@xwiki/cristal-electron-main 0.13.0 → 0.14.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xwiki/cristal-electron-main",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "license": "LGPL 2.1",
   "author": "XWiki Org Community <contact@xwiki.org>",
   "homepage": "https://cristal.xwiki.org/",
@@ -13,15 +13,16 @@
     "url": "https://jira.xwiki.org/projects/CRISTAL/"
   },
   "dependencies": {
-    "electron": "33.2.1",
-    "@xwiki/cristal-browser-electron": "0.13.0",
-    "@xwiki/cristal-electron-authentication-xwiki-main": "0.13.0",
-    "@xwiki/cristal-electron-storage": "0.13.0"
+    "electron": "34.0.0",
+    "@xwiki/cristal-browser-electron": "0.14.0",
+    "@xwiki/cristal-configuration-electron-main": "0.14.0",
+    "@xwiki/cristal-electron-storage": "0.14.0",
+    "@xwiki/cristal-electron-authentication-xwiki-main": "0.14.0"
   },
   "devDependencies": {
-    "@types/node": "22.10.2",
-    "typescript": "5.6.3",
-    "vite": "6.0.3"
+    "@types/node": "22.10.7",
+    "typescript": "5.7.3",
+    "vite": "6.0.11"
   },
   "scripts": {
     "build": "tsc --project tsconfig.json && vite build",

package/src/index.ts

@@ -23,6 +23,7 @@ import { loadFile } from "./reload";
 import "./security-restrictions";
 // @ts-expect-error shouldn't happen, but we need to generate the types for the whole project once.
 import loadBrowser from "@xwiki/cristal-browser-electron/main";
+import { load as loadConfiguration } from "@xwiki/cristal-configuration-electron-main";
 import { load as loadAuthentication } from "@xwiki/cristal-electron-authentication-xwiki-main";
 // @ts-expect-error shouldn't happen, but we need to generate the types for the whole project once.
 import load from "@xwiki/cristal-electron-storage/main";
@@ -53,16 +54,22 @@ app.on("window-all-closed", () => {
   }
 });
 
+if (process.env.NODE_ENV !== "development") {
+  // Deactivate debug logs when the environment is not explicitly in development mode.
+  console.debug = () => {};
+}
+
 /**
  * Create the application window when the background process is ready.
  */
 app
   .whenReady()
-  .then(() => {
-    load();
+  .then(async () => {
+    await load();
     restoreOrCreateWindow().then((w) => {
       loadBrowser(w);
       loadAuthentication(w, loadFile);
+      loadConfiguration();
     });
     /**
      * @see https://www.electronjs.org/docs/latest/api/app#event-activate-macos Event: 'activate'.

package/src/security-restrictions.ts

@@ -18,6 +18,7 @@
  * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
  */
 
+import { readConfiguration } from "@xwiki/cristal-configuration-electron-main";
 import { app, shell } from "electron";
 import { URL } from "node:url";
 import type { Session } from "electron";
@@ -32,7 +33,8 @@ type Permission = Parameters<
 /**
  * A list of origins that you allow open INSIDE the application and permissions for them.
  *
- * In development mode you need allow open `VITE_DEV_SERVER_URL`.
+ * In development mode, you need allow open `VITE_DEV_SERVER_URL`.
+ * @deprecated the allowed origins and permissions should be derived from the configuration.
  */
 const ALLOWED_ORIGINS_AND_PERMISSIONS: Map<string, Set<Permission>> = new Map<
   string,
@@ -69,9 +71,20 @@ app.on("web-contents-created", (_, contents) => {
    *
    * @see https://www.electronjs.org/docs/latest/tutorial/security#13-disable-or-limit-navigation
    */
+  const configuration = readConfiguration();
   contents.on("will-navigate", (event, url) => {
     const { origin } = new URL(url);
-    if (ALLOWED_ORIGINS_AND_PERMISSIONS.has(origin)) {
+    const isAllowedOrigin = Object.values(configuration).some(
+      (configuration) => {
+        const baseURL = configuration.baseURL;
+        if (!baseURL) {
+          return false;
+        }
+        return new URL(baseURL).origin == origin;
+      },
+    );
+
+    if (isAllowedOrigin) {
       return;
     }
 
@@ -93,6 +106,8 @@ app.on("web-contents-created", (_, contents) => {
     (webContents, permission, callback) => {
       const { origin } = new URL(webContents.getURL());
 
+      // FIXME: this control is currently based on a fixed set of URLs, but seems also unused. We need to check more
+      // closely if this check is needed.
       const permissionGranted =
         !!ALLOWED_ORIGINS_AND_PERMISSIONS.get(origin)?.has(permission);
       callback(permissionGranted);
@@ -108,9 +123,9 @@ app.on("web-contents-created", (_, contents) => {
   /**
    * Hyperlinks leading to allowed sites are opened in the default browser.
    *
-   * The creation of new `webContents` is a common attack vector. Attackers attempt to convince the app to create new windows,
-   * frames, or other renderer processes with more privileges than they had before; or with pages opened that they couldn't open before.
-   * You should deny any unexpected window creation.
+   * The creation of new `webContents` is a common attack vector. Attackers attempt to convince the app to create new
+   * windows, frames, or other renderer processes with more privileges than they had before; or with pages opened that
+   * they couldn't open before. You should deny any unexpected window creation.
    *
    * @see https://www.electronjs.org/docs/latest/tutorial/security#14-disable-or-limit-creation-of-new-windows
    * @see https://www.electronjs.org/docs/latest/tutorial/security#15-do-not-use-openexternal-with-untrusted-content

package/tsconfig.json

@@ -5,6 +5,8 @@
     "target": "esnext",
     "sourceMap": false,
     "moduleResolution": "Node",
+    "resolveJsonModule": true,
+    "allowSyntheticDefaultImports": true,
     "experimentalDecorators": true,
     "emitDecoratorMetadata": true,
     "skipLibCheck": true,