Merge remote-tracking branch 'origin/main' into webview-permission-origin

fix: WebView permissions only for the app's own origin (#22 )
Linux (WebKitGTK) allowed every permission request of every kind; Windows (WebView2) auto-allowed mic/camera/notifications without checking who asked. Now (src-tauri/src/webview_permissions.rs, unit-tested): - Linux: microphone/camera/screen, device labels, notifications and location are granted when the page in the window is the app (http://localhost:44548; debug builds also the bundled/dev page). Everything else is denied (WebKitGTK has no prompt of its own). WebKitGTK doesn't say which frame asked; frames are gated earlier by the Permissions Policy (cinny gives microphone/camera only to the same-origin call frame). - Windows: the same grants (minus location, which keeps WebView2's prompt), checked against the origin of the frame that asked (args.Uri()). Other origins are denied mic/camera/notifications/location; other kinds keep WebView2's default handling. - Denials are logged ("webview: denied …"). Tested on Linux with a release build under Xvfb + PulseAudio (no WebDriver: WebKit's automation mode bypasses the handler), before/after: - app page: mic, device labels, location allowed (unchanged) - same-origin call frame: mic allowed (unchanged) - cross-origin frame without allow=: blocked before the handler (unchanged) - foreign top-level page: mic, device labels, location now denied (were allowed) Real cinny build: boots, logs in, no denials. Windows code type-checked (x86_64-pc-windows-gnu). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA
2026-09-30 10:59:51 -04:00 · 2026-09-28 20:03:11 -04:00
3 changed files with 340 additions and 152 deletions
@@ -11,7 +11,6 @@
 // instead of failing, so the same script runs on main and on PR branches.
 import { writeFileSync, mkdirSync } from 'node:fs';
 import { execSync } from 'node:child_process';
 import { createServer } from 'node:http';
 import { chromium } from 'playwright-core';
 const OUT = process.argv[2] || 'smoke-out';
@@ -151,19 +150,8 @@ else if (!kc.supported) record('keychain round trip', 'fail', 'secure_session_su
 else record('keychain round trip', kc.roundTrip && kc.restored ? 'pass' : 'fail', JSON.stringify(kc));
 // 7. A foreign page loaded in the window must not get the microphone (#22).
-// Served locally on another port (a different origin, still a secure context),
+await page.goto('https://example.com/').catch(() => undefined);
-// so the check doesn't depend on the runner reaching the internet.
+const foreignMic = await page.evaluate(async () => {
 const foreign = createServer((_, res) => {
  res.writeHead(200, { 'Content-Type': 'text/html' });
  res.end('<!doctype html><title>foreign</title>foreign page');
 });
 await new Promise((r) => foreign.listen(9333, '127.0.0.1', r));
 const FOREIGN = 'http://localhost:9333/';
 await page.goto(FOREIGN).catch(() => undefined);
 if (!page.url().startsWith(FOREIGN)) {
  record('microphone refused to a foreign page', 'fail', `navigation did not happen (at ${page.url()})`);
 } else {
  const foreignMic = await page.evaluate(async () => {
  try {
    const s = await navigator.mediaDevices.getUserMedia({ audio: true });
    s.getTracks().forEach((t) => t.stop());
@@ -171,18 +159,12 @@ if (!page.url().startsWith(FOREIGN)) {
  } catch (e) {
    return e.name;
  }
-  });
+});
-  const guarded = cfg.desktopCallOrigin !== undefined; // builds with #22 also carry #43
+record(
  let status = 'info';
  if (foreignMic === 'NotAllowedError') status = 'pass';
  else if (guarded) status = 'fail';
  record(
  'microphone refused to a foreign page',
-    status,
+  foreignMic === 'NotAllowedError' ? 'pass' : 'info',
-    `${foreignMic} at ${page.url()}${status === 'info' ? ' (build without the #22 origin check)' : ''}`,
+  `${foreignMic}${foreignMic === 'ok' ? ' (build without the #22 origin check)' : ''}`,
-  );
+);
 }
 foreign.close();
 await page.goto(APP).catch(() => undefined);
 await page.screenshot({ path: `${OUT}/02-end.png` }).catch(() => undefined);
@@ -13,6 +13,8 @@ use tauri_plugin_opener::OpenerExt;
 pub mod gpu_workarounds;
 mod native;
 #[cfg(any(target_os = "linux", target_os = "windows", test))]
 mod webview_permissions;
 /// Bring the main window to the foreground from the tray / a hidden /
 /// minimized state. Shared by the tray, single-instance, and deep-link paths.
