urlwall 0.1.2__py3-none-any.whl

urlwall/__init__.py

@@ -0,0 +1,179 @@
+"""
+URL-Wall core logic.
+"""
+
+import os
+import re
+import subprocess
+import sys
+import tempfile
+import urllib.parse
+from pathlib import Path
+
+from urlwall import config
+
+__all__ = [
+    "getCanonicalHost",
+    "isUrlAllowed",
+    "isWebURL",
+    "niceHost",
+    "openURL",
+    "unwrap",
+    "writeWarningHTML",
+]
+
+
+def isWebURL(url):
+    """Check whether url is most likely an actual web URL."""
+    up = urllib.parse.urlparse(url)
+    return up.scheme in ("http", "https", "ftp") and up.netloc
+
+
+def getCanonicalHost(url):
+    """Extract canonical host from a URL (no www., no trailing dot, no port)."""
+    host = url
+    if "/" in host:
+        purl = urllib.parse.urlparse(host)
+        host = purl.netloc
+    # Strip port if present
+    if ":" in host:
+        host = host.rsplit(":", 1)[0]
+    host = host.lower().strip(".")
+    host = host.removeprefix("www.")
+    return host
+
+
+def niceHost(url):
+    """Human-readable host name for display."""
+    up = urllib.parse.urlparse(url)
+    host = up.netloc.lower()
+    host = host.removeprefix("www.")
+    if host.endswith(".safelinks.protection.outlook.com"):
+        host = "safelinks.outlook.com"
+    return host
+
+
+def unwrap(url):
+    """Unwrap redirect chains (Cisco web proxy, Outlook safelinks, etc.).
+
+    Returns a list of all URLs encountered during unwrapping.
+    """
+    urls = []
+    while True:
+        urls.append(url)
+        up = urllib.parse.urlparse(url)
+        query = urllib.parse.parse_qs(up.query)
+
+        # Cisco web proxy: https://secure-web.cisco.com/...#...
+        if up.netloc == "secure-web.cisco.com":
+            m = re.match(r"^([^#]+)/(.+)$", url)
+            if m:
+                url1, url2 = m.groups()
+                url2 = urllib.parse.unquote(url2)
+                if isWebURL(url1) and isWebURL(url2):
+                    url = url2
+                    continue
+
+        # Common redirect query params
+        for q in ("url", "target", "rd"):
+            if q in query and query[q] and isWebURL(query[q][0]):
+                url = query[q][0]
+                break
+        else:
+            break
+
+    return urls
+
+
+def isUrlAllowed(url, _seen=None, _depth=0):
+    """Check if a URL is allowed, unwrapping redirect chains and query params."""
+    if _seen is None:
+        _seen = set()
+    if _depth > 20 or url in _seen:
+        # Prevent infinite recursion from circular redirects
+        return False
+    _seen.add(url)
+
+    # First unwrap query params to find nested URLs
+    up = urllib.parse.urlparse(url)
+    query = urllib.parse.parse_qs(up.query)
+    for key in ("q", "url"):
+        for val in query.get(key, []):
+            if val.startswith(("http://", "https://")):
+                return isUrlAllowed(val, _seen, _depth + 1)
+
+    # Then check the canonical host
+    host = getCanonicalHost(url)
+    return config.getConfig().isAllowed(host)
+
+
+def writeWarningHTML(urls):
+    """Generate a warning HTML page showing the URL chain.
+
+    Returns the path to a temp file containing the rendered page.
+    """
+    assert urls
+    url_pairs = [(niceHost(url), url) for url in urls]
+
+    # Read template from package resources (works when installed via pip)
+    template_path = Path(__file__).parent / "html" / "template.html"
+    text = template_path.read_text(encoding="utf-8")
+
+    bg_path = Path(__file__).parent / "html" / "bg.jpg"
+    bgurl = "file://" + str(bg_path.resolve())
+
+    # The final URL for the "Go to" button
+    final_url = url_pairs[-1][1]
+
+    for k, v in {
+        "backgroundimage": bgurl,
+        "URLS": "",  # Old template uses JS to build the chain
+        "URL": final_url,
+    }.items():
+        text = text.replace("{{" + k + "}}", v)
+
+    fd, fn = tempfile.mkstemp(prefix="warning-", suffix=".html")
+    os.write(fd, text.encode("utf-8"))
+    os.close(fd)
+
+    return fn
+
+
+def openURL(url):
+    """Open a URL through the URL-Wall gate."""
+    try:
+        # Normalize: ensure https scheme
+        if not url.startswith("http"):
+            if not url.startswith("//"):
+                url = "//" + url
+            url = "https:" + url
+
+        # Log
+        log_fn = config.getConfig().logFile
+        with open(log_fn, "a") as log:
+            log.write(f"{url}\n")
+
+        # Unwrap redirect chains
+        chain = unwrap(url)
+
+        # Check if any URL in the chain is allowed
+        allowed = False
+        for chain_url in chain:
+            if isUrlAllowed(chain_url):
+                allowed = True
+                break
+        if not allowed:
+            # Show warning page with the full chain
+            tfn = writeWarningHTML(chain)
+            url = tfn
+
+        browser = config.getConfig().getBrowser()
+        subprocess.call(["/usr/bin/open", "-a", browser, url])
+    except OSError as e:
+        # Log error but still open to avoid losing the URL entirely
+        print(f"URL-Wall error: {e}", file=sys.stderr)
+        import traceback
+
+        traceback.print_exc(file=sys.stderr)
+        # Open in default browser (not user's preferred) as a safe fallback
+        subprocess.call(["/usr/bin/open", url])

