@livx.cc/appwrap 0.54.0 → 0.56.0

package/runtime-desktop/crates/webview-control/src/popup.rs

@@ -1,522 +0,0 @@
-// macOS popup-window support — makes arbitrary wrapped web apps' `window.open` flows work
-// (Firebase signInWithPopup dies with auth/popup-blocked without this).
-//
-// Approach: wrap wry's WKUIDelegate with our own that implements
-//   - webView:createWebViewWithConfiguration:forNavigationAction:windowFeatures:
-//     The child WKWebView is alloc'd with the PASSED configuration — that's what preserves
-//     window.opener / postMessage and the shared session. Hosted in a plain NSWindow.
-//   - webViewDidClose: — pages that call window.close() (Firebase popups do) close their NSWindow.
-// Everything else is forwarded to wry's original delegate via forwardingTargetForSelector /
-// respondsToSelector (wry ALWAYS installs a WryWebViewUIDelegate; `uiDelegate` is a WEAK property,
-// so we keep a strong ref to wry's delegate in our ivars — dropping it would break file-upload
-// panels and media-capture grants).
-//
-// wry 0.55 does have a built-in popup path (NewWindowResponse::Allow via tauri's on_new_window),
-// but it implements NO webViewDidClose and exposes no child handle to patch one in — a Firebase
-// popup would linger as a dead window after auth. Hence the wrapper.
-use std::ffi::c_void;
-use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::Mutex;
-
-use objc2::rc::Retained;
-use objc2::runtime::{AnyObject, NSObject, NSObjectProtocol, ProtocolObject, Sel};
-use objc2::{define_class, msg_send, DefinedClass, MainThreadMarker, MainThreadOnly, Message};
-use objc2_app_kit::{NSBackingStoreType, NSWindow, NSWindowDelegate, NSWindowStyleMask};
-use objc2_foundation::{NSNotification, NSPoint, NSRect, NSSize, NSString, NSURL, NSURLRequest};
-use objc2_web_kit::{
-    WKFrameInfo, WKMediaCaptureType, WKNavigationAction, WKNavigationActionPolicy, WKNavigationDelegate,
-    WKPermissionDecision, WKSecurityOrigin, WKUIDelegate, WKWebView, WKWebViewConfiguration,
-    WKWindowFeatures,
-};
-
-/// When true, Google `signInWithPopup` OAuth popups get `prompt=select_account` appended so a
-/// remembered Google session doesn't auto-sign — the user picks an account (multi-account apps like
-/// Unclaw). Set once from the shell config at install(); read in the child's navigation delegate.
-static GOOGLE_ACCOUNT_PICKER: AtomicBool = AtomicBool::new(false);
-
-/// Rewrite a Google OAuth popup URL to force the account chooser, or None to leave it untouched.
-/// Matches only `accounts.google.com` OAuth authorize / sign-in endpoints that don't already carry a
-/// `prompt` param (so we don't clobber an app that set its own, and don't loop on our own reload).
-fn google_account_picker_rewrite(url: &str) -> Option<String> {
-    let is_oauth = url.starts_with("https://accounts.google.com/o/oauth2")
-        || url.starts_with("https://accounts.google.com/signin/oauth");
-    if !is_oauth {
-        return None;
-    }
-    let query = url.split_once('?').map(|(_, q)| q).unwrap_or("");
-    let has_prompt = query.split('&').any(|kv| kv == "prompt" || kv.starts_with("prompt="));
-    if has_prompt {
-        return None;
-    }
-    let sep = if url.contains('?') { '&' } else { '?' };
-    Some(format!("{url}{sep}prompt=select_account"))
-}
-
-/// Safari-equivalent UA (no wry/Tauri token, full `Version/… Safari/…` suffix) — Google blocks
-/// OAuth in webviews whose UA lacks it (disallowed_useragent). Applied to the shell webview
-/// (main.rs builder) and every child popup.
