feat: call page on its own origin, http://127.0.0.1:44548 (cinny #43)

The bundled Element Call page ran on the app's own origin
(http://localhost:44548), so the call frame could read the app's storage
(login token) and DOM. Serve it from http://127.0.0.1:44548 instead: the
same local server and bundle, a different origin.

- The local server binds 127.0.0.1 explicitly. The app is still loaded as
  http://localhost:44548 (its storage stays where it is; the engines try
  127.0.0.1 for `localhost`). Binding the name `localhost` could pick ::1
  only (Windows lists it first), and then 127.0.0.1 wouldn't answer.
- config.json: desktopCallOrigin = http://127.0.0.1:44548. cinny loads the
  call page from there only when this is set (cinny #43 PR).
- CSP frame-src allows http://127.0.0.1:44548.
- Permissions (on top of #22): the call page's origin gets microphone/
  camera/screen only; nothing else.
- The call page gets no IPC: the capability only matches
  http://localhost:44548.

Tested (Linux release build): the server listens on 127.0.0.1:44548 and
the app loads as http://localhost:44548; the call page loads from
127.0.0.1 inside the app under its CSP; from that frame parent.localStorage
and parent.document are SecurityError, while a same-origin frame (the old
setup) reads the app's storage. The call itself was tested in a simulated
desktop (Chromium, the WebView2 engine) against a local Synapse + LiveKit;
see the cinny PR. Rust tests 17 passed; Windows code type-checked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

config.json

@@ -24,5 +24,6 @@
     "basename": "/"
   },
   "gifApiKey": "",
-  "webAppUrl": "https://chat.lotusguild.org"
+  "webAppUrl": "https://chat.lotusguild.org",
+  "desktopCallOrigin": "http://127.0.0.1:44548"
 }

src-tauri/Cargo.lock

@@ -498,7 +498,6 @@ checksum = "6e4de3bc4ea267985becf712dc6d9eed8b04c953b3fcfb339ebc87acd9804901"
 name = "cinny"
 version = "4.12.2"
 dependencies = [
- "keyring",
  "serde",
  "serde_json",
  "tauri",
@@ -2091,18 +2090,6 @@ dependencies = [
  "unicode-segmentation",
 ]
 
-[[package]]
-name = "keyring"
-version = "3.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eebcc3aff044e5944a8fbaf69eb277d11986064cba30c468730e8b9909fb551c"
-dependencies = [
- "byteorder",
- "log",
- "windows-sys 0.60.2",
- "zeroize",
-]
-
 [[package]]
 name = "kuchikiki"
 version = "0.8.8-speedreader"

src-tauri/Cargo.toml

@@ -38,10 +38,6 @@ tauri-plugin-single-instance = "2"
 tauri-plugin-autostart = "2" # P6-1 launch-on-login
 # Update retry backoff (already in the tree via tauri; adds only the timer).
 tokio = { version = "1", features = ["time"] }
-# cinny #105: login tokens in the OS keychain. Without a platform feature
-# the crate only has its in-memory mock store (used by the tests); Windows
-# turns on Credential Manager below.
-keyring = "3.6"
 
 [target.'cfg(target_os = "linux")'.dependencies]
 # P6-1 desktop parity: screensaver inhibit (no-sleep in calls) + Unity launcher
@@ -54,7 +50,6 @@ zbus = "5"
 webkit2gtk = "2.0"
 
 [target.'cfg(target_os = "windows")'.dependencies]
-keyring = { version = "3.6", features = ["windows-native"] }
 webview2-com = "0.38"
 window-vibrancy = "0.6"
 windows = { version = "0.61", features = [

src-tauri/src/lib.rs

@@ -13,7 +13,8 @@ use tauri_plugin_opener::OpenerExt;
 
 pub mod gpu_workarounds;
 mod native;
-mod secure_session;
+#[cfg(any(target_os = "linux", target_os = "windows", test))]
+mod webview_permissions;
 
