1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
|
; electron-builder NSIS customisation (auto-included: build/installer.nsh).
;
; Per-user install, no elevation (package.json build.nsis) -- that part never
; changes. What this adds, all conditional on interactive setup (never
; ${Silent}):
; - the bundled daemon dir on the user's PATH, so `meshbay-node` works in a
; terminal;
; - a choice of autostart: the normal per-user Startup-folder launcher (no
; admin, starts at sign-in -- see meshbay_node.platform._startup_vbs),
; or a background-service mode (one admin confirmation, starts at boot,
; no sign-in required -- see meshbay_node.platform.service_install and
; packaging/win/service.ps1);
; - the inbound firewall rules, folded into that SAME elevation when service
; mode is chosen, or offered on their own otherwise -- never two UAC
; prompts for one install;
; - cleanup of whichever of those is outside $INSTDIR on the way out (the
; Startup .vbs; the scheduled task and firewall rules, together, if the
; user opts in).
;
; Deliberately NOT touched:
; - %LOCALAPPDATA%\meshbay\ (node.toml, keystore.enc, unlock.key, data/) --
; the keystore must survive an uninstall/reinstall; installers place files,
; never remove secrets. This is also why service mode needs no code
; changes to platform.py: it runs as this same user (S4U), so it is the
; same profile either way.
!include "WinMessages.nsh"
!include "WordFunc.nsh"
!include "LogicLib.nsh"
!insertmacro WordAdd
!insertmacro un.WordAdd
!define MB_PWSH "$SYSDIR\WindowsPowerShell\v1.0\powershell.exe"
; The dir electron-builder drops resources into. `meshbay-node.exe` and its
; frozen Python live directly in here. A fixed suffix of $INSTDIR, so both the
; add (install) and the remove (uninstall, where $INSTDIR is still known) match
; the exact same string.
!define MB_NODE_BIN "$INSTDIR\resources\node-runtime"
!macro customInstall
; resources\node-runtime\meshbay-node.exe is about to be overwritten; a
; daemon still running from a previous version holds the file open.
nsExec::Exec 'taskkill /IM meshbay-node.exe /F'
; Add the daemon dir to the per-user PATH (HKCU\Environment). WordAdd is a
; stock NSIS macro over a ';'-delimited list -- it is a no-op if the entry is
; already there, so a reinstall does not double it. New shells only; the
; broadcast tells already-open Explorer/shells to reload the environment.
ReadRegStr $0 HKCU "Environment" "Path"
${WordAdd} "$0" ";" "+${MB_NODE_BIN}" $1
WriteRegExpandStr HKCU "Environment" "Path" "$1"
SendMessage ${HWND_BROADCAST} ${WM_WININICHANGE} 0 "STR:Environment" /TIMEOUT=5000
${IfNot} ${Silent}
; Already configured -- an upgrade, or a repair install -- asks nothing.
; Checked unelevated: reading firewall rules needs no admin, only
; creating them does (same reasoning as the service task below). Whether
; service mode or per-user mode was chosen last time, firewall rules
; existing already means there is nothing left for this dialog to do.
nsExec::Exec '"${MB_PWSH}" -NoProfile -ExecutionPolicy Bypass -File "$INSTDIR\resources\firewall.ps1" check'
Pop $0
${If} $0 == 0
Goto mb_mode_done
${EndIf}
; The choice. Service mode needs admin to CREATE (a boot trigger touches
; system-wide scheduler state -- the same reason /sc onlogon needed it
; too); day-to-day start/stop from the Node page does not, once the task
; exists, because Task Scheduler grants the owning user that much itself.
MessageBox MB_YESNO|MB_ICONQUESTION \
"Run MeshBay Node as a background service?$\n$\nIt starts automatically at boot, even before you sign in, and needs one administrator confirmation now (which also sets up the Windows Firewall rules, in the same step).$\n$\nChoose No for the normal per-user mode instead: it starts when you sign in, no admin needed, and you will be asked about the firewall rules separately." \
IDNO mb_peruser_mode
; -- Service mode: one elevation, both jobs --------------------------
ExecShellWait "runas" "${MB_PWSH}" \
'-NoProfile -ExecutionPolicy Bypass -File "$INSTDIR\resources\service-mode.ps1" -Action install' \
SW_HIDE
Goto mb_mode_done
mb_peruser_mode:
; -- Per-user mode: the firewall question stands on its own ----------
MessageBox MB_YESNO|MB_ICONQUESTION \
"Allow MeshBay through Windows Firewall now?$\n$\nMeshBay connects to other devices on your local network. Choosing Yes adds the rules in one step (Windows will ask for administrator confirmation). Choosing No is fine too -- Windows will ask you to allow access the first time MeshBay connects." \
/SD IDYES IDNO mb_mode_done
ExecShellWait "runas" "${MB_PWSH}" \
'-NoProfile -ExecutionPolicy Bypass -File "$INSTDIR\resources\firewall.ps1" add' \
SW_HIDE
mb_mode_done:
${EndIf}
!macroend
!macro customUnInstall
nsExec::Exec 'taskkill /IM meshbay-node.exe /F'
; Take our entry back out of PATH, leaving the rest of it alone.
ReadRegStr $0 HKCU "Environment" "Path"
${un.WordAdd} "$0" ";" "-${MB_NODE_BIN}" $1
WriteRegExpandStr HKCU "Environment" "Path" "$1"
SendMessage ${HWND_BROADCAST} ${WM_WININICHANGE} 0 "STR:Environment" /TIMEOUT=5000
; Offer to take the firewall rules, and the service task if one was set up,
; back out together (needs admin again -- one prompt for both, same as
; install). Both underlying removes are no-ops when there is nothing to
; remove, so this is safe to run unconditionally regardless of which mode
; was chosen. Stale rules/tasks are inert if left, so this is opt-in and
; default-No; a silent uninstall skips it entirely. customUnInstall runs
; before the files are removed, so service-mode.ps1 is still there.
${IfNot} ${Silent}
MessageBox MB_YESNO|MB_ICONQUESTION \
"Remove MeshBay's Windows Firewall rules and its boot-time service task, if you set one up? This needs one administrator confirmation. Both are harmless if left." \
/SD IDNO IDNO mb_keep_privileged
ExecShellWait "runas" "${MB_PWSH}" \
'-NoProfile -ExecutionPolicy Bypass -File "$INSTDIR\resources\service-mode.ps1" -Action remove' \
SW_HIDE
mb_keep_privileged:
${EndIf}
; meshbay_node.platform._startup_vbs() -- if the user ran "meshbay-node
; autostart install" (or toggled it in the client), this points wscript at
; the binary we are about to delete, and would error at every sign-in.
Delete "$APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\MeshBay Node.vbs"
!macroend
|