feat(desktop): Tauri v2 kiosk shell — maximized window, prod right-click block, auto-update + code-signing

Add apps/desktop, a thin Tauri v2 shell wrapping the SAME @parking/web SPA so the desktop and browser UIs never drift: dev loads the Vite dev server (HMR), prod bundles the web app's dist/. No business logic in the shell (device/auth/ ledger stay in @parking/server); deny-by-default capabilities. apps/web (single UI source of truth): - lib/origin.ts: centralize the backend origin (API_BASE/apiUrl/wsUrl from VITE_API_BASE); no-op in the browser, lets the desktop build target Fastify. - lib/kiosk.ts: block the right-click context menu in PROD only (dev keeps it + devtools). - lib/desktop-updater.ts: prompt-on-update auto-update (no-op in browser/offline) → downloadAndInstall + relaunch; i18n update.* keys (sq+en). - .env.production: VITE_API_BASE wired to the Fastify origin for the bundle. Desktop: - window starts maximized (not fullscreen — operator keeps OS access). - auto-update via tauri-plugin-updater + -process; self-hosted endpoint is a PLACEHOLDER to fill in. Updater keypair: pubkey embedded in tauri.conf.json; private key + password kept OUTSIDE the repo (~/.parking-updater-keys) and as TAURI_SIGNING_* build secrets. - Turbo build is a no-op; the real signed bundle is `pnpm --filter @parking/desktop bundle` (verified → .deb/.rpm/.AppImage + .sig signatures). Verified: cargo check clean; turbo run build lint 14/14 green; i18n parity holds; no key/sig/bundle artifacts in the repo. Wiki (security + desktop analysis recorded alongside): - new concepts/tpm.md (TPM 2.0: how it works, sealed-LUKS auto-unlock + non- extractable signing key, limits — live-root, bus-sniff — TPM-vs-ATECC608 by platform). - new decisions/desktop-shell-tauri.md (Tauri v2 over Electron; best-case Ubuntu 26.04 LTS, worst-case Windows+WSL → kiosk browser; full as-built). - pull-the-disk attack trace on append-only-event-chain; ATECC608 not-in-a-PC caveat; cross-links from disk-os-hardening / threat-model. - open-questions #11 (appliance WebKitGTK), #12 (TPM hardening impl), #13 (startup verifyChain self-check); index/overview/log/standing-decisions. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V
2026-06-21 12:21:49 +02:00
parent ae736a9e3e
commit d0536da3d7
52 changed files with 5792 additions and 22 deletions
@@ -0,0 +1,11 @@
+# Production build env for the SPA (auto-loaded by `vite build`, which the Tauri
+# desktop bundle runs via beforeBuildCommand). NOT loaded by `vite` dev.
+#
+# The desktop shell serves the bundled SPA from tauri://localhost (no proxy, not
+# same-origin), so the SPA must reach Fastify by absolute origin. This is the
+# appliance's local Fastify address. Not a secret — committed for reproducible
+# desktop builds. Override per-deployment if Fastify binds elsewhere.
+#
+# NOTE: a plain browser prod build (Fastify serving dist/ same-origin) does NOT
+# want this set. If you build the SPA for that, override VITE_API_BASE="" .
+VITE_API_BASE=http://127.0.0.1:3000
@@ -17,6 +17,8 @@
    "@radix-ui/react-tabs": "^1.1.15",
    "@tanstack/react-query": "^5.101.0",
    "@tanstack/react-router": "^1.170.16",
+    "@tauri-apps/plugin-process": "^2.3.1",
+    "@tauri-apps/plugin-updater": "^2.10.1",
    "i18next": "^26.3.1",
    "react": "19.2.7",
    "react-dom": "19.2.7",
@@ -6,6 +6,7 @@
 // wiki/entities/local-jwt-auth.md.

