refactor: upgrade tauri 2.0

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM ubuntu:18.04
+FROM ubuntu:22.04
 
 ARG USERNAME=vscode
 ARG USER_UID=1000
@@ -7,8 +7,9 @@ ARG USER_GID=$USER_UID
 ENV RUSTUP_HOME=/usr/local/rustup \
     CARGO_HOME=/usr/local/cargo \
     PATH=/usr/local/cargo/bin:$PATH \
-    RUST_VERSION=1.75.0
+    RUST_VERSION=1.80.0
 
+# Install common dependencies
 RUN set -eux; \
   apt-get update; \
   apt-get install -y --no-install-recommends \
@@ -18,34 +19,50 @@ RUN set -eux; \
     gnupg \
     git \
     less \
-    software-properties-common \
+    software-properties-common
-    # Tauri dependencies
+
-    libwebkit2gtk-4.0-dev build-essential wget libssl-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev; \
-  # Install openconnect
-  add-apt-repository ppa:yuezk/globalprotect-openconnect; \
-  apt-get update; \
-  apt-get install -y openconnect libopenconnect-dev; \
 # Create a non-root user
+RUN set -eux; \
   groupadd --gid $USER_GID $USERNAME; \
   useradd --uid $USER_UID --gid $USER_GID -m $USERNAME; \
   echo $USERNAME ALL=\(root\) NOPASSWD:ALL > /etc/sudoers.d/$USERNAME; \
-  chmod 0440 /etc/sudoers.d/$USERNAME; \
+  chmod 0440 /etc/sudoers.d/$USERNAME
-  # Install Node.js
+
-  mkdir -p /etc/apt/keyrings; \
-  curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg; \
-  echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_16.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list; \
-  apt-get update; \
-  apt-get install -y nodejs; \
-  corepack enable; \
-  # Install diff-so-fancy
-  npm install -g diff-so-fancy; \
 # Install Rust
+RUN set -eux; \
   curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain $RUST_VERSION; \
   chown -R $USERNAME:$USERNAME $RUSTUP_HOME $CARGO_HOME; \
   rustup --version; \
   cargo --version; \
   rustc --version
 
+# Install Node.js
+RUN set -eux; \
+  curl -fsSL https://deb.nodesource.com/setup_20.x | bash -; \
+  apt-get install -y nodejs; \
+  corepack enable; \
+  # Install diff-so-fancy
+  npm install -g diff-so-fancy
+
+# Install openconnect
+RUN set -eux; \
+  add-apt-repository ppa:yuezk/globalprotect-openconnect; \
+  apt-get update; \
+  apt-get install -y openconnect libopenconnect-dev
+
+# Tauri dependencies
+RUN set -eux; \
+  apt-get install -y \
+    libwebkit2gtk-4.1-dev \
+    build-essential \
+    curl \
+    wget \
+    file \
+    libxdo-dev \
+    libssl-dev \
+    libayatana-appindicator3-dev \
+    librsvg2-dev
+
 USER $USERNAME
 
 # Install Oh My Zsh

.github/workflows/build.yaml

@@ -24,7 +24,8 @@ jobs:
       - name: Set up matrix
         id: set-matrix
         run: |
-          if [[ "${{ github.ref }}" == "refs/tags/"* ]]; then
+          # Set the matrix to include arm64 if the ref is a tag or is the dev branch
+          if [[ "${{ github.ref }}" == "refs/tags/"* || "${{ github.ref }}" == "refs/heads/dev" ]]; then
             echo 'matrix=[{"runner": "ubuntu-latest", "arch": "amd64"}, {"runner": "arm64", "arch": "arm64"}]' >> $GITHUB_OUTPUT
           else
             echo 'matrix=[{"runner": "ubuntu-latest", "arch": "amd64"}]' >> $GITHUB_OUTPUT
@@ -34,13 +35,13 @@ jobs:
     runs-on: ubuntu-latest
     needs: [setup-matrix]
     steps:
-    - uses: pnpm/action-setup@v2
+    - uses: pnpm/action-setup@v4
       with:
-        version: 8
+        version: 9
     - name: Prepare workspace
       run: rm -rf source && mkdir source
     - name: Checkout GlobalProtect-openconnect
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         token: ${{ secrets.GH_PAT }}
         repository: yuezk/GlobalProtect-openconnect
@@ -55,7 +56,7 @@ jobs:
         fi
         make tarball
     - name: Upload tarball
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: artifact-source
         if-no-files-found: error
@@ -79,7 +80,7 @@ jobs:
         rm -rf build-gp-${{ matrix.package }}
         mkdir -p build-gp-${{ matrix.package }}
     - name: Download tarball
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
         name: artifact-source
         path: build-gp-${{ matrix.package }}
@@ -87,18 +88,18 @@ jobs:
       run: echo ${{ secrets.DOCKER_HUB_TOKEN }} | docker login -u ${{ secrets.DOCKER_HUB_USERNAME }} --password-stdin
     - name: Build ${{ matrix.package }} package in Docker
       run: |
-        docker run --rm \
+        docker run --pull=always --rm \
           -v $(pwd)/build-gp-${{ matrix.package }}:/${{ matrix.package }} \
-          yuezk/gpdev:${{ matrix.package }}-builder
+          yuezk/gpdev:${{ matrix.package }}-builder-tauri2
     - name: Install ${{ matrix.package }} package in Docker
       run: |
-        docker run --rm \
+        docker run --pull=always --rm \
           -e GPGUI_INSTALLED=0 \
           -v $(pwd)/build-gp-${{ matrix.package }}:/${{ matrix.package }} \
-          yuezk/gpdev:${{ matrix.package }}-builder \
+          yuezk/gpdev:${{ matrix.package }}-builder-tauri2 \
           bash install.sh
     - name: Upload ${{ matrix.package }} package
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: artifact-gp-${{ matrix.package }}-${{ matrix.os.arch }}
         if-no-files-found: error
@@ -114,20 +115,20 @@ jobs:
     runs-on: ${{ matrix.os.runner }}
     name: build-gpgui (${{ matrix.os.arch }})
     steps:
-    - uses: pnpm/action-setup@v2
+    - uses: pnpm/action-setup@v4
       with:
-        version: 8
+        version: 9
     - name: Prepare workspace
       run: rm -rf gpgui-source && mkdir gpgui-source
     - name: Checkout GlobalProtect-openconnect
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         token: ${{ secrets.GH_PAT }}
         repository: yuezk/GlobalProtect-openconnect
         ref: ${{ github.ref }}
         path: gpgui-source/gp
     - name: Checkout gpgui@${{ github.ref_name }}
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         token: ${{ secrets.GH_PAT }}
         repository: yuezk/gpgui
@@ -141,15 +142,15 @@ jobs:
       run: echo ${{ secrets.DOCKER_HUB_TOKEN }} | docker login -u ${{ secrets.DOCKER_HUB_USERNAME }} --password-stdin
     - name: Build gpgui in Docker
       run: |
-        docker run --rm -v $(pwd)/gpgui-source:/gpgui yuezk/gpdev:gpgui-builder
+        docker run --pull=always --rm -v $(pwd)/gpgui-source:/gpgui yuezk/gpdev:gpgui-builder-tauri2
     - name: Install gpgui in Docker
       run: |
         cd gpgui-source
         tar -xJf *.bin.tar.xz
-        docker run --rm -v $(pwd):/gpgui yuezk/gpdev:gpgui-builder \
+        docker run --pull=always --rm -v $(pwd):/gpgui yuezk/gpdev:gpgui-builder-tauri2 \
           bash -c "cd /gpgui/gpgui_*/ && ./gpgui --version"
     - name: Upload gpgui
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: artifact-gpgui-${{ matrix.os.arch }}
         if-no-files-found: error
@@ -170,7 +171,7 @@ jobs:
       run: rm -rf gh-release && mkdir gh-release
 
     - name: Checkout GlobalProtect-openconnect
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         token: ${{ secrets.GH_PAT }}
         repository: yuezk/GlobalProtect-openconnect
@@ -178,7 +179,7 @@ jobs:
         path: gh-release/gp
 
     - name: Download all artifacts
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
         path: gh-release/gp/.build/artifacts
 

.github/workflows/publish.yaml

@@ -47,9 +47,9 @@ jobs:
     if: ${{ inputs.ppa }}
     runs-on: ubuntu-latest
     steps:
-    - uses: pnpm/action-setup@v2
+    - uses: pnpm/action-setup@v4
       with:
-        version: 8
+        version: 9
     - name: Prepare workspace
       run: rm -rf publish-ppa && mkdir publish-ppa
     - name: Download ${{ inputs.tag }} source code
@@ -71,12 +71,20 @@ jobs:
 
         # Prepare the debian directory with custom files
         mkdir -p .build/debian
-        sed 's/@RUST@/rust-all(>=1.70)/g' packaging/deb/control.in > .build/debian/control
+
-        sed 's/@OFFLINE@/1/g' packaging/deb/rules.in > .build/debian/rules
+        cp -v packaging/deb/control.in .build/debian/control
-        cp packaging/deb/postrm .build/debian/postrm
+        cp -v packaging/deb/rules.in .build/debian/rules
+        cp -v packaging/deb/compat .build/debian/compat
+        cp -v packaging/deb/postrm .build/debian/postrm
+
+        sed -i "s/@RUST@/cargo-1.80/g" .build/debian/control
+
+        sed -i "s/@OFFLINE@/1/g" .build/debian/rules
+        sed -i "s/@BUILD_GUI@/1/g" .build/deb/debian/rules
+        sed -i "s/@RUST_VERSION@/1.80/g" .build/deb/debian/rules
 
     - name: Publish to PPA
-      uses: yuezk/publish-ppa-package@v2
+      uses: yuezk/publish-ppa-package@gp
       with:
         repository: "yuezk/globalprotect-openconnect"
         gpg_private_key: ${{ secrets.PPA_GPG_PRIVATE_KEY }}
@@ -85,5 +93,7 @@ jobs:
         debian_dir: publish-ppa/globalprotect-openconnect-*/.build/debian
         deb_email: "k3vinyue@gmail.com"
         deb_fullname: "Kevin Yue"
-        extra_ppa: "yuezk/globalprotect-openconnect liushuyu-011/rust-bpo-1.75"
+        extra_ppa: "yuezk/globalprotect-openconnect liushuyu-011/rust-updates-1.80"
+        # Ubuntu 18.04 and 20.04 are excluded because tauri2 no longer supports them
+        excluded_series: "bionic focal"
         revision: ${{ inputs.revision }}

.github/workflows/release.yaml

@@ -109,20 +109,20 @@ jobs:
       run: echo ${{ secrets.DOCKER_HUB_TOKEN }} | docker login -u ${{ secrets.DOCKER_HUB_USERNAME }} --password-stdin
     - name: Build ${{ matrix.package }} package in Docker
       run: |
-        docker run --rm \
+        docker run --pull=always --rm \
           -v $(pwd)/build-${{ matrix.package }}:/${{ matrix.package }} \
           -e INCLUDE_GUI=1 \
           yuezk/gpdev:${{ matrix.package }}-builder-tauri2
 
     - name: Install ${{ matrix.package }} package in Docker
       run: |
-        docker run --rm \
+        docker run --pull=always --rm \
           -v $(pwd)/build-${{ matrix.package }}:/${{ matrix.package }} \
           yuezk/gpdev:${{ matrix.package }}-builder-tauri2 \
           bash install.sh
 
     - name: Upload ${{ matrix.package }} package
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: artifact-${{ matrix.os }}-${{ matrix.package }}
         if-no-files-found: error
@@ -138,7 +138,7 @@ jobs:
     - name: Prepare workspace
       run: rm -rf gh-release && mkdir gh-release
     - name: Download artifact
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
         path: gh-release
     - name: Update release

.gitignore

@@ -8,3 +8,6 @@
 .cargo
 .build
 SNAPSHOT
+
+# Tauri generated files
+gen

Cargo.toml

@@ -4,8 +4,8 @@ resolver = "2"
 members = ["crates/*", "apps/gpclient", "apps/gpservice", "apps/gpauth", "apps/gpgui-helper/src-tauri"]
 
 [workspace.package]
-rust-version = "1.70"
+rust-version = "1.80"
-version = "2.3.9"
+version = "2.4.0"
 authors = ["Kevin Yue <k3vinyue@gmail.com>"]
 homepage = "https://github.com/yuezk/GlobalProtect-openconnect"
 edition = "2021"
@@ -13,22 +13,22 @@ license = "GPL-3.0"
 
 [workspace.dependencies]
 anyhow = "1.0"
-base64 = "0.21"
+base64 = "0.22"
-clap = { version = "4.4.2", features = ["derive"] }
+clap = { version = "4", features = ["derive"] }
 ctrlc = "3.4"
 directories = "5.0"
 dns-lookup = "2.0.4"
-env_logger = "0.10"
+env_logger = "0.11"
 is_executable = "1.0"
 log = "0.4"
 regex = "1"
-reqwest = { version = "0.11", features = ["native-tls-vendored", "json"] }
+reqwest = { version = "0.12", features = ["native-tls", "json"] }
 openssl = "0.10"
 pem = "3"
-roxmltree = "0.18"
+roxmltree = "0.20"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
-sysinfo = "0.29"
+sysinfo = "0.33"
 tempfile = "3.8"
 tokio = { version = "1", features = ["full"] }
 tokio-util = "0.7"
@@ -37,22 +37,19 @@ urlencoding = "2.1.3"
 axum = "0.7"
 futures = "0.3"
 futures-util = "0.3"
-tokio-tungstenite = "0.20.1"
+uzers = "0.12"
-uzers = "0.11"
 whoami = "1"
-thiserror = "1"
+thiserror = "2"
 redact-engine = "0.1"
 compile-time = "0.2"
 serde_urlencoded = "0.7"
 md5="0.7"
 sha256="1"
-which="6"
+which="7"
 
 # Tauri dependencies
-tauri = { version = "1.5" }
+tauri = { version = "2" }
-specta = "=2.0.0-rc.1"
+specta = "=2.0.0-rc.20"
-specta-macros = "=2.0.0-rc.1"
-rspc = { version = "1.0.0-rc.5", features = ["tauri"] }
 
 [profile.release]
 opt-level = 'z'   # Optimize for size

Makefile

@@ -4,6 +4,7 @@ OFFLINE ?= 0
 BUILD_FE ?= 1
 INCLUDE_GUI ?= 0
 CARGO ?= cargo
+RUST_VERSION = 1.80
 
 VERSION = $(shell $(CARGO) metadata --no-deps --format-version 1 | jq -r '.packages[0].version')
 REVISION ?= 1
@@ -13,6 +14,9 @@ PKG = $(PKG_NAME)-$(VERSION)
 SERIES ?= $(shell lsb_release -cs)
 PUBLISH ?= 0
 
+# Indicates whether to build the GUI components
+BUILD_GUI ?= 1
+
 export DEBEMAIL = k3vinyue@gmail.com
 export DEBFULLNAME = Kevin Yue
 export SNAPSHOT = $(shell test -f SNAPSHOT && echo "true" || echo "false")
@@ -42,7 +46,7 @@ clean-tarball:
 
 # Create a tarball, include the cargo dependencies if OFFLINE is set to 1
 tarball: clean-tarball
-	if [ $(BUILD_FE) -eq 1 ]; then \
+	if [ $(BUILD_GUI) -eq 1 ] && [ $(BUILD_FE) -eq 1 ]; then \
 		echo "Building frontend..."; \
 		cd apps/gpgui-helper && pnpm install && pnpm build; \
 	fi
@@ -80,13 +84,13 @@ build: download-gui build-fe build-rs
 # Install and build the frontend
 # If OFFLINE is set to 1, skip it
 build-fe:
-	if [ $(OFFLINE) -eq 1 ] || [ $(BUILD_FE) -eq 0 ]; then \
+	if [ $(BUILD_GUI) -eq 0 ] || [ $(OFFLINE) -eq 1 ] || [ $(BUILD_FE) -eq 0 ]; then \
-		echo "Skipping frontend build (OFFLINE=1 or BUILD_FE=0)"; \
+		echo "Skipping frontend build (BUILD_GUI=0 or OFFLINE=1 or BUILD_FE=0)"; \
 	else \
 		cd apps/gpgui-helper && pnpm install && pnpm build; \
 	fi
 
-	if [ ! -d apps/gpgui-helper/dist ]; then \
+	if [ $(BUILD_GUI) -eq 1 ] && [ ! -d apps/gpgui-helper/dist ]; then \
 		echo "Error: frontend build failed"; \
 		exit 1; \
 	fi
@@ -96,8 +100,13 @@ build-rs:
 		tar -xJf vendor.tar.xz; \
 	fi
 
