dk.simongray.wary-fetch.electron — dk.simongray/wary-fetch 0.14.1

A :send for the page of an Electron app, which sends each request through the main process, where Node sends it and CORS doesn't stop it.

The main process answers with handler, and the page sends with sender over the IPC of Electron, which the preload script gives the page:

;; main process
(.handle ipcMain "wary-fetch" (electron/handler))

;; preload script
(.exposeInMainWorld contextBridge "waryFetch"
                    #js {:send #(.invoke ipcRenderer "wary-fetch" %)})

;; page
(def send (electron/sender (.. js/window -waryFetch -send)))

The main process keeps its own limits, so a page can't reach what the handler doesn't allow, e.g. the app's own network. A request and its response cross the IPC as plain data, without functions, so a :sink or an :allow-pred of the page stays in the page.

handler cljs

(handler)

(handler {:keys [send allow-pred max-bytes timeout-seconds]
          :or {send http/send!
               allow-pred url/public?
               max-bytes (* 100 1024 1024)
               timeout-seconds 30}
          :as opts})

A function to give ipcMain.handle in the main process, which sends each request of a page with the :send of opts, within the limits of opts, and gives a promise of the response as plain data.

The opts are those of the requests that the main process allows:

• :send, the function that sends, http/send! by default
• :allow-pred, the URLs that a page may reach, url/public? by default, whatever a page asks
• :max-bytes and :timeout-seconds, the most that a page may ask for, by default those of send!

sender cljs

(sender invoke)

A function to give as :send in the page, which sends each request through the main process with invoke, a function that gives the plain data of a request to the handler of the main process and gives a promise of its answer, e.g. ipcRenderer.invoke with the name of the channel.

The keys of a request are those of send!, but for :sink, :allow-pred and :signal, which the main process doesn't get. The :signal is checked before the request crosses. Its hidden texts go as text, as they go to a server. The main process follows the redirects, so the :prepare-fn of the request gives the request of the first hop alone, in the page.