 import { logFailedRequest } from "./lib/logger.js";
+import { apiUrl } from "./lib/origin.js";
 import type { AppLogRecord } from "@parking/shared";

 const CSRF_COOKIE = "parking_csrf";
@@ -27,7 +28,7 @@ export async function apiFetch<T>(path: string, init: RequestInit = {}): Promise
    const csrf = readCookie(CSRF_COOKIE);
    if (csrf) headers.set(CSRF_HEADER, csrf);
  }
-  const res = await fetch(path, { ...init, headers, credentials: "include" });
+  const res = await fetch(apiUrl(path), { ...init, headers, credentials: "include" });
  if (!res.ok) {
    const msg = (await res.json().catch(() => ({}))) as { error?: string; problems?: string[] };
    const error = msg.error ?? `${path}: ${res.status}`;
@@ -0,0 +1,51 @@
+// Desktop auto-update — prompt-on-update flow.
+//
+// Runs ONLY inside the Tauri desktop shell; a plain browser has no updater, so
+// this is a guarded no-op there. On launch it checks the configured update
+// endpoint (tauri.conf.json → plugins.updater); if a signed newer version is
+// available it asks the operator, then downloads + installs and relaunches.
+//
+// The plugins are imported dynamically so the browser build never bundles them
+// and never tries to resolve the Tauri APIs. Offline-first: a failed check (no
+// network — the appliance is usually offline) is swallowed; updates only happen
+// when someone has brought the box online (e.g. a phone hotspot) on purpose.
+
+/** True when running inside the Tauri webview (not a normal browser). */
+function inTauri(): boolean {
+  return typeof window !== "undefined" && "__TAURI_INTERNALS__" in window;
+}
+
+export interface UpdatePrompt {
+  /** Newer version string offered by the server. */
+  version: string;
+  /** Release notes, if the server provided them. */
+  notes?: string;
+}
+
+/**
+ * Check for an update. If one is available, calls `confirm` (your UI) with the
+ * version/notes; when it resolves true, downloads + installs and relaunches.
+ * No-op (resolves silently) in the browser or when no update / offline.
+ */
+export async function checkForDesktopUpdate(
+  confirm: (info: UpdatePrompt) => Promise<boolean>,
+): Promise<void> {
+  if (!inTauri()) return;
+  try {
+    const { check } = await import("@tauri-apps/plugin-updater");
+    const update = await check();
+    if (!update) return; // up to date
+
+    const accepted = await confirm({ version: update.version, notes: update.body });
+    if (!accepted) return;
+
+    // Download + install the signed update (signature verified against the
+    // pubkey in tauri.conf.json), then relaunch into the new version.
+    await update.downloadAndInstall();
+    const { relaunch } = await import("@tauri-apps/plugin-process");
+    await relaunch();
+  } catch {
+    // Offline / endpoint unreachable / no update server yet → ignore. The app
+    // keeps running on the current version; checking again next launch.
+  }
+}
@@ -38,6 +38,10 @@ export const en: Catalog = {
    signIn: "Sign in",
    signingIn: "Signing in…",
  },
+  update: {
+    available: "Update available",
+    prompt: "Version {{version}} is available. Install now and restart?",
+  },
  nav: {
    booth: "Booth",
    shift: "Shift",
@@ -40,6 +40,10 @@ export const sq = {
    signIn: "Hyr",
    signingIn: "Duke hyrë…",
  },
+  update: {
+    available: "Përditësim i disponueshëm",
+    prompt: "Versioni {{version}} është i disponueshëm. Ta instaloj tani dhe ta rinis?",
+  },
  nav: {
    booth: "Kabina",
    shift: "Turni",
@@ -0,0 +1,16 @@
+// Kiosk affordances for the operator console.
+//
+// We do NOT lock the operator out of the OS (that's a deliberate decision —
+// the desktop window starts maximized, not fullscreen). The one restriction is
+// blocking the right-click context menu in PRODUCTION builds, so an operator
+// can't reach "Inspect"/"Reload"/"Save as" on the live appliance. In DEV the
+// context menu (and devtools) stay available for debugging.
+//
+// Applies to both the browser prod build and the Tauri desktop build, since both
+// load this same SPA. import.meta.env.PROD is true for `vite build`, false for
+// `vite` dev.
+
+export function installKioskGuards(): void {
+  if (!import.meta.env.PROD) return; // dev: keep right-click + devtools
+  window.addEventListener("contextmenu", (e) => e.preventDefault());
+}
@@ -0,0 +1,30 @@
+// Where the SPA reaches the Fastify backend.
+//
+// In a browser (dev via the Vite proxy, or prod where Fastify serves the built
+// SPA) this is EMPTY — requests stay relative (`/api/...`) and same-origin, so
+// nothing changes. The Tauri desktop shell (apps/desktop) serves the bundled
+// SPA from `tauri://localhost`, which has no backend and no proxy; there we set
+// VITE_API_BASE to the appliance's Fastify origin (e.g. http://127.0.0.1:3000)
+// at build time so /api and the live WS feed resolve to the real server.
+//
+// Keep this the SINGLE source for the backend origin — api.ts and the live-feed
+// WebSocket both read it, so the web app and the desktop shell stay identical
+// except for this one build-time value.
+
+/** Backend HTTP origin, no trailing slash. Empty string = same-origin/relative. */
+export const API_BASE: string = (import.meta.env.VITE_API_BASE ?? "").replace(/\/$/, "");
+
+/** Resolve an API path to a full URL (or a relative path when API_BASE is empty). */
+export function apiUrl(path: string): string {
+  return API_BASE ? `${API_BASE}${path}` : path;
+}
+
+/** Build the ws:// or wss:// URL for the backend's live feed. Uses API_BASE when
+ *  set (Tauri), else the page origin (browser). */
+export function wsUrl(path: string): string {
+  if (API_BASE) {
+    return `${API_BASE.replace(/^http/, "ws")}${path}`;
+  }
+  const proto = window.location.protocol === "https:" ? "wss:" : "ws:";
+  return `${proto}//${window.location.host}${path}`;
+}
@@ -3,6 +3,7 @@ import { useQueryClient } from "@tanstack/react-query";
 import type { DeviceStatus, LedgerEvent, Occupancy } from "../api.js";
 import { qk } from "./query.js";
 import { useLiveStore } from "./live-store.js";
+import { wsUrl } from "./origin.js";