-	$(CARGO) build $(CARGO_BUILD_ARGS) -p gpclient -p gpservice -p gpauth
+	# Only build the GUI components if BUILD_GUI is set to 1
-	$(CARGO) build $(CARGO_BUILD_ARGS) -p gpgui-helper --features "tauri/custom-protocol"
+	if [ $(BUILD_GUI) -eq 1 ]; then \
+		$(CARGO) build $(CARGO_BUILD_ARGS) -p gpclient -p gpservice -p gpauth; \
+		$(CARGO) build $(CARGO_BUILD_ARGS) -p gpgui-helper --features "tauri/custom-protocol"; \
+	else \
+		$(CARGO) build $(CARGO_BUILD_ARGS) -p gpclient -p gpservice -p gpauth --no-default-features; \
+	fi
 
 clean:
 	$(CARGO) clean
@@ -111,7 +120,11 @@ install:
 	install -Dm755 target/release/gpclient $(DESTDIR)/usr/bin/gpclient
 	install -Dm755 target/release/gpauth $(DESTDIR)/usr/bin/gpauth
 	install -Dm755 target/release/gpservice $(DESTDIR)/usr/bin/gpservice
-	install -Dm755 target/release/gpgui-helper $(DESTDIR)/usr/bin/gpgui-helper
+
+	# Install the GUI components if BUILD_GUI is set to 1
+	if [ $(BUILD_GUI) -eq 1 ]; then \
+		install -Dm755 target/release/gpgui-helper $(DESTDIR)/usr/bin/gpgui-helper; \
+	fi
 
 	if [ -f .build/gpgui/gpgui_*/gpgui ]; then \
 		install -Dm755 .build/gpgui/gpgui_*/gpgui $(DESTDIR)/usr/bin/gpgui; \
@@ -154,13 +167,25 @@ init-debian: clean-debian tarball
 	cp -f packaging/deb/control.in .build/deb/$(PKG)/debian/control
 	cp -f packaging/deb/rules.in .build/deb/$(PKG)/debian/rules
 	cp -f packaging/deb/postrm .build/deb/$(PKG)/debian/postrm
+	cp -f packaging/deb/compat .build/deb/$(PKG)/debian/compat
 
 	sed -i "s/@OFFLINE@/$(OFFLINE)/g" .build/deb/$(PKG)/debian/rules
+	sed -i "s/@BUILD_GUI@/$(BUILD_GUI)/g" .build/deb/$(PKG)/debian/rules
+	sed -i "s/@RUST_VERSION@/$(RUST_VERSION)/g" .build/deb/$(PKG)/debian/rules
+
+	# Remove the GUI dependencies if BUILD_GUI is set to 0
+	if [ $(BUILD_GUI) -eq 0 ]; then \
+		sed -i "/libxml2/d" .build/deb/$(PKG)/debian/control; \
+		sed -i "/libsecret-1-0/d" .build/deb/$(PKG)/debian/control; \
+		sed -i "/libayatana-appindicator3-1/d" .build/deb/$(PKG)/debian/control; \
+		sed -i "/gnome-keyring/d" .build/deb/$(PKG)/debian/control; \
+		sed -i "/libwebkit2gtk-4.1-dev/d" .build/deb/$(PKG)/debian/control; \
+	fi
 
 	rm -f .build/deb/$(PKG)/debian/changelog
 
 deb: init-debian
-	# Remove the rust build depdency from the control file
+	# Remove the rust build dependency from the control file
 	sed -i "s/@RUST@//g" .build/deb/$(PKG)/debian/control
 
 	cd .build/deb/$(PKG) && dch --create --distribution unstable --package $(PKG_NAME) --newversion $(VERSION)-$(REVISION) "Bugfix and improvements."
@@ -174,7 +199,7 @@ check-ppa:
 
 # Usage: make ppa SERIES=focal OFFLINE=1 PUBLISH=1
 ppa: check-ppa init-debian
-	sed -i "s/@RUST@/rust-all(>=1.70)/g" .build/deb/$(PKG)/debian/control
+	sed -i "s/@RUST@/cargo-1.80/g" .build/deb/$(PKG)/debian/control
 
 	$(eval SERIES_VER = $(shell distro-info --series $(SERIES) -r | cut -d' ' -f1))
 	@echo "Building for $(SERIES) $(SERIES_VER)"

README.md

@@ -70,12 +70,10 @@ The GUI version is also available after you installed it. You can launch it from
 
 ### Debian/Ubuntu based distributions
 
-#### Install from PPA (Ubuntu 18.04 and later, except 24.04)
+#### Install from PPA (Ubuntu > 18.04)
 
 ```
-sudo apt-get install gir1.2-gtk-3.0 gir1.2-webkit2-4.0
 sudo add-apt-repository ppa:yuezk/globalprotect-openconnect
-sudo apt-get update
 sudo apt-get install globalprotect-openconnect
 ```
 
@@ -83,18 +81,9 @@ sudo apt-get install globalprotect-openconnect
 >
 > For Linux Mint, you might need to import the GPG key with: `sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 7937C393082992E5D6E4A60453FC26B43838D761` if you encountered an error `gpg: keyserver receive failed: General error`.
 
-#### **Ubuntu 24.04 and later**
-
-The `libwebkit2gtk-4.0-37` package was [removed](https://bugs.launchpad.net/ubuntu/+source/webkit2gtk/+bug/2061914) from its repo. You can use the [`deb-install.sh`](./scripts/deb-install.sh) script to install the package:
-
-```bash
-curl -o- https://raw.githubusercontent.com/yuezk/GlobalProtect-openconnect/main/scripts/deb-install.sh \
-  | bash -s -- 2.3.9
-```
-
 #### **Ubuntu 18.04**
 
-The latest package is not available in the PPA either, but you still needs to add the `ppa:yuezk/globalprotect-openconnect` repo beforehand to use the required `openconnect` package. Then you can follow the [Install from deb package](#install-from-deb-package) section to install the latest package.
+The latest package is not available in the PPA, but you still needs to add the `ppa:yuezk/globalprotect-openconnect` repo beforehand to use the required `openconnect` package. Then you can follow the [Install from deb package](#install-from-deb-package) section to install the latest package.
 
 #### Install from deb package
 
@@ -172,8 +161,8 @@ You can also build the client from source, steps are as follows:
 
 ### Prerequisites
 
-- [Install Rust 1.75 or later](https://www.rust-lang.org/tools/install)
+- [Install Rust 1.80 or later](https://www.rust-lang.org/tools/install)
-- Install Tauri dependencies: https://tauri.app/v1/guides/getting-started/prerequisites/#setting-up-linux
+- Install Tauri dependencies: https://tauri.app/start/prerequisites/
 - Install `perl` and `jq`
 - Install `openconnect >= 8.20` and `libopenconnect-dev` (or `openconnect-devel` on RPM-based distributions)
 - Install `pkexec`, `gnome-keyring` (or `pam_kwallet` on KDE)
@@ -210,6 +199,7 @@ The CLI version is always free, while the GUI version is paid. There are two tri
 - crate [gpapi](./crates/gpapi): [MIT](./crates/gpapi/LICENSE)
 - crate [openconnect](./crates/openconnect): [GPL-3.0](./crates/openconnect/LICENSE)
 - crate [common](./crates/common): [GPL-3.0](./crates/common/LICENSE)
+- crate [auth](./crates/auth): [GPL-3.0](./crates/auth/LICENSE)
 - app [gpservice](./apps/gpservice): [GPL-3.0](./apps/gpservice/LICENSE)
 - app [gpclient](./apps/gpclient): [GPL-3.0](./apps/gpclient/LICENSE)
 - app [gpauth](./apps/gpauth): [GPL-3.0](./apps/gpauth/LICENSE)

apps/gpauth/Cargo.toml

@@ -1,29 +1,32 @@
 [package]
 name = "gpauth"
+rust-version.workspace = true
 authors.workspace = true
 version.workspace = true
 edition.workspace = true
 license.workspace = true
 
 [build-dependencies]
-tauri-build = { version = "1.5", features = [] }
+tauri-build = { version = "2", features = [], optional = true }
 
 [dependencies]
-gpapi = { path = "../../crates/gpapi", features = [
+gpapi = { path = "../../crates/gpapi", features = ["clap"] }
-  "tauri",
+
-  "clap",
+auth = { path = "../../crates/auth", features = ["browser-auth"] }
-  "browser-auth",
+
-] }
+# Shared dependencies
 anyhow.workspace = true
 clap.workspace = true
 env_logger.workspace = true
 log.workspace = true
-regex.workspace = true
 serde_json.workspace = true
 tokio.workspace = true
-tokio-util.workspace = true
 tempfile.workspace = true
-html-escape = "0.2.13"
-webkit2gtk = "0.18.2"
-tauri = { workspace = true, features = ["http-all"] }
 compile-time.workspace = true
+
+# webview auth dependencies
+tauri = { workspace = true, optional = true }
+
+[features]
+default = ["webview-auth"]
+webview-auth = ["auth/webview-auth", "dep:tauri", "dep:tauri-build"]

apps/gpauth/build.rs

@@ -1,3 +1,4 @@
 fn main() {
+  #[cfg(feature = "webview-auth")]
   tauri_build::build()
 }

