frontendDist pointed at the raw portal/ source tree, so all 33 test suites (and anything else dropped into portal/) shipped verbatim inside the signed, notarized app, with no gate inspecting payload contents. Portal now bundles from portal-dist/, assembled by scripts/build-portal-dist.sh from an explicit allowlist of runtime files; *.test.mjs is rejected by construction and a missing allowlisted file fails the build loudly.
- commit
- d90cfb4b35cffc432ad92832997bf5c1b2c580d6
- parent
- f09bb621643f4a5290478bf94e17a4dcf3a3b9b7
- author
- Dami <dami.etoile@gmail.com>
| M | .gitignore | 1 | + |
| A | scripts/ | 45 | ++++++++++++++++++++++++++++++ |
| M | src-tauri/ | 4 | ++- |
@@ -0,0 +1,45 @@
1+2+# Assemble the Portal webview payload from an explicit runtime allowlist.3+#4+# Tauri's frontendDist previously pointed at the raw portal/ source tree, so5+# every file dropped into that directory — test suites included — shipped6+# verbatim inside the signed, notarized app. This script makes the release7+# payload enforceable by construction: only the file classes named below can8+# reach the bundle, and *.test.mjs files are rejected even if a glob would9+# have matched them.10+set -euo pipefail11+12+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"13+source_dir="${repo_root}/portal"14+dist_dir="${repo_root}/portal-dist"15+16+rm -rf "${dist_dir}"17+mkdir -p "${dist_dir}"18+19+# Runtime payload allowlist. Anything not matched here does not ship.20+allowlist=(21+ "index.html"22+ "style.css"23+ "main.js"24+ "codecs.js"25+ "audio-worklet.js"26+)27+while IFS= read -r module; do28+ allowlist+=("$(basename "${module}")")29+done < <(find "${source_dir}" -maxdepth 1 -name '*.mjs' ! -name '*.test.mjs' | sort)30+31+for file in "${allowlist[@]}"; do32+ case "${file}" in33+ *.test.mjs)34+ echo "refusing to bundle test module: ${file}" >&235+ exit 136+ ;;37+ esac38+ if [[ ! -f "${source_dir}/${file}" ]]; then39+ echo "allowlisted portal payload file is missing: ${file}" >&240+ exit 141+ fi42+ cp "${source_dir}/${file}" "${dist_dir}/${file}"43+done44+45+echo "portal payload: $(find "${dist_dir}" -type f | wc -l | tr -d ' ') files in ${dist_dir}"@@ -4,7 +4,9 @@
44 "version": "0.1.0",55 "identifier": "sh.goq.portal",66 "build": {7- "frontendDist": "../portal"7+ "frontendDist": "../portal-dist",8+ "beforeDevCommand": "bash ../scripts/build-portal-dist.sh",9+ "beforeBuildCommand": "bash ../scripts/build-portal-dist.sh"810 },911 "app": {1012 "windows": [