsoNavigation);"
+          )
+
+          $NavigationReplacement = $NavigationReplacementLines -join "`n"
+
+          $PatchedWindowContent = [regex]::Replace(
+            $WindowContent,
+            $NavigationPattern,
+            $NavigationReplacement,
+            1
+          )
+
+          if ($PatchedWindowContent -eq $WindowContent) {
+            throw "Unable to patch Window.ts SSO navigation handler"
+          }
+
+          Set-Content `
+            -Path $WindowPath `
+            -Value $PatchedWindowContent `
+            -NoNewline `
+            -Encoding utf8
+
+          Write-Host "SSO navigation allowlist patch applied"
+
+          Select-String `
+            -Path $WindowPath `
+            -Pattern "sso.gandc.ru|will-redirect|allowTrustedOrSsoNavigation"
+
 
       - name: Install dependencies
         shell: powershell
@@ -586,6 +619,76 @@ jobs:
           print(result)
           PY
 
+          python3 <<'PY'
+          from pathlib import Path
+          import re
+
+          path = Path(
+              "fluxer-src/fluxer_desktop/src/main/Window.ts"
+          )
+
+          if not path.is_file():
+              raise SystemExit(
+                  f"Window.ts not found: {path}"
+              )
+
+          data = path.read_text(
+              encoding="utf-8"
+          )
+
+          pattern = re.compile(
+              r"webContents\.on\('will-navigate', \(event, url\) => \{\s*"
+              r"if \(!isTrustedOrigin\(url\)\) \{\s*"
+              r"event\.preventDefault\(\);\s*"
+              r"\}\s*"
+              r"\}\);"
+          )
+
+          replacement = "\n".join([
+              "const isAllowedSsoOrigin = (url: string): boolean => {",
+              "\ttry {",
+              "\t\treturn new URL(url).origin === 'https://sso.gandc.ru';",
+              "\t} catch {",
+              "\t\treturn false;",
+              "\t}",
+              "};",
+              "",
+              "\tconst allowTrustedOrSsoNavigation = (event: Electron.Event, url: string): void => {",
+              "\t\tif (isTrustedOrigin(url) || isAllowedSsoOrigin(url)) {",
+              "\t\t\treturn;",
+              "\t\t}",
+              "",
+              "\t\tlogger.warn('Blocked navigation outside trusted and SSO origins', {url});",
+              "\t\tevent.preventDefault();",
+              "\t};",
+              "",
+              "\twebContents.on('will-navigate', allowTrustedOrSsoNavigation);",
+              "\twebContents.on('will-redirect', allowTrustedOrSsoNavigation);",
+          ])
+
+          data, count = pattern.subn(
+              replacement,
+              data,
+              count=1,
+          )
+
+          if count != 1:
+              raise SystemExit(
+                  "Unable to patch Window.ts SSO navigation handler"
+              )
+
+          path.write_text(
+              data,
+              encoding="utf-8",
+          )
+
+          print("SSO navigation allowlist patch applied")
+          PY
+
+          grep -n \
+            -E 'sso\.gandc\.ru|will-redirect|allowTrustedOrSsoNavigation' \
+            fluxer-src/fluxer_desktop/src/main/Window.ts
+
 
       - name: Install dependencies
         shell: bash