force ice all v4

This reverts commit 6c7a87994e.

.gitea/workflows/desktop.yml

@@ -207,45 +207,57 @@ jobs:
             -Path $WindowPath `
             -Pattern "sso.gandc.ru|will-redirect|allowTrustedOrSsoNavigation"
 
-          $WindowContent = Get-Content $WindowPath -Raw
 
-          if ($WindowContent -match "'local-network-access'") {
-            throw "Local network permissions are already present in Window.ts"
+      - name: Force WebRTC ICE policy to all
+        shell: powershell
+        run: |
+          $ErrorActionPreference = "Stop"
+
+          $Path = "fluxer-src\fluxer_desktop\src\preload\index.ts"
+
+          if (-not (Test-Path $Path)) {
+            throw "Desktop preload not found at $Path"
           }
 
-          $PermissionPattern = "'clipboard-sanitized-write',\r?\n\]\);"
+          $Content = Get-Content $Path -Raw
+          $Anchor = "import {contextBridge, ipcRenderer, webFrame} from 'electron';"
 
-          $PermissionReplacement = @(
-            "'clipboard-sanitized-write',"
-            "`t'local-network-access',"
-            "`t'local-network',"
-            "`t'loopback-network',"
-            "]);"
-          ) -join "`n"
+          if ($Content -notmatch [regex]::Escape($Anchor)) {
+            throw "Unable to locate Electron preload import"
+          }
 
-          $PatchedWindowContent = [regex]::Replace(
-            $WindowContent,
-            $PermissionPattern,
-            $PermissionReplacement,
-            1
+          if ($Content -match "installForceAllIceTransportPolicy") {
+            throw "WebRTC ICE policy patch is already present"
+          }
+
+          $Patch = [Text.Encoding]::UTF8.GetString(
+            [Convert]::FromBase64String(
+              "aW1wb3J0IHtjb250ZXh0QnJpZGdlLCBpcGNSZW5kZXJlciwgd2ViRnJhbWV9IGZyb20gJ2VsZWN0cm9uJzsKCmZ1bmN0aW9uIGluc3RhbGxGb3JjZUFsbEljZVRyYW5zcG9ydFBvbGljeSgpOiB2b2lkIHsKCWNvbnRleHRCcmlkZ2UuZXhlY3V0ZUluTWFpbldvcmxkKHsKCQlmdW5jOiAoKSA9PiB7CgkJCWNvbnN0IE5hdGl2ZVJUQ1BlZXJDb25uZWN0aW9uID0gd2luZG93LlJUQ1BlZXJDb25uZWN0aW9uOwoKCQkJaWYgKHR5cGVvZiBOYXRpdmVSVENQZWVyQ29ubmVjdGlvbiAhPT0gJ2Z1bmN0aW9uJykgewoJCQkJcmV0dXJuOwoJCQl9CgoJCQl3aW5kb3cuUlRDUGVlckNvbm5lY3Rpb24gPSBuZXcgUHJveHkoTmF0aXZlUlRDUGVlckNvbm5lY3Rpb24sIHsKCQkJCWNvbnN0cnVjdChUYXJnZXQsIGFyZ3MsIG5ld1RhcmdldCkgewoJCQkJCWNvbnN0IGNvbmZpZyA9IGFyZ3NbMF0gYXMgUlRDQ29uZmlndXJhdGlvbiB8IHVuZGVmaW5lZDsKCgkJCQkJaWYgKGNvbmZpZz8uaWNlVHJhbnNwb3J0UG9saWN5ID09PSAncmVsYXknKSB7CgkJCQkJCWFyZ3NbMF0gPSB7CgkJCQkJCQkuLi5jb25maWcsCgkJCQkJCQlpY2VUcmFuc3BvcnRQb2xpY3k6ICdhbGwnLAoJCQkJCQl9OwoJCQkJCX0KCgkJCQkJcmV0dXJuIFJlZmxlY3QuY29uc3RydWN0KFRhcmdldCwgYXJncywgbmV3VGFyZ2V0KTsKCQkJCX0sCgkJCX0pOwoKCQkJY29uc29sZS5pbmZvKCdbRmx1eGVyIERlc2t0b3BdIFdlYlJUQyBpY2VUcmFuc3BvcnRQb2xpY3kgZm9yY2VkIHRvIGFsbCcpOwoJCX0sCgl9KTsKfQoKaW5zdGFsbEZvcmNlQWxsSWNlVHJhbnNwb3J0UG9saWN5KCk7"
+            )
           )
 
-          if ($PatchedWindowContent -eq $WindowContent) {
-            throw "Unable to patch trustedRendererPermissionTypes"
-          }
+          $Content = $Content.Replace(
+            $Anchor,
+            $Patch
+          )
 
           Set-Content `
-            -Path $WindowPath `
-            -Value $PatchedWindowContent `
+            -Path $Path `
+            -Value $Content `
             -NoNewline `
             -Encoding utf8
 
-          Write-Host "Local network permissions patch applied"
+          $Result = Get-Content $Path -Raw
+
+          if ($Result -notmatch "installForceAllIceTransportPolicy") {
+            throw "WebRTC ICE policy patch verification failed"
+          }
+
+          Write-Host "Installed preload WebRTC ICE policy override"
 
           Select-String `
-            -Path $WindowPath `
-            -Pattern "local-network-access|local-network|loopback-network"
-
+            -Path $Path `
+            -Pattern "installForceAllIceTransportPolicy|iceTransportPolicy forced to all"
 
