fix(mobile,relay): remote session attach — E2EE OUT decrypt + Origins editor#271
Merged
Conversation
… editor Mobile "无法进入远程会话" (black terminal after tapping a remote session) had two independent causes, both fixed here: 1. WKWebView WS to /client failed nhooyr's origin check. Mobile Origin `capacitor://localhost` doesn't match any pattern unless admin's AllowedOrigins includes it, and the admin UI had no editor for that field — so first-time mobile users hit `close 1006` with no obvious knob to turn. Adds `allowed_origins` to the /admin/api/config response and a multi-line editor in the Config tab. 2. SessionConnection was created without `remote: true`, so once QR-pairing reliably unlocks account_key (recent 51dee2e / 9004b73), the desktop uplink's sealed OUT envelopes got fed straight to xterm.write() — the random nonce bytes contain ESC/CSI sequences that continuously clear/reposition, producing a fully-black screen. META still decrypted via its own path, so the header still showed cwd/title — masking the bug. Tests: - Go: TestAdminConfigRoundtripsAllowedOrigins covers GET/PUT and hot-apply of the origin patterns. - TS: Config.vue test covers pre-populate from server + parse-on-save (trim + drop blank lines).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
capacitor://localhostfailed nhooyr's origin check because admin'sAllowedOriginsdidn't include it, and the Config tab had no editor for that field. Addsallowed_originsto/admin/api/configGET/PUT and a multi-line textarea in the admin Config tab.MobileTerminalcreatedSessionConnectionwithoutremote: true, so once QR-pairing reliably unlocksaccount_keythe desktop uplink's sealed OUT envelopes were fed straight toxterm.write()— the random 24-byte nonce contains ESC/CSI sequences that continuously clear/reposition the terminal, producing a fully-black screen. META decrypted via its own path so header cwd/title still displayed, masking the bug.TestAdminConfigRoundtripsAllowedOrigins(Go) covers the API contract + hot-apply;Config.vuetest covers pre-populate + parse-on-save trim/blank-drop.Test plan
/admin/healthpage still renders correctly.capacitor://localhostin the editor, save;/admin/api/healthmobile_origin_compatibleflips totruewithin ~10s hot-reload TTL.wails.localhost).