From 68bfe56a19aeb4c16f8e185fc85d8eee61aef78f Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Tue, 18 Aug 2026 10:30:59 +0200 Subject: fix(client): the desktop client runs, and running it corrected three things MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Electron 42 / Chromium 148, launched under xvfb. The packaged interface mounts over `app://` with a secure context, `crypto.subtle` present, Argon2 WASM loaded, and no console errors. Three statements in the design were wrong, and only launching it found them. **A CSP in a `` tag silently drops `frame-ancestors`.** Chromium says so in the console. A policy carrying a directive that does nothing is worse than one without it, so the policy is sent as a header by the protocol handler — which is also the only thing serving the interface, so one source instead of two. **`secure: true` is not what makes the service worker register.** Chromium refuses a worker on a custom scheme whatever its privileges: "The URL protocol of the current origin ('app://meshbay') is not supported". The application has no service worker and needs none — it saves through a native dialog, which is the better of the two paths. `sw.js` stays in the package because the same files serve the browser, where it is one of only three ways to write a large file. What `secure: true` is actually for was measured at the same time: without it **the whole of `crypto.subtle` is undefined**. The first probe loaded a `data:` URL and every algorithm failed with TypeError, AES-GCM included — which is why the probe was rewritten before believing its answer. X25519 and Ed25519 are both present on Chromium 148, settling the version floor left open as O6. **The renderer cannot call the hub.** Its origin is `app://meshbay` and CORS refuses it. The hub has *no CORS middleware at all* — its API is reachable from no web origin whatever — and that is worth keeping. Widening it for `app://meshbay` would be worse than it looks: that origin is not a credential, since any Electron application can claim the same scheme and host name. So every hub call leaves from the main process, exactly as saving a file does, and it refuses any origin that is not the hub the user signed in to. `platform.apiFetch()` is `fetch` in a browser and the bridge in the application, so no caller has to know which it got. `transport.js` reaches it through a global because it is a classic script, not a module — the alternative was a second fetch path, which is how two callers of one hub start disagreeing about how to reach it. Verified from inside Electron: the main process gets 200 from /v1/hub/version, the renderer is refused by CORS, and **a script served by the hub is refused by the policy** — T3's mitigation demonstrated rather than asserted. Build note, written into the README because it will bite the next person: **Ubuntu 24.04's nodejs 18 cannot install Electron at all** — the download script `require()`s an ESM module, which Node gained in 22. Node 24 LTS, checksum-verified against nodejs.org, is what this was built with. package-lock.json is committed; builds use `npm ci`, not `npm install`. 799 tests pass, e2e.py still passes end to end. The session harness needed a platform stub: it lifts `hubFetch` out of app.js as text and runs it, so the adapter is now part of the environment it models. Co-Authored-By: Claude Opus 5 --- packages/meshbay-hub/tests/test_desktop_shell.py | 49 ++++++++++++++++++------ 1 file changed, 37 insertions(+), 12 deletions(-) (limited to 'packages/meshbay-hub/tests/test_desktop_shell.py') diff --git a/packages/meshbay-hub/tests/test_desktop_shell.py b/packages/meshbay-hub/tests/test_desktop_shell.py index 13d194e..c4f5b08 100644 --- a/packages/meshbay-hub/tests/test_desktop_shell.py +++ b/packages/meshbay-hub/tests/test_desktop_shell.py @@ -85,11 +85,18 @@ def test_no_permission_is_granted_to_the_page(): ]) def test_the_scheme_is_privileged(privilege): """ - Without `secure` the scheme is not a secure context, the service worker - silently refuses to register, and streamed downloads break with no error — - the same failure mode as an uncontrolled page, which this codebase has - already learned once. `standard` gives a real origin, so IndexedDB survives - an update instead of being keyed to something that moves. + `secure` is what makes it a secure context, and without it **the whole of + `crypto.subtle` is undefined** — measured, not assumed: the first probe + loaded a `data:` URL and every algorithm failed with TypeError, AES-GCM + included. `standard` gives a real origin, so IndexedDB survives an update + instead of being keyed to something that moves. + + An earlier version of this docstring said `secure` was what let the service + worker register. That is wrong: Chromium refuses to register a worker on a + custom scheme whatever its privileges — "The URL protocol of the current + origin ('app://meshbay') is not supported". The application therefore has no + service worker and does not need one; it saves files through a native + dialog, which is better than the path the worker exists to provide. """ assert privilege in _main(), f"{privilege} missing from the scheme privileges" @@ -107,6 +114,18 @@ def test_the_protocol_handler_cannot_be_walked_out_of(): # ── Content Security Policy ───────────────────────────────────────────────── +def test_the_policy_is_sent_as_a_header(): + """ + A policy cannot carry `frame-ancestors`, and having it there means + one directive of the policy is decoration. The handler is also the only + thing that serves the interface, so this is one source rather than two. + """ + source = _main() + assert "'Content-Security-Policy': CSP" in source + assert "Content-Security-Policy" not in INDEX.read_text(encoding="utf-8") \ + .split("-->")[1], "the packaged page still carries a policy of its own" + + def test_the_policy_keeps_wasm_unsafe_eval(): """ The bundle key is Argon2id in WebAssembly. A policy that forbids it does not @@ -116,14 +135,20 @@ def test_the_policy_keeps_wasm_unsafe_eval(): def _policy() -> str: - """The meta tag's content, not the file — the comment above it names the - same directives and would satisfy a naive search.""" + """ + The policy the protocol handler sends, read out of the CSP constant. + + Not a tag: `frame-ancestors` is ignored there, and a directive that + silently does nothing is worse than one that is absent. Chromium said so in + the console the first time the application was launched. + """ import re - page = INDEX.read_text(encoding="utf-8") - match = re.search( - r'http-equiv="Content-Security-Policy"\s+content="([^"]*)"', page) - assert match, "no Content-Security-Policy meta tag" - return match.group(1) + source = _main() + match = re.search(r"const CSP = \[(.*?)\]\.join", source, re.S) + assert match, "no CSP constant in the main process" + return "; ".join( + line.strip().strip('",').strip('"') + for line in match.group(1).splitlines() if line.strip()) def _directive(name: str) -> str: -- cgit v1.2.3