fix(desktop): isolate remote runtime auth and embeds

Fix remote Desktop runtime bootstrapping across context-panel session chats, additional windows, and host switches.\n\n- Bootstrap embedded session-chat frames through a same-origin parent handshake that supplies the active endpoint, bearer token, runtime headers, local origin, and a credential-free relay descriptor.\n- Keep relay pairing grants out of iframe state and explicitly rebind the SDK after embedded bootstrap or relay restoration.\n- Preserve each additional and Mini Chat window's own init script instead of overwriting it when the main window's host configuration changes.\n- Replace direct iframe global calls with same-origin postMessage synchronization for theme, chat settings, and visibility.\n\nHarden Desktop host authentication and probing.\n\n- Bind password, passkey, session-status, and token-persistence completions to the runtime identity that started them, so a late result cannot alter a newly selected host.\n- Cancel active passkey operations and reset transient auth UI state on endpoint changes.\n- Verify stored client authentication via /auth/session for direct and relay host probes, distinguishing reachable hosts from hosts that require re-authentication.\n- Bound every relay probe request with an aborting timeout so a stalled auth request cannot hang refresh or host switching.\n\nAdd regression coverage for the embedded bootstrap handshake, credential-free relay descriptor exposure, runtime configuration, stale password completion after an A-to-B switch, and SDK errors that carry a zero response status.\n\nAlso preserve SDK response status on session-message loader errors so callers can distinguish transport and server failures.
2026-07-30 17:43:39 +03:00
parent 4ae3debf54
commit 3b00c91893
19 changed files with 819 additions and 159 deletions
@@ -3,9 +3,12 @@ import { getDefaultTheme } from '@/lib/theme/themes';
 import type { Theme } from '@/types/theme';
 import {
  buildEmbeddedSessionChatURL,
+  EMBEDDED_RUNTIME_BOOTSTRAP_REQUEST,
+  EMBEDDED_RUNTIME_BOOTSTRAP_RESPONSE,
  getOrCreateEmbeddedSessionChatURL,
  getEmbeddedSessionChatOriginSessionId,
  isEmbeddedSessionChat,
+  requestEmbeddedSessionRuntimeBootstrap,
  resetEmbeddedSessionChatCache,
  type EmbeddedSessionChatURLCacheEntry,
 } from './contextPanelEmbeddedChat';
@@ -207,3 +210,137 @@ describe('getEmbeddedSessionChatOriginSessionId', () => {
    expect(getEmbeddedSessionChatOriginSessionId()).toBe('ses_child');
  });
 });
+
+describe('embedded runtime bootstrap handshake', () => {
+  test('accepts only the matching response from the same-origin parent', async () => {
+    let messageListener: ((event: MessageEvent) => void) | null = null;
+    let requestCount = 0;
+    let retryCleared = false;
+    const parent = {
+      postMessage(message: { type?: string; requestId?: string }, targetOrigin: string) {
+        requestCount += 1;
+        expect(message.type).toBe(EMBEDDED_RUNTIME_BOOTSTRAP_REQUEST);
+        queueMicrotask(() => {
+          messageListener?.({
+            origin: 'https://wrong.example.com',
+            source: parent,
+            data: {
+              type: EMBEDDED_RUNTIME_BOOTSTRAP_RESPONSE,
+              requestId: message.requestId,
+              payload: null,
+            },
+          } as unknown as MessageEvent);
+          if (requestCount === 1) return;
+          messageListener?.({
+            origin: targetOrigin,
+            source: parent,
+            data: {
+              type: EMBEDDED_RUNTIME_BOOTSTRAP_RESPONSE,
+              requestId: 'different-request',
+              payload: null,
+            },
+          } as unknown as MessageEvent);
+          messageListener?.({
+            origin: targetOrigin,
+            source: parent,
+            data: {
+              type: EMBEDDED_RUNTIME_BOOTSTRAP_RESPONSE,
+              requestId: message.requestId,