urlwall/__main__.py

@@ -0,0 +1,112 @@
+"""
+URL-Wall CLI entry point.
+
+Usage:
+    python -m urlwall [URL]                  # Open URL through the gate
+    python -m urlwall --allow-host-add URL   # Add to allow list
+    python -m urlwall --allow-host-remove URL # Remove from allow list
+    python -m urlwall --also-subdomains      # Combine with --allow-host-add
+    python -m urlwall --set-browser BROWSER  # Set browser used after URL-Wall
+    python -m urlwall --use-as-default       # Set URL-Wall as macOS default browser
+    python -m urlwall --install PATH         # Install .app bundle
+"""
+
+import argparse
+import os
+import sys
+
+import urlwall
+import urlwall.app
+from urlwall import config
+
+
+def main():
+    parser = argparse.ArgumentParser(prog="url-wall")
+    group = parser.add_mutually_exclusive_group()
+
+    group.add_argument(
+        "url",
+        metavar="URL",
+        nargs="?",
+        help="URL to open. If no URL and no flags, prints config.",
+    )
+    parser.add_argument("-v", "--verbose", action="store_true")
+    parser.add_argument(
+        "--install", metavar="PATH", help="Install URL-Wall as a .app bundle at PATH"
+    )
+
+    # Config updates
+    group.add_argument(
+        "--allow-host-add", "-a", metavar="URL", help="Add host to allow list"
+    )
+    group.add_argument(
+        "--allow-host-remove", metavar="URL", help="Remove host from allow list"
+    )
+    parser.add_argument(
+        "--also-subdomains",
+        action="store_true",
+        help="Make --allow-host-add also apply for subdomains",
+    )
+    group.add_argument(
+        "--set-browser", metavar="BROWSER", help="Set browser to use after URL-Wall"
+    )
+    group.add_argument(
+        "--use-as-default",
+        action="store_true",
+        help="Set URL-Wall as the macOS default browser",
+    )
+
+    args = parser.parse_args()
+
+    if args.install is not None:
+        app_path = os.path.expanduser(args.install)
+        if os.path.isdir(app_path):
+            print(
+                f"Error: {app_path} already exists. Remove it first.", file=sys.stderr
+            )
+            sys.exit(1)
+        urlwall.app.install(app_path)
+        print(f"URL-Wall installed at {app_path}")
+        return
+
+    cfg = config.getConfig()
+
+    if args.url is not None:
+        urlwall.openURL(args.url)
+    elif args.allow_host_add is not None:
+        url = args.allow_host_add
+        if args.also_subdomains:
+            if host := cfg.addAllowedHostSubdomains(url):
+                print(f"Added {host!r} incl. subdomains to allowed hosts")
+        else:
+            if host := cfg.addAllowedHost(url):
+                print(f"Added {host!r} to allowed hosts")
+    elif args.allow_host_remove is not None:
+        url = args.allow_host_remove
+        if host := cfg.removeAllowedHost(url):
+            print(f"Removed {host!r} from allowed hosts")
+        if host := cfg.removeAllowedHostSubdomains(url):
+            print(f"Removed {host!r} incl. subdomains from allowed hosts")
+    elif args.set_browser is not None:
+        browser = args.set_browser
+        if br := cfg.setBrowser(browser):
+            print(f"Browser set to {br!r}")
+        else:
+            print(f"Browser already set to {browser!r}")
+    elif args.use_as_default:
+        if cfg.setAsDefaultBrowser():
+            print("URL-Wall registered as default browser handler.")
+        else:
+            sys.exit(1)
+    else:
+        # Print current config summary
+        print(f"Browser: {cfg.getBrowser()}")
+        print(f"Allowed hosts: {', '.join(cfg.plist['hostsAllowed'])}")
+        if cfg.plist["hostWithSubdomainsAllowed"]:
+            print(
+                f"Allowed with subdomains: {', '.join(cfg.plist['hostWithSubdomainsAllowed'])}"
+            )
+
+
+if __name__ == "__main__":
+    main()