-pub const SAFARI_UA: &str = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15";
-
-#[cfg(test)]
-mod tests {
-    use super::google_account_picker_rewrite as r;
-    #[test]
-    fn appends_prompt_to_oauth_urls() {
-        assert_eq!(
-            r("https://accounts.google.com/o/oauth2/auth?client_id=x").as_deref(),
-            Some("https://accounts.google.com/o/oauth2/auth?client_id=x&prompt=select_account")
-        );
-        assert_eq!(
-            r("https://accounts.google.com/signin/oauth").as_deref(),
-            Some("https://accounts.google.com/signin/oauth?prompt=select_account")
-        );
-    }
-    #[test]
-    fn leaves_others_untouched() {
-        assert!(r("https://accounts.google.com/o/oauth2/auth?prompt=consent").is_none());
-        assert!(r("https://accounts.google.com/o/oauth2/auth?x=1&prompt=none").is_none());
-        assert!(r("https://example.com/o/oauth2/auth").is_none());
-        assert!(r("https://myapp.firebaseapp.com/__/auth/handler").is_none());
-    }
-
-    #[test]
-    fn descendants_resolve_transitively() {
-        use super::descendants_of;
-        // 1 → 2 → 3, 1 → 4; 5 hangs off an unrelated 9.
-        let pairs = [(2, 1), (3, 2), (4, 1), (5, 9)];
-        let mut d = descendants_of(&pairs, 1);
-        d.sort_unstable();
-        assert_eq!(d, vec![2, 3, 4]);
-        assert_eq!(descendants_of(&pairs, 3), Vec::<usize>::new());
-        assert_eq!(descendants_of(&pairs, 9), vec![5]);
-    }
-
-    #[test]
-    fn descendants_cycle_safe() {
-        // Degenerate cycle must terminate and not include the root.
-        let pairs = [(2, 1), (1, 2)];
-        assert_eq!(super::descendants_of(&pairs, 1), vec![2]);
-    }
-}
-
-/// Strong refs for one open popup. Only touched on the main thread (Send impl exists purely so
-/// the registry can live in a static Mutex — same pattern as oauth_mac::ActiveFlow).
-struct Popup {
-    window: Retained<NSWindow>,
-    webview: Retained<WKWebView>,
-    /// Opener WKWebView pointer (shell webview for top-level popups, another popup's webview for
-    /// nested ones). Identity only — never dereferenced. Drives cascade-close.
-    parent: usize,
-    /// Google account-picker rewrite is applied AT MOST ONCE per popup — only the entry OAuth
-    /// navigation. Otherwise Google's own redirects to chooser/error pages (which drop the `prompt`
-    /// param) would re-match and re-trigger a cancel+reload loop. Tied to the popup so it's dropped
-    /// with the window.
-    rewritten: AtomicBool,
-    /// The Delegate that created this popup (the opener's UI delegate — the global INSTALLED one for
-    /// the main shell window, or a per-profile-window delegate). It's the KVO `title` observer we
-    /// registered on `webview`, so teardown MUST remove the observer using THIS same object (not a
-    /// global) or KVO throws / leaks. Held strong so it outlives the observed webview.
-    observer: Retained<Delegate>,
-}
-unsafe impl Send for Popup {}
-static POPUPS: Mutex<Vec<Popup>> = Mutex::new(Vec::new());
-
-/// Single idempotent teardown for a popup. Removes the (only) strong-ref entry from POPUPS so the
-/// NSWindow + child WKWebView (JS timers, network) can finally be released. Both close paths route
-/// here: page-initiated `window.close()` (webViewDidClose:, `close_window = true` — the window is
-/// still open so we close it) and the user clicking the red button (windowWillClose:,
-/// `close_window = false` — AppKit is already closing it). Calling it twice is a no-op (the second
-/// path finds no entry), which is exactly what happens when either close triggers the other.
-/// Main-thread only (guaranteed: both callers are WK/AppKit delegate methods).
-// `&dyn Fn` (not `impl Fn`): cleanup_popup recurses for the cascade — a generic pred would
-// monomorphize a fresh closure type per recursion level (compile error: recursion limit).
-fn cleanup_popup(pred: &dyn Fn(&Popup) -> bool, close_window: bool) {
-    // One critical section: remove the entry AND snapshot the remaining (key, parent) pairs, then
-    // drop the lock BEFORE any window.close() — closing re-enters windowWillClose → cleanup_popup,
-    // which must not deadlock on POPUPS.