 /// Bring the main window to the foreground from the tray / a hidden /
 /// minimized state. Shared by the tray, single-instance, and deep-link paths.
@@ -953,12 +954,18 @@ pub fn run() {
             native::focus_assist::get_focus_assist,
             native::hotkeys::global_hotkeys_supported,
             native::hotkeys::set_global_hotkeys,
-            secure_session::secure_session_supported,
-            secure_session::secure_session_set,
-            secure_session::secure_session_get,
-            secure_session::secure_session_clear,
         ])
-        .plugin(tauri_plugin_localhost::Builder::new(port).build())
+        // Bound to 127.0.0.1 explicitly (cinny #43). The app is still loaded as
+        // http://localhost:{port} (its storage lives under that origin, and the
+        // engines try 127.0.0.1 for `localhost`); the bundled call page is
+        // loaded as http://127.0.0.1:{port}, a separate origin on the same
+        // server. Binding the name `localhost` could pick ::1 only (Windows
+        // lists it first), and then the call page wouldn't load.
+        .plugin(
+            tauri_plugin_localhost::Builder::new(port)
+                .host("127.0.0.1")
+                .build(),
+        )
         .plugin(
             // DECORATIONS is excluded: the custom-chrome toggle (set_custom_chrome)
             // owns the decorated flag. Letting window-state restore a saved
@@ -1226,41 +1233,76 @@ pub fn run() {
                 let _ = window_vibrancy::apply_mica(&window, Some(true));
             }
 
-            // Auto-grant camera, microphone, and notification permissions in WebView2.
-            #[cfg(target_os = "windows")]
-            window.with_webview(|webview| {
-                use webview2_com::{
-                    Microsoft::Web::WebView2::Win32::{
-                        COREWEBVIEW2_PERMISSION_KIND,
-                        COREWEBVIEW2_PERMISSION_KIND_CAMERA,
-                        COREWEBVIEW2_PERMISSION_KIND_MICROPHONE,
-                        COREWEBVIEW2_PERMISSION_KIND_NOTIFICATIONS,
-                        COREWEBVIEW2_PERMISSION_STATE_ALLOW,
-                    },
-                    PermissionRequestedEventHandler,
-                };
+            // cinny-desktop #22: the app's own page gets the microphone, camera
+            // and notifications without a prompt; other origins (room widgets,
+            // link-preview embeds) are refused them. See webview_permissions.
+            #[cfg(any(target_os = "linux", target_os = "windows"))]
+            let app_origins = webview_permissions::AppOrigins::new(
+                port,
+                app.config().build.dev_url.as_ref(),
+            );
 