urlwall/app/Info-patch.plist

@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleIdentifier</key>
+	<string>com.github.svalgaard.url-wall</string>
+	<key>CFBundleName</key>
+	<string>url-wall</string>
+    <key>CFBundleURLTypes</key>
+    <array>
+		<dict>
+			<key>CFBundleURLName</key>
+			<string>Web site URL</string>
+			<key>CFBundleURLSchemes</key>
+			<array>
+				<string>http</string>
+				<string>https</string>
+			</array>
+		</dict>
+		<dict>
+			<key>CFBundleURLName</key>
+			<string>FTP site URL</string>
+			<key>CFBundleURLSchemes</key>
+			<array>
+				<string>ftp</string>
+			</array>
+		</dict>
+    </array>
+</dict>
+</plist>

urlwall/app/url-wall.scpt

@@ -0,0 +1,17 @@
+--
+-- AppleScript URL handler for URL-Wall
+-- https://github.com/svalgaard/url-wall
+--
+-- https://developer.apple.com/library/archive/technotes/tn2065/
+--
+
+on open location theURL
+	set AppPath to POSIX path of (path to me as text)
+	set ScriptPath to AppPath & "/Contents/Resources/Assets/urlwall/cli.py"
+	try
+		do shell script "echo " & quoted form of theURL & " | python3 " & ScriptPath
+	on error
+		-- If Python fails, open directly in default browser
+		do shell script "open " & quoted form of theURL
+	end try
+end open location

urlwall/app.py

@@ -0,0 +1,78 @@
+"""
+Build a URL-Wall .app bundle from the AppleScript handler.
+
+Usage:
+    ./url-wall install ~/Applications/URL-Wall.app
+    ./url-wall install -f ~/Applications/URL-Wall.app   # force overwrite
+"""
+
+import fnmatch
+import os
+import plistlib
+import shutil
+import subprocess
+
+ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+APP_DIR = os.path.join(os.path.dirname(__file__), "app")
+
+
+def _ignore_bundle(src, names):
+    """Ignore files/dirs that don't belong in the .app bundle."""
+    ignored = []
+    for pattern in (
+        "__pycache__",
+        "*.pyc",
+        ".git",
+        ".gitignore",
+        "tests",
+        "*.egg-info",
+        "dist",
+        "build",
+        ".venv",
+        "venv",
+        "*.egg",
+        ".github",
+        ".gitkeep",
+    ):
+        ignored.extend(fnmatch.filter(names, pattern))
+    return set(ignored)
+
+
+def patchInfo(appPath):
+    """Patch the .app's Info.plist with URL scheme handlers."""
+    infofn = os.path.join(appPath, "Contents/Info.plist")
+    patchfn = os.path.join(APP_DIR, "Info-patch.plist")
+
+    if not os.path.isfile(infofn):
+        raise FileNotFoundError(f"Info.plist not found inside {appPath}")
+    if not os.path.isfile(patchfn):
+        raise FileNotFoundError(f"Info-patch.plist not found at {patchfn}")
+
+    with open(patchfn, "rb") as f:
+        patch = plistlib.load(f)
+    with open(infofn, "rb") as f:
+        info = plistlib.load(f)
+    info.update(patch)
+    with open(infofn, "wb") as f:
+        plistlib.dump(info, f)
+
+
+def install(appPath):
+    """Build and install a URL-Wall .app bundle."""
+    assert appPath.endswith(".app")
+
+    scpt = os.path.join(APP_DIR, "url-wall.scpt")
+    if not os.path.isfile(scpt):
+        raise FileNotFoundError(f"AppleScript handler not found at {scpt}")
+
+    # Compile AppleScript into .app
+    subprocess.call(["/usr/bin/osacompile", "-o", appPath, scpt])
+
+    # Patch with URL scheme handlers
+    patchInfo(appPath)
+
+    # Copy project assets into the bundle (exclude build artifacts, vcs, tests)
+    assetsPath = os.path.join(appPath, "Contents/Resources/Assets")
+    if os.path.isdir(assetsPath):
+        shutil.rmtree(assetsPath)
+    shutil.copytree(ROOT, assetsPath, ignore=_ignore_bundle)

