c7ffc2b994
News called /api/v1/client/news through apiGet(), which sends the webtoken Bearer obtained from POST /api/v1/client/user/webtoken. But that route is a defineClientEventHandler -- it verifies the clients own short-lived signed JWT and never consults the webtokens ACLs at all, so it rejected the request outright. Store and Library have always worked because they already use the JWT path. Adds api_get_jwt on the Rust side and apiGetClient() in the composable, and points News at it. Verified working against the live server. Two auth mechanisms coexist here and picking the wrong one yields a clean 403 that looks like a permissions problem: /api/v1/client/* wants the client JWT, while routes gated by aclManager.getUserIdACL want the webtoken plus the right ACL.
50 lines
1 KiB
JSON
50 lines
1 KiB
JSON
{
|
|
"$schema": "https://schema.tauri.app/config/2.0.0",
|
|
"productName": "Drop Desktop Client (Quasarke Edition)",
|
|
"version": "0.4.4",
|
|
"identifier": "net.quasarke.drop.client",
|
|
"build": {
|
|
"beforeDevCommand": "pnpm run -C main dev --port 1432",
|
|
"devUrl": "http://localhost:1432/",
|
|
"beforeBuildCommand": "pnpm build",
|
|
"frontendDist": "../.output"
|
|
},
|
|
"app": {
|
|
"security": {
|
|
"csp": "",
|
|
"assetProtocol": {
|
|
"enable": true,
|
|
"scope": {}
|
|
}
|
|
}
|
|
},
|
|
"plugins": {
|
|
"deep-link": {
|
|
"desktop": {
|
|
"schemes": ["drop"]
|
|
}
|
|
}
|
|
},
|
|
"bundle": {
|
|
"active": true,
|
|
"targets": ["nsis", "deb", "rpm", "dmg"],
|
|
"windows": {
|
|
"nsis": {
|
|
"installMode": "both"
|
|
},
|
|
"webviewInstallMode": {
|
|
"silent": true,
|
|
"type": "embedBootstrapper"
|
|
},
|
|
"wix": null
|
|
},
|
|
"icon": [
|
|
"icons/32x32.png",
|
|
"icons/128x128.png",
|
|
"icons/128x128@2x.png",
|
|
"icons/icon.icns",
|
|
"icons/icon.ico"
|
|
],
|
|
"externalBin": []
|
|
}
|
|
}
|