-                let controller = webview.controller();
-                if let Ok(core) = unsafe { controller.CoreWebView2() } {
-                    let handler = PermissionRequestedEventHandler::create(Box::new(
-                        |_sender, args| {
-                            if let Some(args) = args {
-                                let mut kind = COREWEBVIEW2_PERMISSION_KIND(0);
-                                unsafe { args.PermissionKind(&mut kind) }?;
-                                if kind == COREWEBVIEW2_PERMISSION_KIND_MICROPHONE
-                                    || kind == COREWEBVIEW2_PERMISSION_KIND_CAMERA
-                                    || kind == COREWEBVIEW2_PERMISSION_KIND_NOTIFICATIONS
-                                {
-                                    unsafe {
-                                        args.SetState(COREWEBVIEW2_PERMISSION_STATE_ALLOW)
-                                    }?;
-                                }
-                            }
-                            Ok(())
+            #[cfg(target_os = "windows")]
+            window.with_webview({
+                let app_origins = app_origins.clone();
+                move |webview| {
+                    use webview2_com::{
+                        Microsoft::Web::WebView2::Win32::{
+                            COREWEBVIEW2_PERMISSION_KIND,
+                            COREWEBVIEW2_PERMISSION_KIND_CAMERA,
+                            COREWEBVIEW2_PERMISSION_KIND_GEOLOCATION,
+                            COREWEBVIEW2_PERMISSION_KIND_MICROPHONE,
+                            COREWEBVIEW2_PERMISSION_KIND_NOTIFICATIONS,
+                            COREWEBVIEW2_PERMISSION_STATE_ALLOW,
+                            COREWEBVIEW2_PERMISSION_STATE_DENY,
                         },
-                    ));
-                    let mut token = Default::default();
-                    let _ = unsafe { core.add_PermissionRequested(&handler, &mut token) };
+                        PermissionRequestedEventHandler,
+                    };
+                    use webview_permissions::{decide, Decision, Kind, WINDOWS_GRANTS};
+
+                    let controller = webview.controller();
+                    if let Ok(core) = unsafe { controller.CoreWebView2() } {
+                        let handler = PermissionRequestedEventHandler::create(Box::new(
+                            move |_sender, args| {
+                                if let Some(args) = args {
+                                    let mut raw = COREWEBVIEW2_PERMISSION_KIND(0);
+                                    unsafe { args.PermissionKind(&mut raw) }?;
+                                    let kind = if raw == COREWEBVIEW2_PERMISSION_KIND_MICROPHONE
+                                        || raw == COREWEBVIEW2_PERMISSION_KIND_CAMERA
+                                    {
+                                        Kind::Media
+                                    } else if raw == COREWEBVIEW2_PERMISSION_KIND_NOTIFICATIONS {
+                                        Kind::Notifications
+                                    } else if raw == COREWEBVIEW2_PERMISSION_KIND_GEOLOCATION {
+                                        Kind::Geolocation
+                                    } else {
+                                        Kind::Other
+                                    };
+                                    // The origin of the frame that asked.
+                                    let mut uri = windows::core::PWSTR::null();
+                                    unsafe { args.Uri(&mut uri) }?;
+                                    let uri = webview2_com::take_pwstr(uri);
+                                    match decide(kind, &uri, &app_origins, WINDOWS_GRANTS) {
+                                        Decision::Allow => unsafe {
+                                            args.SetState(COREWEBVIEW2_PERMISSION_STATE_ALLOW)
+                                        }?,
+                                        Decision::Deny => {
+                                            eprintln!(
+                                                "webview: denied {kind:?} permission to {uri}"
+                                            );
+                                            unsafe {
+                                                args.SetState(COREWEBVIEW2_PERMISSION_STATE_DENY)
+                                            }?
+                                        }
+                                        Decision::Default => {}
+                                    }
+                                }
+                                Ok(())
+                            },
+                        ));
+                        let mut token = Default::default();
+                        let _ = unsafe { core.add_PermissionRequested(&handler, &mut token) };
+                    }
                 }
             })?;
 
@@ -1268,19 +1310,48 @@ pub fn run() {
             // default (unlike WebView2/WKWebView), which leaves
             // `navigator.mediaDevices` undefined and makes Element Call
             // report "browser does not support WebRTC". Turn them on and
-            // auto-grant the resulting camera/mic permission prompt, mirroring
-            // the WebView2 handling above.
+            // answer the permission requests, mirroring the WebView2 handling
+            // above. WebKitGTK doesn't say which frame asked, so the origin
+            // checked is the page in the window (see webview_permissions).
             #[cfg(target_os = "linux")]
-            window.with_webview(|webview| {
-                use webkit2gtk::{PermissionRequestExt, SettingsExt, WebViewExt};
+            window.with_webview(move |webview| {
+                use webkit2gtk::glib::prelude::ObjectExt;
+                use webkit2gtk::{
+                    DeviceInfoPermissionRequest, GeolocationPermissionRequest,
+                    NotificationPermissionRequest, PermissionRequestExt, SettingsExt,
+                    UserMediaPermissionRequest, WebViewExt,
+                };
+                use webview_permissions::{decide, Decision, Kind, LINUX_GRANTS};
 
                 let wv = webview.inner();
                 if let Some(settings) = WebViewExt::settings(&wv) {
                     settings.set_enable_media_stream(true);
                     settings.set_enable_webrtc(true);
                 }
-                wv.connect_permission_request(|_webview, request| {
-                    request.allow();
+                wv.connect_permission_request(move |wv, request| {
+                    let kind = if request.is::<UserMediaPermissionRequest>() {
+                        Kind::Media
+                    } else if request.is::<DeviceInfoPermissionRequest>() {
+                        Kind::DeviceInfo
+                    } else if request.is::<NotificationPermissionRequest>() {
+                        Kind::Notifications
+                    } else if request.is::<GeolocationPermissionRequest>() {
+                        Kind::Geolocation
+                    } else {
+                        Kind::Other
+                    };
+                    let uri = wv.uri().map(|u| u.to_string()).unwrap_or_default();
+                    match decide(kind, &uri, &app_origins, LINUX_GRANTS) {
+                        Decision::Allow => request.allow(),
+                        // No prompt of our own: anything not granted is denied.
+                        Decision::Deny | Decision::Default => {
+                            eprintln!(
+                                "webview: denied {} to {uri}",
+                                request.type_().name()
+                            );
+                            request.deny();
+                        }
+                    }
                     true
                 });
             })?;