urlwall/cli.py

@@ -0,0 +1,28 @@
+"""
+URL-Wall CLI wrapper.
+
+This script is placed in the .app bundle and called by the AppleScript handler.
+It ensures the urlwall package is importable from the bundle context.
+
+When called with no arguments, reads the URL from stdin (piped by AppleScript).
+When called with arguments, passes them through to __main__.py.
+"""
+
+import os
+import sys
+
+# The .app bundle copies Assets/ at the same level as urlwall/
+# So we need to add the Assets parent to sys.path
+bundle_root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+if bundle_root not in sys.path:
+    sys.path.insert(0, bundle_root)
+
+from urlwall.__main__ import main
+
+if __name__ == "__main__":
+    # If called with no args, read URL from stdin (piped by AppleScript)
+    if len(sys.argv) == 1 and not sys.stdin.isatty():
+        url = sys.stdin.read().strip()
+        if url:
+            sys.argv = ["urlwall", url]
+    main()

urlwall/config.py

@@ -0,0 +1,152 @@
+"""
+URL-Wall configuration management.
+"""
+
+import os
+import plistlib
+import socket
+import subprocess
+import sys
+
+import urlwall
+
+ME = "urlwall"
+CONFIG_VERSION = "1.0"
+CFG_ROOT = os.path.expanduser(f"~/.{ME}")
+CONFIG_FN = os.path.join(CFG_ROOT, "setup.plist")
+_config = None
+
+
+class Config:
+    """Manages the URL-Wall configuration stored as a plist."""
+
+    def __init__(self, fn):
+        self.fn = fn
+        self.read()
+
+    # -- read/write setup --
+
+    def read(self):
+        if not os.path.isfile(self.fn):
+            self.setupDefault()
+        try:
+            with open(self.fn, "rb") as f:
+                self.plist = plistlib.load(f)
+        except (OSError, plistlib.InvalidFileException) as e:
+            print(f"Config read error: {e}", file=sys.stderr)
+            self.setupDefault()
+
+    def setupDefault(self):
+        self.plist = {
+            "configVersion": CONFIG_VERSION,
+            "defaultBrowser": "Safari.app",
+            "hostsAllowed": ["google.com"],
+            "hostWithSubdomainsAllowed": [],
+        }
+        self.write()
+
+    def write(self):
+        self.plist["hostsAllowed"].sort()
+        dn = os.path.dirname(self.fn)
+        if not os.path.isdir(dn):
+            os.makedirs(dn, exist_ok=True)
+        try:
+            with open(self.fn, "wb") as f:
+                plistlib.dump(self.plist, f)
+        except OSError as e:
+            print(f"Config write error: {e}", file=sys.stderr)
+
+    # -- browser --
+
+    def getBrowser(self):
+        return self.plist["defaultBrowser"]
+
+    def setBrowser(self, br):
+        curBrowser = self.getBrowser()
+        if br != curBrowser:
+            self.plist["defaultBrowser"] = br
+            self.write()
+            return br
+
+    def setAsDefaultBrowser(self):
+        """Set URL-Wall as macOS default browser for http/https/ftp."""
