@xwiki/cristal-electron-main 0.12.0 → 0.14.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xwiki/cristal-electron-main",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "license": "LGPL 2.1",
   "author": "XWiki Org Community <contact@xwiki.org>",
   "homepage": "https://cristal.xwiki.org/",
@@ -13,21 +13,20 @@
     "url": "https://jira.xwiki.org/projects/CRISTAL/"
   },
   "dependencies": {
-    "electron": "33.0.2",
-    "@xwiki/cristal-browser-electron": "0.12.0",
-    "@xwiki/cristal-electron-authentication-xwiki-main": "0.12.0",
-    "@xwiki/cristal-electron-storage": "0.12.0"
+    "electron": "34.0.0",
+    "@xwiki/cristal-browser-electron": "0.14.0",
+    "@xwiki/cristal-configuration-electron-main": "0.14.0",
+    "@xwiki/cristal-electron-storage": "0.14.0",
+    "@xwiki/cristal-electron-authentication-xwiki-main": "0.14.0"
   },
   "devDependencies": {
-    "@types/node": "22.8.7",
-    "cross-env": "7.0.3"
+    "@types/node": "22.10.7",
+    "typescript": "5.7.3",
+    "vite": "6.0.11"
   },
   "scripts": {
     "build": "tsc --project tsconfig.json && vite build",
     "clean": "rimraf dist",
-    "electron": "echo 'no task'",
-    "lint": "eslint \"./src/**/*.{ts,tsx}\" --max-warnings=0",
-    "linux": "echo 'no task'",
-    "package": "echo 'no task'"
+    "lint": "eslint \"./src/**/*.{ts,tsx,vue}\" --max-warnings=0"
   }
 }

package/src/index.ts

@@ -23,6 +23,7 @@ import { loadFile } from "./reload";
 import "./security-restrictions";
 // @ts-expect-error shouldn't happen, but we need to generate the types for the whole project once.
 import loadBrowser from "@xwiki/cristal-browser-electron/main";
+import { load as loadConfiguration } from "@xwiki/cristal-configuration-electron-main";
 import { load as loadAuthentication } from "@xwiki/cristal-electron-authentication-xwiki-main";
 // @ts-expect-error shouldn't happen, but we need to generate the types for the whole project once.
 import load from "@xwiki/cristal-electron-storage/main";
@@ -53,16 +54,22 @@ app.on("window-all-closed", () => {
   }
 });
 
+if (process.env.NODE_ENV !== "development") {
+  // Deactivate debug logs when the environment is not explicitly in development mode.
+  console.debug = () => {};
+}
+
 /**
  * Create the application window when the background process is ready.
  */
 app
   .whenReady()
-  .then(() => {
-    load();
+  .then(async () => {
+    await load();
     restoreOrCreateWindow().then((w) => {
       loadBrowser(w);
       loadAuthentication(w, loadFile);
+      loadConfiguration();
     });
     /**
      * @see https://www.electronjs.org/docs/latest/api/app#event-activate-macos Event: 'activate'.

package/src/mainWindow.ts

@@ -18,6 +18,7 @@
  * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
  */
 
+import { initializeMenu } from "./menu";
 import { loadFile } from "./reload";
 import { BrowserWindow, app, shell } from "electron";
 import { join } from "node:path";
@@ -35,6 +36,8 @@ async function createWindow() {
     },
   });
 
+  initializeMenu(browserWindow);
+
   // Uncomment to start electron debugger at startup.
   // browserWindow.webContents.openDevTools();
 

package/src/menu.ts

@@ -0,0 +1,73 @@
+/*
+ * See the LICENSE file distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ */
+
+import { BrowserWindow, Menu } from "electron";
+import type { MenuItem } from "electron";
+
+/**
+ * Scan recursively the menus and sub-menus to find the interesting items.
+ *
+ * @param items - the item of the current menu
+ * @param actions - the action we are interested to keep
+ * @param newMenu - the new menu built from interesting actions
+ * @since 0.13
+ */
+function scan(items: MenuItem[], actions: string[], newMenu: Menu): void {
+  for (const item of items) {
+    if (actions.includes(`${item.role}`)) {
+      newMenu.insert(0, item);
+    } else {
+      if (item.submenu != undefined) {
+        scan(item.submenu.items, actions, newMenu);
+      }
+    }
+  }
+}
+
+/**
+ * Initialize the menu for the provided browser window. The menu is hidden, and we only keep entries with useful
+ * keyboard shortcuts.
+ * @param browserWindow - the provided browser window.
+ * @since 0.13
+ */
+function initializeMenu(browserWindow: BrowserWindow) {
+  const menu = Menu.getApplicationMenu();
+  const newMenu = new Menu();
+
+  // The list of actions we wish to preserve from the default application menu.
+  const actions = [
+    "toggledevtools",
+    "resetzoom",
+    "zoomin",
+    "zoomout",
+    "togglefullscreen",
+  ];
+  if (menu?.items) {
+    scan(menu?.items, actions, newMenu);
+  }
+
+  // Sets the menu on windows and linux.
+  browserWindow.setMenu(newMenu);
+  // Set the menu on MacOS.
+  Menu.setApplicationMenu(menu);
+  browserWindow.setMenuBarVisibility(false);
+}
+
+export { initializeMenu };