src-tauri/src/secure_session.rs

@@ -1,181 +0,0 @@
-//! Login tokens in the OS keychain (cinny #105, step 1).
-//!
-//! Step 1 only MIRRORS the session tokens into the keychain (Windows
-//! Credential Manager): the web client keeps reading its session from
-//! localStorage exactly as before, so nothing about login changes and a
-//! keychain problem can't log anyone out. Once the mirror has proven itself on
-//! real installs, step 2 switches reads to the keychain and drops the tokens
-//! from localStorage.
-//!
-//! Only the secrets are stored (user id + device id to match them to the
-//! session, the access token and the refresh token); the rest of the session
-//! stays in localStorage. Windows caps a credential at 2560 bytes, so the
-//! serialized value is limited well below that.
-//!
-//! Other platforms: not supported yet (Linux Secret Service can prompt to
-//! unlock a wallet at startup; that needs its own testing), and the commands
-//! say so instead of failing.
-
-use serde::{Deserialize, Serialize};
-
-#[cfg_attr(not(any(target_os = "windows", test)), allow(dead_code))]
-pub(crate) const SERVICE: &str = "Lotus Chat";
-#[cfg_attr(not(any(target_os = "windows", test)), allow(dead_code))]
-pub(crate) const ACCOUNT: &str = "session";
-/// Serialized-length cap (chars). Windows' limit is 2560 bytes; staying under
-/// 1200 chars keeps us safe whether the value is stored as UTF-8 or UTF-16.
-pub(crate) const MAX_LEN: usize = 1200;
-
-#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, Eq)]
-#[serde(rename_all = "camelCase")]
-pub struct SessionTokens {
-    pub user_id: String,
-    pub device_id: String,
-    pub access_token: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub refresh_token: Option<String>,
-}
-
-pub(crate) fn store(entry: &keyring::Entry, tokens: &SessionTokens) -> Result<(), String> {
-    if tokens.user_id.is_empty() || tokens.device_id.is_empty() || tokens.access_token.is_empty() {
-        return Err("incomplete session".into());
-    }
-    let value = serde_json::to_string(tokens).map_err(|e| e.to_string())?;
-    if value.chars().count() > MAX_LEN {
-        return Err(format!(
-            "session too large for the keychain ({} chars)",
-            value.chars().count()
-        ));
-    }
-    entry.set_password(&value).map_err(|e| e.to_string())
-}
-
-pub(crate) fn load(entry: &keyring::Entry) -> Result<Option<SessionTokens>, String> {
-    match entry.get_password() {
-        Ok(value) => serde_json::from_str(&value)
-            .map(Some)
-            .map_err(|e| format!("unreadable keychain entry: {e}")),
-        Err(keyring::Error::NoEntry) => Ok(None),
-        Err(e) => Err(e.to_string()),
-    }
-}
-
-pub(crate) fn clear(entry: &keyring::Entry) -> Result<(), String> {
-    match entry.delete_credential() {
-        Ok(()) | Err(keyring::Error::NoEntry) => Ok(()),
-        Err(e) => Err(e.to_string()),
-    }
-}
-
-#[cfg(target_os = "windows")]
-fn entry() -> Result<keyring::Entry, String> {
-    keyring::Entry::new(SERVICE, ACCOUNT).map_err(|e| e.to_string())
-}
-
-#[cfg(not(target_os = "windows"))]
-fn entry() -> Result<keyring::Entry, String> {
-    Err("not supported on this platform".into())
-}
-
-/// Keychain calls can block (credential store, AV scanners): keep them off
-/// the main thread.
-async fn blocking<T: Send + 'static>(
