upgrade gpauth

apps/gpauth/Cargo.toml

@@ -1,29 +1,32 @@
 [package]
 name = "gpauth"
+rust-version.workspace = true
 authors.workspace = true
 version.workspace = true
 edition.workspace = true
 license.workspace = true
 
 [build-dependencies]
-tauri-build = { version = "1.5", features = [] }
+tauri-build = { version = "2", features = [], optional = true }
 
 [dependencies]
-gpapi = { path = "../../crates/gpapi", features = [
-  "tauri",
-  "clap",
-  "browser-auth",
-] }
+gpapi = { path = "../../crates/gpapi", features = ["clap"] }
+
+auth = { path = "../../crates/auth", features = ["browser-auth"] }
+
+# Shared dependencies
 anyhow.workspace = true
 clap.workspace = true
 env_logger.workspace = true
 log.workspace = true
-regex.workspace = true
 serde_json.workspace = true
 tokio.workspace = true
-tokio-util.workspace = true
 tempfile.workspace = true
-html-escape = "0.2.13"
-webkit2gtk = "0.18.2"
-tauri = { workspace = true, features = ["http-all"] }
 compile-time.workspace = true
+
+# webview auth dependencies
+tauri = { workspace = true, optional = true }
+
+[features]
+default = ["webview-auth"]
+webview-auth = ["auth/webview-auth", "dep:tauri", "dep:tauri-build"]

apps/gpauth/build.rs

@@ -1,3 +1,4 @@
 fn main() {
+  #[cfg(feature = "webview-auth")]
   tauri_build::build()
 }