-    let (p, descendants) = {
-        let mut popups = POPUPS.lock().unwrap();
-        let Some(i) = popups.iter().position(|p| pred(p)) else {
-            eprintln!("[popup] cleanup: no matching entry (already torn down)");
-            return;
-        };
-        let p = popups.remove(i);
-        let key = Retained::as_ptr(&p.webview) as usize;
-        let pairs: Vec<(usize, usize)> = popups
-            .iter()
-            .map(|q| (Retained::as_ptr(&q.webview) as usize, q.parent))
-            .collect();
-        (p, descendants_of(&pairs, key))
-    };
-    // Stop observing `title` BEFORE releasing the webview (KVO throws if an observed object
-    // deallocates with observers attached). Registered in create_web_view with p.observer as the
-    // observer — remove with the SAME object (per-window delegates make a global lookup wrong).
-    {
-        let key = NSString::from_str("title");
-        let _: () = unsafe { msg_send![&*p.webview, removeObserver: &*p.observer, forKeyPath: &*key] };
-    }
-    if close_window {
-        p.window.close();
-    }
-    // Cascade: close this popup's descendants through the same idempotent path. Any that already
-    // tore themselves down (e.g. their windowWillClose fired first) are a no-op above.
-    for key in descendants {
-        eprintln!("[popup] cascade-close child {key:#x}");
-        cleanup_popup(&move |q: &Popup| Retained::as_ptr(&q.webview) as usize == key, true);
-    }
-    // p (window + webview Retained refs) drops here → last strong refs released.
-}
-
-/// All descendant keys of `root` in a (key, parent-key) edge list — breadth-ish order, cycle-safe.
-/// Pure so the registry cascade logic is unit-testable without AppKit.
-fn descendants_of(pairs: &[(usize, usize)], root: usize) -> Vec<usize> {
-    let mut out: Vec<usize> = Vec::new();
-    let mut queue = vec![root];
-    while let Some(k) = queue.pop() {
-        for &(child, parent) in pairs {
-            if parent == k && child != root && !out.contains(&child) {
-                out.push(child);
-                queue.push(child);
-            }
-        }
-    }
-    out
-}
-
-/// Close every popup (main-window close / app teardown). Main-thread only — callers are tauri
-/// window-event handlers, which run on the main thread on macOS.
-pub fn close_all() {
-    loop {
-        let key = POPUPS
-            .lock()
-            .unwrap()
-            .first()
-            .map(|p| Retained::as_ptr(&p.webview) as usize);
-        match key {
-            Some(k) => cleanup_popup(&move |p: &Popup| Retained::as_ptr(&p.webview) as usize == k, true),
-            None => break,
-        }
-    }
-}
-
-/// Strong refs to our delegate + wry's original (uiDelegate is weak on WKWebView).
-struct Installed(Option<(Retained<Delegate>, Retained<AnyObject>)>);
-unsafe impl Send for Installed {}
-static INSTALLED: Mutex<Installed> = Mutex::new(Installed(None));
-
-pub struct DelegateIvars {
-    /// wry's WryWebViewUIDelegate — unhandled WKUIDelegate messages forward here.
-    wry_delegate: Option<Retained<AnyObject>>,
-}
-
-define_class!(
-    #[unsafe(super(NSObject))]
-    #[thread_kind = MainThreadOnly]
-    #[name = "AppwrapUIDelegate"]
-    #[ivars = DelegateIvars]
-    struct Delegate;
-
-    unsafe impl NSObjectProtocol for Delegate {}
-
-    unsafe impl WKUIDelegate for Delegate {
-        #[unsafe(method_id(webView:createWebViewWithConfiguration:forNavigationAction:windowFeatures:))]
-        fn create_web_view(
-            &self,
-            opener: &WKWebView,
-            configuration: &WKWebViewConfiguration,
-            action: &WKNavigationAction,
-            features: &WKWindowFeatures,
-        ) -> Option<Retained<WKWebView>> {
-            let mtm = self.mtm();
-            let url = unsafe { action.request().URL() }
-                .and_then(|u| u.absoluteString())
-                .map(|s| s.to_string())
-                .unwrap_or_default();
-
-            // Verification #4 proof: the SSO popup inherits the opener's data store (its profile's
-            // cookie jar). WebKit hands us a configuration derived from the opener, so its
-            // websiteDataStore is the SAME object as the opener's — log the pointer identity.
