@wtfalch/desktop 0.1.1 → 0.1.2

package/README.md

@@ -97,15 +97,18 @@ Cloudflare Access answers a request without a `CF_Authorization` cookie with a
 redirect to `*.cloudflareaccess.com`. The cookie lives in the company partition,
 so:
 
-1. Every request the shell makes to the origin after the window exists (redeem,
-   logout, the Access probe) goes through that partition's `session.fetch` with
-   `credentials: 'include'` (`partitionFetcher`). Global `fetch` is never used
-   for them; `DesktopLogin` has no default fetcher.
+1. Every request the shell makes to the origin after the window exists goes
+   through that partition. The redeem and logout use its `session.fetch` with
+   `credentials: 'include'` (`partitionFetcher`). The Access probe uses
+   `net.request` on the same session with its cookies (`manualRedirectFetcher`),
+   because `session.fetch` rejects a `redirect: 'manual'` request that meets a
+   3xx with "Redirect was cancelled" (Electron 44.4.5), which would read Access's
+   own 302 as offline. Global `fetch` is never used for them; `DesktopLogin` has
+   no default fetcher.
 2. With `accessProbePath: '/api/health'`, before the system-browser sign-in starts (and
    before a stored company loads) the shell asks the origin through the
    partition with `redirect: 'manual'`, deciding from status and `Location`
-   only (Electron's `session.fetch` reports a wrong `response.url`, so it is never
-   read). A non-3xx answer, or a 3xx back to the origin itself, is a pass; a 3xx
+   only (the `redirect` event names the target before anything is followed). A non-3xx answer, or a 3xx back to the origin itself, is a pass; a 3xx
    to any other host (Access, or an identity provider) is not. A network failure
    is not an Access answer: the window shows the "Could not reach" screen with
    Try again. When Access wants a login, the window shows the origin so the person passes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/desktop",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "type": "module",
   "license": "MIT",
   "description": "The shared Electron shell for wtfalch apps: sign-in handoff, welcome screen, locked company window, auto-update.",

package/src/access.mjs

@@ -51,6 +51,40 @@ export function accessNavigation(value, origin) {
 export const partitionFetcher = (partition) => (url, init) =>
   partition.fetch(url, { ...init, credentials: 'include' });
 
+// The probe's fetcher. Electron's session.fetch rejects a `redirect: 'manual'`
+// request that meets a 3xx with "Redirect was cancelled" (Electron 44.4.5), so
+// Access's own 302 would read as offline. net.request on the same partition
+// session names the target in its 'redirect' event instead, before anything is
+// followed. `request` is net.request bound to the partition, injected so this
+// module stays plain Node.
+export const manualRedirectFetcher =
+  (request) =>
+  (url, init = {}) =>
+    new Promise((resolve, reject) => {
+      const req = request({
+        url,
+        method: init.method ?? 'GET',
+        redirect: 'manual',
+        useSessionCookies: true,
+      });
+      const answer = (status, location) => {
+        req.abort();
+        resolve({ status, headers: new Headers(location ? { location } : {}) });
+      };
+      req.on('redirect', (status, _method, location) => answer(status, location));
+      req.on('response', (response) => answer(response.statusCode));
+      req.on('error', reject);
+      init.signal?.addEventListener(
+        'abort',
+        () => {
+          req.abort();
+          reject(init.signal.reason);
+        },
+        { once: true },
+      );
+      req.end();
+    });
+
 // Asks the origin, through the partition, whether Access lets this person in:
 // 'passed', 'access' (still being sent to log in) or 'offline' (the request
 // itself failed, so Access cannot be judged).

package/src/shell.mjs

@@ -4,6 +4,7 @@ import { pathToFileURL } from 'node:url';
 // Main process only; loaded by startShell() so that importing the package
 // outside Electron (tests, check scripts) never imports 'electron'.
 import {
+  net,
   BrowserWindow,
   Menu,
   WebContentsView,
@@ -16,7 +17,13 @@ import {
   shell,
 } from 'electron';
 import updaterPkg from 'electron-updater';
-import { accessNavigation, partitionFetcher, probeAccess, waitForAccess } from './access.mjs';
+import {
+  accessNavigation,
+  manualRedirectFetcher,
+  partitionFetcher,
+  probeAccess,
+  waitForAccess,
+} from './access.mjs';
 import {
   forgetCompany,
   loadCompany,
@@ -228,8 +235,11 @@ export function run(config) {
         // polls through the partition until the origin answers for itself.
         const passAccess = async (found) => {
           if (config.accessProbePath === null) return 'passed';
-          const { partition, fetcher } = context(found.origin);
-          const probe = () => probeAccess(fetcher, found.origin, config.accessProbePath);
+          const { partition } = context(found.origin);
+          const probeFetcher = manualRedirectFetcher((options) =>
+            net.request({ ...options, session: partition }),
+          );
+          const probe = () => probeAccess(probeFetcher, found.origin, config.accessProbePath);
           // Set before the first await so a second request cannot open a second gate.
           const mine = { cancelled: false };
           gate = mine;