apps/gpauth/src/auth_window.rs

@@ -1,523 +0,0 @@
-use std::{
-  rc::Rc,
-  sync::Arc,
-  time::{Duration, Instant},
-};
-
-use anyhow::bail;
-use gpapi::{
-  auth::SamlAuthData,
-  error::AuthDataParseError,
-  gp_params::GpParams,
-  portal::{prelogin, Prelogin},
-  utils::{redact::redact_uri, window::WindowExt},
-};
-use log::{info, warn};
-use regex::Regex;
-use tauri::{AppHandle, Window, WindowEvent, WindowUrl};
-use tokio::sync::{mpsc, oneshot, RwLock};
-use tokio_util::sync::CancellationToken;
-use webkit2gtk::{
-  gio::Cancellable,
-  glib::{GString, TimeSpan},
-  LoadEvent, SettingsExt, TLSErrorsPolicy, URIResponse, URIResponseExt, WebContextExt, WebResource, WebResourceExt,
-  WebView, WebViewExt, WebsiteDataManagerExtManual, WebsiteDataTypes,
-};
-
-enum AuthDataError {
-  /// Failed to load page due to TLS error
-  TlsError,
-  /// 1. Found auth data in headers/body but it's invalid
-  /// 2. Loaded an empty page, failed to load page. etc.
-  Invalid,
-  /// No auth data found in headers/body
-  NotFound,
-}
-
-type AuthResult = Result<SamlAuthData, AuthDataError>;
-
-pub(crate) struct AuthWindow<'a> {
-  app_handle: AppHandle,
-  server: &'a str,
-  saml_request: &'a str,
-  user_agent: &'a str,
-  gp_params: Option<GpParams>,
-  clean: bool,
-}
-
-impl<'a> AuthWindow<'a> {
-  pub fn new(app_handle: AppHandle) -> Self {
-    Self {
-      app_handle,
-      server: "",
-      saml_request: "",
-      user_agent: "",
-      gp_params: None,
-      clean: false,
-    }
-  }
-
-  pub fn server(mut self, server: &'a str) -> Self {
-    self.server = server;
-    self
-  }
-
-  pub fn saml_request(mut self, saml_request: &'a str) -> Self {
-    self.saml_request = saml_request;
-    self
-  }
-
-  pub fn user_agent(mut self, user_agent: &'a str) -> Self {
-    self.user_agent = user_agent;
-    self
-  }
-
-  pub fn gp_params(mut self, gp_params: GpParams) -> Self {
-    self.gp_params.replace(gp_params);
-    self
-  }
-
-  pub fn clean(mut self, clean: bool) -> Self {
-    self.clean = clean;
-    self
-  }
-
-  pub async fn open(&self) -> anyhow::Result<SamlAuthData> {
-    info!("Open auth window, user_agent: {}", self.user_agent);
-
-    let window = Window::builder(&self.app_handle, "auth_window", WindowUrl::default())
-      .title("GlobalProtect Login")
-      // .user_agent(self.user_agent)
-      .focused(true)
-      .visible(false)
-      .center()
-      .build()?;
-
-    let window = Arc::new(window);
-
-    let cancel_token = CancellationToken::new();
-    let cancel_token_clone = cancel_token.clone();
-
-    window.on_window_event(move |event| {
-      if let WindowEvent::CloseRequested { .. } = event {
-        cancel_token_clone.cancel();
-      }
-    });
-
-    let window_clone = Arc::clone(&window);
-    let timeout_secs = 15;
-    tokio::spawn(async move {
-      tokio::time::sleep(Duration::from_secs(timeout_secs)).await;
-      let visible = window_clone.is_visible().unwrap_or(false);
-      if !visible {
-        info!("Try to raise auth window after {} seconds", timeout_secs);
-        raise_window(&window_clone);
-      }
-    });
-
-    tokio::select! {
-      _ = cancel_token.cancelled() => {
-        bail!("Auth cancelled");
-      }
-      saml_result = self.auth_loop(&window) => {
-        window.close()?;
-        saml_result
-      }
-    }
-  }
-
-  async fn auth_loop(&self, window: &Arc<Window>) -> anyhow::Result<SamlAuthData> {
-    let saml_request = self.saml_request.to_string();
-    let (auth_result_tx, mut auth_result_rx) = mpsc::unbounded_channel::<AuthResult>();
-    let raise_window_cancel_token: Arc<RwLock<Option<CancellationToken>>> = Default::default();
-    let gp_params = self.gp_params.as_ref().unwrap();
-    let tls_err_policy = if gp_params.ignore_tls_errors() {
-      TLSErrorsPolicy::Ignore
-    } else {
-      TLSErrorsPolicy::Fail
-    };
-
-    if self.clean {
-      clear_webview_cookies(window).await?;
-    }
-
-    let raise_window_cancel_token_clone = Arc::clone(&raise_window_cancel_token);
-    window.with_webview(move |wv| {
-      let wv = wv.inner();
-
-      if let Some(context) = wv.context() {
-        context.set_tls_errors_policy(tls_err_policy);
-      }
-
-      if let Some(settings) = wv.settings() {
-        let ua = settings.user_agent().unwrap_or("".into());
-        info!("Auth window user agent: {}", ua);
-      }
-
-      // Load the initial SAML request
-      load_saml_request(&wv, &saml_request);
-
-      let auth_result_tx_clone = auth_result_tx.clone();
-      wv.connect_load_changed(move |wv, event| {
-        if event == LoadEvent::Started {
-          let Ok(mut cancel_token) = raise_window_cancel_token_clone.try_write() else {
-            return;
-          };
-
-          // Cancel the raise window task
-          if let Some(cancel_token) = cancel_token.take() {
-            cancel_token.cancel();
-          }
-          return;
-        }
-
-        if event != LoadEvent::Finished {
-          return;
-        }
-
-        if let Some(main_resource) = wv.main_resource() {
-          let uri = main_resource.uri().unwrap_or("".into());
-
-          if uri.is_empty() {
-            warn!("Loaded an empty uri");
-            send_auth_result(&auth_result_tx_clone, Err(AuthDataError::Invalid));
-            return;
-          }
-
-          info!("Loaded uri: {}", redact_uri(&uri));
-          if uri.starts_with("globalprotectcallback:") {
-            return;
-          }
-
-          read_auth_data(&main_resource, auth_result_tx_clone.clone());
-        }
-      });
-
-      let auth_result_tx_clone = auth_result_tx.clone();
