debont80
037ea2da32
The release repo is private, so the auto-updater previously required each user to paste a Gitea token into Settings before it could see or download updates. Inject a read-only token at build time (AEROFETCH_UPDATE_TOKEN env var or a gitignored .update-token file) via electron.vite's `define`, and fall back to it in authHeader() when the user hasn't set their own. The token value lives only in the built bundle, never in source or git. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
66 lines
2.2 KiB
TypeScript
66 lines
2.2 KiB
TypeScript
import { resolve } from 'path'
|
|
import { existsSync, readFileSync } from 'fs'
|
|
import { defineConfig, externalizeDepsPlugin } from 'electron-vite'
|
|
import react from '@vitejs/plugin-react'
|
|
|
|
// Read-only Gitea token compiled into the main bundle so the auto-updater can
|
|
// read the PRIVATE release repo without user setup (see config.ts BAKED_UPDATE_TOKEN).
|
|
// Source order: AEROFETCH_UPDATE_TOKEN env var (CI/secret), else a gitignored
|
|
// .update-token file (local builds). Absent → empty string → no token baked in.
|
|
// Keep this a dedicated read-only service-account token; the shipped bundle is public.
|
|
function bakedUpdateToken(): string {
|
|
const fromEnv = process.env.AEROFETCH_UPDATE_TOKEN?.trim()
|
|
if (fromEnv) return fromEnv
|
|
const file = resolve('.update-token')
|
|
return existsSync(file) ? readFileSync(file, 'utf8').trim() : ''
|
|
}
|
|
|
|
export default defineConfig({
|
|
main: {
|
|
plugins: [externalizeDepsPlugin()],
|
|
// Textually replaces the __AEROFETCH_UPDATE_TOKEN__ identifier in main-process
|
|
// code with the token literal at build time — value never lands in source/git.
|
|
define: {
|
|
__AEROFETCH_UPDATE_TOKEN__: JSON.stringify(bakedUpdateToken())
|
|
},
|
|
resolve: {
|
|
alias: {
|
|
'@shared': resolve('src/shared')
|
|
}
|
|
},
|
|
// Hidden source maps: emit .map files so a field crash stack (the logger writes
|
|
// raw stacks, CC8) can be symbolicated offline, without referencing/exposing them
|
|
// in the shipped bundle (L170).
|
|
build: { sourcemap: 'hidden' }
|
|
},
|
|
preload: {
|
|
plugins: [externalizeDepsPlugin()],
|
|
resolve: {
|
|
alias: {
|
|
'@shared': resolve('src/shared')
|
|
}
|
|
},
|
|
// Emit CommonJS (.cjs): sandboxed preload scripts must be CJS, and enabling
|
|
// the sandbox (webPreferences.sandbox) is part of the security hardening.
|
|
build: {
|
|
sourcemap: 'hidden',
|
|
rollupOptions: {
|
|
output: {
|
|
format: 'cjs',
|
|
entryFileNames: 'index.cjs'
|
|
}
|
|
}
|
|
}
|
|
},
|
|
renderer: {
|
|
resolve: {
|
|
alias: {
|
|
'@renderer': resolve('src/renderer/src'),
|
|
'@shared': resolve('src/shared')
|
|
}
|
|
},
|
|
plugins: [react()],
|
|
build: { sourcemap: 'hidden' }
|
|
}
|
|
})
|