fix sso login failure 2

.gitea/workflows/desktop.yml

@@ -68,7 +68,6 @@ jobs:
           node --version
           pnpm --version
 
-
       - name: Setup Rust
         shell: powershell
         run: |
@@ -81,7 +80,6 @@ jobs:
           rustc --version
           cargo --version
 
-
       - name: Show build tools
         shell: powershell
         run: |
@@ -152,6 +150,63 @@ jobs:
             throw "CANARY_APP_URL was not configured"
           }
 
+          $WindowPath = "fluxer-src\fluxer_desktop\src\main\Window.ts"
+
+          if (-not (Test-Path $WindowPath)) {
+            throw "Window.ts not found at $WindowPath"
+          }
+
+          $WindowContent = Get-Content $WindowPath -Raw
+
+          $NavigationPattern = "webContents\.on\('will-navigate', \(event, url\) => \{\r?\n\s*if \(!isTrustedOrigin\(url\)\) \{\r?\n\s*event\.preventDefault\(\);\r?\n\s*\}\r?\n\s*\}\);"
+
+          $NavigationReplacementLines = @(
+            "const isAllowedSsoOrigin = (url: string): boolean => {"
+            "`ttry {"
+            "`t`treturn new URL(url).origin === 'https://sso.gandc.ru';"
+            "`t} catch {"
+            "`t`treturn false;"
+            "`t}"
+            "};"
+            ""
+            "`tconst allowTrustedOrSsoNavigation = (event: Electron.Event, url: string): void => {"
+            "`t`tif (isTrustedOrigin(url) || isAllowedSsoOrigin(url)) {"
+            "`t`t`treturn;"
+            "`t`t}"
+            ""
+            "`t`tlogger.warn('Blocked navigation outside trusted and SSO origins', {url});"
+            "`t`tevent.preventDefault();"
+            "`t};"
+            ""
+            "`twebContents.on('will-navigate', allowTrustedOrSsoNavigation);"
+            "`twebContents.on('will-redirect', allowTrustedOrSsoNavigation);"
+          )
+
+          $NavigationReplacement = $NavigationReplacementLines -join "`n"
+
+          $PatchedWindowContent = [regex]::Replace(
+            $WindowContent,
+            $NavigationPattern,
+            $NavigationReplacement,
+            1
+          )
+
+          if ($PatchedWindowContent -eq $WindowContent) {
+            throw "Unable to patch Window.ts SSO navigation handler"
+          }
+
+          Set-Content `
+            -Path $WindowPath `
+            -Value $PatchedWindowContent `
+            -NoNewline `
+            -Encoding utf8
+
+          Write-Host "SSO navigation allowlist patch applied"
+
+          Select-String `
+            -Path $WindowPath `
+            -Pattern "sso.gandc.ru|will-redirect|allowTrustedOrSsoNavigation"
+
 
       - name: Install dependencies
         shell: powershell
@@ -357,6 +412,98 @@ jobs:
             -name 'libfido2*' \
             -print
 