-      wv.connect_load_failed_with_tls_errors(move |_wv, uri, cert, err| {
-        let redacted_uri = redact_uri(uri);
-        warn!(
-          "Failed to load uri: {} with error: {}, cert: {}",
-          redacted_uri, err, cert
-        );
-
-        send_auth_result(&auth_result_tx_clone, Err(AuthDataError::TlsError));
-        true
-      });
-
-      wv.connect_load_failed(move |_wv, _event, uri, err| {
-        let redacted_uri = redact_uri(uri);
-        if !uri.starts_with("globalprotectcallback:") {
-          warn!("Failed to load uri: {} with error: {}", redacted_uri, err);
-        }
-        // NOTE: Don't send error here, since load_changed event will be triggered after this
-        // send_auth_result(&auth_result_tx, Err(AuthDataError::Invalid));
-        // true to stop other handlers from being invoked for the event. false to propagate the event further.
-        true
-      });
-    })?;
-
-    let portal = self.server.to_string();
-
-    loop {
-      if let Some(auth_result) = auth_result_rx.recv().await {
-        match auth_result {
-          Ok(auth_data) => return Ok(auth_data),
-          Err(AuthDataError::TlsError) => bail!("TLS error: certificate verify failed"),
-          Err(AuthDataError::NotFound) => {
-            info!("No auth data found, it may not be the /SAML20/SP/ACS endpoint");
-
-            // The user may need to interact with the auth window, raise it in 3 seconds
-            if !window.is_visible().unwrap_or(false) {
-              let window = Arc::clone(window);
-              let cancel_token = CancellationToken::new();
-
-              raise_window_cancel_token.write().await.replace(cancel_token.clone());
-
-              tokio::spawn(async move {
-                let delay_secs = 1;
-
-                info!("Raise window in {} second(s)", delay_secs);
-                tokio::select! {
-                  _ = tokio::time::sleep(Duration::from_secs(delay_secs)) => {
-                    raise_window(&window);
-                  }
-                  _ = cancel_token.cancelled() => {
-                    info!("Raise window cancelled");
-                  }
-                }
-              });
-            }
-          }
-          Err(AuthDataError::Invalid) => {
-            info!("Got invalid auth data, retrying...");
-
-            window.with_webview(|wv| {
-              let wv = wv.inner();
-              wv.run_javascript(r#"
-                  var loading = document.createElement("div");
-                  loading.innerHTML = '<div style="position: absolute; width: 100%; text-align: center; font-size: 20px; font-weight: bold; top: 50%; left: 50%; transform: translate(-50%, -50%);">Got invalid token, retrying...</div>';
-                  loading.style = "position: fixed; top: 0; left: 0; width: 100%; height: 100%; background: rgba(255, 255, 255, 0.85); z-index: 99999;";
-                  document.body.appendChild(loading);
-              "#,
-                  Cancellable::NONE,
-                  |_| info!("Injected loading element successfully"),
-              );
-            })?;
-
-            let saml_request = portal_prelogin(&portal, gp_params).await?;
-            window.with_webview(move |wv| {
-              let wv = wv.inner();
-              load_saml_request(&wv, &saml_request);
-            })?;
-          }
-        }
-      }
-    }
-  }
-}
-
-fn raise_window(window: &Arc<Window>) {
-  let visible = window.is_visible().unwrap_or(false);
-  if !visible {
-    if let Err(err) = window.raise() {
-      warn!("Failed to raise window: {}", err);
-    }
-  }
-}
-
-pub async fn portal_prelogin(portal: &str, gp_params: &GpParams) -> anyhow::Result<String> {
-  match prelogin(portal, gp_params).await? {
-    Prelogin::Saml(prelogin) => Ok(prelogin.saml_request().to_string()),
-    Prelogin::Standard(_) => bail!("Received non-SAML prelogin response"),
-  }
-}
-
-fn send_auth_result(auth_result_tx: &mpsc::UnboundedSender<AuthResult>, auth_result: AuthResult) {
-  if let Err(err) = auth_result_tx.send(auth_result) {
-    warn!("Failed to send auth event: {}", err);
-  }
-}
-
-fn load_saml_request(wv: &Rc<WebView>, saml_request: &str) {
-  if saml_request.starts_with("http") {
-    info!("Load the SAML request as URI...");
-    wv.load_uri(saml_request);
-  } else {
-    info!("Load the SAML request as HTML...");
-    wv.load_html(saml_request, None);
-  }
-}
-
-fn read_auth_data_from_headers(response: &URIResponse) -> AuthResult {
-  response.http_headers().map_or_else(
-    || {
-      info!("No headers found in response");
-      Err(AuthDataError::NotFound)
-    },
-    |mut headers| match headers.get("saml-auth-status") {
-      Some(status) if status == "1" => {
-        let username = headers.get("saml-username").map(GString::into);
-        let prelogin_cookie = headers.get("prelogin-cookie").map(GString::into);
-        let portal_userauthcookie = headers.get("portal-userauthcookie").map(GString::into);
-
-        if SamlAuthData::check(&username, &prelogin_cookie, &portal_userauthcookie) {
-          return Ok(SamlAuthData::new(
-            username.unwrap(),
-            prelogin_cookie,
-            portal_userauthcookie,
-          ));
-        }
-
-        info!("Found invalid auth data in headers");
-        Err(AuthDataError::Invalid)
-      }
-      Some(status) => {
-        info!("Found invalid SAML status: {} in headers", status);
-        Err(AuthDataError::Invalid)
-      }
-      None => {
-        info!("No saml-auth-status header found");
-        Err(AuthDataError::NotFound)
-      }
-    },
-  )
-}
-
-fn read_auth_data_from_body<F>(main_resource: &WebResource, callback: F)
-where