 // Booth WebSocket client. Opens ONE socket to /api/ws and turns server pushes into
 // (a) live-store updates for the ticker/occupancy and (b) Query cache invalidations
@@ -18,11 +19,6 @@ type WsMessage =
  | { kind: "printer-status"; event: unknown }
  | { kind: "device-status"; event: DeviceStatus };

-/** Build the ws:// or wss:// URL for the same origin the SPA is served from. */
-function wsUrl(): string {
-  const proto = window.location.protocol === "https:" ? "wss:" : "ws:";
-  return `${proto}//${window.location.host}/api/ws`;
-}

 export function useLiveFeed(): void {
  const qc = useQueryClient();
@@ -39,7 +35,7 @@ export function useLiveFeed(): void {
    const connect = () => {
      if (closedRef.current) return;
      setStatus(retryRef.current === 0 ? "connecting" : "connecting");
-      const sock = new WebSocket(wsUrl());
+      const sock = new WebSocket(wsUrl("/api/ws"));
      sockRef.current = sock;

      sock.onopen = () => {
@@ -5,11 +5,23 @@ import "./lib/i18n/index.js"; // initialize i18next before the app renders
 import { App } from "./App.js";
 import { ErrorBoundary } from "./lib/ErrorBoundary.js";
 import { installClientLogging } from "./lib/logger.js";
+import { installKioskGuards } from "./lib/kiosk.js";
+import { checkForDesktopUpdate } from "./lib/desktop-updater.js";
+import i18n from "./lib/i18n/index.js";

 // Capture uncaught errors / rejections / console noise → backend log store, before
 // the app mounts so even an early crash is reported. See lib/logger.ts.
 installClientLogging();

+// Block the right-click context menu in prod builds (dev keeps it + devtools).
+installKioskGuards();
+
+// Desktop only: check for a signed update on launch and, if one exists, ask the
+// operator before installing + relaunching. No-op in the browser / when offline.
+void checkForDesktopUpdate(({ version }) =>
+  Promise.resolve(window.confirm(i18n.t("update.prompt", { version }))),
+);
+
 const rootEl = document.getElementById("root");
 if (!rootEl) throw new Error("root element not found");