@@ -189,47 +191,6 @@ mod update_retry {
    }
 }
 /// How this copy of the app gets updated.
 ///
 /// Tauri's updater can replace the Windows install and a Linux AppImage, but
 /// not a copy installed by a package manager: it tries to write next to the
 /// binary in /usr/bin and fails with "Permission denied (os error 13)"
 /// (reported on CachyOS). Those installs update through their package
 /// manager instead; the web UI shows the right command.
 pub(crate) fn install_kind(linux: bool, appimage: bool, os_release: &str) -> &'static str {
    if !linux || appimage {
        return "in-app";
    }
    let field = |key: &str| {
        os_release
            .lines()
            .find_map(|l| l.strip_prefix(key).and_then(|v| v.strip_prefix('=')))
            .map(|v| v.trim().trim_matches('"').to_ascii_lowercase())
            .unwrap_or_default()
    };
    let ids = format!("{} {}", field("ID"), field("ID_LIKE"));
    let has = |name: &str| ids.split_whitespace().any(|w| w == name);
    if has("arch") {
        "pacman"
    } else if has("debian") || has("ubuntu") {
        "deb"
    } else {
        "manual"
    }
 }
 #[tauri::command]
 fn update_install_kind() -> &'static str {
    let linux = cfg!(target_os = "linux");
    let appimage = std::env::var_os("APPIMAGE").is_some();
    let os_release = if linux {
        std::fs::read_to_string("/etc/os-release").unwrap_or_default()
    } else {
        String::new()
    };
    install_kind(linux, appimage, &os_release)
 }
 #[tauri::command]
 async fn check_for_update(app: tauri::AppHandle) -> Result<UpdateInfo, String> {
    #[cfg(not(any(target_os = "android", target_os = "ios")))]
@@ -252,15 +213,6 @@ async fn install_update(app: tauri::AppHandle) -> Result<(), String> {
    {
        use std::time::{Duration, Instant};
        // A package-manager install can't be replaced in place (see
        // install_kind); refuse before downloading anything.
        let kind = update_install_kind();
        if kind != "in-app" {
            return Err(format!(
                "install: package-managed ({kind}): update Lotus Chat with your package manager"
            ));
        }
        let emit = |detail: serde_json::Value| {
            native::emit_to_web(&app, "lotus-update-progress", &detail.to_string());
        };
@@ -989,7 +941,6 @@ pub fn run() {
            send_notification,
            check_for_update,
            install_update,
            update_install_kind,
            native::power::set_call_active,
            native::jumplist::set_jump_list,
            native::thumbbar::set_thumbbar,
@@ -1272,34 +1223,68 @@ pub fn run() {
                let _ = window_vibrancy::apply_mica(&window, Some(true));
            }
-            // Auto-grant camera, microphone, and notification permissions in WebView2.
+            // cinny-desktop #22: the app's own page gets the microphone, camera
            // and notifications without a prompt; other origins (room widgets,
            // link-preview embeds) are refused them. See webview_permissions.
            #[cfg(any(target_os = "linux", target_os = "windows"))]
            let app_origins = webview_permissions::AppOrigins::new(
                port,
                app.config().build.dev_url.as_ref(),
            );
            #[cfg(target_os = "windows")]
-            window.with_webview(|webview| {
+            window.with_webview({
                let app_origins = app_origins.clone();
                move |webview| {
                    use webview2_com::{
                        Microsoft::Web::WebView2::Win32::{
                            COREWEBVIEW2_PERMISSION_KIND,
                            COREWEBVIEW2_PERMISSION_KIND_CAMERA,
                            COREWEBVIEW2_PERMISSION_KIND_GEOLOCATION,
                            COREWEBVIEW2_PERMISSION_KIND_MICROPHONE,
                            COREWEBVIEW2_PERMISSION_KIND_NOTIFICATIONS,
                            COREWEBVIEW2_PERMISSION_STATE_ALLOW,
                            COREWEBVIEW2_PERMISSION_STATE_DENY,
                        },
                        PermissionRequestedEventHandler,
                    };
                    use webview_permissions::{decide, Decision, Kind, WINDOWS_GRANTS};
                    let controller = webview.controller();
                    if let Ok(core) = unsafe { controller.CoreWebView2() } {
                        let handler = PermissionRequestedEventHandler::create(Box::new(
-                        |_sender, args| {
+                            move |_sender, args| {
                                if let Some(args) = args {
-                                let mut kind = COREWEBVIEW2_PERMISSION_KIND(0);
+                                    let mut raw = COREWEBVIEW2_PERMISSION_KIND(0);
-                                unsafe { args.PermissionKind(&mut kind) }?;
+                                    unsafe { args.PermissionKind(&mut raw) }?;
-                                if kind == COREWEBVIEW2_PERMISSION_KIND_MICROPHONE
+                                    let kind = if raw == COREWEBVIEW2_PERMISSION_KIND_MICROPHONE
-                                    || kind == COREWEBVIEW2_PERMISSION_KIND_CAMERA
+                                        || raw == COREWEBVIEW2_PERMISSION_KIND_CAMERA
                                    || kind == COREWEBVIEW2_PERMISSION_KIND_NOTIFICATIONS
                                    {
-                                    unsafe {
+                                        Kind::Media
                                    } else if raw == COREWEBVIEW2_PERMISSION_KIND_NOTIFICATIONS {
                                        Kind::Notifications
                                    } else if raw == COREWEBVIEW2_PERMISSION_KIND_GEOLOCATION {
                                        Kind::Geolocation
                                    } else {
                                        Kind::Other
                                    };
                                    // The origin of the frame that asked.
