feat: prevent launch with inconsistent geodata

src-tauri/src/vpn_extension_detect/mod.rs

@@ -0,0 +1,164 @@
+//! Detects VPN/proxy browser extensions present in a profile.
+//!
+//! An extension holding Chromium's `proxy` permission can override the proxy
+//! Donut passes on the command line, so the browser's real exit stops being the
+//! one Donut measured and generated the fingerprint against. That produces
+//! exactly the geo/timezone/language mismatch the fingerprint exists to avoid,
+//! except Donut cannot observe it from the outside — hence a launch-time
+//! warning rather than a measurement.
+//!
+//! Two sources, deliberately both: Donut-managed extensions live in the app's
+//! own store and are handed to Chromium via `--load-extension` from *outside*
+//! the profile directory, while extensions the user installed from the Web
+//! Store live *inside* it. Neither set appears in the other.
+
+mod browser_scan;
+mod rules;
+
+// `message_placeholder_key`/`lookup_message` are shared with
+// `extension_manager`, which resolves the same placeholders out of a zip.
+use rules::{classify, keyword_hit, manifest_str, signal_labels, signals_from_manifest};
+pub use rules::{lookup_message, message_placeholder_key, DetectedVpnExtension};
+
+use serde::{Deserialize, Serialize};
+use std::collections::HashSet;
+use std::time::Instant;
+
+use crate::profile::types::BrowserProfile;
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct ExtensionScan {
+  pub extensions: Vec<DetectedVpnExtension>,
+  /// `scanned` | `partial` | `encrypted` | `ephemeral` | `missing`.
+  ///
+  /// Reported honestly so the dialog can say the scan was incomplete rather
+  /// than implying a clean profile it never managed to read.
+  pub scan_state: String,
+}
+
+/// Donut-managed extensions, reached through the profile's extension group.
+///
+/// Read live from the stored archive rather than from the metadata cached on
+/// `Extension`, so replacing an extension's file cannot leave a stale verdict
+/// behind. N is the group size — typically a handful.
+fn scan_donut_extensions(profile: &BrowserProfile, out: &mut Vec<DetectedVpnExtension>) {
+  let Some(group_id) = &profile.extension_group_id else {
+    return;
+  };
+  let Ok(manager) = crate::extension_manager::EXTENSION_MANAGER.lock() else {
+    log::warn!("VPN extension scan: extension manager lock poisoned, skipping managed extensions");
+    return;
+  };
+  let Ok(group) = manager.get_group(group_id) else {
+    return;
+  };
+
+  for ext_id in &group.extension_ids {
+    let Ok(ext) = manager.get_extension(ext_id) else {
+      continue;
+    };
+    let path = manager.get_file_dir_public(ext_id).join(&ext.file_name);
+    let Ok(data) = std::fs::read(&path) else {
+      continue;
+    };
+    let Some(manifest) =
+      crate::extension_manager::read_manifest_from_archive(&data, &ext.file_type)
+    else {
+      continue;
+    };
+
+    let raw_name = manifest_str(&manifest, "name").unwrap_or_else(|| ext.name.clone());
+    let name =
+      crate::extension_manager::resolve_archive_i18n(&data, &ext.file_type, &manifest, &raw_name)
+        .unwrap_or_else(|| {
+          // An unresolvable placeholder is not a name — fall back to the one
+          // the extension carries in Donut.
+          if message_placeholder_key(&raw_name).is_some() {
+            ext.name.clone()
+          } else {
+            raw_name.clone()
+          }
+        });
+    let description = manifest_str(&manifest, "description").and_then(|d| {
+      crate::extension_manager::resolve_archive_i18n(&data, &ext.file_type, &manifest, &d).or(
+        if message_placeholder_key(&d).is_some() {
+          None
+        } else {
+          Some(d)
+        },
+      )
+    });
+
+    let signals = signals_from_manifest(&manifest);
+    let keyword = keyword_hit(&name, description.as_deref());
+    let Some(confidence) = classify(&signals, keyword) else {
+      continue;
+    };
+
+    out.push(DetectedVpnExtension {
+      key: format!("donut:{ext_id}"),
+      name,
+      version: manifest_str(&manifest, "version").or_else(|| ext.version.clone()),
+      source: "donut".to_string(),
+      confidence: confidence.to_string(),
+      signals: signal_labels(&signals, keyword),
+    });
+  }
+}
+
+/// Scan a profile for VPN/proxy extensions from both sources.
+///
+/// Never fails: an unreadable profile reports whatever it could see plus a
+/// `scan_state` explaining why the picture is incomplete.
+pub fn scan_profile(profile: &BrowserProfile) -> ExtensionScan {
+  let started = Instant::now();
+  let mut extensions = Vec::new();
+
+  scan_donut_extensions(profile, &mut extensions);
+
+  let profiles_dir = crate::app_dirs::profiles_dir();
+  let user_data_dir = crate::ephemeral_dirs::get_effective_profile_path(profile, &profiles_dir);
+
+  // `get_effective_profile_path` only returns the decrypted RAM copy while the
+  // profile is unlocked; locked, it falls back to the on-disk directory, which
+  // exists but is ciphertext. Walking that finds nothing — so the state has to
+  // be decided on whether we actually got a readable copy, not on the path
+  // existing, or a locked profile reports as verified-clean.
+  let has_plaintext_dir = !(profile.password_protected || profile.ephemeral)
+    || crate::ephemeral_dirs::get_ephemeral_dir(&profile.id.to_string()).is_some();
+
+  let scan_state = if !has_plaintext_dir {
+    if profile.password_protected {
+      "encrypted"
+    } else {
+      "ephemeral"
+    }
+  } else if !user_data_dir.is_dir() {
+    // Never launched, so there is no profile directory to inspect yet.
+    "missing"
+  } else if browser_scan::scan_browser_extensions(&user_data_dir, &mut extensions, started) {
+    "scanned"
+  } else {
+    "partial"
+  };
+
+  // The two sources are disjoint by construction, but an imported profile can
+  // carry its own copy of an extension Donut also manages. Collapse only on an
+  // exact name+version match, and never on an unresolved `__MSG_` placeholder —
+  // those are not identities and would fold unrelated extensions into one row.
+  let mut seen = HashSet::new();
+  extensions.retain(|e| {
+    message_placeholder_key(&e.name).is_some() || seen.insert((e.name.clone(), e.version.clone()))
+  });
+
+  ExtensionScan {
+    extensions,
+    scan_state: scan_state.to_string(),
+  }
+}
+
+/// True when at least one detection is `confirmed` — the extension holds the
+/// `proxy` permission and can actually redirect the browser's traffic.
+pub fn has_confirmed(scan: &ExtensionScan) -> bool {
+  scan.extensions.iter().any(|e| e.confidence == "confirmed")
+}