package/src/security-restrictions.ts

@@ -18,6 +18,7 @@
  * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
  */
 
+import { readConfiguration } from "@xwiki/cristal-configuration-electron-main";
 import { app, shell } from "electron";
 import { URL } from "node:url";
 import type { Session } from "electron";
@@ -32,7 +33,8 @@ type Permission = Parameters<
 /**
  * A list of origins that you allow open INSIDE the application and permissions for them.
  *
- * In development mode you need allow open `VITE_DEV_SERVER_URL`.
+ * In development mode, you need allow open `VITE_DEV_SERVER_URL`.
+ * @deprecated the allowed origins and permissions should be derived from the configuration.
  */
 const ALLOWED_ORIGINS_AND_PERMISSIONS: Map<string, Set<Permission>> = new Map<
   string,
@@ -69,9 +71,20 @@ app.on("web-contents-created", (_, contents) => {
    *
    * @see https://www.electronjs.org/docs/latest/tutorial/security#13-disable-or-limit-navigation
    */
+  const configuration = readConfiguration();
   contents.on("will-navigate", (event, url) => {
     const { origin } = new URL(url);
-    if (ALLOWED_ORIGINS_AND_PERMISSIONS.has(origin)) {
+    const isAllowedOrigin = Object.values(configuration).some(
+      (configuration) => {
+        const baseURL = configuration.baseURL;
+        if (!baseURL) {
+          return false;
+        }
+        return new URL(baseURL).origin == origin;
+      },
+    );
+
+    if (isAllowedOrigin) {
       return;
     }
 
@@ -93,6 +106,8 @@ app.on("web-contents-created", (_, contents) => {
     (webContents, permission, callback) => {
       const { origin } = new URL(webContents.getURL());
 
+      // FIXME: this control is currently based on a fixed set of URLs, but seems also unused. We need to check more
+      // closely if this check is needed.
       const permissionGranted =
         !!ALLOWED_ORIGINS_AND_PERMISSIONS.get(origin)?.has(permission);
       callback(permissionGranted);
@@ -108,9 +123,9 @@ app.on("web-contents-created", (_, contents) => {
   /**
    * Hyperlinks leading to allowed sites are opened in the default browser.
    *
-   * The creation of new `webContents` is a common attack vector. Attackers attempt to convince the app to create new windows,
-   * frames, or other renderer processes with more privileges than they had before; or with pages opened that they couldn't open before.
-   * You should deny any unexpected window creation.
+   * The creation of new `webContents` is a common attack vector. Attackers attempt to convince the app to create new
+   * windows, frames, or other renderer processes with more privileges than they had before; or with pages opened that
+   * they couldn't open before. You should deny any unexpected window creation.
    *
    * @see https://www.electronjs.org/docs/latest/tutorial/security#14-disable-or-limit-creation-of-new-windows
    * @see https://www.electronjs.org/docs/latest/tutorial/security#15-do-not-use-openexternal-with-untrusted-content

package/tsconfig.json

@@ -5,6 +5,8 @@
     "target": "esnext",
     "sourceMap": false,
     "moduleResolution": "Node",
+    "resolveJsonModule": true,
+    "allowSyntheticDefaultImports": true,
     "experimentalDecorators": true,
     "emitDecoratorMetadata": true,
     "skipLibCheck": true,

package/tsdoc.json

@@ -0,0 +1,4 @@
+{
+  "$schema": "https://developer.microsoft.com/json-schemas/tsdoc/v0/tsdoc.schema.json",
+  "extends": ["../../tsdoc.json"]
+}