                                    let mut uri = windows::core::PWSTR::null();
                                    unsafe { args.Uri(&mut uri) }?;
                                    let uri = webview2_com::take_pwstr(uri);
                                    match decide(kind, &uri, &app_origins, WINDOWS_GRANTS) {
                                        Decision::Allow => unsafe {
                                            args.SetState(COREWEBVIEW2_PERMISSION_STATE_ALLOW)
-                                    }?;
+                                        }?,
                                        Decision::Deny => {
                                            eprintln!(
                                                "webview: denied {kind:?} permission to {uri}"
                                            );
                                            unsafe {
                                                args.SetState(COREWEBVIEW2_PERMISSION_STATE_DENY)
                                            }?
                                        }
                                        Decision::Default => {}
                                    }
                                }
                                Ok(())
@@ -1308,25 +1293,55 @@ pub fn run() {
                        let mut token = Default::default();
                        let _ = unsafe { core.add_PermissionRequested(&handler, &mut token) };
                    }
                }
            })?;
            // WebKitGTK ships `enable-media-stream`/`enable-webrtc` OFF by
            // default (unlike WebView2/WKWebView), which leaves
            // `navigator.mediaDevices` undefined and makes Element Call
            // report "browser does not support WebRTC". Turn them on and
-            // auto-grant the resulting camera/mic permission prompt, mirroring
+            // answer the permission requests, mirroring the WebView2 handling
-            // the WebView2 handling above.
+            // above. WebKitGTK doesn't say which frame asked, so the origin
            // checked is the page in the window (see webview_permissions).
            #[cfg(target_os = "linux")]
-            window.with_webview(|webview| {
+            window.with_webview(move |webview| {
-                use webkit2gtk::{PermissionRequestExt, SettingsExt, WebViewExt};
+                use webkit2gtk::glib::prelude::ObjectExt;
                use webkit2gtk::{
                    DeviceInfoPermissionRequest, GeolocationPermissionRequest,
                    NotificationPermissionRequest, PermissionRequestExt, SettingsExt,
                    UserMediaPermissionRequest, WebViewExt,
                };
                use webview_permissions::{decide, Decision, Kind, LINUX_GRANTS};
                let wv = webview.inner();
                if let Some(settings) = WebViewExt::settings(&wv) {
                    settings.set_enable_media_stream(true);
                    settings.set_enable_webrtc(true);
                }
-                wv.connect_permission_request(|_webview, request| {
+                wv.connect_permission_request(move |wv, request| {
-                    request.allow();
+                    let kind = if request.is::<UserMediaPermissionRequest>() {
                        Kind::Media
                    } else if request.is::<DeviceInfoPermissionRequest>() {
                        Kind::DeviceInfo
                    } else if request.is::<NotificationPermissionRequest>() {
                        Kind::Notifications
                    } else if request.is::<GeolocationPermissionRequest>() {
                        Kind::Geolocation
                    } else {
                        Kind::Other
                    };
                    let uri = wv.uri().map(|u| u.to_string()).unwrap_or_default();
                    match decide(kind, &uri, &app_origins, LINUX_GRANTS) {
                        Decision::Allow => request.allow(),
                        // No prompt of our own: anything not granted is denied.