-            unsafe {
-                let opener_store = opener.configuration().websiteDataStore();
-                let child_store = configuration.websiteDataStore();
-                eprintln!(
-                    "[popup] shared-store check: opener={:p} child={:p} shared={}",
-                    Retained::as_ptr(&opener_store),
-                    Retained::as_ptr(&child_store),
-                    Retained::as_ptr(&opener_store) == Retained::as_ptr(&child_store),
-                );
-            }
-
-            let width = unsafe { features.width() }.map(|n| n.doubleValue()).unwrap_or(720.0).max(200.0);
-            let height = unsafe { features.height() }.map(|n| n.doubleValue()).unwrap_or(640.0).max(200.0);
-            let rect = NSRect::new(NSPoint::new(0.0, 0.0), NSSize::new(width, height));
-
-            let style = NSWindowStyleMask::Titled
-                | NSWindowStyleMask::Closable
-                | NSWindowStyleMask::Miniaturizable
-                | NSWindowStyleMask::Resizable;
-            let window = unsafe {
-                NSWindow::initWithContentRect_styleMask_backing_defer(
-                    mtm.alloc::<NSWindow>(),
-                    rect,
-                    style,
-                    NSBackingStoreType::Buffered,
-                    false,
-                )
-            };
-            // Required for NSWindows created without a window controller; we manage lifetime.
-            unsafe { window.setReleasedWhenClosed(false) };
-
-            // MUST use the PASSED configuration — anything else breaks window.opener/session
-            // (and WebKit raises if the returned webview wasn't made with it).
-            let child = unsafe {
-                WKWebView::initWithFrame_configuration(
-                    mtm.alloc::<WKWebView>(),
-                    window.frame(),
-                    configuration,
-                )
-            };
-            unsafe {
-                child.setCustomUserAgent(Some(&NSString::from_str(SAFARI_UA)));
-                // Safari Web Inspector on window.open() child popups too (SSO flows etc.) —
-                // gated identically (debug always; release only under APPWRAP_DEVTOOLS).
-                crate::wkwebview_backend::set_inspectable(Retained::as_ptr(&child) as *mut WKWebView);
-                // Route the child's own UI-delegate messages (window.close(), nested
-                // window.open) back through us.
-                child.setUIDelegate(Some(ProtocolObject::from_ref(self)));
-                child.setAutoresizingMask(
-                    objc2_app_kit::NSAutoresizingMaskOptions::ViewWidthSizable
-                        | objc2_app_kit::NSAutoresizingMaskOptions::ViewHeightSizable,
-                );
-                // Google multi-account: intercept the popup's OAuth navigation to append
-                // prompt=select_account (see decide_policy). Only wired when configured so the
-                // default remember-me behavior is untouched.
-                if GOOGLE_ACCOUNT_PICKER.load(Ordering::Relaxed) {
-                    child.setNavigationDelegate(Some(ProtocolObject::from_ref(self)));
-                }
-            }
-            window.setContentView(Some(&child));
-            // Observe the red-button (user) close so we tear the popup down too — otherwise the
-            // NSWindow + live WKWebView leak forever (webViewDidClose: only fires for page-initiated
-            // window.close()). setDelegate is a WEAK ref; our Delegate is held strong for the app's
-            // lifetime in INSTALLED, so it outlives every child window.
-            window.setDelegate(Some(ProtocolObject::from_ref(self)));
-            window.center();
-            window.makeKeyAndOrderFront(None);
-
-            // Bind the NSWindow title to the page's real <title> (KVO on WKWebView.title) — anti-spoof
-            // + UX; removed in cleanup_popup. Options=New(1) so the change dict carries the value
-            // (we re-read from the webview anyway); context unused (we key off the object).
-            unsafe {
-                let key = NSString::from_str("title");
-                let _: () = msg_send![
-                    &*child,
-                    addObserver: self,
-                    forKeyPath: &*key,
-                    options: 1usize,
-                    context: std::ptr::null_mut::<c_void>()
-                ];
-            }
-
-            eprintln!("[popup] createWebView → {url} ({width}x{height})");
-            POPUPS.lock().unwrap().push(Popup {
-                window,
-                webview: child.clone(),
-                parent: opener as *const WKWebView as usize,
-                rewritten: AtomicBool::new(false),
-                observer: self.retain(),
-            });
-            // Returning the webview makes WebKit load the navigation action's request itself.