-    f: impl FnOnce() -> Result<T, String> + Send + 'static,
-) -> Result<T, String> {
-    tauri::async_runtime::spawn_blocking(f)
-        .await
-        .map_err(|e| e.to_string())?
-}
-
-/// Whether this platform stores the session in the keychain.
-#[tauri::command]
-pub fn secure_session_supported() -> bool {
-    cfg!(target_os = "windows")
-}
-
-#[tauri::command]
-pub async fn secure_session_set(tokens: SessionTokens) -> Result<(), String> {
-    blocking(move || store(&entry()?, &tokens)).await
-}
-
-#[tauri::command]
-pub async fn secure_session_get() -> Result<Option<SessionTokens>, String> {
-    blocking(|| load(&entry()?)).await
-}
-
-#[tauri::command]
-pub async fn secure_session_clear() -> Result<(), String> {
-    blocking(|| clear(&entry()?)).await
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn mock_entry() -> keyring::Entry {
-        keyring::set_default_credential_builder(keyring::mock::default_credential_builder());
-        keyring::Entry::new(SERVICE, ACCOUNT).unwrap()
-    }
-
-    fn tokens() -> SessionTokens {
-        SessionTokens {
-            user_id: "@alice:lotusguild.org".into(),
-            device_id: "ABCDEFGHIJ".into(),
-            access_token: "syt_YWxpY2U_abcdefghijklmnopqrst_0AbCdE".into(),
-            refresh_token: None,
-        }
-    }
-
-    #[test]
-    fn round_trip_and_clear() {
-        let e = mock_entry();
-        assert_eq!(load(&e).unwrap(), None);
-        store(&e, &tokens()).unwrap();
-        assert_eq!(load(&e).unwrap(), Some(tokens()));
-        let mut oidc = tokens();
-        oidc.refresh_token = Some("mar_refresh_token_value_0123456789".into());
-        store(&e, &oidc).unwrap();
-        assert_eq!(load(&e).unwrap(), Some(oidc));
-        clear(&e).unwrap();
-        assert_eq!(load(&e).unwrap(), None);
-        // Clearing an empty keychain is fine (logout twice, or never mirrored).
-        clear(&e).unwrap();
-    }
-
-    #[test]
-    fn rejects_incomplete_or_oversized_sessions() {
-        let e = mock_entry();
-        let mut t = tokens();
-        t.access_token = String::new();
-        assert!(store(&e, &t).is_err());
-        let mut big = tokens();
-        big.access_token = "x".repeat(MAX_LEN);
-        assert!(store(&e, &big).unwrap_err().contains("too large"));
-        assert_eq!(load(&e).unwrap(), None, "nothing written on error");
-    }
-
-    #[test]
-    fn serialized_shape_matches_the_web_client() {
-        let json = serde_json::to_value(tokens()).unwrap();
-        assert_eq!(json["userId"], "@alice:lotusguild.org");
-        assert_eq!(json["deviceId"], "ABCDEFGHIJ");
-        assert!(json.get("refreshToken").is_none());
-        let back: SessionTokens = serde_json::from_str(
-            r#"{"userId":"@a:b","deviceId":"D","accessToken":"t","refreshToken":"r"}"#,
-        )
-        .unwrap();
-        assert_eq!(back.refresh_token.as_deref(), Some("r"));
-    }
-
-    #[test]
-    fn a_realistic_oidc_session_fits() {
-        let e = mock_entry();
-        let t = SessionTokens {
-            user_id: format!("@{}:matrix.lotusguild.org", "a".repeat(60)),
-            device_id: "X".repeat(40),
-            access_token: "mat_".to_string() + &"A".repeat(200),
-            refresh_token: Some("mar_".to_string() + &"B".repeat(200)),
-        };
-        store(&e, &t).unwrap();
-    }
-}