                        Decision::Deny | Decision::Default => {
                            eprintln!(
                                "webview: denied {} to {uri}",
                                request.type_().name()
                            );
                            request.deny();
                        }
                    }
                    true
                });
            })?;
@@ -1384,36 +1399,6 @@ mod webview2_args_tests {
    }
 }
 #[cfg(test)]
 mod install_kind_tests {
    use super::install_kind;
    #[test]
    fn package_installs_update_through_their_package_manager() {
        let cachy = "NAME=\"CachyOS Linux\"\nID=cachyos\nID_LIKE=arch\n";
        let arch = "NAME=\"Arch Linux\"\nID=arch\n";
        let ubuntu = "NAME=\"Ubuntu\"\nID=ubuntu\nID_LIKE=debian\n";
        let debian = "ID=debian\n";
        let mint = "ID=linuxmint\nID_LIKE=\"ubuntu debian\"\n";
        let fedora = "ID=fedora\n";
        assert_eq!(install_kind(true, false, cachy), "pacman");
        assert_eq!(install_kind(true, false, arch), "pacman");
        assert_eq!(install_kind(true, false, ubuntu), "deb");
        assert_eq!(install_kind(true, false, debian), "deb");
        assert_eq!(install_kind(true, false, mint), "deb");
        assert_eq!(install_kind(true, false, fedora), "manual");
        assert_eq!(install_kind(true, false, ""), "manual");
        // ID_LIKE mentioning arch only as part of a longer word doesn't count.
        assert_eq!(install_kind(true, false, "ID=x\nID_LIKE=archlike\n"), "manual");
    }
    #[test]
    fn appimage_and_windows_update_in_app() {
        assert_eq!(install_kind(true, true, "ID=cachyos\nID_LIKE=arch\n"), "in-app");
        assert_eq!(install_kind(false, false, ""), "in-app");
    }
 }
 #[cfg(test)]
 mod tray_tests {
    use super::*;
@@ -0,0 +1,221 @@
 //! Which WebView permission requests the app grants (cinny-desktop #22).
 //!
 //! The web client asks for the microphone/camera/screen (calls, voice
 //! messages), the device list (audio-output picker), notifications and the
 //! location (location sharing). Those are granted without a prompt, but only
 //! to the app's own origin. Everything else is left alone (Windows: WebView2's
 //! own prompt) or denied (Linux: WebKitGTK has no prompt of its own).
 //!
 //! What "the requesting origin" means differs per engine:
 //! - WebView2 reports the origin of the frame that asked (`args.Uri()`), so a
 //!   room widget or link-preview embed is refused here.
 //! - WebKitGTK doesn't say which frame asked; the check is on the page loaded
 //!   in the window. Frames are gated before the request gets this far by the
 //!   Permissions Policy: cinny only puts `microphone; camera` in the `allow=`
 //!   of the call frame (same origin on desktop), and cross-origin frames get
 //!   neither location nor notifications.
 use tauri::Url;
 /// A permission request, reduced to what the policy cares about.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub(crate) enum Kind {
    /// Microphone, camera or screen capture (getUserMedia/getDisplayMedia).
    Media,
    /// Device labels/ids from enumerateDevices (WebKitGTK only).
    #[cfg_attr(not(target_os = "linux"), allow(dead_code))]
    DeviceInfo,
    Notifications,
    Geolocation,
    /// Anything else: clipboard read, storage access, pointer lock, DRM, …
    Other,
 }
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub(crate) enum Decision {
    Allow,
    Deny,
    /// Let the engine decide (WebView2 prompts; WebKitGTK denies).
    Default,
 }
 /// What the Linux (WebKitGTK) handler grants to the app.
 #[cfg_attr(not(target_os = "linux"), allow(dead_code))]
 pub(crate) const LINUX_GRANTS: &[Kind] = &[
    Kind::Media,
    Kind::DeviceInfo,
    Kind::Notifications,
    Kind::Geolocation,
 ];
 /// What the Windows (WebView2) handler grants to the app. Location keeps
 /// WebView2's own prompt, as before.
 #[cfg_attr(not(target_os = "windows"), allow(dead_code))]
 pub(crate) const WINDOWS_GRANTS: &[Kind] = &[Kind::Media, Kind::Notifications];
 /// The decision for a request of `kind` from `uri`.
 pub(crate) fn decide(kind: Kind, uri: &str, app: &AppOrigins, grants: &[Kind]) -> Decision {
    if kind == Kind::Other {
        return Decision::Default;
    }
    if !app.contains(uri) {
        return Decision::Deny;
    }
    if grants.contains(&kind) {
        Decision::Allow
    } else {
        Decision::Default
    }
 }
 /// scheme, host, port (explicit or the scheme's default).
 type Origin = (String, String, Option<u16>);
 fn origin_of(uri: &str) -> Option<Origin> {
    let url = Url::parse(uri).ok()?;
    let host = url.host_str()?.to_ascii_lowercase();
    Some((url.scheme().to_owned(), host, url.port_or_known_default()))
 }
 /// The origins the app's own page is served from.