apps/gpauth/src/auth_window.rs

@@ -1,523 +0,0 @@
-use std::{
-  rc::Rc,
-  sync::Arc,
-  time::{Duration, Instant},
-};
-
-use anyhow::bail;
-use gpapi::{
-  auth::SamlAuthData,
-  error::AuthDataParseError,
-  gp_params::GpParams,
-  portal::{prelogin, Prelogin},
-  utils::{redact::redact_uri, window::WindowExt},
-};
-use log::{info, warn};
-use regex::Regex;
-use tauri::{AppHandle, Window, WindowEvent, WindowUrl};
-use tokio::sync::{mpsc, oneshot, RwLock};
-use tokio_util::sync::CancellationToken;
-use webkit2gtk::{
-  gio::Cancellable,
-  glib::{GString, TimeSpan},
-  LoadEvent, SettingsExt, TLSErrorsPolicy, URIResponse, URIResponseExt, WebContextExt, WebResource, WebResourceExt,
-  WebView, WebViewExt, WebsiteDataManagerExtManual, WebsiteDataTypes,
-};
-
-enum AuthDataError {
-  /// Failed to load page due to TLS error
-  TlsError,
-  /// 1. Found auth data in headers/body but it's invalid
-  /// 2. Loaded an empty page, failed to load page. etc.
-  Invalid,
-  /// No auth data found in headers/body
-  NotFound,
-}
-
-type AuthResult = Result<SamlAuthData, AuthDataError>;
-
-pub(crate) struct AuthWindow<'a> {
-  app_handle: AppHandle,
-  server: &'a str,
-  saml_request: &'a str,
-  user_agent: &'a str,
-  gp_params: Option<GpParams>,
-  clean: bool,
-}
-
-impl<'a> AuthWindow<'a> {
-  pub fn new(app_handle: AppHandle) -> Self {
-    Self {
-      app_handle,
-      server: "",
-      saml_request: "",
-      user_agent: "",
-      gp_params: None,
-      clean: false,
-    }
-  }
-
-  pub fn server(mut self, server: &'a str) -> Self {
-    self.server = server;
-    self
-  }
-
-  pub fn saml_request(mut self, saml_request: &'a str) -> Self {
-    self.saml_request = saml_request;
-    self
-  }
-
-  pub fn user_agent(mut self, user_agent: &'a str) -> Self {
-    self.user_agent = user_agent;
-    self
-  }
-
-  pub fn gp_params(mut self, gp_params: GpParams) -> Self {
-    self.gp_params.replace(gp_params);
-    self
-  }
-
-  pub fn clean(mut self, clean: bool) -> Self {
-    self.clean = clean;
-    self
-  }
-
-  pub async fn open(&self) -> anyhow::Result<SamlAuthData> {
-    info!("Open auth window, user_agent: {}", self.user_agent);
-
-    let window = Window::builder(&self.app_handle, "auth_window", WindowUrl::default())
-      .title("GlobalProtect Login")
-      // .user_agent(self.user_agent)
-      .focused(true)
-      .visible(false)
-      .center()
-      .build()?;
-
-    let window = Arc::new(window);
-
-    let cancel_token = CancellationToken::new();
-    let cancel_token_clone = cancel_token.clone();
-
-    window.on_window_event(move |event| {
-      if let WindowEvent::CloseRequested { .. } = event {
-        cancel_token_clone.cancel();
-      }
-    });
-
-    let window_clone = Arc::clone(&window);
-    let timeout_secs = 15;
-    tokio::spawn(async move {
-      tokio::time::sleep(Duration::from_secs(timeout_secs)).await;
-      let visible = window_clone.is_visible().unwrap_or(false);
-      if !visible {
-        info!("Try to raise auth window after {} seconds", timeout_secs);
-        raise_window(&window_clone);
-      }
-    });
-
-    tokio::select! {
-      _ = cancel_token.cancelled() => {
-        bail!("Auth cancelled");
-      }
-      saml_result = self.auth_loop(&window) => {
-        window.close()?;
-        saml_result
-      }
-    }
-  }
-
-  async fn auth_loop(&self, window: &Arc<Window>) -> anyhow::Result<SamlAuthData> {
-    let saml_request = self.saml_request.to_string();
-    let (auth_result_tx, mut auth_result_rx) = mpsc::unbounded_channel::<AuthResult>();
-    let raise_window_cancel_token: Arc<RwLock<Option<CancellationToken>>> = Default::default();
-    let gp_params = self.gp_params.as_ref().unwrap();
-    let tls_err_policy = if gp_params.ignore_tls_errors() {
-      TLSErrorsPolicy::Ignore
-    } else {
-      TLSErrorsPolicy::Fail
-    };
-
-    if self.clean {
-      clear_webview_cookies(window).await?;
-    }
-
-    let raise_window_cancel_token_clone = Arc::clone(&raise_window_cancel_token);
-    window.with_webview(move |wv| {
-      let wv = wv.inner();
-
-      if let Some(context) = wv.context() {
-        context.set_tls_errors_policy(tls_err_policy);
-      }
-
-      if let Some(settings) = wv.settings() {
-        let ua = settings.user_agent().unwrap_or("".into());
-        info!("Auth window user agent: {}", ua);
-      }
-
-      // Load the initial SAML request
-      load_saml_request(&wv, &saml_request);
-
-      let auth_result_tx_clone = auth_result_tx.clone();
-      wv.connect_load_changed(move |wv, event| {
-        if event == LoadEvent::Started {
-          let Ok(mut cancel_token) = raise_window_cancel_token_clone.try_write() else {
-            return;
-          };
-
-          // Cancel the raise window task
-          if let Some(cancel_token) = cancel_token.take() {
-            cancel_token.cancel();
-          }
-          return;
-        }
-
-        if event != LoadEvent::Finished {
-          return;
-        }
-
-        if let Some(main_resource) = wv.main_resource() {
-          let uri = main_resource.uri().unwrap_or("".into());
-
-          if uri.is_empty() {
-            warn!("Loaded an empty uri");
-            send_auth_result(&auth_result_tx_clone, Err(AuthDataError::Invalid));
-            return;
-          }
-
-          info!("Loaded uri: {}", redact_uri(&uri));
-          if uri.starts_with("globalprotectcallback:") {
-            return;
-          }
-
-          read_auth_data(&main_resource, auth_result_tx_clone.clone());
-        }
-      });
-
-      let auth_result_tx_clone = auth_result_tx.clone();
-      wv.connect_load_failed_with_tls_errors(move |_wv, uri, cert, err| {
-        let redacted_uri = redact_uri(uri);
-        warn!(
-          "Failed to load uri: {} with error: {}, cert: {}",
-          redacted_uri, err, cert
-        );
-
-        send_auth_result(&auth_result_tx_clone, Err(AuthDataError::TlsError));
-        true
-      });
-
-      wv.connect_load_failed(move |_wv, _event, uri, err| {
-        let redacted_uri = redact_uri(uri);
-        if !uri.starts_with("globalprotectcallback:") {
-          warn!("Failed to load uri: {} with error: {}", redacted_uri, err);
-        }
-        // NOTE: Don't send error here, since load_changed event will be triggered after this
-        // send_auth_result(&auth_result_tx, Err(AuthDataError::Invalid));
-        // true to stop other handlers from being invoked for the event. false to propagate the event further.
-        true
-      });
-    })?;
-
-    let portal = self.server.to_string();
-
-    loop {
-      if let Some(auth_result) = auth_result_rx.recv().await {
-        match auth_result {
-          Ok(auth_data) => return Ok(auth_data),
-          Err(AuthDataError::TlsError) => bail!("TLS error: certificate verify failed"),
-          Err(AuthDataError::NotFound) => {
-            info!("No auth data found, it may not be the /SAML20/SP/ACS endpoint");
-
-            // The user may need to interact with the auth window, raise it in 3 seconds
-            if !window.is_visible().unwrap_or(false) {
-              let window = Arc::clone(window);
-              let cancel_token = CancellationToken::new();
-
-              raise_window_cancel_token.write().await.replace(cancel_token.clone());
-
-              tokio::spawn(async move {
-                let delay_secs = 1;
-
-                info!("Raise window in {} second(s)", delay_secs);
-                tokio::select! {
-                  _ = tokio::time::sleep(Duration::from_secs(delay_secs)) => {
-                    raise_window(&window);
-                  }
-                  _ = cancel_token.cancelled() => {
-                    info!("Raise window cancelled");
-                  }
-                }
-              });
-            }
-          }
-          Err(AuthDataError::Invalid) => {
-            info!("Got invalid auth data, retrying...");
-
-            window.with_webview(|wv| {
-              let wv = wv.inner();
-              wv.run_javascript(r#"
-                  var loading = document.createElement("div");
-                  loading.innerHTML = '<div style="position: absolute; width: 100%; text-align: center; font-size: 20px; font-weight: bold; top: 50%; left: 50%; transform: translate(-50%, -50%);">Got invalid token, retrying...</div>';
-                  loading.style = "position: fixed; top: 0; left: 0; width: 100%; height: 100%; background: rgba(255, 255, 255, 0.85); z-index: 99999;";
-                  document.body.appendChild(loading);
-              "#,
-                  Cancellable::NONE,
-                  |_| info!("Injected loading element successfully"),
-              );
-            })?;
-
-            let saml_request = portal_prelogin(&portal, gp_params).await?;
-            window.with_webview(move |wv| {
-              let wv = wv.inner();
-              load_saml_request(&wv, &saml_request);
-            })?;
-          }
-        }
-      }
-    }
-  }
-}
-
-fn raise_window(window: &Arc<Window>) {
-  let visible = window.is_visible().unwrap_or(false);
-  if !visible {
-    if let Err(err) = window.raise() {
-      warn!("Failed to raise window: {}", err);
-    }
-  }
-}
-
-pub async fn portal_prelogin(portal: &str, gp_params: &GpParams) -> anyhow::Result<String> {
-  match prelogin(portal, gp_params).await? {
-    Prelogin::Saml(prelogin) => Ok(prelogin.saml_request().to_string()),
-    Prelogin::Standard(_) => bail!("Received non-SAML prelogin response"),
-  }
-}
-
-fn send_auth_result(auth_result_tx: &mpsc::UnboundedSender<AuthResult>, auth_result: AuthResult) {
-  if let Err(err) = auth_result_tx.send(auth_result) {
-    warn!("Failed to send auth event: {}", err);
-  }
-}
-
-fn load_saml_request(wv: &Rc<WebView>, saml_request: &str) {
-  if saml_request.starts_with("http") {
-    info!("Load the SAML request as URI...");
-    wv.load_uri(saml_request);
-  } else {
-    info!("Load the SAML request as HTML...");
-    wv.load_html(saml_request, None);
-  }
-}
-
-fn read_auth_data_from_headers(response: &URIResponse) -> AuthResult {
-  response.http_headers().map_or_else(
-    || {
-      info!("No headers found in response");
-      Err(AuthDataError::NotFound)
-    },
-    |mut headers| match headers.get("saml-auth-status") {
-      Some(status) if status == "1" => {
-        let username = headers.get("saml-username").map(GString::into);
-        let prelogin_cookie = headers.get("prelogin-cookie").map(GString::into);
-        let portal_userauthcookie = headers.get("portal-userauthcookie").map(GString::into);
-
-        if SamlAuthData::check(&username, &prelogin_cookie, &portal_userauthcookie) {
-          return Ok(SamlAuthData::new(
-            username.unwrap(),
-            prelogin_cookie,
-            portal_userauthcookie,
-          ));
-        }
-
-        info!("Found invalid auth data in headers");
-        Err(AuthDataError::Invalid)
-      }
-      Some(status) => {
-        info!("Found invalid SAML status: {} in headers", status);
-        Err(AuthDataError::Invalid)
-      }
-      None => {
-        info!("No saml-auth-status header found");
-        Err(AuthDataError::NotFound)
-      }
-    },
-  )
-}
-
-fn read_auth_data_from_body<F>(main_resource: &WebResource, callback: F)
-where
-  F: FnOnce(Result<SamlAuthData, AuthDataParseError>) + Send + 'static,
-{
-  main_resource.data(Cancellable::NONE, |data| match data {
-    Ok(data) => {
-      let html = String::from_utf8_lossy(&data);
-      callback(read_auth_data_from_html(&html));
-    }
-    Err(err) => {
-      info!("Failed to read response body: {}", err);
-      callback(Err(AuthDataParseError::Invalid))
-    }
-  });
-}
-
-fn read_auth_data_from_html(html: &str) -> Result<SamlAuthData, AuthDataParseError> {
-  if html.contains("Temporarily Unavailable") {
-    info!("Found 'Temporarily Unavailable' in HTML, auth failed");
-    return Err(AuthDataParseError::Invalid);
-  }
-
-  SamlAuthData::from_html(html).or_else(|err| {
-    if let Some(gpcallback) = extract_gpcallback(html) {
-      info!("Found gpcallback from html...");
-      SamlAuthData::from_gpcallback(&gpcallback)
-    } else {
-      Err(err)
-    }
-  })
-}
-
-fn extract_gpcallback(html: &str) -> Option<String> {
-  let re = Regex::new(r#"globalprotectcallback:[^"]+"#).unwrap();
-  re.captures(html)
-    .and_then(|captures| captures.get(0))
-    .map(|m| html_escape::decode_html_entities(m.as_str()).to_string())
-}
-
-fn read_auth_data(main_resource: &WebResource, auth_result_tx: mpsc::UnboundedSender<AuthResult>) {
-  let Some(response) = main_resource.response() else {
-    info!("No response found in main resource");
-    send_auth_result(&auth_result_tx, Err(AuthDataError::Invalid));
-    return;
-  };
-
-  info!("Trying to read auth data from response headers...");
-
-  match read_auth_data_from_headers(&response) {
-    Ok(auth_data) => {
-      info!("Got auth data from headers");
-      send_auth_result(&auth_result_tx, Ok(auth_data));
-    }
-    Err(AuthDataError::Invalid) => {
-      info!("Found invalid auth data in headers, trying to read from body...");
-      read_auth_data_from_body(main_resource, move |auth_result| {
-        // Since we have already found invalid auth data in headers, which means this could be the `/SAML20/SP/ACS` endpoint
-        // any error result from body should be considered as invalid, and trigger a retry
-        let auth_result = auth_result.map_err(|err| {
-          info!("Failed to read auth data from body: {}", err);
-          AuthDataError::Invalid
-        });
-        send_auth_result(&auth_result_tx, auth_result);
-      });
-    }
-    Err(AuthDataError::NotFound) => {
-      info!("No auth data found in headers, trying to read from body...");
-
-      let is_acs_endpoint = main_resource.uri().map_or(false, |uri| uri.contains("/SAML20/SP/ACS"));
-
-      read_auth_data_from_body(main_resource, move |auth_result| {
-        // If the endpoint is `/SAML20/SP/ACS` and no auth data found in body, it should be considered as invalid
-        let auth_result = auth_result.map_err(|err| {
-          info!("Failed to read auth data from body: {}", err);
-
-          if !is_acs_endpoint && matches!(err, AuthDataParseError::NotFound) {
-            AuthDataError::NotFound
-          } else {
-            AuthDataError::Invalid
-          }
-        });
-
-        send_auth_result(&auth_result_tx, auth_result)
-      });
-    }
-    Err(AuthDataError::TlsError) => {
-      // NOTE: This is unreachable
-      info!("TLS error found in headers, trying to read from body...");
-      send_auth_result(&auth_result_tx, Err(AuthDataError::TlsError));
-    }
-  }
-}
-
-pub(crate) async fn clear_webview_cookies(window: &Window) -> anyhow::Result<()> {
-  let (tx, rx) = oneshot::channel::<Result<(), String>>();
-
-  window.with_webview(|wv| {
-    let send_result = move |result: Result<(), String>| {
-      if let Err(err) = tx.send(result) {
-        info!("Failed to send result: {:?}", err);
-      }
-    };
-
-    let wv = wv.inner();
-    let context = match wv.context() {
-      Some(context) => context,
-      None => {
-        send_result(Err("No webview context found".into()));
-        return;
-      }
-    };
-    let data_manager = match context.website_data_manager() {
-      Some(manager) => manager,
-      None => {
-        send_result(Err("No data manager found".into()));
-        return;
-      }
-    };
-
-    let now = Instant::now();
-    data_manager.clear(
-      WebsiteDataTypes::COOKIES,
-      TimeSpan(0),
-      Cancellable::NONE,
-      move |result| match result {
-        Err(err) => {
-          send_result(Err(err.to_string()));
-        }
-        Ok(_) => {
-          info!("Cookies cleared in {} ms", now.elapsed().as_millis());
-          send_result(Ok(()));
-        }
-      },
-    );
-  })?;
-
-  rx.await?.map_err(|err| anyhow::anyhow!(err))
-}
-
-#[cfg(test)]
-mod tests {
-  use super::*;
-
-  #[test]
-  fn extract_gpcallback_some() {
-    let html = r#"
-      <meta http-equiv="refresh" content="0; URL=globalprotectcallback:PGh0bWw+PCEtLSA8c">
-      <meta http-equiv="refresh" content="0; URL=globalprotectcallback:PGh0bWw+PCEtLSA8c">
-    "#;
-
-    assert_eq!(
-      extract_gpcallback(html).as_deref(),
-      Some("globalprotectcallback:PGh0bWw+PCEtLSA8c")
-    );
-  }
-
-  #[test]
-  fn extract_gpcallback_cas() {
-    let html = r#"
-      <meta http-equiv="refresh" content="0; URL=globalprotectcallback:cas-as=1&amp;un=xyz@email.com&amp;token=very_long_string">
-    "#;
-
-    assert_eq!(
-      extract_gpcallback(html).as_deref(),
-      Some("globalprotectcallback:cas-as=1&un=xyz@email.com&token=very_long_string")
-    );
-  }
-
-  #[test]
-  fn extract_gpcallback_none() {
-    let html = r#"
-      <meta http-equiv="refresh" content="0; URL=PGh0bWw+PCEtLSA8c">
-    "#;
-
-    assert_eq!(extract_gpcallback(html), None);
-  }
-}

apps/gpauth/src/cli.rs

@@ -1,21 +1,17 @@
-use std::{env::temp_dir, fs, os::unix::fs::PermissionsExt};
+use std::borrow::Cow;
 
+use auth::{auth_prelogin, Authenticator, BrowserAuthenticator};
 use clap::Parser;
 use gpapi::{
   auth::{SamlAuthData, SamlAuthResult},
-  clap::args::Os,
+  clap::{args::Os, handle_error, Args},
   gp_params::{ClientOs, GpParams},
-  process::browser_authenticator::BrowserAuthenticator,
   utils::{normalize_server, openssl},
   GP_USER_AGENT,
 };
 use log::{info, LevelFilter};
 use serde_json::json;
-use tauri::{App, AppHandle, RunEvent};
 use tempfile::NamedTempFile;
-use tokio::{io::AsyncReadExt, net::TcpListener};
-
-use crate::auth_window::{portal_prelogin, AuthWindow};
 
 const VERSION: &str = concat!(env!("CARGO_PKG_VERSION"), " (", compile_time::date_str!(), ")");
 
@@ -37,7 +33,7 @@ const VERSION: &str = concat!(env!("CARGO_PKG_VERSION"), " (", compile_time::dat
 See 'gpauth -h' for more information.
 "
 )]
-struct Cli {
+pub(crate) struct Cli {
   #[arg(help = "The portal server to authenticate")]
   server: String,
 
@@ -56,18 +52,13 @@ struct Cli {
   #[arg(long)]
   os_version: Option<String>,
 
-  #[arg(long, help = "The HiDPI mode, useful for high-resolution screens")]
-  hidpi: bool,
-
   #[arg(long, help = "Get around the OpenSSL `unsafe legacy renegotiation` error")]
   fix_openssl: bool,
 
   #[arg(long, help = "Ignore TLS errors")]
   ignore_tls_errors: bool,
 
-  #[arg(long, help = "Clean the cache of the embedded browser")]
+  #[cfg(feature = "webview-auth")]
-  clean: bool,
-
   #[arg(long, help = "Use the default browser for authentication")]
   default_browser: bool,
 
@@ -76,76 +67,30 @@ struct Cli {
     help = "The browser to use for authentication, e.g., `default`, `firefox`, `chrome`, `chromium`, or the path to the browser executable"
   )]
   browser: Option<String>,
+
+  #[cfg(feature = "webview-auth")]
+  #[arg(long, help = "The HiDPI mode, useful for high-resolution screens")]
+  hidpi: bool,
+
+  #[cfg(feature = "webview-auth")]
+  #[arg(long, help = "Clean the cache of the embedded browser")]
+  pub clean: bool,
+}
+
+impl Args for Cli {
+  fn fix_openssl(&self) -> bool {
+    self.fix_openssl
+  }
+
+  fn ignore_tls_errors(&self) -> bool {
+    self.ignore_tls_errors
+  }
 }
 
 impl Cli {
-  async fn run(&mut self) -> anyhow::Result<()> {
-    if self.ignore_tls_errors {
-      info!("TLS errors will be ignored");
-    }
-
-    let mut openssl_conf = self.prepare_env()?;
-
-    self.server = normalize_server(&self.server)?;
-    let gp_params = self.build_gp_params();
-
-    // Get the initial SAML request
-    let saml_request = match self.saml_request {
-      Some(ref saml_request) => saml_request.clone(),
-      None => portal_prelogin(&self.server, &gp_params).await?,
-    };
-
-    let browser_auth = if let Some(browser) = &self.browser {
-      Some(BrowserAuthenticator::new_with_browser(&saml_request, browser))
-    } else if self.default_browser {
-      Some(BrowserAuthenticator::new(&saml_request))
-    } else {
-      None
-    };
-
-    if let Some(browser_auth) = browser_auth {
-      browser_auth.authenticate()?;
-
-      info!("Please continue the authentication process in the default browser");
-
-      let auth_result = match wait_auth_data().await {
-        Ok(auth_data) => SamlAuthResult::Success(auth_data),
-        Err(err) => SamlAuthResult::Failure(format!("{}", err)),
-      };
-
-      info!("Authentication completed");
-
-      println!("{}", json!(auth_result));
-
-      return Ok(());
-    }
-
-    self.saml_request.replace(saml_request);
-
-    let app = create_app(self.clone())?;
-
-    app.run(move |_app_handle, event| {
-      if let RunEvent::Exit = event {
-        if let Some(file) = openssl_conf.take() {
-          if let Err(err) = file.close() {
-            info!("Error closing OpenSSL config file: {}", err);
-          }
-        }
-      }
-    });
-
-    Ok(())
-  }
-
   fn prepare_env(&self) -> anyhow::Result<Option<NamedTempFile>> {
-    std::env::set_var("WEBKIT_DISABLE_COMPOSITING_MODE", "1");
+    #[cfg(feature = "webview-auth")]
-
+    gpapi::utils::env_utils::patch_gui_runtime_env(self.hidpi);
-    if self.hidpi {
-      info!("Setting GDK_SCALE=2 and GDK_DPI_SCALE=0.5");
-
-      std::env::set_var("GDK_SCALE", "2");
-      std::env::set_var("GDK_DPI_SCALE", "0.5");
-    }
 
     if self.fix_openssl {
       info!("Fixing OpenSSL environment");
@@ -157,6 +102,49 @@ impl Cli {
     Ok(None)
   }
 
+  async fn run(&self) -> anyhow::Result<()> {
+    if self.ignore_tls_errors {
+      info!("TLS errors will be ignored");
+    }
+
+    let openssl_conf = self.prepare_env()?;
+
+    let server = normalize_server(&self.server)?;
+    let server: &'static str = Box::leak(server.into_boxed_str());
+    let gp_params: &'static GpParams = Box::leak(Box::new(self.build_gp_params()));
+
+    let auth_request = match self.saml_request.as_deref() {
+      Some(auth_request) => Cow::Borrowed(auth_request),
+      None => Cow::Owned(auth_prelogin(server, gp_params).await?),
+    };
+
+    let auth_request: &'static str = Box::leak(auth_request.into_owned().into_boxed_str());
+    let authenticator = Authenticator::new(&server, gp_params).with_auth_request(&auth_request);
+
+    #[cfg(feature = "webview-auth")]
+    let browser = self
+      .browser
+      .as_deref()
+      .or_else(|| self.default_browser.then_some("default"));
+
+    #[cfg(not(feature = "webview-auth"))]
+    let browser = self.browser.as_deref().or(Some("default"));
+
+    if browser.is_some() {
+      let auth_result = authenticator.browser_authenticate(browser).await;
+      print_auth_result(auth_result);
+
+      // explicitly drop openssl_conf to avoid the unused variable warning
+      drop(openssl_conf);
+      return Ok(());
+    }
+
+    #[cfg(feature = "webview-auth")]
+    crate::webview_auth::authenticate(&self, authenticator, openssl_conf)?;
+
+    Ok(())
+  }
+
   fn build_gp_params(&self) -> GpParams {
     let gp_params = GpParams::builder()
       .user_agent(&self.user_agent)
@@ -168,37 +156,6 @@ impl Cli {
 
     gp_params
   }
-
-  async fn saml_auth(&self, app_handle: AppHandle) -> anyhow::Result<SamlAuthData> {
-    let auth_window = AuthWindow::new(app_handle)
-      .server(&self.server)
-      .user_agent(&self.user_agent)
-      .gp_params(self.build_gp_params())
-      .saml_request(self.saml_request.as_ref().unwrap())
-      .clean(self.clean);
-
-    auth_window.open().await
-  }
-}
-
-fn create_app(cli: Cli) -> anyhow::Result<App> {
-  let app = tauri::Builder::default()
-    .setup(|app| {
-      let app_handle = app.handle();
-
-      tauri::async_runtime::spawn(async move {
-        let auth_result = match cli.saml_auth(app_handle.clone()).await {
-          Ok(auth_data) => SamlAuthResult::Success(auth_data),
-          Err(err) => SamlAuthResult::Failure(format!("{}", err)),
-        };
-
-        println!("{}", json!(auth_result));
-      });
-      Ok(())
-    })
-    .build(tauri::generate_context!())?;
-
-  Ok(app)
 }
 
 fn init_logger() {
@@ -206,53 +163,22 @@ fn init_logger() {
 }
 
 pub async fn run() {
-  let mut cli = Cli::parse();
+  let cli = Cli::parse();
 
   init_logger();
   info!("gpauth started: {}", VERSION);
 
   if let Err(err) = cli.run().await {
-    eprintln!("\nError: {}", err);
+    handle_error(err, &cli);
-
-    if err.to_string().contains("unsafe legacy renegotiation") && !cli.fix_openssl {
-      eprintln!("\nRe-run it with the `--fix-openssl` option to work around this issue, e.g.:\n");
-      // Print the command
-      let args = std::env::args().collect::<Vec<_>>();
-      eprintln!("{} --fix-openssl {}\n", args[0], args[1..].join(" "));
-    }
-
     std::process::exit(1);
   }
 }
 