src-tauri/src/webview_permissions.rs

@@ -0,0 +1,273 @@
+//! Which WebView permission requests the app grants (cinny-desktop #22).
+//!
+//! The web client asks for the microphone/camera/screen (calls, voice
+//! messages), the device list (audio-output picker), notifications and the
+//! location (location sharing). Those are granted without a prompt, but only
+//! to the app's own origin. Everything else is left alone (Windows: WebView2's
+//! own prompt) or denied (Linux: WebKitGTK has no prompt of its own).
+//!
+//! What "the requesting origin" means differs per engine:
+//! - WebView2 reports the origin of the frame that asked (`args.Uri()`), so a
+//!   room widget or link-preview embed is refused here.
+//! - WebKitGTK doesn't say which frame asked; the check is on the page loaded
+//!   in the window. Frames are gated before the request gets this far by the
+//!   Permissions Policy: cinny only puts `microphone; camera` in the `allow=`
+//!   of the call frame, and cross-origin frames get neither location nor
+//!   notifications.
+//!
+//! The call frame (cinny #43): the bundled Element Call page is loaded from
+//! `http://127.0.0.1:{port}`, the same local server on a second origin, so it
+//! can't reach the app's storage. WebView2 reports that origin for the call's
+//! microphone/camera requests; it gets media and nothing else.
+
+use tauri::Url;
+
+/// A permission request, reduced to what the policy cares about.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum Kind {
+    /// Microphone, camera or screen capture (getUserMedia/getDisplayMedia).
+    Media,
+    /// Device labels/ids from enumerateDevices (WebKitGTK only).
+    #[cfg_attr(not(target_os = "linux"), allow(dead_code))]
+    DeviceInfo,
+    Notifications,
+    Geolocation,
+    /// Anything else: clipboard read, storage access, pointer lock, DRM, …
+    Other,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum Decision {
+    Allow,
+    Deny,
+    /// Let the engine decide (WebView2 prompts; WebKitGTK denies).
+    Default,
+}
+
+/// What the Linux (WebKitGTK) handler grants to the app.
+#[cfg_attr(not(target_os = "linux"), allow(dead_code))]
+pub(crate) const LINUX_GRANTS: &[Kind] = &[
+    Kind::Media,
+    Kind::DeviceInfo,
+    Kind::Notifications,
+    Kind::Geolocation,
+];
+/// What the Windows (WebView2) handler grants to the app. Location keeps
+/// WebView2's own prompt, as before.
+#[cfg_attr(not(target_os = "windows"), allow(dead_code))]
+pub(crate) const WINDOWS_GRANTS: &[Kind] = &[Kind::Media, Kind::Notifications];
+
+/// The decision for a request of `kind` from `uri`.
+pub(crate) fn decide(kind: Kind, uri: &str, app: &AppOrigins, grants: &[Kind]) -> Decision {
+    if kind == Kind::Other {
+        return Decision::Default;
+    }
+    if app.is_call_frame(uri) {
+        // The call page: microphone/camera/screen only.
+        return if kind == Kind::Media && grants.contains(&kind) {
+            Decision::Allow
+        } else {
+            Decision::Deny
+        };
+    }
+    if !app.contains(uri) {
+        return Decision::Deny;
+    }
+    if grants.contains(&kind) {
+        Decision::Allow
+    } else {
+        Decision::Default
+    }
+}
+
+/// scheme, host, port (explicit or the scheme's default).
+type Origin = (String, String, Option<u16>);
+
+fn origin_of(uri: &str) -> Option<Origin> {
+    let url = Url::parse(uri).ok()?;
+    let host = url.host_str()?.to_ascii_lowercase();
+    Some((url.scheme().to_owned(), host, url.port_or_known_default()))
+}
+
+/// The origins the app's own page is served from, and the call page's.
+#[derive(Clone, Debug)]
+pub(crate) struct AppOrigins {
+    app: Vec<Origin>,
+    call: Option<Origin>,
+}
+
+impl AppOrigins {
+    /// Release builds load `http://localhost:{port}` (tauri-plugin-localhost).
+    /// Debug builds load the bundled page (`tauri://localhost`, or
+    /// `http://tauri.localhost` on Windows) or, under `tauri dev`, `dev_url`.
+    pub(crate) fn new(port: u16, dev_url: Option<&Url>) -> Self {
+        let mut uris = vec![format!("http://localhost:{port}/")];
+        if cfg!(debug_assertions) {
+            uris.push("tauri://localhost/".into());
+            uris.push("http://tauri.localhost/".into());
+            if let Some(dev) = dev_url {
+                uris.push(dev.to_string());
+            }
+        }
+        Self {
+            app: uris.iter().filter_map(|u| origin_of(u)).collect(),
+            call: origin_of(&format!("http://127.0.0.1:{port}/")),
+        }
+    }
+
+    /// The app's own page.
+    pub(crate) fn contains(&self, uri: &str) -> bool {
+        origin_of(uri).is_some_and(|o| self.app.contains(&o))
+    }
+
+    /// The call page on its own origin (`http://127.0.0.1:{port}`).
+    pub(crate) fn is_call_frame(&self, uri: &str) -> bool {
