From 505e65f319d51c6a6a94ecafbe00d08f1ba11f60 Mon Sep 17 00:00:00 2001 From: Bernd Rodler Date: Wed, 5 Aug 2026 14:29:17 +0200 Subject: [PATCH] fix(electron): disable npmRebuild so packaging doesn't need Xcode CLT electron-builder's default npmRebuild pass scans the entire node_modules tree (not just what's actually packaged) for native addons and tries to recompile them against Electron's ABI via node-gyp. It caught @parcel/watcher - a transitive devDependency of some dev tool, never shipped in this app - and hard-failed packaging on any machine without a full Xcode Command Line Tools install ("gyp: No Xcode or CLT version detected!"). GitHub's macOS runners happen to have Xcode, which is presumably why CI never caught this. The packaged app is plain esbuild-bundled JS with no native modules of its own; the one native dependency in the repo (@signalapp/sqlcipher, used by lib/mail-index/) ships prebuilt .node binaries for every platform and is copied in wholesale by scripts/assemble-standalone.mjs, never rebuilt by electron-builder. Verified by execution: packaging failed with npmRebuild at its default (true), succeeded once set false, and the resulting .dmg launches and runs correctly. Also adds e2e/electron-live-sandbox.spec.ts - a live-connectivity check against the real sandbox JMAP backend (stalwart.sandbox.vnc.de), proving the packaged/launched app reaches it with no TLS/network errors and gets a real structured auth-rejection on a deliberately fake credential. Deliberately NOT wired into playwright.electron.config.ts's default testMatch (electron-smoke.spec.ts only) - this depends on a live external service and is a manual/opt-in verification tool, not part of the regular regression suite. Also carries the pre-existing lib/smime-ca/ejbca.ts no-control-regex eslint fix from MR !1's branch (not yet merged to dev) so this commit's own pre-commit hook passes - unrelated to electron work otherwise. --- e2e/electron-live-sandbox.spec.ts | 113 ++++++++++++++++++++++++++++++ electron-builder.config.js | 18 +++++ lib/smime-ca/ejbca.ts | 4 +- 3 files changed, 134 insertions(+), 1 deletion(-) create mode 100644 e2e/electron-live-sandbox.spec.ts diff --git a/e2e/electron-live-sandbox.spec.ts b/e2e/electron-live-sandbox.spec.ts new file mode 100644 index 00000000..d42bd403 --- /dev/null +++ b/e2e/electron-live-sandbox.spec.ts @@ -0,0 +1,113 @@ +import { test, expect, _electron as electron } from '@playwright/test'; +import type { ElectronApplication, Page } from '@playwright/test'; +import path from 'node:path'; + +// Live-sandbox verification run (not part of the regular regression suite). +// +// Unlike e2e/electron-smoke.spec.ts (which deliberately uses a fake +// JMAP_SERVER_URL just to skip the /setup wizard, and never expects a real +// server on the other end), this spec launches the exact same packaged +// artifact against the REAL sandbox JMAP backend at +// https://stalwart.sandbox.vnc.de and proves: +// 1. the login screen renders with no TLS/network errors reaching that host +// 2. submitting an obviously-fake, nonexistent test credential produces a +// structured "invalid credentials" style response from the real server +// (not a network failure) - proving the renderer -> Next API route -> +// real JMAP server round trip works end-to-end, without ever using or +// guessing a real account's credentials. +const projectRoot = path.resolve(__dirname, '..'); +const SANDBOX_URL = 'https://stalwart.sandbox.vnc.de'; + +test.describe('Electron desktop shell - live sandbox connectivity', () => { + let electronApp: ElectronApplication; + let appWindow: Page; + const pageErrors: Error[] = []; + const networkFailures: string[] = []; + + test.beforeAll(async () => { + electronApp = await electron.launch({ + args: [projectRoot], + env: { + ...process.env, + JMAP_SERVER_URL: SANDBOX_URL, + SESSION_SECRET: process.env.SESSION_SECRET || 'live-sandbox-verification-run', + NODE_ENV: 'production', + }, + }); + + appWindow = await electronApp.firstWindow(); + appWindow.on('pageerror', (error) => { + pageErrors.push(error); + }); + appWindow.on('requestfailed', (request) => { + networkFailures.push(`${request.method()} ${request.url()} - ${request.failure()?.errorText}`); + }); + await appWindow.waitForLoadState('domcontentloaded'); + }); + + test.afterAll(async () => { + await electronApp?.close(); + }); + + test('renders the real login screen (not SETUP REQUIRED) with no network/TLS errors', async () => { + const bodyText = await appWindow.locator('body').innerText(); + expect(bodyText).not.toContain('SETUP REQUIRED'); + expect(bodyText).not.toContain('Setup Required'); + + const emailInput = appWindow.locator('input[type="text"]').first(); + const passwordInput = appWindow.locator('input[type="password"]').first(); + await expect(emailInput).toBeVisible({ timeout: 20000 }); + await expect(passwordInput).toBeVisible(); + + await appWindow.screenshot({ + path: path.join(projectRoot, 'live-sandbox-login-screen.png'), + fullPage: true, + }); + + expect(pageErrors.map((e) => e.message).join('\n')).not.toMatch(/ERR_CERT|ERR_CONNECTION|ERR_NAME_NOT_RESOLVED|ECONNREFUSED/i); + expect(networkFailures.join('\n')).not.toMatch(/ERR_CERT|ERR_CONNECTION|ERR_NAME_NOT_RESOLVED|ECONNREFUSED/i); + }); + + test('submitting a nonexistent test credential reaches the real JMAP server and returns a structured auth error (no real account used/guessed)', async () => { + const emailInput = appWindow.locator('input[type="text"]').first(); + const passwordInput = appWindow.locator('input[type="password"]').first(); + + // Deliberately fake, nonexistent address - not a real account, not a + // guess against one. This only proves the pipe to the real server works. + await emailInput.fill('electron-live-sandbox-verify-8f2c@invalid-test.example'); + await passwordInput.fill('not-a-real-password-8f2c'); + + const allResponses: { url: string; status: number }[] = []; + appWindow.on('response', (res) => { + allResponses.push({ url: res.url(), status: res.status() }); + }); + + await appWindow.locator('button[type="submit"]').first().click(); + + // The important assertion: the app renders a structured "invalid + // credentials" style error sourced from the real JMAP server's rejection + // (visible in whatever locale the app negotiated), not a network/TLS + // failure. A real connectivity break to stalwart.sandbox.vnc.de would + // instead surface as a generic network-error message or a stuck spinner. + const errorBanner = appWindow.getByText(/invalid|ungültig|incorrect|falsch|unauthorized/i).first(); + await expect(errorBanner).toBeVisible({ timeout: 15000 }); + const errorText = await errorBanner.innerText(); + console.log('[live-sandbox] login error banner text:', errorText); + expect(errorText.length).toBeGreaterThan(0); + expect(errorText).not.toMatch(/network error|failed to fetch|ERR_CERT|ERR_CONNECTION|ECONNREFUSED/i); + + await appWindow.screenshot({ + path: path.join(projectRoot, 'live-sandbox-after-failed-login-attempt.png'), + fullPage: true, + }); + + console.log('[live-sandbox] ALL responses observed after click:', JSON.stringify(allResponses, null, 2)); + const authResponses = allResponses.filter((r) => r.url.includes('/api/auth/')); + if (authResponses.length > 0) { + for (const r of authResponses) { + expect(r.status).toBeGreaterThanOrEqual(400); + expect(r.status).toBeLessThan(500); + } + } + }); +}); diff --git a/electron-builder.config.js b/electron-builder.config.js index da98fb9e..15a69802 100644 --- a/electron-builder.config.js +++ b/electron-builder.config.js @@ -15,6 +15,24 @@ module.exports = { directories: { output: "dist-electron-builds", }, + // The packaged app (`files` below) is plain esbuild-bundled JS - no native + // node modules of its own. The one native dependency anywhere in the repo, + // @signalapp/sqlcipher (used by lib/mail-index/**), ships its own prebuilt + // .node binaries for every platform/arch and is copied in wholesale by + // scripts/assemble-standalone.mjs as part of the extraResources standalone + // bundle below - it is never rebuilt by electron-builder. + // + // Without this, electron-builder's default @electron/rebuild pass scans + // the ENTIRE node_modules tree (not just what's actually packaged) for + // anything with a native binding and tries to recompile it from source + // against Electron's ABI via node-gyp. That caught @parcel/watcher - a + // transitive devDependency of some dev tool, never shipped in this app - + // and hard-failed the whole packaging step on any machine without a full + // Xcode Command Line Tools install (`gyp: No Xcode or CLT version + // detected!`), even though nothing that rebuild step touches is part of + // the artifact. Verified by execution: builds failed with npmRebuild at + // its default (true) and succeeded once set to false. + npmRebuild: false, files: ["dist-electron/**/*", "package.json"], extraResources: [ { diff --git a/lib/smime-ca/ejbca.ts b/lib/smime-ca/ejbca.ts index 61dd4028..dccddc0f 100644 --- a/lib/smime-ca/ejbca.ts +++ b/lib/smime-ca/ejbca.ts @@ -210,7 +210,9 @@ function escapeDn(value: string): string { .replace(/([\\,+"<>;=])/g, '\\$1') .replace(/^([ #])/, '\\$1') .replace(/ $/, '\\ ') - // Control characters have no legitimate place in a DN. + // Control characters have no legitimate place in a DN — the class below + // is intentional, not a typo. + // eslint-disable-next-line no-control-regex .replace(/[\x00-\x1f\x7f]/g, ''); }