-            Some(child)
-        }
-
-        #[unsafe(method(webViewDidClose:))]
-        fn web_view_did_close(&self, webview: &WKWebView) {
-            eprintln!("[popup] webViewDidClose → cleanup + close window");
-            // Page called window.close(): window still open, so close it (windowWillClose: then
-            // fires but finds no entry → no-op).
-            cleanup_popup(&|p: &Popup| &*p.webview == webview, true);
-        }
-
-        // getUserMedia (mic/camera — e.g. voice mode): without this WKUIDelegate method the WebView
-        // DENIES capture by default, so `navigator.mediaDevices.getUserMedia` rejects. We GRANT it —
-        // the page is our own trusted (local/first-party) content. macOS still gates the actual device
-        // behind TCC, which needs the app's Info.plist usage string (NSMicrophoneUsageDescription, added
-        // when the `media` module is declared) + the user's one-time consent; this only lifts the
-        // WebKit-layer denial so that TCC prompt can appear at all.
-        #[unsafe(method(webView:requestMediaCapturePermissionForOrigin:initiatedByFrame:type:decisionHandler:))]
-        fn request_media_capture(
-            &self,
-            _web_view: &WKWebView,
-            _origin: &WKSecurityOrigin,
-            _frame: &WKFrameInfo,
-            _capture_type: WKMediaCaptureType,
-            decision_handler: &block2::DynBlock<dyn Fn(WKPermissionDecision)>,
-        ) {
-            decision_handler.call((WKPermissionDecision::Grant,));
-        }
-    }
-
-    // Child-popup navigation policy — only consulted when GOOGLE_ACCOUNT_PICKER wired the child's
-    // navigationDelegate to us (create_web_view). Rewrites the Google OAuth navigation to force the
-    // account chooser; everything else is allowed unchanged.
-    unsafe impl WKNavigationDelegate for Delegate {
-        #[unsafe(method(webView:decidePolicyForNavigationAction:decisionHandler:))]
-        fn decide_policy(
-            &self,
-            webview: &WKWebView,
-            action: &WKNavigationAction,
-            handler: &block2::DynBlock<dyn Fn(WKNavigationActionPolicy)>,
-        ) {
-            let url = unsafe { action.request().URL() }
-                .and_then(|u| u.absoluteString())
-                .map(|s| s.to_string())
-                .unwrap_or_default();
-            // Rewrite AT MOST ONCE per popup, and only the entry OAuth navigation — consume the
-            // once-flag lazily (only when we actually have a rewrite) so a non-OAuth first navigation
-            // doesn't burn it. Prevents re-triggering on Google's own chooser/error redirects.
-            if let Some(rewritten) = google_account_picker_rewrite(&url) {
-                let claim = {
-                    let popups = POPUPS.lock().unwrap();
-                    popups
-                        .iter()
-                        .find(|p| &*p.webview == webview)
-                        .map(|p| !p.rewritten.swap(true, Ordering::Relaxed))
-                        .unwrap_or(true)
-                };
-                if claim {
-                    eprintln!("[popup] google account-picker: reload with prompt=select_account → {rewritten}");
-                    // Cancel THIS load, then reload the SAME child webview with the rewritten URL.
-                    // window.opener/postMessage survive a same-window navigation, so the Firebase flow
-                    // still resolves; the reloaded URL carries `prompt`, so it's allowed (no loop).
-                    handler.call((WKNavigationActionPolicy::Cancel,));
-                    if let Some(nsurl) = NSURL::URLWithString(&NSString::from_str(&rewritten)) {
-                        let req = NSURLRequest::requestWithURL(&nsurl);
-                        let _ = unsafe { webview.loadRequest(&req) };
-                    }
-                    return;
-                }
-            }
-            handler.call((WKNavigationActionPolicy::Allow,));
-        }
-    }
-
-    unsafe impl NSWindowDelegate for Delegate {
-        #[unsafe(method(windowWillClose:))]
-        fn window_will_close(&self, notification: &NSNotification) {
-            let Some(obj) = notification.object() else { return };
-            // NSNotification.object is the closing NSWindow.