-async fn wait_auth_data() -> anyhow::Result<SamlAuthData> {
+pub fn print_auth_result(auth_result: anyhow::Result<SamlAuthData>) {
-  // Start a local server to receive the browser authentication data
+  let auth_result = match auth_result {
-  let listener = TcpListener::bind("127.0.0.1:0").await?;
+    Ok(auth_data) => SamlAuthResult::Success(auth_data),
-  let port = listener.local_addr()?.port();
+    Err(err) => SamlAuthResult::Failure(format!("{}", err)),
-  let port_file = temp_dir().join("gpcallback.port");
+  };
 
-  // Write the port to a file
+  println!("{}", json!(auth_result));
-  fs::write(&port_file, port.to_string())?;
-  fs::set_permissions(&port_file, fs::Permissions::from_mode(0o600))?;
-
-  // Remove the previous log file
-  let callback_log = temp_dir().join("gpcallback.log");
-  let _ = fs::remove_file(&callback_log);
-
-  info!("Listening authentication data on port {}", port);
-  info!(
-    "If it hangs, please check the logs at `{}` for more information",
-    callback_log.display()
-  );
-  let (mut socket, _) = listener.accept().await?;
-
-  info!("Received the browser authentication data from the socket");
-  let mut data = String::new();
-  socket.read_to_string(&mut data).await?;
-
-  // Remove the port file
-  fs::remove_file(&port_file)?;
-
-  let auth_data = SamlAuthData::from_gpcallback(&data)?;
-  Ok(auth_data)
 }

apps/gpauth/src/main.rs

@@ -1,7 +1,8 @@
 #![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
 
-mod auth_window;
 mod cli;
+#[cfg(feature = "webview-auth")]
+mod webview_auth;
 
 #[tokio::main]
 async fn main() {

apps/gpauth/src/webview_auth.rs

@@ -0,0 +1,41 @@
+use auth::{Authenticator, WebviewAuthenticator};
+use log::info;
+use tauri::RunEvent;
+use tempfile::NamedTempFile;
+
+use crate::cli::{print_auth_result, Cli};
+
+pub fn authenticate(
+  cli: &Cli,
+  authenticator: Authenticator<'static>,
+  mut openssl_conf: Option<NamedTempFile>,
+) -> anyhow::Result<()> {
+  let authenticator = authenticator.with_clean(cli.clean);
+
+  tauri::Builder::default()
+    .setup(move |app| {
+      let app_handle = app.handle().clone();
+
+      tauri::async_runtime::spawn(async move {
+        let auth_result = authenticator.webview_authenticate(&app_handle).await;
+        print_auth_result(auth_result);
+
+        // Ensure the app exits after the authentication process
+        app_handle.exit(0);
+      });
+
+      Ok(())
+    })
+    .build(tauri::generate_context!())?
+    .run(move |_app_handle, event| {
+      if let RunEvent::Exit = event {
+        if let Some(file) = openssl_conf.take() {
+          if let Err(err) = file.close() {
+            info!("Error closing OpenSSL config file: {}", err);
+          }
+        }
+      }
+    });
+
+  Ok(())
+}

apps/gpauth/tauri.conf.json

@@ -1,47 +1,16 @@
 {
-  "$schema": "https://cdn.jsdelivr.net/gh/tauri-apps/tauri@tauri-v1.5.0/tooling/cli/schema.json",
+  "$schema": "https://cdn.jsdelivr.net/gh/tauri-apps/tauri@tauri-v2.1.1/crates/tauri-cli/config.schema.json",
   "build": {
-    "distDir": [
+    "frontendDist": ["index.html"],
-      "index.html"
-    ],
-    "devPath": [
-      "index.html"
-    ],
     "beforeDevCommand": "",
-    "beforeBuildCommand": "",
+    "beforeBuildCommand": ""
-    "withGlobalTauri": false
   },
-  "package": {
-    "productName": "gpauth",
-    "version": "0.0.0"
-  },
-  "tauri": {
-    "allowlist": {
-      "all": false,
-      "http": {
-        "all": true,
-        "request": true,
-        "scope": [
-          "http://*",
-          "https://*"
-        ]
-      }
-    },
-    "bundle": {
-      "active": true,
-      "targets": "deb",
   "identifier": "com.yuezk.gpauth",
-      "icon": [
+  "productName": "gpauth",
-        "icons/32x32.png",
+  "app": {
-        "icons/128x128.png",
+    "withGlobalTauri": false,
-        "icons/128x128@2x.png",
-        "icons/icon.icns",
-        "icons/icon.ico"
-      ]
-    },
     "security": {
       "csp": null
-    },
+    }
-    "windows": []
   }
 }

apps/gpclient/Cargo.toml

@@ -1,5 +1,6 @@
 [package]
 name = "gpclient"
+rust-version.workspace = true
 authors.workspace = true
 version.workspace = true
 edition.workspace = true
@@ -9,10 +10,11 @@ license.workspace = true
 common = { path = "../../crates/common" }
 gpapi = { path = "../../crates/gpapi", features = ["clap"] }
 openconnect = { path = "../../crates/openconnect" }
+
 anyhow.workspace = true
 clap.workspace = true
 env_logger.workspace = true
-inquire = "0.6.2"
+inquire = "0.7"
 log.workspace = true
 tokio.workspace = true
 sysinfo.workspace = true
@@ -22,3 +24,7 @@ tempfile.workspace = true
 reqwest.workspace = true
 directories = "5.0"
 compile-time.workspace = true
+
+[features]
+default = ["webview-auth"]
+webview-auth = ["gpapi/webview-auth"]

apps/gpclient/src/cli.rs

@@ -1,7 +1,10 @@
 use std::{env::temp_dir, fs::File};
 
 use clap::{Parser, Subcommand};
-use gpapi::utils::openssl;
+use gpapi::{
+  clap::{handle_error, Args},
+  utils::openssl,
+};
 use log::{info, LevelFilter};
 use tempfile::NamedTempFile;
 
@@ -50,12 +53,25 @@ struct Cli {
   #[command(subcommand)]
   command: CliCommand,
 
-  #[arg(long, help = "Uses extended compatibility mode for OpenSSL operations to support a broader range of systems and formats.")]
+  #[arg(
+    long,
+    help = "Uses extended compatibility mode for OpenSSL operations to support a broader range of systems and formats."
+  )]
   fix_openssl: bool,
   #[arg(long, help = "Ignore the TLS errors")]
   ignore_tls_errors: bool,
 }
 
+impl Args for Cli {
+  fn fix_openssl(&self) -> bool {
+    self.fix_openssl
+  }
+
+  fn ignore_tls_errors(&self) -> bool {
+    self.ignore_tls_errors
+  }
+}
+
 impl Cli {
   fn fix_openssl(&self) -> anyhow::Result<Option<NamedTempFile>> {
     if self.fix_openssl {
@@ -113,24 +129,7 @@ pub(crate) async fn run() {
   info!("gpclient started: {}", VERSION);
 
   if let Err(err) = cli.run().await {
-    eprintln!("\nError: {}", err);
+    handle_error(err, &cli);
-
-    let err = err.to_string();
-
-    if err.contains("unsafe legacy renegotiation") && !cli.fix_openssl {
-      eprintln!("\nRe-run it with the `--fix-openssl` option to work around this issue, e.g.:\n");
-      // Print the command
-      let args = std::env::args().collect::<Vec<_>>();
-      eprintln!("{} --fix-openssl {}\n", args[0], args[1..].join(" "));
-    }
-
-    if err.contains("certificate verify failed") && !cli.ignore_tls_errors {
-      eprintln!("\nRe-run it with the `--ignore-tls-errors` option to ignore the certificate error, e.g.:\n");
-      // Print the command
-      let args = std::env::args().collect::<Vec<_>>();
-      eprintln!("{} --ignore-tls-errors {}\n", args[0], args[1..].join(" "));
-    }
-
     std::process::exit(1);
   }
 }

apps/gpclient/src/connect.rs

@@ -93,12 +93,15 @@ pub(crate) struct ConnectArgs {
   #[arg(long, help = "Disable DTLS and ESP")]
   no_dtls: bool,
 
+  #[cfg(feature = "webview-auth")]
   #[arg(long, help = "The HiDPI mode, useful for high-resolution screens")]
   hidpi: bool,
 
+  #[cfg(feature = "webview-auth")]
   #[arg(long, help = "Do not reuse the remembered authentication cookie")]
   clean: bool,
 
+  #[cfg(feature = "webview-auth")]
   #[arg(long, help = "Use the default browser to authenticate")]
   default_browser: bool,
 
@@ -151,6 +154,7 @@ impl<'a> ConnectHandler<'a> {
   }
 
   pub(crate) async fn handle(&self) -> anyhow::Result<()> {
+    #[cfg(feature = "webview-auth")]
     if self.args.default_browser && self.args.browser.is_some() {
       bail!("Cannot use `--default-browser` and `--browser` options at the same time");
     }
@@ -343,28 +347,34 @@ impl<'a> ConnectHandler<'a> {
 
     match prelogin {
       Prelogin::Saml(prelogin) => {
-        let use_default_browser = prelogin.support_default_browser() && self.args.default_browser;
         let browser = if prelogin.support_default_browser() {
           self.args.browser.as_deref()
+        } else if !cfg!(feature = "webview-auth") {
+          bail!("The server does not support authentication via the default browser and the gpclient is not built with the `webview-auth` feature");
         } else {
           None
         };
 
-        let cred = SamlAuthLauncher::new(&self.args.server)
+        let os_version = self.args.os_version();
+        let auth_launcher = SamlAuthLauncher::new(&self.args.server)
           .gateway(is_gateway)
           .saml_request(prelogin.saml_request())
           .user_agent(&self.args.user_agent)
           .os(self.args.os.as_str())
-          .os_version(Some(&self.args.os_version()))
+          .os_version(Some(&os_version))
-          .hidpi(self.args.hidpi)
           .fix_openssl(self.shared_args.fix_openssl)
           .ignore_tls_errors(self.shared_args.ignore_tls_errors)
-          .clean(self.args.clean)
+          .browser(browser);
-          .default_browser(use_default_browser)
-          .browser(browser)
-          .launch()
-          .await?;
 
+        #[cfg(feature = "webview-auth")]
+        let use_default_browser = prelogin.support_default_browser() && self.args.default_browser;
+        #[cfg(feature = "webview-auth")]
+        let auth_launcher = auth_launcher
+          .hidpi(self.args.hidpi)
+          .clean(self.args.clean)
+          .default_browser(use_default_browser);
+
+        let cred = auth_launcher.launch().await?;
         Ok(cred)
       }
 

apps/gpclient/src/disconnect.rs

@@ -1,7 +1,7 @@
 use crate::GP_CLIENT_LOCK_FILE;
 use log::{info, warn};
 use std::fs;
-use sysinfo::{Pid, ProcessExt, Signal, System, SystemExt};
+use sysinfo::{Pid, Signal, System};
 
 pub(crate) struct DisconnectHandler;
 

apps/gpclient/src/launch_gui.rs

@@ -4,7 +4,8 @@ use clap::Args;
 use directories::ProjectDirs;
 use gpapi::{
   process::service_launcher::ServiceLauncher,
-  utils::{endpoint::http_endpoint, env_file, shutdown_signal},
+  utils::{endpoint::http_endpoint, env_utils, shutdown_signal},
+  GP_CALLBACK_PORT_FILENAME,
 };
 use log::info;
 use tokio::io::AsyncWriteExt;
@@ -62,7 +63,7 @@ impl<'a> LaunchGuiHandler<'a> {
     extra_envs.insert("GP_LOG_FILE".into(), log_file_path.clone());
 
     // Persist the environment variables to a file
-    let env_file = env_file::persist_env_vars(Some(extra_envs))?;
+    let env_file = env_utils::persist_env_vars(Some(extra_envs))?;
     let env_file = env_file.into_temp_path();
     let env_file_path = env_file.to_string_lossy().to_string();
 
@@ -80,42 +81,17 @@ impl<'a> LaunchGuiHandler<'a> {
 }
 
 async fn feed_auth_data(auth_data: &str) -> anyhow::Result<()> {
-  let (res_gui, res_cli) = tokio::join!(feed_auth_data_gui(auth_data), feed_auth_data_cli(auth_data));
+  if let Err(err) = feed_auth_data_cli(auth_data).await {
-  if let Err(err) = res_gui {
-    info!("Failed to feed auth data to the GUI: {}", err);
-  }
-
-  if let Err(err) = res_cli {
     info!("Failed to feed auth data to the CLI: {}", err);
   }
 
-  // Cleanup the temporary file
-  let html_file = temp_dir().join("gpauth.html");
-  if let Err(err) = std::fs::remove_file(&html_file) {
-    info!("Failed to remove {}: {}", html_file.display(), err);
-  }
-
-  Ok(())
-}
-
-async fn feed_auth_data_gui(auth_data: &str) -> anyhow::Result<()> {
-  info!("Feeding auth data to the GUI");
-  let service_endpoint = http_endpoint().await?;
-
-  reqwest::Client::default()
-    .post(format!("{}/auth-data", service_endpoint))
-    .body(auth_data.to_string())
-    .send()
-    .await?
-    .error_for_status()?;
-
   Ok(())
 }
 
 async fn feed_auth_data_cli(auth_data: &str) -> anyhow::Result<()> {
   info!("Feeding auth data to the CLI");
 
-  let port_file = temp_dir().join("gpcallback.port");
+  let port_file = temp_dir().join(GP_CALLBACK_PORT_FILENAME);
   let port = tokio::fs::read_to_string(port_file).await?;
   let mut stream = tokio::net::TcpStream::connect(format!("127.0.0.1:{}", port.trim())).await?;
 

apps/gpgui-helper/dist/index.html

@@ -5,8 +5,8 @@
     <link rel="icon" type="image/svg+xml" href="/vite.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>GlobalProtect</title>
-    <script type="module" crossorigin src="/assets/main-c159dd55.js"></script>
+    <script type="module" crossorigin src="/assets/main-CQPVXkdn.js"></script>
-    <link rel="stylesheet" href="/assets/index-11e7064a.css">
+    <link rel="stylesheet" crossorigin href="/assets/main-B3YRsHQ2.css">
   </head>
   <body>
     <script>
@@ -16,6 +16,5 @@
       document.documentElement.style.fontSize = 16 / ratio + "px";
     </script>
     <div id="root" data-tauri-drag-region></div>
-    
   </body>
 </html>

apps/gpgui-helper/package.json

@@ -9,29 +9,29 @@
     "tauri": "tauri"
   },
   "dependencies": {
-    "@emotion/react": "^11.13.0",
+    "@emotion/react": "^11.14.0",
-    "@emotion/styled": "^11.13.0",
+    "@emotion/styled": "^11.14.0",
-    "@mui/icons-material": "^5.16.7",
+    "@mui/icons-material": "^6.3.0",
-    "@mui/material": "^5.16.7",
+    "@mui/material": "^6.3.0",
-    "@tauri-apps/api": "^1.6.0",
+    "@tauri-apps/api": "^2.1.1",
-    "react": "^18.3.1",
+    "react": "^19.0.0",
-    "react-dom": "^18.3.1"
+    "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@tauri-apps/cli": "^1.6.0",
+    "@tauri-apps/cli": "^2.1.0",
-    "@types/node": "^20.14.15",
+    "@types/node": "^22.10.2",
-    "@types/react": "^18.3.3",
+    "@types/react": "^19.0.2",
-    "@types/react-dom": "^18.3.0",
+    "@types/react-dom": "^19.0.2",
-    "@typescript-eslint/eslint-plugin": "^6.21.0",
+    "@typescript-eslint/eslint-plugin": "^8.18.2",
-    "@typescript-eslint/parser": "^6.21.0",
+    "@typescript-eslint/parser": "^8.18.2",
-    "@vitejs/plugin-react": "^4.3.1",
+    "@vitejs/plugin-react": "^4.3.4",
-    "eslint": "^8.57.0",
+    "eslint": "^9.17.0",
     "eslint-config-prettier": "^9.1.0",
-    "eslint-plugin-react": "^7.35.0",
+    "eslint-plugin-react": "^7.37.3",
-    "eslint-plugin-react-hooks": "^4.6.2",
+    "eslint-plugin-react-hooks": "^5.1.0",
-    "prettier": "3.1.0",
+    "prettier": "3.4.2",
-    "typescript": "^5.5.4",
+    "typescript": "^5.7.2",
-    "vite": "^4.5.3"
+    "vite": "^6.0.5"
   },
-  "packageManager": "pnpm@8.15.7"
+  "packageManager": "pnpm@9.15.1"
 }

apps/gpgui-helper/src-tauri/Cargo.toml

@@ -1,16 +1,18 @@
 [package]
 name = "gpgui-helper"
+rust-version.workspace = true
 authors.workspace = true
 version.workspace = true
 edition.workspace = true
 license.workspace = true
 