+              payload: {
+                apiBaseUrl: 'https://remote.example.com',
+                clientToken: 'client-token',
+                localOrigin: 'openchamber-ui://app',
+                runtimeHeaders: { 'x-runtime': 'value' },
+                relayHostId: 'host-1',
+                relay: {
+                  relayUrl: 'wss://relay.example.com',
+                  serverId: 'server-1',
+                  hostEncPubJwk: { kty: 'EC', crv: 'P-256', x: 'public-x', y: 'public-y' },
+                },
+              },
+            },
+          } as unknown as MessageEvent);
+        });
+      },
+    };
+    const url = new URL('openchamber-ui://app/index.html?ocPanel=session-chat&sessionId=ses_1');
+    Object.defineProperty(globalThis, 'window', {
+      configurable: true,
+      value: {
+        location: { origin: url.origin, search: url.search },
+        parent,
+        addEventListener: (type: string, listener: (event: MessageEvent) => void) => {
+          if (type === 'message') messageListener = listener;
+        },
+        removeEventListener: (type: string, listener: (event: MessageEvent) => void) => {
+          if (type === 'message' && messageListener === listener) messageListener = null;
+        },
+        setTimeout: globalThis.setTimeout.bind(globalThis),
+        clearTimeout: globalThis.clearTimeout.bind(globalThis),
+        setInterval: globalThis.setInterval.bind(globalThis),
+        clearInterval: (interval: ReturnType<typeof setInterval>) => {
+          retryCleared = true;
+          globalThis.clearInterval(interval);
+        },
+      },
+    });
+    resetEmbeddedSessionChatCache();
+
+    const result = await requestEmbeddedSessionRuntimeBootstrap();
+    expect(result).toEqual({
+      apiBaseUrl: 'https://remote.example.com',
+      clientToken: 'client-token',
+      localOrigin: 'openchamber-ui://app',
+      runtimeHeaders: { 'x-runtime': 'value' },
+      relayHostId: 'host-1',
+      relay: {
+        relayUrl: 'wss://relay.example.com',
+        serverId: 'server-1',
+        hostEncPubJwk: { kty: 'EC', crv: 'P-256', x: 'public-x', y: 'public-y' },
+      },
+    });
+    expect(requestCount).toBe(2);
+    expect(retryCleared).toBe(true);
+    expect(messageListener).toBeNull();
+  });
+
+  test('cleans up its listener and retry when the bootstrap times out', async () => {
+    let messageListener: ((event: MessageEvent) => void) | null = null;
+    let timeoutCallback: () => void = () => {
+      throw new Error('Timeout was not scheduled');
+    };
+    let timeoutCleared = false;
+    let retryCleared = false;
+    const parent = { postMessage() {} };
+    const url = new URL('openchamber-ui://app/index.html?ocPanel=session-chat&sessionId=ses_1');
+    Object.defineProperty(globalThis, 'window', {
+      configurable: true,
+      value: {
+        location: { origin: url.origin, search: url.search },
+        parent,
+        addEventListener: (type: string, listener: (event: MessageEvent) => void) => {
+          if (type === 'message') messageListener = listener;
+        },
+        removeEventListener: (type: string, listener: (event: MessageEvent) => void) => {
+          if (type === 'message' && messageListener === listener) messageListener = null;
+        },
+        setTimeout: (callback: () => void) => {
+          timeoutCallback = callback;
+          return 1;
+        },
+        clearTimeout: () => { timeoutCleared = true; },
+        setInterval: () => 2,
+        clearInterval: () => { retryCleared = true; },
+      },
+    });
+    resetEmbeddedSessionChatCache();
+
+    const resultPromise = requestEmbeddedSessionRuntimeBootstrap();
+    timeoutCallback();
+
+    expect(await resultPromise).toBeNull();
+    expect(timeoutCleared).toBe(true);
+    expect(retryCleared).toBe(true);
+    expect(messageListener).toBeNull();
+  });
+});