-            let window: &NSWindow = unsafe { &*(Retained::as_ptr(&obj) as *const NSWindow) };
-            eprintln!("[popup] windowWillClose → cleanup (red-button or programmatic)");
-            // Window is already closing (AppKit drives it) → don't re-close.
-            cleanup_popup(&|p: &Popup| &*p.window == window, false);
-        }
-    }
-
-    /// Forward every WKUIDelegate message we don't implement to wry's original delegate
-    /// (file-upload open panel, media-capture permission, …).
-    impl Delegate {
-        /// KVO callback — only ever registered for popup WKWebViews' `title` (create_web_view), so
-        /// no context/keyPath dispatch or super call is needed. Mirrors the page title onto the
-        /// popup's NSWindow.
-        #[unsafe(method(observeValueForKeyPath:ofObject:change:context:))]
-        fn observe_value(
-            &self,
-            _key_path: Option<&NSString>,
-            object: Option<&AnyObject>,
-            _change: Option<&AnyObject>,
-            _context: *mut c_void,
-        ) {
-            let Some(object) = object else { return };
-            let key = object as *const AnyObject as usize;
-            let (window, webview) = {
-                let popups = POPUPS.lock().unwrap();
-                let Some(p) = popups.iter().find(|p| Retained::as_ptr(&p.webview) as usize == key)
-                else {
-                    return; // stale notification after teardown
-                };
-                (p.window.clone(), p.webview.clone())
-            };
-            if let Some(title) = unsafe { webview.title() } {
-                window.setTitle(&title);
-            }
-        }
-
-        #[unsafe(method(forwardingTargetForSelector:))]
-        fn forwarding_target(&self, _sel: Sel) -> *mut AnyObject {
-            match &self.ivars().wry_delegate {
-                Some(d) => Retained::as_ptr(d) as *mut AnyObject,
-                None => std::ptr::null_mut(),
-            }
-        }
-
-        #[unsafe(method(respondsToSelector:))]
-        fn responds_to(&self, sel: Sel) -> objc2::runtime::Bool {
-            let own: bool = unsafe { msg_send![super(self), respondsToSelector: sel] };
-            if own {
-                return objc2::runtime::Bool::YES;
-            }
-            let fwd = match &self.ivars().wry_delegate {
-                Some(d) => unsafe { msg_send![&**d, respondsToSelector: sel] },
-                None => false,
-            };
-            objc2::runtime::Bool::new(fwd)
-        }
-    }
-);
-
-/// Install the wrapper on the shell's WKWebView. `webview_ptr` is tauri's
-/// `PlatformWebview::inner()` (a WKWebView on macOS); runs inside `with_webview`,
-/// i.e. on the main thread.
-pub fn install(webview_ptr: *mut std::ffi::c_void, google_account_picker: bool) {
-    GOOGLE_ACCOUNT_PICKER.store(google_account_picker, Ordering::Relaxed);
-    let Some(mtm) = MainThreadMarker::new() else {
-        eprintln!("[popup] install called off the main thread — skipped");
-        return;
-    };
-    if webview_ptr.is_null() {
-        eprintln!("[popup] null webview ptr — skipped");
-        return;
-    }
-    let webview: &WKWebView = unsafe { &*(webview_ptr as *const WKWebView) };
-
-    // Keep wry's delegate alive (weak property) and as the forwarding target.
-    let wry_delegate: Option<Retained<AnyObject>> = unsafe { webview.UIDelegate() }
-        .map(|d| unsafe { Retained::cast_unchecked::<AnyObject>(d.retain()) });
-    eprintln!(
-        "[popup] wrapping uiDelegate (wry delegate present: {})",
-        wry_delegate.is_some()
-    );
-
-    let delegate = Delegate::alloc(mtm).set_ivars(DelegateIvars { wry_delegate: wry_delegate.clone() });
-    let delegate: Retained<Delegate> = unsafe { msg_send![super(delegate), init] };
-    unsafe { webview.setUIDelegate(Some(ProtocolObject::from_ref(&*delegate))) };
-
-    // Shell-webview UA is normalized at BUILD time in main.rs (.user_agent) — setting it here
-    // (setup) is too late for the first document's navigator.userAgent snapshot.