       - name: Install dependencies
         shell: powershell
@@ -728,43 +740,49 @@ jobs:
             -E 'sso\.gandc\.ru|will-redirect|allowTrustedOrSsoNavigation' \
             fluxer-src/fluxer_desktop/src/main/Window.ts
 
-          python3 <<'PY'
+
+      - name: Force WebRTC ICE policy to all
+        shell: bash
+        run: |
+          set -euxo pipefail
+
+          python3 - <<'PY'
           from pathlib import Path
+          import base64
 
           path = Path(
-              "fluxer-src/fluxer_desktop/src/main/Window.ts"
+              "fluxer-src/fluxer_desktop/"
+              "src/preload/index.ts"
           )
 
+          if not path.is_file():
+              raise SystemExit(
+                  f"Desktop preload not found: {path}"
+              )
+
           data = path.read_text(
               encoding="utf-8"
           )
 
-          if "'local-network-access'" in data:
+          anchor = "import {contextBridge, ipcRenderer, webFrame} from 'electron';"
+
+          if anchor not in data:
               raise SystemExit(
-                  "Local network permissions are already present in Window.ts"
+                  "Unable to locate Electron preload import"
               )
 
-          old = (
-              "\t'clipboard-sanitized-write',\n"
-              "]);"
-          )
-
-          new = (
-              "\t'clipboard-sanitized-write',\n"
-              "\t'local-network-access',\n"
-              "\t'local-network',\n"
-              "\t'loopback-network',\n"
-              "]);"
-          )
-
-          if data.count(old) != 1:
+          if "installForceAllIceTransportPolicy" in data:
               raise SystemExit(
-                  "Unable to locate trustedRendererPermissionTypes"
+                  "WebRTC ICE policy patch is already present"
               )
 
+          patch = base64.b64decode(
+              "aW1wb3J0IHtjb250ZXh0QnJpZGdlLCBpcGNSZW5kZXJlciwgd2ViRnJhbWV9IGZyb20gJ2VsZWN0cm9uJzsKCmZ1bmN0aW9uIGluc3RhbGxGb3JjZUFsbEljZVRyYW5zcG9ydFBvbGljeSgpOiB2b2lkIHsKCWNvbnRleHRCcmlkZ2UuZXhlY3V0ZUluTWFpbldvcmxkKHsKCQlmdW5jOiAoKSA9PiB7CgkJCWNvbnN0IE5hdGl2ZVJUQ1BlZXJDb25uZWN0aW9uID0gd2luZG93LlJUQ1BlZXJDb25uZWN0aW9uOwoKCQkJaWYgKHR5cGVvZiBOYXRpdmVSVENQZWVyQ29ubmVjdGlvbiAhPT0gJ2Z1bmN0aW9uJykgewoJCQkJcmV0dXJuOwoJCQl9CgoJCQl3aW5kb3cuUlRDUGVlckNvbm5lY3Rpb24gPSBuZXcgUHJveHkoTmF0aXZlUlRDUGVlckNvbm5lY3Rpb24sIHsKCQkJCWNvbnN0cnVjdChUYXJnZXQsIGFyZ3MsIG5ld1RhcmdldCkgewoJCQkJCWNvbnN0IGNvbmZpZyA9IGFyZ3NbMF0gYXMgUlRDQ29uZmlndXJhdGlvbiB8IHVuZGVmaW5lZDsKCgkJCQkJaWYgKGNvbmZpZz8uaWNlVHJhbnNwb3J0UG9saWN5ID09PSAncmVsYXknKSB7CgkJCQkJCWFyZ3NbMF0gPSB7CgkJCQkJCQkuLi5jb25maWcsCgkJCQkJCQlpY2VUcmFuc3BvcnRQb2xpY3k6ICdhbGwnLAoJCQkJCQl9OwoJCQkJCX0KCgkJCQkJcmV0dXJuIFJlZmxlY3QuY29uc3RydWN0KFRhcmdldCwgYXJncywgbmV3VGFyZ2V0KTsKCQkJCX0sCgkJCX0pOwoKCQkJY29uc29sZS5pbmZvKCdbRmx1eGVyIERlc2t0b3BdIFdlYlJUQyBpY2VUcmFuc3BvcnRQb2xpY3kgZm9yY2VkIHRvIGFsbCcpOwoJCX0sCgl9KTsKfQoKaW5zdGFsbEZvcmNlQWxsSWNlVHJhbnNwb3J0UG9saWN5KCk7"
+          ).decode("utf-8")
+
           data = data.replace(
-              old,
-              new,
+              anchor,
+              patch,
               1,
           )
 
@@ -773,13 +791,23 @@ jobs:
               encoding="utf-8",
           )
 
-          print("Local network permissions patch applied")
+          result = path.read_text(
+              encoding="utf-8"
+          )
+
+          if "installForceAllIceTransportPolicy" not in result:
+              raise SystemExit(
+                  "WebRTC ICE policy patch verification failed"
+              )
+
+          print(
+              "Installed preload WebRTC ICE policy override"
+          )
           PY
 
           grep -n \
-            -E "local-network-access|local-network|loopback-network" \
-            fluxer-src/fluxer_desktop/src/main/Window.ts
-
+            -E 'installForceAllIceTransportPolicy|iceTransportPolicy forced to all' \
+            fluxer-src/fluxer_desktop/src/preload/index.ts
 
       - name: Install dependencies
         shell: bash