+        origin_of(uri).is_some_and(|o| self.call.as_ref() == Some(&o))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn app() -> AppOrigins {
+        AppOrigins::new(44548, None)
+    }
+
+    #[test]
+    fn app_origin_matches_only_the_app() {
+        let app = app();
+        assert!(app.contains("http://localhost:44548/"));
+        assert!(app.contains("http://localhost:44548/#/home/!room:server"));
+        assert!(app.contains("http://LOCALHOST:44548/public/element-call/index.html"));
+        for other in [
+            "http://localhost:44549/",
+            "https://localhost:44548/",
+            "http://127.0.0.1:44548/",
+            "http://localhost/",
+            "http://localhost.evil.example:44548/",
+            "http://evil.example/?http://localhost:44548/",
+            "https://www.youtube-nocookie.com/embed/x",
+            "https://chat.lotusguild.org/",
+            "about:blank",
+            "data:text/html,hi",
+            "null",
+            "",
+        ] {
+            assert!(!app.contains(other), "{other}");
+        }
+    }
+
+    #[test]
+    fn debug_builds_also_accept_the_bundled_and_dev_pages() {
+        let dev = Url::parse("http://localhost:8080").unwrap();
+        let app = AppOrigins::new(44548, Some(&dev));
+        assert_eq!(
+            app.contains("tauri://localhost/index.html"),
+            cfg!(debug_assertions)
+        );
+        assert_eq!(
+            app.contains("http://tauri.localhost/"),
+            cfg!(debug_assertions)
+        );
+        assert_eq!(
+            app.contains("http://localhost:8080/"),
+            cfg!(debug_assertions)
+        );
+        assert!(app.contains("http://localhost:44548/"));
+        assert!(!app.contains("tauri://evil/"));
+    }
+
+    #[test]
+    fn app_gets_its_grants_without_a_prompt() {
+        let app = app();
+        let uri = "http://localhost:44548/";
+        for kind in [
+            Kind::Media,
+            Kind::DeviceInfo,
+            Kind::Notifications,
+            Kind::Geolocation,
+        ] {
+            assert_eq!(
+                decide(kind, uri, &app, LINUX_GRANTS),
+                Decision::Allow,
+                "{kind:?}"
+            );
+        }
+        assert_eq!(
+            decide(Kind::Media, uri, &app, WINDOWS_GRANTS),
+            Decision::Allow
+        );
+        assert_eq!(
+            decide(Kind::Notifications, uri, &app, WINDOWS_GRANTS),
+            Decision::Allow
+        );
+        // Location on Windows keeps WebView2's prompt.
+        assert_eq!(
+            decide(Kind::Geolocation, uri, &app, WINDOWS_GRANTS),
+            Decision::Default
+        );
+    }
+
+    #[test]
+    fn other_origins_are_refused() {
+        let app = app();
+        for uri in [
+            "https://widget.example/",
+            "https://www.youtube-nocookie.com/embed/x",
+            "",
+        ] {
+            for kind in [
+                Kind::Media,
+                Kind::DeviceInfo,
+                Kind::Notifications,
+                Kind::Geolocation,
+            ] {
+                assert_eq!(decide(kind, uri, &app, LINUX_GRANTS), Decision::Deny);
+                assert_eq!(decide(kind, uri, &app, WINDOWS_GRANTS), Decision::Deny);
+            }
+        }
+    }
+
+    #[test]
+    fn call_frame_gets_media_only() {
+        let app = app();
+        let call = "http://127.0.0.1:44548/public/element-call/index.html?widgetId=x";
+        assert!(app.is_call_frame(call));
+        assert!(!app.contains(call));
+        for grants in [LINUX_GRANTS, WINDOWS_GRANTS] {
+            assert_eq!(decide(Kind::Media, call, &app, grants), Decision::Allow);
+            for kind in [Kind::DeviceInfo, Kind::Notifications, Kind::Geolocation] {
+                assert_eq!(decide(kind, call, &app, grants), Decision::Deny, "{kind:?}");
+            }
+            assert_eq!(decide(Kind::Other, call, &app, grants), Decision::Default);
+        }
+        for not_call in [
+            "http://127.0.0.1:44549/",
+            "https://127.0.0.1:44548/",
+            "http://127.0.0.2:44548/",
+            "http://[::1]:44548/",
+        ] {
+            assert!(!app.is_call_frame(not_call), "{not_call}");
+            assert_eq!(
+                decide(Kind::Media, not_call, &app, WINDOWS_GRANTS),
+                Decision::Deny
+            );
+        }
+    }
+
+    #[test]
+    fn other_kinds_are_left_to_the_engine() {
+        let app = app();
+        for uri in ["http://localhost:44548/", "https://widget.example/"] {
+            assert_eq!(
+                decide(Kind::Other, uri, &app, LINUX_GRANTS),
+                Decision::Default
+            );
+            assert_eq!(
+                decide(Kind::Other, uri, &app, WINDOWS_GRANTS),
+                Decision::Default
+            );
+        }
+    }
+}

