* refactor(dialog)!: remove deprecated MessageDialogOptions.okLabel
Use `buttons: { ok: 'label' }` instead. `ConfirmDialogOptions` (used by
`ask` and `confirm`) still accepts `okLabel` and `cancelLabel`.
* Apply suggestion from @amrbashir
---------
Co-authored-by: Amr Bashir <github@amrbashir.me>
* refactor(fs)!: return Watcher from watch and watchImmediate
Both resolve to a `Watcher` resource instead of an `UnwatchFn` callback;
call `await watcher.close()` to stop watching. `UnwatchFn` is removed and
`Watcher` is now exported.
* fix change file
* fmt
`WatchEvent` now follows notify v8's format: the event kind is flattened
into the event, with `type` holding the top-level kind and `kind`/`mode`
refining it, e.g. `{ type: 'modify', kind: 'data', mode: 'content' }`
instead of `{ type: { modify: { kind: 'data', mode: 'content' } } }`.
`attrs` is now typed as `WatchEventAttributes` and its `flag` is
`rescan` instead of `Rescan`.
There has been no `unwatch` command since v2.0 (`Watcher.close()` releases
the resource), so `allow-unwatch` and `deny-unwatch` never granted anything.
`readTextFile` and `writeTextFile` now go through `read_file` and
`write_file`, so the `allow-read-text-file`, `deny-read-text-file`,
`allow-write-text-file` and `deny-write-text-file` permissions are gone;
grant `fs:allow-read-file` and `fs:allow-write-file` instead.
* refactor(deep-link)!: return Error::Execute when an OS command fails to run
On Linux, `register`, `unregister` and `is_registered` now fail with the
new `Error::Execute(command, io_error)` variant when `xdg-mime` or
`update-desktop-database` cannot be spawned, instead of logging and
returning the raw `Error::Io`. This is the change deferred to v3 in #2970.
* docs(deep-link): unregister does not run OS commands
* refactor(http)!: remove deprecated macos-system-configuration feature
Use `system-proxy` (enabled by default) instead.
* chore(upload): enable reqwest's system-proxy feature instead of the deprecated alias
---------
Co-authored-by: Lucas Nogueira <lucas@crabnebula.dev>
* refactor(http)!: always enforce the scope on redirects
Removes the `scopeRedirects` option (and the `Config` struct with it) that
was added as an opt-in in 2.7.0. Every hop of a redirect chain is now
checked against the URL scope, so a server on an allowed origin can no
longer redirect the request to a URL the scope denies.
`tauri_plugin_http::init()` returns `TauriPlugin<R>` again.
* chore(http): compile without warnings when the cookies feature is disabled
* refactor(store)!: reset to defaults before merging the on-disk state in reload
`Store::reload` / `reload()` previously merged the on-disk state into the
current in-memory store. It now resets the store to its defaults first,
so in-memory keys that are neither in the defaults nor on disk are
dropped. `reload_ignore_defaults` / `reload({ ignoreDefaults: true })`
is unchanged.
* test(store): cover reload resetting to the defaults before merging the on-disk state
---------
Co-authored-by: Lucas Nogueira <lucas@crabnebula.dev>
Checks the URL scope on every hop of a redirect chain instead of only on the URL requested by the frontend.
Without it, a server on an allowed origin can redirect the request to any other origin - including `localhost` services, internal hosts and cloud metadata endpoints - and the plugin follows it, returning the response to the webview.
* feat(updater): verify the version an update was signed for
The endpoint response is fetched over TLS but is not signed, and the signature
only covers the artifact, so a crafted response could pair an inflated version
with an older release's url and signature to force a downgrade to a genuine
but outdated build.
Read the version back from the signature's trusted comment and reject an
update whose announced version differs. Signatures carrying no version are
only rejected under the new requireSignedVersion option, since older CLIs did
not record one.
* fix tests
* fix(http): stop unhandled rejections from the fetch cleanup path
The request/body cleanup commands are fired as floating promises, and the
Rust side releases a resource only once: fetch_cancel_body is
resources_table.close(rid)?, and fetch_read_body also closes the rid at
end-of-body. So every release after the first rejects with BadResourceId
into a promise nobody is listening to.
Make dropBody idempotent and let both cleanup calls handle their own
rejection.
* chore: add changefile
* chore(http): rebuild api-iife.js
* fix(android): missing `consumer-rules.pro`
* setup android test
* copy right too new
* build api first
* we're still on gradle 8 right now...
* restore the right host on mac