-  F: FnOnce(Result<SamlAuthData, AuthDataParseError>) + Send + 'static,
-{
-  main_resource.data(Cancellable::NONE, |data| match data {
-    Ok(data) => {
-      let html = String::from_utf8_lossy(&data);
-      callback(read_auth_data_from_html(&html));
-    }
-    Err(err) => {
-      info!("Failed to read response body: {}", err);
-      callback(Err(AuthDataParseError::Invalid))
-    }
-  });
-}
-
-fn read_auth_data_from_html(html: &str) -> Result<SamlAuthData, AuthDataParseError> {
-  if html.contains("Temporarily Unavailable") {
-    info!("Found 'Temporarily Unavailable' in HTML, auth failed");
-    return Err(AuthDataParseError::Invalid);
-  }
-
-  SamlAuthData::from_html(html).or_else(|err| {
-    if let Some(gpcallback) = extract_gpcallback(html) {
-      info!("Found gpcallback from html...");
-      SamlAuthData::from_gpcallback(&gpcallback)
-    } else {
-      Err(err)
-    }
-  })
-}
-
-fn extract_gpcallback(html: &str) -> Option<String> {
-  let re = Regex::new(r#"globalprotectcallback:[^"]+"#).unwrap();
-  re.captures(html)
-    .and_then(|captures| captures.get(0))
-    .map(|m| html_escape::decode_html_entities(m.as_str()).to_string())
-}
-
-fn read_auth_data(main_resource: &WebResource, auth_result_tx: mpsc::UnboundedSender<AuthResult>) {
-  let Some(response) = main_resource.response() else {
-    info!("No response found in main resource");
-    send_auth_result(&auth_result_tx, Err(AuthDataError::Invalid));
-    return;
-  };
-
-  info!("Trying to read auth data from response headers...");
-
-  match read_auth_data_from_headers(&response) {
-    Ok(auth_data) => {
-      info!("Got auth data from headers");
-      send_auth_result(&auth_result_tx, Ok(auth_data));
-    }
-    Err(AuthDataError::Invalid) => {
-      info!("Found invalid auth data in headers, trying to read from body...");
-      read_auth_data_from_body(main_resource, move |auth_result| {
-        // Since we have already found invalid auth data in headers, which means this could be the `/SAML20/SP/ACS` endpoint
-        // any error result from body should be considered as invalid, and trigger a retry
-        let auth_result = auth_result.map_err(|err| {
-          info!("Failed to read auth data from body: {}", err);
-          AuthDataError::Invalid
-        });
-        send_auth_result(&auth_result_tx, auth_result);
-      });
-    }
-    Err(AuthDataError::NotFound) => {
-      info!("No auth data found in headers, trying to read from body...");
-
-      let is_acs_endpoint = main_resource.uri().map_or(false, |uri| uri.contains("/SAML20/SP/ACS"));
-
-      read_auth_data_from_body(main_resource, move |auth_result| {
-        // If the endpoint is `/SAML20/SP/ACS` and no auth data found in body, it should be considered as invalid
-        let auth_result = auth_result.map_err(|err| {
-          info!("Failed to read auth data from body: {}", err);
-
-          if !is_acs_endpoint && matches!(err, AuthDataParseError::NotFound) {
-            AuthDataError::NotFound
-          } else {
-            AuthDataError::Invalid
-          }
-        });
-
-        send_auth_result(&auth_result_tx, auth_result)
-      });
-    }
-    Err(AuthDataError::TlsError) => {
-      // NOTE: This is unreachable
-      info!("TLS error found in headers, trying to read from body...");
-      send_auth_result(&auth_result_tx, Err(AuthDataError::TlsError));
-    }
-  }
-}
-
-pub(crate) async fn clear_webview_cookies(window: &Window) -> anyhow::Result<()> {
-  let (tx, rx) = oneshot::channel::<Result<(), String>>();
-
-  window.with_webview(|wv| {
-    let send_result = move |result: Result<(), String>| {
-      if let Err(err) = tx.send(result) {
-        info!("Failed to send result: {:?}", err);
-      }
-    };
-
-    let wv = wv.inner();
-    let context = match wv.context() {
-      Some(context) => context,
-      None => {
-        send_result(Err("No webview context found".into()));
-        return;
-      }
-    };
-    let data_manager = match context.website_data_manager() {
-      Some(manager) => manager,
-      None => {
-        send_result(Err("No data manager found".into()));
-        return;
-      }
-    };
-
-    let now = Instant::now();
-    data_manager.clear(
-      WebsiteDataTypes::COOKIES,
-      TimeSpan(0),
-      Cancellable::NONE,
-      move |result| match result {
-        Err(err) => {
-          send_result(Err(err.to_string()));
-        }
-        Ok(_) => {
-          info!("Cookies cleared in {} ms", now.elapsed().as_millis());
-          send_result(Ok(()));
-        }
-      },
-    );
-  })?;
-
-  rx.await?.map_err(|err| anyhow::anyhow!(err))
-}
-
-#[cfg(test)]
-mod tests {
-  use super::*;
-
-  #[test]
-  fn extract_gpcallback_some() {
-    let html = r#"
-      <meta http-equiv="refresh" content="0; URL=globalprotectcallback:PGh0bWw+PCEtLSA8c">
-      <meta http-equiv="refresh" content="0; URL=globalprotectcallback:PGh0bWw+PCEtLSA8c">
-    "#;
-
-    assert_eq!(
-      extract_gpcallback(html).as_deref(),
-      Some("globalprotectcallback:PGh0bWw+PCEtLSA8c")
-    );
-  }
-
-  #[test]
-  fn extract_gpcallback_cas() {
-    let html = r#"
-      <meta http-equiv="refresh" content="0; URL=globalprotectcallback:cas-as=1&amp;un=xyz@email.com&amp;token=very_long_string">
-    "#;
-
-    assert_eq!(
-      extract_gpcallback(html).as_deref(),
-      Some("globalprotectcallback:cas-as=1&un=xyz@email.com&token=very_long_string")
-    );
-  }
-
-  #[test]
-  fn extract_gpcallback_none() {
-    let html = r#"
-      <meta http-equiv="refresh" content="0; URL=PGh0bWw+PCEtLSA8c">
-    "#;
-
-    assert_eq!(extract_gpcallback(html), None);
-  }
-}