src-tauri/tauri.conf.json

@@ -71,7 +71,7 @@
   },
   "app": {
     "security": {
-      "csp": "default-src 'self'; script-src 'self' 'unsafe-eval' 'sha256-dT6noyex1I8o5CS9Sx/y8UOqwpZYIridpGz92gcObIM='; style-src 'self' 'unsafe-inline'; font-src 'self' data:; img-src 'self' data: blob: http: https:; media-src 'self' blob: data: mediastream: http: https:; worker-src 'self' blob:; frame-src 'self' blob: https://www.openstreetmap.org https://www.youtube-nocookie.com https://www.youtube.com https://player.vimeo.com https://www.tiktok.com https://www.dailymotion.com https://geo.dailymotion.com https://streamable.com https://player.twitch.tv https://clips.twitch.tv https://open.spotify.com https://w.soundcloud.com https://embed.music.apple.com https://platform.twitter.com https://www.instagram.com https://embed.tidal.com https://www.redditmedia.com https://embed.reddit.com https://embed.bsky.app https://www.loom.com https://player.kick.com https://www.mixcloud.com https://widget.deezer.com https://store.steampowered.com; connect-src 'self' blob: data: ipc: ws: wss: http: https: http://ipc.localhost; object-src 'none'; base-uri 'self'"
+      "csp": "default-src 'self'; script-src 'self' 'unsafe-eval' 'sha256-dT6noyex1I8o5CS9Sx/y8UOqwpZYIridpGz92gcObIM='; style-src 'self' 'unsafe-inline'; font-src 'self' data:; img-src 'self' data: blob: http: https:; media-src 'self' blob: data: mediastream: http: https:; worker-src 'self' blob:; frame-src 'self' blob: http://127.0.0.1:44548 https://www.openstreetmap.org https://www.youtube-nocookie.com https://www.youtube.com https://player.vimeo.com https://www.tiktok.com https://www.dailymotion.com https://geo.dailymotion.com https://streamable.com https://player.twitch.tv https://clips.twitch.tv https://open.spotify.com https://w.soundcloud.com https://embed.music.apple.com https://platform.twitter.com https://www.instagram.com https://embed.tidal.com https://www.redditmedia.com https://embed.reddit.com https://embed.bsky.app https://www.loom.com https://player.kick.com https://www.mixcloud.com https://widget.deezer.com https://store.steampowered.com; connect-src 'self' blob: data: ipc: ws: wss: http: https: http://ipc.localhost; object-src 'none'; base-uri 'self'"
     }
   }
 }