 [build-dependencies]
-tauri-build = { version = "1.5", features = [] }
+tauri-build = { version = "2", features = [] }
 
 [dependencies]
 gpapi = { path = "../../../crates/gpapi", features = ["tauri"] }
-tauri = { workspace = true, features = ["window-start-dragging"] }
+tauri.workspace = true
+
 tokio.workspace = true
 anyhow.workspace = true
 log.workspace = true

apps/gpgui-helper/src-tauri/capabilities/default.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "../gen/schemas/desktop-schema.json",
+  "identifier": "default",
+  "description": "Capability for the main window",
+  "windows": ["main"],
+  "permissions": [
+    "core:window:allow-start-dragging",
+    "core:event:allow-listen",
+    "core:event:allow-emit",
+    "core:event:allow-unlisten"
+  ]
+}

apps/gpgui-helper/src-tauri/src/app.rs

@@ -1,8 +1,7 @@
 use std::sync::Arc;
 
-use gpapi::utils::window::WindowExt;
 use log::info;
-use tauri::Manager;
+use tauri::{Listener, Manager};
 
 use crate::updater::{GuiUpdater, Installer, ProgressNotifier};
 
@@ -25,15 +24,15 @@ impl App {
 
     tauri::Builder::default()
       .setup(move |app| {
-        let win = app.get_window("main").expect("no main window");
+        let win = app.get_webview_window("main").expect("no main window");
-        win.hide_menu();
+        let _ = win.hide_menu();
 
         let notifier = ProgressNotifier::new(win.clone());
         let installer = Installer::new(api_key);
         let updater = Arc::new(GuiUpdater::new(gui_version, notifier, installer));
 
         let win_clone = win.clone();
-        app.listen_global("app://update-done", move |_event| {
+        app.listen_any("app://update-done", move |_event| {
           info!("Update done");
           let _ = win_clone.close();
         });
@@ -41,12 +40,15 @@ impl App {
         // Listen for the update event
         win.listen("app://update", move |_event| {
           let updater = Arc::clone(&updater);
+          if updater.is_in_progress() {
+            info!("Update already in progress");
+            updater.notify_progress();
+            return;
+          }
+
           tokio::spawn(async move { updater.update().await });
         });
 
-        // Update the GUI on startup
-        win.trigger("app://update", None);
-
         Ok(())
       })
       .run(tauri::generate_context!())?;

apps/gpgui-helper/src-tauri/src/cli.rs

@@ -1,5 +1,5 @@
 use clap::Parser;
-use gpapi::utils::base64;
+use gpapi::utils::{base64, env_utils};
 use log::{info, LevelFilter};
 
 use crate::app::App;
@@ -22,6 +22,8 @@ impl Cli {
     let api_key = self.read_api_key()?;
     let app = App::new(api_key, &self.gui_version);
 
+    env_utils::patch_gui_runtime_env(false);
+
     app.run()
   }
 

apps/gpgui-helper/src-tauri/src/updater.rs

@@ -1,39 +1,39 @@
-use std::sync::Arc;
+use std::sync::{Arc, RwLock};
 
 use gpapi::{
   service::request::UpdateGuiRequest,
   utils::{checksum::verify_checksum, crypto::Crypto, endpoint::http_endpoint},
 };
 use log::{info, warn};
-use tauri::{Manager, Window};
+use tauri::{Emitter, WebviewWindow};
 
 use crate::downloader::{ChecksumFetcher, FileDownloader};
 
 #[cfg(not(debug_assertions))]
 const SNAPSHOT: &str = match option_env!("SNAPSHOT") {
   Some(val) => val,
-    None => "false"
+  None => "false",
 };
 
 pub struct ProgressNotifier {
-  win: Window,
+  win: WebviewWindow,
 }
 
 impl ProgressNotifier {
-  pub fn new(win: Window) -> Self {
+  pub fn new(win: WebviewWindow) -> Self {
     Self { win }
   }
 
   fn notify(&self, progress: Option<f64>) {
-    let _ = self.win.emit_all("app://update-progress", progress);
+    let _ = self.win.emit("app://update-progress", progress);
   }
 
   fn notify_error(&self) {
-    let _ = self.win.emit_all("app://update-error", ());
+    let _ = self.win.emit("app://update-error", ());
   }
 
   fn notify_done(&self) {
-    let _ = self.win.emit_and_trigger("app://update-done", ());
+    let _ = self.win.emit("app://update-done", ());
   }
 }
 
@@ -72,6 +72,8 @@ pub struct GuiUpdater {
   version: String,
   notifier: Arc<ProgressNotifier>,
   installer: Installer,
+  in_progress: RwLock<bool>,
+  progress: Arc<RwLock<Option<f64>>>,
 }
 
 impl GuiUpdater {
@@ -80,6 +82,8 @@ impl GuiUpdater {
       version,
       notifier: Arc::new(notifier),
       installer,
+      in_progress: Default::default(),
+      progress: Default::default(),
     }
   }
 
@@ -112,15 +116,23 @@ impl GuiUpdater {
     let cf = ChecksumFetcher::new(&checksum_url);
     let notifier = Arc::clone(&self.notifier);
 
-    dl.on_progress(move |progress| notifier.notify(progress));
+    let progress_ref = Arc::clone(&self.progress);
+    dl.on_progress(move |progress| {
+      // Save progress to shared state so that it can be notified to the UI when needed
+      if let Ok(mut guard) = progress_ref.try_write() {
+        *guard = progress;
+      }
+      notifier.notify(progress);
+    });
 
+    self.set_in_progress(true);
     let res = tokio::try_join!(dl.download(), cf.fetch());
 
     let (file, checksum) = match res {
       Ok((file, checksum)) => (file, checksum),
       Err(err) => {
         warn!("Download error: {}", err);
-        self.notifier.notify_error();
+        self.notify_error();
         return;
       }
     };
@@ -130,7 +142,7 @@ impl GuiUpdater {
 
     if let Err(err) = verify_checksum(&file_path, &checksum) {
       warn!("Checksum error: {}", err);
-      self.notifier.notify_error();
+      self.notify_error();
       return;
     }
 
@@ -138,10 +150,48 @@ impl GuiUpdater {
 
     if let Err(err) = self.installer.install(&file_path, &checksum).await {
       warn!("Install error: {}", err);
-      self.notifier.notify_error();
+      self.notify_error();
     } else {
       info!("Install success");
+      self.notify_done();
+    }
+  }
+
+  pub fn is_in_progress(&self) -> bool {
+    if let Ok(guard) = self.in_progress.try_read() {
+      *guard
+    } else {
+      info!("Failed to acquire in_progress lock");
+      false
+    }
+  }
+
+  fn set_in_progress(&self, in_progress: bool) {
+    if let Ok(mut guard) = self.in_progress.try_write() {
+      *guard = in_progress;
+    } else {
+      info!("Failed to acquire in_progress lock");
+    }
+  }
+
+  fn notify_error(&self) {
+    self.set_in_progress(false);
+    self.notifier.notify_error();
+  }
+
+  fn notify_done(&self) {
+    self.set_in_progress(false);
     self.notifier.notify_done();
   }
+
+  pub fn notify_progress(&self) {
+    let progress = if let Ok(guard) = self.progress.try_read() {
+      *guard
+    } else {
+      info!("Failed to acquire progress lock");
+      None
+    };
+
+    self.notifier.notify(progress);
   }
 }

apps/gpgui-helper/src-tauri/tauri.conf.json

@@ -1,35 +1,15 @@
 {
-  "$schema": "../node_modules/@tauri-apps/cli/schema.json",
+  "$schema": "../node_modules/@tauri-apps/cli/config.schema.json",
   "build": {
     "beforeDevCommand": "pnpm dev",
     "beforeBuildCommand": "pnpm build",
-    "devPath": "http://localhost:1421",
+    "devUrl": "http://localhost:1421",
-    "distDir": "../dist",
+    "frontendDist": "../dist"
-    "withGlobalTauri": false
   },
-  "package": {
-    "productName": "gpgui-helper"
-  },
-  "tauri": {
-    "allowlist": {
-      "all": false,
-      "window": {
-        "all": false,
-        "startDragging": true
-      }
-    },
-    "bundle": {
-      "active": false,
-      "targets": "deb",
   "identifier": "com.yuezk.gpgui-helper",
-      "icon": [
+  "productName": "gpgui-helper",
-        "icons/32x32.png",
+  "app": {
-        "icons/128x128.png",
+    "withGlobalTauri": false,
-        "icons/128x128@2x.png",
-        "icons/icon.icns",
-        "icons/icon.ico"
-      ]
-    },
     "security": {
       "csp": null
     },
@@ -48,5 +28,16 @@
         "decorations": false
       }
     ]
+  },
+  "bundle": {
+    "active": false,
+    "targets": "deb",
+    "icon": [
+      "icons/32x32.png",
+      "icons/128x128.png",
+      "icons/128x128@2x.png",
+      "icons/icon.icns",
+      "icons/icon.ico"
+    ]
   }
 }

apps/gpgui-helper/src/components/App/App.tsx

@@ -1,10 +1,12 @@
 import { Box, Button, CssBaseline, LinearProgress, Typography } from "@mui/material";
-import { appWindow } from "@tauri-apps/api/window";
+import { getCurrentWindow } from "@tauri-apps/api/window";
 import logo from "../../assets/icon.svg";
 import { useEffect, useState } from "react";
 
 import "./styles.css";
 
+const appWindow = getCurrentWindow();
+
 function useUpdateProgress() {
   const [progress, setProgress] = useState<number | null>(null);
 
@@ -25,6 +27,8 @@ export default function App() {
   const [error, setError] = useState(false);
 
   useEffect(() => {
+    appWindow.emit("app://update");
+
     const unlisten = appWindow.listen("app://update-error", () => {
       setError(true);
     });

apps/gpservice/src/cli.rs

@@ -6,7 +6,7 @@ use clap::Parser;
 use gpapi::{
   process::gui_launcher::GuiLauncher,
   service::{request::WsRequest, vpn_state::VpnState},
-  utils::{crypto::generate_key, env_file, lock_file::LockFile, redact::Redaction, shutdown_signal},
+  utils::{crypto::generate_key, env_utils, lock_file::LockFile, redact::Redaction, shutdown_signal},
   GP_SERVICE_LOCK_FILE,
 };
 use log::{info, warn, LevelFilter};
@@ -63,7 +63,7 @@ impl Cli {
     if no_gui {
       info!("GUI is disabled");
     } else {
-      let envs = self.env_file.as_ref().map(env_file::load_env_vars).transpose()?;
+      let envs = self.env_file.as_ref().map(env_utils::load_env_vars).transpose()?;
 
       let minimized = self.minimized;
 

apps/gpservice/src/handlers.rs

@@ -39,10 +39,6 @@ pub(crate) async fn active_gui(State(ctx): State<Arc<WsServerContext>>) -> impl
   ctx.send_event(WsEvent::ActiveGui).await;
 }
 
-pub(crate) async fn auth_data(State(ctx): State<Arc<WsServerContext>>, body: String) -> impl IntoResponse {
-  ctx.send_event(WsEvent::AuthData(body)).await;
-}
-
 pub async fn update_gui(State(ctx): State<Arc<WsServerContext>>, body: Bytes) -> Result<(), StatusCode> {
   let payload = match ctx.decrypt::<UpdateGuiRequest>(body.to_vec()) {
     Ok(payload) => payload,

apps/gpservice/src/routes.rs

@@ -11,7 +11,6 @@ pub(crate) fn routes(ctx: Arc<WsServerContext>) -> Router {
   Router::new()
     .route("/health", get(handlers::health))
     .route("/active-gui", post(handlers::active_gui))
-    .route("/auth-data", post(handlers::auth_data))
     .route("/update-gui", post(handlers::update_gui))
     .route("/ws", get(handlers::ws_handler))
     .with_state(ctx)

changelog.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 2.4.0 - 2024-12-26
+
+- Upgrade to Tauri 2.0
+- Support Ubuntu 22.04 and later
+
 ## 2.3.9 - 2024-11-02
 
 - Enhance the OpenSSL compatibility mode (fix [#437](https://github.com/yuezk/GlobalProtect-openconnect/issues/437))

crates/auth/Cargo.toml

@@ -0,0 +1,49 @@
+[package]
+name = "auth"
+rust-version.workspace = true
+version.workspace = true
+authors.workspace = true
+homepage.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+gpapi = { path = "../gpapi" }
+
+# Shared dependencies
+anyhow.workspace = true
+log.workspace = true
+tokio.workspace = true
+
+# Browser auth dependencies
+webbrowser = { version = "1", optional = true }
+open = { version = "5", optional = true }
+which = { workspace = true, optional = true }
+tiny_http = { version = "0.12", optional = true }
+uuid = { version = "1", optional = true, features = ["v4"] }
+
+# Webview auth dependencies
+tauri = { workspace = true, optional = true }
+regex = { workspace = true, optional = true }
+tokio-util = { workspace = true, optional = true }
+html-escape = { version = "0.2.13", optional = true }
+
+[target.'cfg(not(target_os = "macos"))'.dependencies]
+webkit2gtk = { version = "2", optional = true }
+
+[features]
+browser-auth = [
+  "dep:webbrowser",
+  "dep:open",
+  "dep:which",
+  "dep:tiny_http",
+  "dep:uuid",
+]
+webview-auth = [
+  "dep:tauri",
+  "dep:regex",
+  "dep:tokio-util",
+  "dep:html-escape",
+  "dep:webkit2gtk",
+  "gpapi/tauri",
+]

crates/auth/LICENSE

@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.

crates/auth/src/authenticator.rs

@@ -0,0 +1,60 @@
+use std::borrow::Cow;
+
+use anyhow::bail;
+use gpapi::{
+  gp_params::GpParams,
+  portal::{prelogin, Prelogin},
+};
+
+pub struct Authenticator<'a> {
+  server: &'a str,
+  auth_request: Option<&'a str>,
+  pub(crate) gp_params: &'a GpParams,
+
+  #[cfg(feature = "webview-auth")]
+  pub(crate) clean: bool,
+  #[cfg(feature = "webview-auth")]
+  pub(crate) is_retrying: tokio::sync::RwLock<bool>,
+}
+
+impl<'a> Authenticator<'a> {
+  pub fn new(server: &'a str, gp_params: &'a GpParams) -> Self {
+    Self {
+      server,
+      gp_params,
+      auth_request: None,
+
+      #[cfg(feature = "webview-auth")]
+      clean: false,
+      #[cfg(feature = "webview-auth")]
+      is_retrying: Default::default(),
+    }
+  }
+
+  pub fn with_auth_request(mut self, auth_request: &'a str) -> Self {
+    if !auth_request.is_empty() {
+      self.auth_request = Some(auth_request);
+    }
+    self
+  }
+
+  pub(crate) async fn initial_auth_request(&self) -> anyhow::Result<Cow<'a, str>> {
+    if let Some(auth_request) = self.auth_request {
+      return Ok(Cow::Borrowed(auth_request));
+    }
+
+    let auth_request = self.portal_prelogin().await?;
+    Ok(Cow::Owned(auth_request))
+  }
+
+  pub(crate) async fn portal_prelogin(&self) -> anyhow::Result<String> {
+    auth_prelogin(self.server, self.gp_params).await
+  }
+}
+
+pub async fn auth_prelogin(server: &str, gp_params: &GpParams) -> anyhow::Result<String> {
+  match prelogin(server, gp_params).await? {
+    Prelogin::Saml(prelogin) => Ok(prelogin.saml_request().to_string()),
+    Prelogin::Standard(_) => bail!("Received non-SAML prelogin response"),
+  }
+}

crates/auth/src/browser_auth.rs

@@ -0,0 +1,5 @@
+mod auth_server;
+mod browser_auth_ext;
+mod browser_auth_impl;
+
+pub use browser_auth_ext::BrowserAuthenticator;