-
-    INSTALLED.lock().unwrap().0 = Some((
-        delegate,
-        wry_delegate.unwrap_or_else(|| unsafe {
-            Retained::cast_unchecked::<AnyObject>(NSObject::new())
-        }),
-    ));
-}
-
-/// Install a DEDICATED popup delegate on a manually-created profile window's WKWebView, and return
-/// it so the caller retains it for that window's lifetime (uiDelegate is a WEAK property). Unlike
-/// install(), this does NOT touch the global INSTALLED — every concurrent profile window keeps its
-/// own delegate, so SSO popups work in all of them simultaneously (not last-writer-wins).
-///
-/// There is no wry delegate to forward to (the webview was built by us, not wry), so file-upload /
-/// media panels aren't forwarded — acceptable (trusted OS input is out of scope). The child popup is
-/// alloc'd with the PARENT's passed WKWebViewConfiguration (create_web_view), which carries the
-/// parent's websiteDataStore — so the popup shares the profile's cookie jar (verification #4).
-pub fn install_for_profile(webview_ptr: *mut std::ffi::c_void, mtm: MainThreadMarker) -> Retained<AnyObject> {
-    let webview: &WKWebView = unsafe { &*(webview_ptr as *const WKWebView) };
-    let delegate = Delegate::alloc(mtm).set_ivars(DelegateIvars { wry_delegate: None });
-    let delegate: Retained<Delegate> = unsafe { msg_send![super(delegate), init] };
-    unsafe { webview.setUIDelegate(Some(ProtocolObject::from_ref(&*delegate))) };
-    // Opaque to the caller (Delegate is private) — retained only for the window's lifetime.
-    unsafe { Retained::cast_unchecked::<AnyObject>(delegate) }
-}

package/runtime-desktop/crates/webview-control/src/profiles.rs

@@ -1,57 +0,0 @@
-// Per-profile persistent + isolated WKWebsiteDataStore identity map (THE CRUX).
-//
-// A "profile" is a named, persistent cookie/localStorage/IndexedDB jar. On macOS 14+ WebKit gives
-// us persistent, isolated stores via `WKWebsiteDataStore(forIdentifier:)` keyed by a stable NSUUID.
-// We persist a profileId->UUID map on disk so the SAME store is reattached across app quits
-// (persistence) while different profiles get different stores (isolation).
-//
-// Lifted verbatim from bridge_mac.rs's `mod profiles` (Phase 1 extraction).
-use objc2_foundation::NSUUID;
-use std::collections::HashMap;
-use std::path::PathBuf;
-
-fn map_path() -> PathBuf {
-    let base = std::env::var("APPWRAP_PROFILE_DIR")
-        .map(PathBuf::from)
-        .unwrap_or_else(|_| {
-            PathBuf::from(std::env::var("HOME").unwrap_or_default())
-                .join("Library/Application Support/appwrap-desktop")
-        });
-    base.join("browser-profiles.json")
-}
-
-fn load() -> HashMap<String, String> {
-    std::fs::read_to_string(map_path())
-        .ok()
-        .and_then(|s| serde_json::from_str(&s).ok())
-        .unwrap_or_default()
-}
-
-/// Sorted list of known profile ids from the on-disk map (the dropdown source). Always includes
-/// "default" so the chrome always has at least one selectable profile, even on a fresh install.
-pub fn list() -> Vec<String> {
-    let mut ids: Vec<String> = load().into_keys().collect();
-    if !ids.iter().any(|k| k == "default") {
-        ids.push("default".to_string());
-    }
-    ids.sort();
-    ids.dedup();
-    ids
-}
-
-/// Stable UUID string for a profile id — generated once and persisted so the
-/// same on-disk data store is reattached on every subsequent launch.
-pub fn uuid_for(profile_id: &str) -> String {
-    let mut map = load();
-    if let Some(u) = map.get(profile_id) {
-        return u.clone();
-    }
-    let uuid = NSUUID::UUID().UUIDString().to_string();
-    map.insert(profile_id.to_string(), uuid.clone());
-    let p = map_path();
-    if let Some(dir) = p.parent() {
-        let _ = std::fs::create_dir_all(dir);
-    }
-    let _ = std::fs::write(&p, serde_json::to_string_pretty(&map).unwrap_or_default());
-    uuid
-}