+      - name: Install modern PipeWire
+        shell: bash
+        run: |
+          set -euxo pipefail
+
+          PIPEWIRE_VERSION="1.0.5"
+
+          rm -rf /tmp/pipewire
+
+          git clone \
+            --depth 1 \
+            --branch "${PIPEWIRE_VERSION}" \
+            https://github.com/PipeWire/pipewire.git \
+            /tmp/pipewire
+
+          meson setup \
+            /tmp/pipewire/build \
+            /tmp/pipewire \
+            --prefix=/usr/local \
+            --libdir=lib/x86_64-linux-gnu \
+            --buildtype=release \
+            -Ddocs=disabled \
+            -Dman=disabled \
+            -Dexamples=disabled \
+            -Dtests=disabled \
+            -Dinstalled_tests=disabled \
+            -Dsession-managers=[] \
+            -Dgstreamer=disabled \
+            -Dsystemd=disabled \
+            -Dselinux=disabled \
+            -Dpipewire-jack=disabled \
+            -Dpipewire-v4l2=disabled \
+            -Dbluez5=disabled \
+            -Djack=disabled \
+            -Dv4l2=disabled \
+            -Dlibcamera=disabled \
+            -Dvulkan=disabled \
+            -Dsdl2=disabled \
+            -Dlibmysofa=disabled \
+            -Droc=disabled \
+            -Davahi=disabled \
+            -Decho-cancel-webrtc=disabled \
+            -Dlibusb=disabled \
+            -Draop=disabled \
+            -Dlv2=disabled \
+            -Dlibcanberra=disabled \
+            -Dlibffado=disabled
+
+          meson compile \
+            -C /tmp/pipewire/build \
+            -j "$(nproc)"
+
+          meson install \
+            -C /tmp/pipewire/build
+
+          ldconfig
+
+          export PKG_CONFIG_PATH="/usr/local/lib/x86_64-linux-gnu/pkgconfig:/usr/local/lib/pkgconfig:/usr/lib/x86_64-linux-gnu/pkgconfig"
+
+          echo "=== PipeWire ==="
+
+          pkg-config \
+            --modversion \
+            libpipewire-0.3
+
+          pkg-config \
+            --modversion \
+            libspa-0.2
+
+          echo "=== PipeWire CFLAGS ==="
+
+          pkg-config \
+            --cflags \
+            libpipewire-0.3
+
+          pkg-config \
+            --cflags \
+            libspa-0.2
+
+          echo "=== Checking headers ==="
+
+          grep -R \
+            "spa_meta_region_is_valid" \
+            /usr/local/include/spa-0.2/spa \
+            | head
+
+          echo "=== PipeWire libraries ==="
+
+          find /usr/local/lib \
+            \( -name 'libpipewire-0.3.so*' -o -name 'libspa*.so*' \) \
+            -print
+
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
@@ -472,6 +619,76 @@ jobs:
           print(result)
           PY
 
+          python3 <<'PY'
+          from pathlib import Path
+          import re
+
+          path = Path(
+              "fluxer-src/fluxer_desktop/src/main/Window.ts"
+          )
+
+          if not path.is_file():
+              raise SystemExit(
+                  f"Window.ts not found: {path}"
+              )
+
+          data = path.read_text(
+              encoding="utf-8"
+          )
+
+          pattern = re.compile(
+              r"webContents\.on\('will-navigate', \(event, url\) => \{\s*"
+              r"if \(!isTrustedOrigin\(url\)\) \{\s*"
+              r"event\.preventDefault\(\);\s*"
+              r"\}\s*"
+              r"\}\);"
+          )
+
+          replacement = "\n".join([
+              "const isAllowedSsoOrigin = (url: string): boolean => {",
+              "\ttry {",
+              "\t\treturn new URL(url).origin === 'https://sso.gandc.ru';",
+              "\t} catch {",
+              "\t\treturn false;",
+              "\t}",
+              "};",
+              "",
+              "\tconst allowTrustedOrSsoNavigation = (event: Electron.Event, url: string): void => {",
+              "\t\tif (isTrustedOrigin(url) || isAllowedSsoOrigin(url)) {",
+              "\t\t\treturn;",
+              "\t\t}",
+              "",
+              "\t\tlogger.warn('Blocked navigation outside trusted and SSO origins', {url});",
+              "\t\tevent.preventDefault();",
+              "\t};",
+              "",
+              "\twebContents.on('will-navigate', allowTrustedOrSsoNavigation);",
+              "\twebContents.on('will-redirect', allowTrustedOrSsoNavigation);",
+          ])
+
+          data, count = pattern.subn(
+              replacement,
+              data,
+              count=1,
+          )
+
+          if count != 1:
+              raise SystemExit(
+                  "Unable to patch Window.ts SSO navigation handler"
+              )
+
+          path.write_text(
+              data,
+              encoding="utf-8",
+          )
+
+          print("SSO navigation allowlist patch applied")
+          PY
+
+          grep -n \
+            -E 'sso\.gandc\.ru|will-redirect|allowTrustedOrSsoNavigation' \
+            fluxer-src/fluxer_desktop/src/main/Window.ts
+
 
       - name: Install dependencies
         shell: bash