crates/auth/src/browser_auth/auth_server.rs

@@ -0,0 +1,57 @@
+use std::io::Cursor;
+
+use log::info;
+use tiny_http::{Header, Response, Server};
+use uuid::Uuid;
+
+pub(super) struct AuthServer {
+  server: Server,
+  auth_id: String,
+}
+
+impl AuthServer {
+  pub fn new() -> anyhow::Result<Self> {
+    let server = Server::http("127.0.0.1:0").map_err(|err| anyhow::anyhow!(err))?;
+    let auth_id = Uuid::new_v4().to_string();
+
+    Ok(Self { server, auth_id })
+  }
+
+  pub fn auth_url(&self) -> String {
+    format!("http://{}/{}", self.server.server_addr(), self.auth_id)
+  }
+
+  pub fn serve_request(&self, auth_request: &str) {
+    info!("auth server started at: {}", self.auth_url());
+
+    for req in self.server.incoming_requests() {
+      info!("received request, method: {}, url: {}", req.method(), req.url());
+
+      if req.url() != format!("/{}", self.auth_id) {
+        let forbidden = Response::from_string("forbidden").with_status_code(403);
+        let _ = req.respond(forbidden);
+      } else {
+        let auth_response = build_auth_response(auth_request);
+        if let Err(err) = req.respond(auth_response) {
+          info!("failed to respond to request: {}", err);
+        } else {
+          info!("stop the auth server");
+          break;
+        }
+      }
+    }
+  }
+}
+
+fn build_auth_response(auth_request: &str) -> Response<Cursor<Vec<u8>>> {
+  if auth_request.starts_with("http") {
+    let header = format!("location: {}", auth_request);
+    let header: Header = header.parse().unwrap();
+    Response::from_string("redirect")
+      .with_status_code(302)
+      .with_header(header)
+  } else {
+    let content_type: Header = "content-type: text/html".parse().unwrap();
+    Response::from_string(auth_request).with_header(content_type)
+  }
+}

crates/auth/src/browser_auth/browser_auth_ext.rs

@@ -0,0 +1,22 @@
+use std::future::Future;
+
+use gpapi::auth::SamlAuthData;
+
+use crate::{browser_auth::browser_auth_impl::BrowserAuthenticatorImpl, Authenticator};
+
+pub trait BrowserAuthenticator {
+  fn browser_authenticate(&self, browser: Option<&str>) -> impl Future<Output = anyhow::Result<SamlAuthData>> + Send;
+}
+
+impl BrowserAuthenticator for Authenticator<'_> {
+  async fn browser_authenticate(&self, browser: Option<&str>) -> anyhow::Result<SamlAuthData> {
+    let auth_request = self.initial_auth_request().await?;
+    let browser_auth = if let Some(browser) = browser {
+      BrowserAuthenticatorImpl::new_with_browser(&auth_request, browser)
+    } else {
+      BrowserAuthenticatorImpl::new(&auth_request)
+    };
+
+    browser_auth.authenticate().await
+  }
+}

crates/auth/src/browser_auth/browser_auth_impl.rs

@@ -0,0 +1,100 @@
+use std::{env::temp_dir, fs, os::unix::fs::PermissionsExt};
+
+use gpapi::{auth::SamlAuthData, GP_CALLBACK_PORT_FILENAME};
+use log::info;
+use tokio::{io::AsyncReadExt, net::TcpListener};
+
+use super::auth_server::AuthServer;
+
+pub(super) struct BrowserAuthenticatorImpl<'a> {
+  auth_request: &'a str,
+  browser: Option<&'a str>,
+}
+
+impl BrowserAuthenticatorImpl<'_> {
+  pub fn new(auth_request: &str) -> BrowserAuthenticatorImpl {
+    BrowserAuthenticatorImpl {
+      auth_request,
+      browser: None,
+    }
+  }
+
+  pub fn new_with_browser<'a>(auth_request: &'a str, browser: &'a str) -> BrowserAuthenticatorImpl<'a> {
+    let browser = browser.trim();
+    BrowserAuthenticatorImpl {
+      auth_request,
+      browser: if browser.is_empty() || browser == "default" {
+        None
+      } else {
+        Some(browser)
+      },
+    }
+  }
+
+  pub async fn authenticate(&self) -> anyhow::Result<SamlAuthData> {
+    let auth_server = AuthServer::new()?;
+    let auth_url = auth_server.auth_url();
+
+    let auth_request = self.auth_request.to_string();
+    tokio::spawn(async move {
+      auth_server.serve_request(&auth_request);
+    });
+
+    if let Some(browser) = self.browser {
+      let app = find_browser_path(browser);
+
+      info!("Launching browser: {}", app);
+      open::with_detached(auth_url, app)?;
+    } else {
+      info!("Launching the default browser...");
+      webbrowser::open(&auth_url)?;
+    }
+
+    info!("Please continue the authentication process in the default browser");
+    wait_auth_data().await
+  }
+}
+
+fn find_browser_path(browser: &str) -> String {
+  if browser == "chrome" {
+    which::which("google-chrome-stable")
+      .or_else(|_| which::which("google-chrome"))
+      .or_else(|_| which::which("chromium"))
+      .map(|path| path.to_string_lossy().to_string())
+      .unwrap_or_else(|_| browser.to_string())
+  } else {
+    browser.into()
+  }
+}
+
+async fn wait_auth_data() -> anyhow::Result<SamlAuthData> {
+  // Start a local server to receive the browser authentication data
+  let listener = TcpListener::bind("127.0.0.1:0").await?;
+  let port = listener.local_addr()?.port();
+  let port_file = temp_dir().join(GP_CALLBACK_PORT_FILENAME);
+
+  // Write the port to a file
+  fs::write(&port_file, port.to_string())?;
+  fs::set_permissions(&port_file, fs::Permissions::from_mode(0o600))?;
+
+  // Remove the previous log file
+  let callback_log = temp_dir().join("gpcallback.log");
+  let _ = fs::remove_file(&callback_log);
+
+  info!("Listening authentication data on port {}", port);
+  info!(
+    "If it hangs, please check the logs at `{}` for more information",
+    callback_log.display()
+  );
+  let (mut socket, _) = listener.accept().await?;
+
+  info!("Received the browser authentication data from the socket");
+  let mut data = String::new();
+  socket.read_to_string(&mut data).await?;
+
+  // Remove the port file
+  fs::remove_file(&port_file)?;
+
+  let auth_data = SamlAuthData::from_gpcallback(&data)?;
+  Ok(auth_data)
+}

crates/auth/src/lib.rs

@@ -0,0 +1,13 @@
+mod authenticator;
+pub use authenticator::auth_prelogin;
+pub use authenticator::Authenticator;
+
+#[cfg(feature = "browser-auth")]
+mod browser_auth;
+#[cfg(feature = "browser-auth")]
+pub use browser_auth::BrowserAuthenticator;
+
+#[cfg(feature = "webview-auth")]
+mod webview_auth;
+#[cfg(feature = "webview-auth")]
+pub use webview_auth::WebviewAuthenticator;

crates/auth/src/webview_auth.rs

@@ -0,0 +1,9 @@
+mod auth_messenger;
+mod auth_response;
+mod auth_settings;
+mod webview_auth_ext;
+
+#[cfg_attr(not(target_os = "macos"), path = "webview_auth/unix.rs")]
+mod platform_impl;
+
+pub use webview_auth_ext::WebviewAuthenticator;

crates/auth/src/webview_auth/auth_messenger.rs

@@ -0,0 +1,108 @@
+use anyhow::bail;
+use gpapi::auth::SamlAuthData;
+use log::{error, info};
+use tokio::sync::{mpsc, RwLock};
+use tokio_util::sync::CancellationToken;
+
+pub enum AuthError {
+  /// Failed to load page due to TLS error
+  TlsError,
+  /// 1. Found auth data in headers/body but it's invalid
+  /// 2. Loaded an empty page, failed to load page. etc.
+  Invalid,
+  /// No auth data found in headers/body
+  NotFound,
+}
+
+pub type AuthResult = anyhow::Result<SamlAuthData, AuthError>;
+
+pub enum AuthEvent {
+  Data(SamlAuthData),
+  Error(AuthError),
+  RaiseWindow,
+  Close,
+}
+
+pub struct AuthMessenger {
+  tx: mpsc::UnboundedSender<AuthEvent>,
+  rx: RwLock<mpsc::UnboundedReceiver<AuthEvent>>,
+  raise_window_cancel_token: RwLock<Option<CancellationToken>>,
+}
+
+impl AuthMessenger {
+  pub fn new() -> Self {
+    let (tx, rx) = mpsc::unbounded_channel();
+
+    Self {
+      tx,
+      rx: RwLock::new(rx),
+      raise_window_cancel_token: Default::default(),
+    }
+  }
+
+  pub async fn subscribe(&self) -> anyhow::Result<AuthEvent> {
+    let mut rx = self.rx.write().await;
+    if let Some(event) = rx.recv().await {
+      return Ok(event);
+    }
+    bail!("Failed to receive auth event");
+  }
+
+  pub fn send_auth_event(&self, event: AuthEvent) {
+    if let Err(event) = self.tx.send(event) {
+      error!("Failed to send auth event: {}", event);
+    }
+  }
+
+  pub fn send_auth_result(&self, result: AuthResult) {
+    match result {
+      Ok(data) => self.send_auth_data(data),
+      Err(err) => self.send_auth_error(err),
+    }
+  }
+
+  pub fn send_auth_error(&self, err: AuthError) {
+    self.send_auth_event(AuthEvent::Error(err));
+  }
+
+  pub fn send_auth_data(&self, data: SamlAuthData) {
+    self.send_auth_event(AuthEvent::Data(data));
+  }
+
+  pub fn schedule_raise_window(&self, delay: u64) {
+    let cancel_token = CancellationToken::new();
+    let cancel_token_clone = cancel_token.clone();
+
+    if let Ok(mut guard) = self.raise_window_cancel_token.try_write() {
+      // Cancel the previous raise window task if it exists
+      if let Some(token) = guard.take() {
+        token.cancel();
+      }
+      *guard = Some(cancel_token_clone);
+    }
+
+    let tx = self.tx.clone();
+    tokio::spawn(async move {
+      info!("Displaying the window in {} second(s)...", delay);
+
+      tokio::select! {
+        _ = tokio::time::sleep(tokio::time::Duration::from_secs(delay)) => {
+          if let Err(err) = tx.send(AuthEvent::RaiseWindow) {
+            error!("Failed to send raise window event: {}", err);
+          }
+        }
+        _ = cancel_token.cancelled() => {
+          info!("Cancelled raise window task");
+        }
+      }
+    });
+  }
+
+  pub fn cancel_raise_window(&self) {
+    if let Ok(mut cancel_token) = self.raise_window_cancel_token.try_write() {
+      if let Some(token) = cancel_token.take() {
+        token.cancel();
+      }
+    }
+  }
+}

crates/auth/src/webview_auth/auth_response.rs

@@ -0,0 +1,152 @@
+use std::sync::Arc;
+
+use gpapi::{
+  auth::{AuthDataParseResult, SamlAuthData},
+  error::AuthDataParseError,
+};
+use log::{info, warn};
+use regex::Regex;
+
+use crate::webview_auth::auth_messenger::{AuthError, AuthMessenger};
+
+/// Trait for handling authentication response
+pub trait AuthResponse {
+  fn get_header(&self, key: &str) -> Option<String>;
+  fn get_body<F>(&self, cb: F)
+  where
+    F: FnOnce(anyhow::Result<Vec<u8>>) + 'static;
+
+  fn url(&self) -> Option<String>;
+
+  fn is_acs_endpoint(&self) -> bool {
+    self.url().map_or(false, |url| url.ends_with("/SAML20/SP/ACS"))
+  }
+}
+
+pub fn read_auth_data(auth_response: &impl AuthResponse, auth_messenger: &Arc<AuthMessenger>) {
+  let auth_messenger = Arc::clone(auth_messenger);
+
+  match read_from_headers(auth_response) {
+    Ok(auth_data) => {
+      info!("Found auth data in headers");
+      auth_messenger.send_auth_data(auth_data);
+    }
+    Err(header_err) => {
+      info!("Failed to read auth data from headers: {}", header_err);
+
+      let is_acs_endpoint = auth_response.is_acs_endpoint();
+      read_from_body(auth_response, move |auth_result| {
+        // If the endpoint is `/SAML20/SP/ACS` and no auth data found in body, it should be considered as invalid
+        let auth_result = auth_result.map_err(move |e| {
+          info!("Failed to read auth data from body: {}", e);
+          if is_acs_endpoint || e.is_invalid() || header_err.is_invalid() {
+            AuthError::Invalid
+          } else {
+            AuthError::NotFound
+          }
+        });
+
+        auth_messenger.send_auth_result(auth_result);
+      });
+    }
+  }
+}
+
+fn read_from_headers(auth_response: &impl AuthResponse) -> AuthDataParseResult {
+  let Some(status) = auth_response.get_header("saml-auth-status") else {
+    info!("No SAML auth status found in headers");
+    return Err(AuthDataParseError::NotFound);
+  };
+
+  if status != "1" {
+    info!("Found invalid auth status: {}", status);
+    return Err(AuthDataParseError::Invalid);
+  }
+
+  let username = auth_response.get_header("saml-username");
+  let prelogin_cookie = auth_response.get_header("prelogin-cookie");
+  let portal_userauthcookie = auth_response.get_header("portal-userauthcookie");
+
+  SamlAuthData::new(username, prelogin_cookie, portal_userauthcookie).map_err(|e| {
+    warn!("Found invalid auth data: {}", e);
+    AuthDataParseError::Invalid
+  })
+}
+
+fn read_from_body<F>(auth_response: &impl AuthResponse, cb: F)
+where
+  F: FnOnce(AuthDataParseResult) + 'static,
+{
+  auth_response.get_body(|body| match body {
+    Ok(body) => {
+      let html = String::from_utf8_lossy(&body);
+      cb(read_from_html(&html))
+    }
+    Err(err) => {
+      info!("Failed to read body: {}", err);
+      cb(Err(AuthDataParseError::Invalid))
+    }
+  });
+}
+
+fn read_from_html(html: &str) -> AuthDataParseResult {
+  if html.contains("Temporarily Unavailable") {
+    info!("Found 'Temporarily Unavailable' in HTML, auth failed");
+    return Err(AuthDataParseError::Invalid);
+  }
+
+  SamlAuthData::from_html(html).or_else(|err| {
+    if let Some(gpcallback) = extract_gpcallback(html) {
+      info!("Found gpcallback from html...");
+      SamlAuthData::from_gpcallback(&gpcallback)
+    } else {
+      Err(err)
+    }
+  })
+}
+
+fn extract_gpcallback(html: &str) -> Option<String> {
+  let re = Regex::new(r#"globalprotectcallback:[^"]+"#).unwrap();
+  re.captures(html)
+    .and_then(|captures| captures.get(0))
+    .map(|m| html_escape::decode_html_entities(m.as_str()).to_string())
+}
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+
+  #[test]
+  fn extract_gpcallback_some() {
+    let html = r#"
+      <meta http-equiv="refresh" content="0; URL=globalprotectcallback:PGh0bWw+PCEtLSA8c">
+      <meta http-equiv="refresh" content="0; URL=globalprotectcallback:PGh0bWw+PCEtLSA8c">
+    "#;
+
+    assert_eq!(
+      extract_gpcallback(html).as_deref(),
+      Some("globalprotectcallback:PGh0bWw+PCEtLSA8c")
+    );
+  }
+
+  #[test]
+  fn extract_gpcallback_cas() {
+    let html = r#"
+      <meta http-equiv="refresh" content="0; URL=globalprotectcallback:cas-as=1&amp;un=xyz@email.com&amp;token=very_long_string">
+    "#;
+
+    assert_eq!(
+      extract_gpcallback(html).as_deref(),
+      Some("globalprotectcallback:cas-as=1&un=xyz@email.com&token=very_long_string")
+    );
+  }
+
+  #[test]
+  fn extract_gpcallback_none() {
+    let html = r#"
+      <meta http-equiv="refresh" content="0; URL=PGh0bWw+PCEtLSA8c">
+    "#;
+
+    assert_eq!(extract_gpcallback(html), None);
+  }
+}

crates/auth/src/webview_auth/auth_settings.rs

@@ -0,0 +1,25 @@
+use std::sync::Arc;
+
+use super::auth_messenger::AuthMessenger;
+
+pub struct AuthRequest<'a>(&'a str);
+
+impl<'a> AuthRequest<'a> {
+  pub fn new(auth_request: &'a str) -> Self {
+    Self(auth_request)
+  }
+
+  pub fn is_url(&self) -> bool {
+    self.0.starts_with("http")
+  }
+
+  pub fn as_str(&self) -> &str {
+    self.0
+  }
+}
+
+pub struct AuthSettings<'a> {
+  pub auth_request: AuthRequest<'a>,
+  pub auth_messenger: Arc<AuthMessenger>,
+  pub ignore_tls_errors: bool,
+}