 #[derive(Clone, Debug)]
 pub(crate) struct AppOrigins(Vec<Origin>);
 impl AppOrigins {
    /// Release builds load `http://localhost:{port}` (tauri-plugin-localhost).
    /// Debug builds load the bundled page (`tauri://localhost`, or
    /// `http://tauri.localhost` on Windows) or, under `tauri dev`, `dev_url`.
    pub(crate) fn new(port: u16, dev_url: Option<&Url>) -> Self {
        let mut uris = vec![format!("http://localhost:{port}/")];
        if cfg!(debug_assertions) {
            uris.push("tauri://localhost/".into());
            uris.push("http://tauri.localhost/".into());
            if let Some(dev) = dev_url {
                uris.push(dev.to_string());
            }
        }
        Self(uris.iter().filter_map(|u| origin_of(u)).collect())
    }
    pub(crate) fn contains(&self, uri: &str) -> bool {
        origin_of(uri).is_some_and(|o| self.0.contains(&o))
    }
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    fn app() -> AppOrigins {
        AppOrigins::new(44548, None)
    }
    #[test]
    fn app_origin_matches_only_the_app() {
        let app = app();
        assert!(app.contains("http://localhost:44548/"));
        assert!(app.contains("http://localhost:44548/#/home/!room:server"));
        assert!(app.contains("http://LOCALHOST:44548/public/element-call/index.html"));
        for other in [
            "http://localhost:44549/",
            "https://localhost:44548/",
            "http://127.0.0.1:44548/",
            "http://localhost/",
            "http://localhost.evil.example:44548/",
            "http://evil.example/?http://localhost:44548/",
            "https://www.youtube-nocookie.com/embed/x",
            "https://chat.lotusguild.org/",
            "about:blank",
            "data:text/html,hi",
            "null",
            "",
        ] {
            assert!(!app.contains(other), "{other}");
        }
    }
    #[test]
    fn debug_builds_also_accept_the_bundled_and_dev_pages() {
        let dev = Url::parse("http://localhost:8080").unwrap();
        let app = AppOrigins::new(44548, Some(&dev));
        assert_eq!(
            app.contains("tauri://localhost/index.html"),
            cfg!(debug_assertions)
        );
        assert_eq!(
            app.contains("http://tauri.localhost/"),
            cfg!(debug_assertions)
        );
        assert_eq!(
            app.contains("http://localhost:8080/"),
            cfg!(debug_assertions)
        );
        assert!(app.contains("http://localhost:44548/"));
        assert!(!app.contains("tauri://evil/"));
    }
    #[test]
    fn app_gets_its_grants_without_a_prompt() {
        let app = app();
        let uri = "http://localhost:44548/";
        for kind in [
            Kind::Media,
            Kind::DeviceInfo,
            Kind::Notifications,
            Kind::Geolocation,
        ] {
            assert_eq!(
                decide(kind, uri, &app, LINUX_GRANTS),
                Decision::Allow,
                "{kind:?}"
            );
        }
        assert_eq!(
            decide(Kind::Media, uri, &app, WINDOWS_GRANTS),
            Decision::Allow
        );
        assert_eq!(
            decide(Kind::Notifications, uri, &app, WINDOWS_GRANTS),
            Decision::Allow
        );
        // Location on Windows keeps WebView2's prompt.
        assert_eq!(
            decide(Kind::Geolocation, uri, &app, WINDOWS_GRANTS),
            Decision::Default
        );
    }
    #[test]
    fn other_origins_are_refused() {
        let app = app();
        for uri in [
            "https://widget.example/",
            "https://www.youtube-nocookie.com/embed/x",
            "",
        ] {
            for kind in [
                Kind::Media,
                Kind::DeviceInfo,
                Kind::Notifications,
                Kind::Geolocation,
            ] {
                assert_eq!(decide(kind, uri, &app, LINUX_GRANTS), Decision::Deny);
                assert_eq!(decide(kind, uri, &app, WINDOWS_GRANTS), Decision::Deny);
            }
        }
    }
    #[test]
    fn other_kinds_are_left_to_the_engine() {
        let app = app();
        for uri in ["http://localhost:44548/", "https://widget.example/"] {
            assert_eq!(
                decide(Kind::Other, uri, &app, LINUX_GRANTS),
                Decision::Default
            );
            assert_eq!(
                decide(Kind::Other, uri, &app, WINDOWS_GRANTS),
                Decision::Default
            );
        }
    }
 }