+        bundle_id = "com.github.svalgaard.url-wall"
+        schemes = ("http", "https", "ftp")
+        entries = " ".join(
+            f'{{CFBundleIdentifier="{bundle_id}",LSHandlerRoleViewer="{s}",LSHandlerContentClassName=""}}'
+            for s in schemes
+        )
+        cmd = f"defaults write com.apple.LaunchServices LSHandlers -array-add {entries}"
+        try:
+            subprocess.run(["bash", "-c", cmd], check=True)
+            print("Run `killall Finder` to apply the change.")
+            return True
+        except subprocess.CalledProcessError as e:
+            print(f"Error setting default browser: {e}", file=sys.stderr)
+            return False
+
+    # -- allowed hosts --
+
+    def addAllowedHost(self, host):
+        host = urlwall.getCanonicalHost(host)
+        if not host:
+            raise ValueError("Invalid host")
+        if host not in self.plist["hostsAllowed"]:
+            self.plist["hostsAllowed"].append(host)
+            self.write()
+            return host
+
+    def addAllowedHostSubdomains(self, host):
+        host = urlwall.getCanonicalHost(host)
+        if not host:
+            raise ValueError("Invalid host")
+        if host not in self.plist["hostWithSubdomainsAllowed"]:
+            self.plist["hostWithSubdomainsAllowed"].append(host)
+            self.write()
+            return host
+
+    def removeAllowedHost(self, host):
+        host = urlwall.getCanonicalHost(host)
+        if not host:
+            raise ValueError("Invalid host")
+        if host in self.plist["hostsAllowed"]:
+            self.plist["hostsAllowed"].remove(host)
+            self.write()
+            return host
+
+    def removeAllowedHostSubdomains(self, host):
+        host = urlwall.getCanonicalHost(host)
+        if not host:
+            raise ValueError("Invalid host")
+        if host in self.plist["hostWithSubdomainsAllowed"]:
+            self.plist["hostWithSubdomainsAllowed"].remove(host)
+            self.write()
+            return host
+
+    # -- allow check --
+
+    def isAllowed(self, url):
+        host = urlwall.getCanonicalHost(url)
+        if host in self.plist["hostsAllowed"]:
+            return True
+        if host in self.plist["hostWithSubdomainsAllowed"]:
+            return True
+        for p in self.plist["hostWithSubdomainsAllowed"]:
+            if host.endswith("." + p):
+                return True
+        return False
+
+    # -- log file (hostname-specific) --
+
+    @property
+    def logFile(self):
+        hostname = socket.gethostname().split(".")[0]
+        return os.path.join(CFG_ROOT, f"url-wall-{hostname}.log")
+
+
+def getConfig(configFilename=CONFIG_FN):
+    """Return the singleton Config instance."""
+    global _config
+    if _config is None:
+        _config = Config(configFilename)
+    return _config