crates/auth/src/webview_auth/unix.rs

@@ -0,0 +1,136 @@
+use std::sync::Arc;
+
+use anyhow::bail;
+use gpapi::utils::redact::redact_uri;
+use log::{info, warn};
+use webkit2gtk::{
+  gio::Cancellable,
+  glib::{GString, TimeSpan},
+  LoadEvent, TLSErrorsPolicy, URIResponseExt, WebResource, WebResourceExt, WebView, WebViewExt, WebsiteDataManagerExt,
+  WebsiteDataManagerExtManual, WebsiteDataTypes,
+};
+
+use crate::webview_auth::{
+  auth_messenger::AuthError,
+  auth_response::read_auth_data,
+  auth_settings::{AuthRequest, AuthSettings},
+};
+
+use super::auth_response::AuthResponse;
+
+impl AuthResponse for WebResource {
+  fn get_header(&self, key: &str) -> Option<String> {
+    self
+      .response()
+      .and_then(|response| response.http_headers())
+      .and_then(|headers| headers.one(key))
+      .map(GString::into)
+  }
+
+  fn get_body<F>(&self, cb: F)
+  where
+    F: FnOnce(anyhow::Result<Vec<u8>>) + 'static,
+  {
+    let cancellable = Cancellable::NONE;
+    self.data(cancellable, |data| cb(data.map_err(|e| anyhow::anyhow!(e))));
+  }
+
+  fn url(&self) -> Option<String> {
+    self.uri().map(GString::into)
+  }
+}
+
+pub fn clear_data<F>(wv: &WebView, cb: F)
+where
+  F: FnOnce(anyhow::Result<()>) + Send + 'static,
+{
+  let Some(data_manager) = wv.website_data_manager() else {
+    cb(Err(anyhow::anyhow!("Failed to get website data manager")));
+    return;
+  };
+
+  data_manager.clear(
+    WebsiteDataTypes::COOKIES,
+    TimeSpan(0),
+    Cancellable::NONE,
+    move |result| {
+      cb(result.map_err(|e| anyhow::anyhow!(e)));
+    },
+  );
+}
+
+pub fn setup_webview(wv: &WebView, auth_settings: AuthSettings) -> anyhow::Result<()> {
+  let AuthSettings {
+    auth_request,
+    auth_messenger,
+    ignore_tls_errors,
+  } = auth_settings;
+  let auth_messenger_clone = Arc::clone(&auth_messenger);
+
+  let Some(data_manager) = wv.website_data_manager() else {
+    bail!("Failed to get website data manager");
+  };
+
+  if ignore_tls_errors {
+    data_manager.set_tls_errors_policy(TLSErrorsPolicy::Ignore);
+  }
+
+  wv.connect_load_changed(move |wv, event| {
+    if event == LoadEvent::Started {
+      auth_messenger_clone.cancel_raise_window();
+      return;
+    }
+
+    if event != LoadEvent::Finished {
+      return;
+    }
+
+    let Some(main_resource) = wv.main_resource() else {
+      return;
+    };
+
+    let uri = main_resource.uri().unwrap_or("".into());
+    if uri.is_empty() {
+      warn!("Loaded an empty URI");
+      auth_messenger_clone.send_auth_error(AuthError::Invalid);
+      return;
+    }
+
+    read_auth_data(&main_resource, &auth_messenger_clone);
+  });
+
+  wv.connect_load_failed_with_tls_errors(move |_wv, uri, cert, err| {
+    let redacted_uri = redact_uri(uri);
+    warn!(
+      "Failed to load uri: {} with error: {}, cert: {}",
+      redacted_uri, err, cert
+    );
+
+    auth_messenger.send_auth_error(AuthError::TlsError);
+    true
+  });
+
+  wv.connect_load_failed(move |_wv, _event, uri, err| {
+    let redacted_uri = redact_uri(uri);
+    if !uri.starts_with("globalprotectcallback:") {
+      warn!("Failed to load uri: {} with error: {}", redacted_uri, err);
+    }
+    // NOTE: Don't send error here, since load_changed event will be triggered after this
+    // true to stop other handlers from being invoked for the event. false to propagate the event further.
+    true
+  });
+
+  load_auth_request(wv, &auth_request);
+
+  Ok(())
+}
+
+pub fn load_auth_request(wv: &WebView, auth_request: &AuthRequest) {
+  if auth_request.is_url() {
+    info!("Loading auth request as URI...");
+    wv.load_uri(auth_request.as_str());
+  } else {
+    info!("Loading auth request as HTML...");
+    wv.load_html(auth_request.as_str(), None);
+  }
+}

crates/auth/src/webview_auth/webview_auth_ext.rs

@@ -0,0 +1,194 @@
+use std::{
+  future::Future,
+  sync::Arc,
+  time::{Duration, Instant},
+};
+
+use anyhow::bail;
+use gpapi::{auth::SamlAuthData, error::PortalError, utils::window::WindowExt};
+use log::{info, warn};
+use tauri::{AppHandle, WebviewUrl, WebviewWindow, WindowEvent};
+use tokio::{sync::oneshot, time};
+
+use crate::{
+  webview_auth::{
+    auth_messenger::{AuthError, AuthEvent, AuthMessenger},
+    auth_settings::{AuthRequest, AuthSettings},
+    platform_impl,
+  },
+  Authenticator,
+};
+
+pub trait WebviewAuthenticator {
+  fn with_clean(self, clean: bool) -> Self;
+  fn webview_authenticate(&self, app_handle: &AppHandle) -> impl Future<Output = anyhow::Result<SamlAuthData>> + Send;
+}
+
+impl WebviewAuthenticator for Authenticator<'_> {
+  fn with_clean(mut self, clean: bool) -> Self {
+    self.clean = clean;
+    self
+  }
+
+  async fn webview_authenticate(&self, app_handle: &AppHandle) -> anyhow::Result<SamlAuthData> {
+    let auth_window = WebviewWindow::builder(app_handle, "auth_window", WebviewUrl::default())
+      .title("GlobalProtect Login")
+      .focused(true)
+      .visible(false)
+      .center()
+      .build()?;
+
+    self.auth_loop(&auth_window).await
+  }
+}
+
+impl Authenticator<'_> {
+  async fn auth_loop(&self, auth_window: &WebviewWindow) -> anyhow::Result<SamlAuthData> {
+    if self.clean {
+      self.clear_webview_data(&auth_window).await?;
+    }
+
+    let auth_messenger = self.setup_auth_window(&auth_window).await?;
+
+    loop {
+      match auth_messenger.subscribe().await? {
+        AuthEvent::Close => bail!("Authentication cancelled"),
+        AuthEvent::RaiseWindow => self.raise_window(auth_window),
+        AuthEvent::Error(AuthError::TlsError) => bail!(PortalError::TlsError),
+        AuthEvent::Error(AuthError::NotFound) => self.handle_not_found(auth_window, &auth_messenger),
+        AuthEvent::Error(AuthError::Invalid) => self.retry_auth(auth_window).await,
+        AuthEvent::Data(auth_data) => {
+          auth_window.close()?;
+          return Ok(auth_data);
+        }
+      }
+    }
+  }
+
+  async fn clear_webview_data(&self, auth_window: &WebviewWindow) -> anyhow::Result<()> {
+    info!("Clearing webview data...");
+
+    let (tx, rx) = oneshot::channel::<anyhow::Result<()>>();
+    let now = Instant::now();
+    auth_window.with_webview(|webview| {
+      platform_impl::clear_data(&webview.inner(), |result| {
+        if let Err(result) = tx.send(result) {
+          warn!("Failed to send clear data result: {:?}", result);
+        }
+      })
+    })?;
+
+    rx.await??;
+    info!("Webview data cleared in {:?}", now.elapsed());
+
+    Ok(())
+  }
+
+  async fn setup_auth_window(&self, auth_window: &WebviewWindow) -> anyhow::Result<Arc<AuthMessenger>> {
+    info!("Setting up auth window...");
+
+    let auth_messenger = Arc::new(AuthMessenger::new());
+    let auth_request = self.initial_auth_request().await?.into_owned();
+    let ignore_tls_errors = self.gp_params.ignore_tls_errors();
+
+    // Handle window close event
+    let auth_messenger_clone = Arc::clone(&auth_messenger);
+    auth_window.on_window_event(move |event| {
+      if let WindowEvent::CloseRequested { .. } = event {
+        auth_messenger_clone.send_auth_event(AuthEvent::Close);
+      }
+    });
+
+    // Show the window after 10 seconds, so that the user can see the window if the auth process is stuck
+    let auth_messenger_clone = Arc::clone(&auth_messenger);
+    tokio::spawn(async move {
+      time::sleep(Duration::from_secs(10)).await;
+      auth_messenger_clone.send_auth_event(AuthEvent::RaiseWindow);
+    });
+
+    // setup webview
+    let auth_messenger_clone = Arc::clone(&auth_messenger);
+    let (tx, rx) = oneshot::channel::<anyhow::Result<()>>();
+
+    auth_window.with_webview(move |webview| {
+      let auth_settings = AuthSettings {
+        auth_request: AuthRequest::new(&auth_request),
+        auth_messenger: auth_messenger_clone,
+        ignore_tls_errors,
+      };
+
+      let result = platform_impl::setup_webview(&webview.inner(), auth_settings);
+      if let Err(result) = tx.send(result) {
+        warn!("Failed to send setup auth window result: {:?}", result);
+      }
+    })?;
+
+    rx.await??;
+    info!("Auth window setup completed");
+
+    Ok(auth_messenger)
+  }
+
+  fn handle_not_found(&self, auth_window: &WebviewWindow, auth_messenger: &Arc<AuthMessenger>) {
+    info!("No auth data found, it may not be the /SAML20/SP/ACS endpoint");
+
+    let visible = auth_window.is_visible().unwrap_or(false);
+    if visible {
+      return;
+    }
+
+    auth_messenger.schedule_raise_window(1);
+  }
+
+  async fn retry_auth(&self, auth_window: &WebviewWindow) {
+    let mut is_retrying = self.is_retrying.write().await;
+    if *is_retrying {
+      info!("Already retrying authentication, skipping...");
+      return;
+    }
+
+    *is_retrying = true;
+    drop(is_retrying);
+
+    if let Err(err) = self.retry_auth_impl(auth_window).await {
+      warn!("Failed to retry authentication: {}", err);
+    }
+
+    *self.is_retrying.write().await = false;
+  }
+
+  async fn retry_auth_impl(&self, auth_window: &WebviewWindow) -> anyhow::Result<()> {
+    info!("Retrying authentication...");
+
+    auth_window.eval( r#"
+      var loading = document.createElement("div");
+      loading.innerHTML = '<div style="position: absolute; width: 100%; text-align: center; font-size: 20px; font-weight: bold; top: 50%; left: 50%; transform: translate(-50%, -50%);">Got invalid token, retrying...</div>';
+      loading.style = "position: fixed; top: 0; left: 0; width: 100%; height: 100%; background: rgba(255, 255, 255, 0.85); z-index: 99999;";
+      document.body.appendChild(loading);
+    "#)?;
+
+    let auth_request = self.portal_prelogin().await?;
+    let (tx, rx) = oneshot::channel::<()>();
+    auth_window.with_webview(move |webview| {
+      let auth_request = AuthRequest::new(&auth_request);
+      platform_impl::load_auth_request(&webview.inner(), &auth_request);
+
+      tx.send(()).expect("Failed to send message to the channel")
+    })?;
+
+    rx.await?;
+    Ok(())
+  }
+
+  fn raise_window(&self, auth_window: &WebviewWindow) {
+    let visible = auth_window.is_visible().unwrap_or(false);
+    if visible {
+      return;
+    }
+
+    info!("Raising auth window...");
+    if let Err(err) = auth_window.raise() {
+      warn!("Failed to raise window: {}", err);
+    }
+  }
+}

crates/gpapi/Cargo.toml

@@ -1,5 +1,6 @@
 [package]
 name = "gpapi"
+rust-version.workspace = true
 version.workspace = true
 edition.workspace = true
 license = "MIT"
@@ -14,8 +15,7 @@ openssl.workspace = true
 pem.workspace = true
 roxmltree.workspace = true
 serde.workspace = true
-specta.workspace = true
+specta = { workspace = true, features = ["derive"] }
-specta-macros.workspace = true
 urlencoding.workspace = true
 tokio.workspace = true
 serde_json.workspace = true
@@ -30,14 +30,11 @@ uzers.workspace = true
 serde_urlencoded.workspace = true
 md5.workspace = true
 sha256.workspace = true
-which.workspace = true
 
 tauri = { workspace = true, optional = true }
 clap = { workspace = true, optional = true }
-open = { version = "5", optional = true }
-webbrowser = { version = "1", optional = true }
 
 [features]
 tauri = ["dep:tauri"]
 clap = ["dep:clap"]
-browser-auth = ["dep:open", "dep:webbrowser"]
+webview-auth = []

crates/gpapi/src/auth.rs

@@ -1,11 +1,14 @@
 use std::borrow::{Borrow, Cow};
 
+use anyhow::bail;
 use log::{info, warn};
 use regex::Regex;
 use serde::{Deserialize, Serialize};
 
 use crate::{error::AuthDataParseError, utils::base64::decode_to_string};
 
+pub type AuthDataParseResult = anyhow::Result<SamlAuthData, AuthDataParseError>;
+
 #[derive(Debug, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct SamlAuthData {
@@ -33,33 +36,51 @@ impl SamlAuthResult {
 }
 
 impl SamlAuthData {
-  pub fn new(username: String, prelogin_cookie: Option<String>, portal_userauthcookie: Option<String>) -> Self {
+  pub fn new(
-    Self {
+    username: Option<String>,
-      username,
+    prelogin_cookie: Option<String>,
-      prelogin_cookie,
+    portal_userauthcookie: Option<String>,
-      portal_userauthcookie,
+  ) -> anyhow::Result<Self> {
-      token: None,
+    let username = username.unwrap_or_default();
-    }
+    if username.is_empty() {
+      bail!("Invalid username: <empty>");
     }
 
-  pub fn from_html(html: &str) -> anyhow::Result<SamlAuthData, AuthDataParseError> {
+    let prelogin_cookie = prelogin_cookie.unwrap_or_default();
+    let portal_userauthcookie = portal_userauthcookie.unwrap_or_default();
+
+    if prelogin_cookie.len() <= 5 && portal_userauthcookie.len() <= 5 {
+      bail!(
+        "Invalid prelogin-cookie: {}, portal-userauthcookie: {}",
+        prelogin_cookie,
+        portal_userauthcookie
+      );
+    }
+
+    Ok(Self {
+      username,
+      prelogin_cookie: Some(prelogin_cookie),
+      portal_userauthcookie: Some(portal_userauthcookie),
+      token: None,
+    })
+  }
+
+  pub fn from_html(html: &str) -> AuthDataParseResult {
     match parse_xml_tag(html, "saml-auth-status") {
-      Some(saml_status) if saml_status == "1" => {
+      Some(status) if status == "1" => {
         let username = parse_xml_tag(html, "saml-username");
         let prelogin_cookie = parse_xml_tag(html, "prelogin-cookie");
         let portal_userauthcookie = parse_xml_tag(html, "portal-userauthcookie");
 
-        if SamlAuthData::check(&username, &prelogin_cookie, &portal_userauthcookie) {
+        SamlAuthData::new(username, prelogin_cookie, portal_userauthcookie).map_err(|e| {
-          Ok(SamlAuthData::new(
+          warn!("Failed to parse auth data: {}", e);
-            username.unwrap(),
+          AuthDataParseError::Invalid
-            prelogin_cookie,
+        })
-            portal_userauthcookie,
+      }
-          ))
+      Some(status) => {
-        } else {
+        warn!("Found invalid auth status: {}", status);
         Err(AuthDataParseError::Invalid)
       }
-      }
-      Some(_) => Err(AuthDataParseError::Invalid),
       None => Err(AuthDataParseError::NotFound),
     }
   }
@@ -105,27 +126,6 @@ impl SamlAuthData {
   pub fn token(&self) -> Option<&str> {
     self.token.as_deref()
   }
-
-  pub fn check(
-    username: &Option<String>,
-    prelogin_cookie: &Option<String>,
-    portal_userauthcookie: &Option<String>,
-  ) -> bool {
-    let username_valid = username.as_ref().is_some_and(|username| !username.is_empty());
-    let prelogin_cookie_valid = prelogin_cookie.as_ref().is_some_and(|val| val.len() > 5);
-    let portal_userauthcookie_valid = portal_userauthcookie.as_ref().is_some_and(|val| val.len() > 5);
-
-    let is_valid = username_valid && (prelogin_cookie_valid || portal_userauthcookie_valid);
-
-    if !is_valid {
-      warn!(
-        "Invalid SAML auth data: username: {:?}, prelogin-cookie: {:?}, portal-userauthcookie: {:?}",
-        username, prelogin_cookie, portal_userauthcookie
-      );
-    }
-
-    is_valid
-  }
 }
 
 pub fn parse_xml_tag(html: &str, tag: &str) -> Option<String> {

crates/gpapi/src/clap/mod.rs

@@ -1 +1,28 @@
+use crate::error::PortalError;
+
 pub mod args;
+
+pub trait Args {
+  fn fix_openssl(&self) -> bool;
+  fn ignore_tls_errors(&self) -> bool;
+}
+
+pub fn handle_error(err: anyhow::Error, args: &impl Args) {
+  eprintln!("\nError: {}", err);
+
+  let Some(err) = err.downcast_ref::<PortalError>() else {
+    return;
+  };
+
+  if err.is_legacy_openssl_error() && !args.fix_openssl() {
+    eprintln!("\nRe-run it with the `--fix-openssl` option to work around this issue, e.g.:\n");
+    let args = std::env::args().collect::<Vec<_>>();
+    eprintln!("{} --fix-openssl {}\n", args[0], args[1..].join(" "));
+  }
+
+  if err.is_tls_error() && !args.ignore_tls_errors() {
+    eprintln!("\nRe-run it with the `--ignore-tls-errors` option to ignore the certificate error, e.g.:\n");
+    let args = std::env::args().collect::<Vec<_>>();
+    eprintln!("{} --ignore-tls-errors {}\n", args[0], args[1..].join(" "));
+  }
+}

crates/gpapi/src/error.rs

@@ -7,7 +7,19 @@ pub enum PortalError {
   #[error("Portal config error: {0}")]
   ConfigError(String),
   #[error("Network error: {0}")]
-  NetworkError(String),
+  NetworkError(#[from] reqwest::Error),
+  #[error("TLS error")]
+  TlsError,
+}
+
+impl PortalError {
+  pub fn is_legacy_openssl_error(&self) -> bool {
+    format!("{:?}", self).contains("unsafe legacy renegotiation")
+  }
+
+  pub fn is_tls_error(&self) -> bool {
+    matches!(self, PortalError::TlsError) || format!("{:?}", self).contains("certificate verify failed")
+  }
 }
 
 #[derive(Error, Debug)]
@@ -17,3 +29,9 @@ pub enum AuthDataParseError {
   #[error("Invalid auth data")]
   Invalid,
 }
+
+impl AuthDataParseError {
+  pub fn is_invalid(&self) -> bool {
+    matches!(self, AuthDataParseError::Invalid)
+  }
+}

crates/gpapi/src/gateway/login.rs

@@ -36,7 +36,7 @@ pub async fn gateway_login(gateway: &str, cred: &Credential, gp_params: &GpParam
     .form(&params)
     .send()
     .await
-    .map_err(|e| anyhow::anyhow!(PortalError::NetworkError(e.to_string())))?;
+    .map_err(|e| anyhow::anyhow!(PortalError::NetworkError(e)))?;
 
   let res = parse_gp_response(res).await.map_err(|err| {
     warn!("{err}");

crates/gpapi/src/lib.rs

@@ -16,6 +16,7 @@ pub const GP_API_KEY: &[u8; 32] = &[0; 32];
 
 pub const GP_USER_AGENT: &str = "PAN GlobalProtect";
 pub const GP_SERVICE_LOCK_FILE: &str = "/var/run/gpservice.lock";
+pub const GP_CALLBACK_PORT_FILENAME: &str = "gpcallback.port";
 
 #[cfg(not(debug_assertions))]
 pub const GP_CLIENT_BINARY: &str = "/usr/bin/gpclient";

crates/gpapi/src/portal/config.rs

@@ -116,7 +116,7 @@ pub async fn retrieve_config(portal: &str, cred: &Credential, gp_params: &GpPara
     .form(&params)
     .send()
     .await
-    .map_err(|e| anyhow::anyhow!(PortalError::NetworkError(e.to_string())))?;
+    .map_err(|e| anyhow::anyhow!(PortalError::NetworkError(e)))?;
 
   let res_xml = parse_gp_response(res).await.or_else(|err| {
     if err.status == StatusCode::NOT_FOUND {

crates/gpapi/src/portal/prelogin.rs

@@ -116,14 +116,12 @@ pub async fn prelogin(portal: &str, gp_params: &GpParams) -> anyhow::Result<Prel
 
   let client = Client::try_from(gp_params)?;
 
-  info!("Perform prelogin, user_agent: {}", gp_params.user_agent());
-
   let res = client
     .post(&prelogin_url)
     .form(&params)
     .send()
     .await
-    .map_err(|e| anyhow::anyhow!(PortalError::NetworkError(e.to_string())))?;
+    .map_err(|e| anyhow::anyhow!(PortalError::NetworkError(e)))?;
 
   let res_xml = parse_gp_response(res).await.or_else(|err| {
     if err.status == StatusCode::NOT_FOUND {

crates/gpapi/src/process/auth_launcher.rs

@@ -14,10 +14,13 @@ pub struct SamlAuthLauncher<'a> {
   user_agent: Option<&'a str>,
   os: Option<&'a str>,
   os_version: Option<&'a str>,
-  hidpi: bool,
   fix_openssl: bool,
   ignore_tls_errors: bool,
+  #[cfg(feature = "webview-auth")]
+  hidpi: bool,
+  #[cfg(feature = "webview-auth")]
   clean: bool,
+  #[cfg(feature = "webview-auth")]
   default_browser: bool,
   browser: Option<&'a str>,
 }
@@ -31,10 +34,13 @@ impl<'a> SamlAuthLauncher<'a> {
       user_agent: None,
       os: None,
       os_version: None,
-      hidpi: false,
       fix_openssl: false,
       ignore_tls_errors: false,
+      #[cfg(feature = "webview-auth")]
+      hidpi: false,
+      #[cfg(feature = "webview-auth")]
       clean: false,
+      #[cfg(feature = "webview-auth")]
       default_browser: false,
       browser: None,
     }
@@ -65,11 +71,6 @@ impl<'a> SamlAuthLauncher<'a> {
     self
   }
 
-  pub fn hidpi(mut self, hidpi: bool) -> Self {
-    self.hidpi = hidpi;
-    self
-  }
-
   pub fn fix_openssl(mut self, fix_openssl: bool) -> Self {
     self.fix_openssl = fix_openssl;
     self
@@ -80,11 +81,19 @@ impl<'a> SamlAuthLauncher<'a> {
     self
   }
 
+  #[cfg(feature = "webview-auth")]
+  pub fn hidpi(mut self, hidpi: bool) -> Self {
+    self.hidpi = hidpi;
+    self
+  }
+
+  #[cfg(feature = "webview-auth")]
   pub fn clean(mut self, clean: bool) -> Self {
     self.clean = clean;
     self
   }
 
+  #[cfg(feature = "webview-auth")]
   pub fn default_browser(mut self, default_browser: bool) -> Self {
     self.default_browser = default_browser;
     self
@@ -120,10 +129,6 @@ impl<'a> SamlAuthLauncher<'a> {
       auth_cmd.arg("--os-version").arg(os_version);
     }
 
-    if self.hidpi {
-      auth_cmd.arg("--hidpi");
-    }
-
     if self.fix_openssl {
       auth_cmd.arg("--fix-openssl");
     }
@@ -132,6 +137,12 @@ impl<'a> SamlAuthLauncher<'a> {
       auth_cmd.arg("--ignore-tls-errors");
     }
 
+    #[cfg(feature = "webview-auth")]
+    {
+      if self.hidpi {
+        auth_cmd.arg("--hidpi");
+      }
+
       if self.clean {
         auth_cmd.arg("--clean");
       }
@@ -139,6 +150,7 @@ impl<'a> SamlAuthLauncher<'a> {
       if self.default_browser {
         auth_cmd.arg("--default-browser");
       }
+    }
 
     if let Some(browser) = self.browser {
       auth_cmd.arg("--browser").arg(browser);

crates/gpapi/src/process/browser_authenticator.rs

@@ -1,77 +0,0 @@
-use std::{borrow::Cow, env::temp_dir, fs, io::Write, os::unix::fs::PermissionsExt};
-
-use anyhow::bail;
-use log::{info, warn};
-
-pub struct BrowserAuthenticator<'a> {
-  auth_request: &'a str,
-  browser: Option<&'a str>,
-}
-
-impl BrowserAuthenticator<'_> {
-  pub fn new(auth_request: &str) -> BrowserAuthenticator {
-    BrowserAuthenticator {
-      auth_request,
-      browser: None,
-    }
-  }
-
-  pub fn new_with_browser<'a>(auth_request: &'a str, browser: &'a str) -> BrowserAuthenticator<'a> {
-    let browser = browser.trim();
-    BrowserAuthenticator {
-      auth_request,
-      browser: if browser.is_empty() || browser == "default" {
-        None
-      } else {
-        Some(browser)
-      },
-    }
-  }
-
-  pub fn authenticate(&self) -> anyhow::Result<()> {
-    let path = if self.auth_request.starts_with("http") {
-      Cow::Borrowed(self.auth_request)
-    } else {
-      let html_file = temp_dir().join("gpauth.html");
-
-      // Remove the file and error if permission denied
-      if let Err(err) = fs::remove_file(&html_file) {
-        if err.kind() != std::io::ErrorKind::NotFound {
-          warn!("Failed to remove the temporary file: {}", err);
-          bail!("Please remove the file manually: {:?}", html_file);
-        }
-      }
-
-      let mut file = fs::File::create(&html_file)?;
-
-      file.set_permissions(fs::Permissions::from_mode(0o600))?;
-      file.write_all(self.auth_request.as_bytes())?;
-
-      Cow::Owned(html_file.to_string_lossy().to_string())
-    };
-
-    if let Some(browser) = self.browser {
-      let app = find_browser_path(browser);
-
-      info!("Launching browser: {}", app);
-      open::with_detached(path.as_ref(), app)?;
-    } else {
-      info!("Launching the default browser...");
-      webbrowser::open(path.as_ref())?;
-    }
-
-    Ok(())
-  }
-}
-
-fn find_browser_path(browser: &str) -> String {
-  if browser == "chrome" {
-    which::which("google-chrome-stable")
-      .or_else(|_| which::which("google-chrome"))
-      .or_else(|_| which::which("chromium"))
-      .map(|path| path.to_string_lossy().to_string())
-      .unwrap_or_else(|_| browser.to_string())
-  } else {
-    browser.into()
-  }
-}

crates/gpapi/src/process/mod.rs

@@ -2,8 +2,6 @@ pub(crate) mod command_traits;
 pub(crate) mod gui_helper_launcher;
 
 pub mod auth_launcher;
-#[cfg(feature = "browser-auth")]
-pub mod browser_authenticator;
 pub mod gui_launcher;
 pub mod hip_launcher;
 pub mod service_launcher;

crates/gpapi/src/service/event.rs

@@ -7,6 +7,4 @@ use super::vpn_state::VpnState;
 pub enum WsEvent {
   VpnState(VpnState),
   ActiveGui,
-  /// External authentication data
-  AuthData(String),
 }

crates/gpapi/src/utils/env_utils.rs

@@ -3,6 +3,7 @@ use std::env;
 use std::io::Write;
 use std::path::Path;
 
+use log::info;
 use tempfile::NamedTempFile;
 
 pub fn persist_env_vars(extra: Option<HashMap<String, String>>) -> anyhow::Result<NamedTempFile> {
@@ -35,3 +36,20 @@ pub fn load_env_vars<T: AsRef<Path>>(env_file: T) -> anyhow::Result<HashMap<Stri
 
   Ok(env_vars)
 }
+
+pub fn patch_gui_runtime_env(hidpi: bool) {
+  // This is to avoid blank screen on some systems
+  std::env::set_var("WEBKIT_DISABLE_COMPOSITING_MODE", "1");
+
+  // Workaround for https://github.com/tauri-apps/tao/issues/929
+  let desktop = env::var("XDG_CURRENT_DESKTOP").unwrap_or_default().to_lowercase();
+  if desktop.contains("gnome") {
+    env::set_var("GDK_BACKEND", "x11");
+  }
+
+  if hidpi {
+    info!("Setting GDK_SCALE=2 and GDK_DPI_SCALE=0.5");
+    std::env::set_var("GDK_SCALE", "2");
+    std::env::set_var("GDK_DPI_SCALE", "0.5");
+  }
+}

crates/gpapi/src/utils/mod.rs

@@ -4,7 +4,7 @@ pub mod base64;
 pub mod checksum;
 pub mod crypto;
 pub mod endpoint;
-pub mod env_file;
+pub mod env_utils;
 pub mod lock_file;
 pub mod openssl;
 pub mod redact;

crates/gpapi/src/utils/window.rs

@@ -2,25 +2,20 @@ use std::{process::ExitStatus, time::Duration};
 
 use anyhow::bail;
 use log::info;
-use tauri::Window;
+use tauri::WebviewWindow;
 use tokio::process::Command;
 
 pub trait WindowExt {
   fn raise(&self) -> anyhow::Result<()>;
-  fn hide_menu(&self);
 }
 
-impl WindowExt for Window {
+impl WindowExt for WebviewWindow {
   fn raise(&self) -> anyhow::Result<()> {
     raise_window(self)
   }
-
-  fn hide_menu(&self) {
-    hide_menu(self);
-  }
 }
 
-pub fn raise_window(win: &Window) -> anyhow::Result<()> {
+pub fn raise_window(win: &WebviewWindow) -> anyhow::Result<()> {
   let is_wayland = std::env::var("XDG_SESSION_TYPE").unwrap_or_default() == "wayland";
 
   if is_wayland {
@@ -40,7 +35,7 @@ pub fn raise_window(win: &Window) -> anyhow::Result<()> {
 
   // Calling window.show() on Windows will cause the menu to be shown.
   // We need to hide it again.
-  hide_menu(win);
+  win.hide_menu()?;
 
   Ok(())
 }
@@ -76,22 +71,3 @@ async fn wmctrl_try_raise_window(title: &str) -> anyhow::Result<ExitStatus> {
 
   Ok(exit_status)
 }
-
-fn hide_menu(win: &Window) {
-  let menu_handle = win.menu_handle();
-
-  tokio::spawn(async move {
-    loop {
-      let menu_visible = menu_handle.is_visible().unwrap_or(false);
-
-      if !menu_visible {
-        break;
-      }
-
-      if menu_visible {
-        let _ = menu_handle.hide();
-        tokio::time::sleep(Duration::from_millis(10)).await;
-      }
-    }
-  });
-}

packaging/deb/compat

@@ -0,0 +1 @@
+10

packaging/deb/control.in

@@ -7,17 +7,24 @@ Build-Depends: debhelper (>= 9),
   pkg-config,
   jq (>= 1),
   make (>= 4),
+  libssl-dev,
   libxml2,
   libsecret-1-0,
   libayatana-appindicator3-1,
   gnome-keyring,
-  libwebkit2gtk-4.0-dev,
+  libwebkit2gtk-4.1-dev,
   libopenconnect-dev (>= 8.20),@RUST@
 Homepage: https://github.com/yuezk/GlobalProtect-openconnect
 
 Package: globalprotect-openconnect
 Architecture: any
 Multi-Arch: foreign
-Depends: ${misc:Depends}, ${shlibs:Depends}, openconnect (>=8.20), libxml2, libsecret-1-0, libayatana-appindicator3-1, gnome-keyring
+Depends: ${misc:Depends},
+  ${shlibs:Depends},
+  openconnect (>=8.20),
+  libxml2,
+  libsecret-1-0,
+  libayatana-appindicator3-1,
+  gnome-keyring,
 Description: A GUI for GlobalProtect VPN
  A GUI for GlobalProtect VPN, based on OpenConnect, supports the SSO authentication method.

packaging/deb/rules.in

@@ -2,6 +2,11 @@
 
 export OFFLINE = @OFFLINE@
 export BUILD_FE = 0
+export BUILD_GUI = @BUILD_GUI@
+
+export PATH := /usr/lib/rust-@RUST_VERSION@/bin:$(PATH)
 
 %:
+	which cargo
+	which rustc
 	dh $@ --no-parallel

packaging/pkgbuild/PKGBUILD.in

@@ -8,8 +8,8 @@ pkgdesc="A GUI for GlobalProtect VPN, based on OpenConnect, supports the SSO aut
 arch=('x86_64' 'aarch64')
 url="https://github.com/yuezk/GlobalProtect-openconnect"
 license=('GPL3')
-makedepends=('make' 'pkg-config' 'rust' 'cargo' 'jq' 'webkit2gtk' 'curl' 'wget' 'file' 'openssl' 'appmenu-gtk-module' 'gtk3' 'libappindicator-gtk3' 'librsvg' 'libvips' 'libayatana-appindicator' 'openconnect' 'libsecret')
+makedepends=('make' 'pkg-config' 'rust' 'cargo' 'jq' 'webkit2gtk-4.1' 'curl' 'wget' 'file' 'openssl' 'appmenu-gtk-module' 'libappindicator-gtk3' 'librsvg' 'openconnect' 'libsecret')
-depends=('openconnect>=8.20' webkit2gtk libappindicator-gtk3 libayatana-appindicator libsecret libxml2)
+depends=('openconnect>=8.20' webkit2gtk-4.1 libappindicator-gtk3 libsecret libxml2)
 optdepends=('wmctrl: for window management')
 
 provides=('globalprotect-openconnect' 'gpclient' 'gpservice' 'gpauth' 'gpgui')

packaging/rpm/globalprotect-openconnect.spec.in

@@ -19,11 +19,11 @@ BuildRequires:  wget
 BuildRequires:  file
 BuildRequires:  perl
 
-BuildRequires:  (webkit2gtk4.0-devel or webkit2gtk3-soup2-devel)
+BuildRequires:  (webkit2gtk4.1-devel or webkit2gtk3-soup2-devel)
 BuildRequires:  (libappindicator-gtk3-devel or libappindicator3-1)
 BuildRequires:  (librsvg2-devel or librsvg-devel)
 
-Requires:       openconnect >= 8.20, (libayatana-appindicator or libappindicator-gtk3)
+Requires:       openconnect >= 8.20, (libappindicator-gtk3 or libayatana-appindicator)
 Conflicts:      globalprotect-openconnect-snapshot
 
 %global debug_package %{nil}