urlwall/html/template.html

@@ -0,0 +1,211 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+  <meta charset="utf-8">
+  <meta http-equiv="X-UA-Compatible" content="IE=edge">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+
+  <title>Warning page</title>
+  <style>
+    * {
+      box-sizing: border-box;
+    }
+
+    body {
+      padding: 0;
+      margin: 0;
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+      font-weight: 700;
+    }
+
+    #notfound {
+      position: relative;
+      height: 100vh;
+    }
+
+    #notfound .notfound-bg {
+      position: absolute;
+      width: 100%;
+      height: 100%;
+      background-image: url('{{backgroundimage}}');
+      background-size: cover;
+    }
+
+    #notfound .notfound-bg:after {
+      content: '';
+      position: absolute;
+      width: 100%;
+      height: 100%;
+      background-color: rgba(255, 0, 0, 0.3);
+    }
+
+    #notfound .notfound {
+      position: absolute;
+      left: 50%;
+      top: 50%;
+      transform: translate(-50%, -50%);
+    }
+
+    .notfound {
+      max-width: 700px;
+      width: 100%;
+      line-height: 1.4;
+      text-align: center;
+    }
+
+    .notfound .notfound-404 {
+      position: relative;
+      height: 120px;
+    }
+
+    .notfound .notfound-404 h1 {
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+      position: absolute;
+      left: 50%;
+      top: 50%;
+      transform: translate(-50%, -50%);
+      font-size: 80px;
+      font-weight: 900;
+      margin: 0px;
+      color: #fff;
+      text-transform: uppercase;
+      letter-spacing: 4px;
+    }
+
+    .notfound h2 {
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+      font-size: 20px;
+      font-weight: 700;
+      text-transform: uppercase;
+      color: #fff;
+      margin-top: 20px;
+      margin-bottom: 15px;
+    }
+
+    .notfound p {
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+      font-size: 16px;
+      font-weight: 400;
+      color: #fff;
+      margin-top: 20px;
+      margin-bottom: 15px;
+    }
+
+    .notfound .home-btn,
+    .notfound .contact-btn {
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+      display: inline-block;
+      font-weight: 700;
+      text-decoration: none;
+      background-color: transparent;
+      border: 2px solid transparent;
+      text-transform: uppercase;
+      padding: 10px 20px;
+      font-size: 16px;
+      border-radius: 40px;
+      margin: 5px;
+      transition: 0.2s all;
+    }
+
+    .notfound .home-btn:hover,
+    .notfound .contact-btn:hover {
+      opacity: 0.9;
+    }
+
+    .notfound .home-btn {
+      color: rgba(255, 0, 36, 0.7);
+      background: #fff;
+    }
+
+    .notfound .contact-btn {
+      border: 2px solid rgba(255, 255, 255, 0.9);
+      color: rgba(255, 255, 255, 0.9);
+    }
+
+    span.url {
+      overflow: hidden;
+      white-space: nowrap;
+      text-overflow: ellipsis;
+      display: block;
+      max-width: 600px;
+      margin: 0 auto;
+    }
+
+    @media only screen and (max-width: 767px) {
+      .notfound .notfound-404 h1 {
+        font-size: 60px;
+      }
+    }
+
+    @media only screen and (max-width: 480px) {
+      .notfound .notfound-404 {
+        height: 100px;
+      }
+
+      .notfound .notfound-404 h1 {
+        font-size: 40px;
+      }
+
+      .notfound h2 {
+        font-size: 16px;
+      }
+
+      .notfound .home-btn,
+      .notfound .contact-btn {
+        font-size: 14px;
+      }
+    }
+  </style>
+</head>
+
+<body>
+  <div id="notfound">
+    <div class="notfound-bg"></div>
+    <div class="notfound">
+      <div class="notfound-404">
+        <h1>⚠️&nbsp;Warning</h1>
+      </div>
+      <h2>Unknown domain in URL</h2>
+      <div id='content'>
+        <p>This page requires JavaScript to display the redirect chain.</p>
+      </div>
+    </div>
+  </div>
+</body>
+<script>
+  var div = document.getElementById('content');
+  div.innerHTML = '';
+  var url = '{{URL}}';
+  var host = '';
+  while (url) {
+    var urlo = new URL(url);
+    var host = urlo.hostname;
+    var urls = url.replace(host, '<b>' + host + '</b>');
+
+    next = urlo.searchParams.get('url') || urlo.searchParams.get('target') || urlo.searchParams.get('originalUrl');
+
+    if (!next && host === 'secure-web.cisco.com') {
+      next = decodeURIComponent(url.replace(/.*\//, ''));
+    }
+    if (!next && host.endsWith('.mcas.ms')) {
+      u = url;
+      u = u.replace(/\.mcas\.ms\//, '/');
+      u = u.replace(/\?McasTsid=[0-9]*/, '');
+      next = decodeURIComponent(u);
+    }
+    if (host.endsWith('.safelinks.protection.outlook.com')) {
+      host = 'safelinks.outlook.com';
+    }
+    if (host.startsWith('www.')) {
+      host = host.substring(4);
+    }
+
+    cls = next ? 'contact-btn' : 'home-btn';
+    div.innerHTML += '<p>Requested URL<br><span class="url">' + urls + '</span></p>';
+    div.innerHTML += '<a href="' + url + '" class="' + cls + '">Go to ' + host + '</a>';
+
+    url = next;
+  }
+  document.title = 'Warning: ' + host;
+</script>

urlwall-0.1.2.dist-info/METADATA

@@ -0,0 +1,90 @@
+Metadata-Version: 2.4
+Name: urlwall
+Version: 0.1.2
+Summary: Interceptive browser for macOS — confirms unknown domains before opening
+Author-email: Jens Svalgaard <github@svalgaard.net>
+License: Apache-2.0
+Project-URL: Homepage, https://github.com/svalgaard/urlwall
+Project-URL: Repository, https://github.com/svalgaard/urlwall
+Project-URL: Issues, https://github.com/svalgaard/urlwall/issues
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Environment :: MacOS X
+Classifier: Intended Audience :: End Users/Desktop
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: test
+Requires-Dist: pytest; extra == "test"
+Requires-Dist: pytest-cov; extra == "test"
+Provides-Extra: lint
+Requires-Dist: ruff; extra == "lint"
+Dynamic: license-file
+
+# URL-Wall — Interceptive Browser for macOS
+
+Add a confirmation step when you click an http, https, or ftp
+URL *outside your browser* to ensure you reach the domain you expect.
+
+Known domains go directly. Unknown domains show a warning page where you
+can acknowledge and proceed.
+
+## Installation
+
+```bash
+# Build the .app bundle
+python -m urlwall --install ~/Applications/URL-Wall.app
+
+# Set as macOS default browser
+python -m urlwall --use-as-default
+# Then run: killall Finder
+```
+
+## CLI Usage
+
+```bash
+# Open a URL through the gate
+python -m urlwall https://example.com
+
+# Add a domain to the allow list
+python -m urlwall --allow-host-add example.com
+
+# Add with subdomain support
+python -m urlwall --allow-host-add example.com --also-subdomains
+
+# Remove from allow list
+python -m urlwall --allow-host-remove example.com
+
+# Set the browser used after URL-Wall
+python -m urlwall --set-browser "Google Chrome.app"
+
+# Set URL-Wall as macOS default browser
+python -m urlwall --use-as-default
+
+# View current config
+python -m urlwall
+```
+
+## How It Works
+
+1. The `install` command compiles an AppleScript handler into a `.app` bundle
+2. The `.app` is patched with URL scheme handlers (http, https, ftp)
+3. When macOS routes a URL to URL-Wall, the AppleScript calls `python -m urlwall <url>`
+4. The Python handler checks if the domain is allowed — if so, opens it directly
+5. If not, shows a warning page with the full redirect chain and a "Proceed" button
+
+## Configuration
+
+Config is stored in `~/.urlwall/setup.plist`:
+
+- `defaultBrowser` — app name (e.g., `Safari.app`)
+- `hostsAllowed` — domains that open directly
+- `hostWithSubdomainsAllowed` — domains + all subdomains

urlwall-0.1.2.dist-info/RECORD

@@ -0,0 +1,16 @@
+urlwall/__init__.py,sha256=K9NLvOeZhLkCcel-qg46ka29GBq-lM44ov3e9crbfp4,5066
+urlwall/__main__.py,sha256=RVudeX1pMNnjHPwfyKG2Vz_KIvZD_Emj34cN8mqEZco,3739
+urlwall/app.py,sha256=gfuU0LtYXshUQ4TQW-79CZHP9o1nO2T96M9x7cP-8sU,2228
+urlwall/cli.py,sha256=e8SnnI91-7WQYb0e7Mw2_IJdY9ZNYupUnmCH9bb3rvg,900
+urlwall/config.py,sha256=FVfcAqjgJjmhhMILMqUaXAOSB3-gjPFOGb5RRo4GUW0,4596
+urlwall/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+urlwall/app/Info-patch.plist,sha256=GSFWWk1txxeKkB9T_1twR_E4dHTyfpnuNk6AWrBU0yE,730
+urlwall/app/url-wall.scpt,sha256=y78SV6OIVDfHwgf5dnTkrx7bRowdiu2Cdw5lAF_tx4E,530
+urlwall/html/bg.jpg,sha256=-9unC5KTAy_jd4KmFs8VVjYXNSb-S_ZjA0bZLg3NBQI,344663
+urlwall/html/template.html,sha256=wDujCbeX3vBUGir9fbFiL1dopDV6ft-a_43xwrZt3w0,5067
+urlwall-0.1.2.dist-info/licenses/LICENSE,sha256=rXNTfYv5HGthwWj0ydLs-ZAKc2SjPeubmLvPgNosGG4,11373
+urlwall-0.1.2.dist-info/METADATA,sha256=-Qc6pX_nxnfDQnhEnTMemYhNE2jtZabOpaSg-4d3e30,2910
+urlwall-0.1.2.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+urlwall-0.1.2.dist-info/entry_points.txt,sha256=S7JXhmWpm_QklIl1zxSxkcPdUSwmh-Fi07t32HxjU-A,51
+urlwall-0.1.2.dist-info/top_level.txt,sha256=SKqDz7xbtrZ32DBs3WpUh7JMoqkfgfEaY3CpwuP2C_k,8
+urlwall-0.1.2.dist-info/RECORD,,

urlwall-0.1.2.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

urlwall-0.1.2.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+url-wall = urlwall.__main__:main

urlwall-0.1.2.dist-info/licenses/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Jens Svalgaard Kohrt <github@svalgaard.net>
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

urlwall-0.1.2.dist-info/top_level.txt

@@ -0,0 +1 @@
+urlwall