apps/gpauth/src/cli.rs

@@ -1,21 +1,17 @@
-use std::{env::temp_dir, fs, os::unix::fs::PermissionsExt};
+use std::borrow::Cow;
 
+use auth::{auth_prelogin, AuthWindow, BrowserAuthenticator};
 use clap::Parser;
 use gpapi::{
   auth::{SamlAuthData, SamlAuthResult},
-  clap::args::Os,
+  clap::{args::Os, handle_error, Args},
   gp_params::{ClientOs, GpParams},
-  process::browser_authenticator::BrowserAuthenticator,
-  utils::{env_utils, normalize_server, openssl},
+  utils::{normalize_server, openssl},
   GP_USER_AGENT,
 };
 use log::{info, LevelFilter};
 use serde_json::json;
-use tauri::{App, AppHandle, RunEvent};
 use tempfile::NamedTempFile;
-use tokio::{io::AsyncReadExt, net::TcpListener};
-
-use crate::auth_window::{portal_prelogin, AuthWindow};
 
 const VERSION: &str = concat!(env!("CARGO_PKG_VERSION"), " (", compile_time::date_str!(), ")");
 
@@ -37,7 +33,7 @@ const VERSION: &str = concat!(env!("CARGO_PKG_VERSION"), " (", compile_time::dat
 See 'gpauth -h' for more information.
 "
 )]
-struct Cli {
+pub(crate) struct Cli {
   #[arg(help = "The portal server to authenticate")]
   server: String,
 
@@ -56,18 +52,12 @@ struct Cli {
   #[arg(long)]
   os_version: Option<String>,
 
-  #[arg(long, help = "The HiDPI mode, useful for high-resolution screens")]
-  hidpi: bool,
-
   #[arg(long, help = "Get around the OpenSSL `unsafe legacy renegotiation` error")]
   fix_openssl: bool,
 
   #[arg(long, help = "Ignore TLS errors")]
   ignore_tls_errors: bool,
 
-  #[arg(long, help = "Clean the cache of the embedded browser")]
-  clean: bool,
-
   #[arg(long, help = "Use the default browser for authentication")]
   default_browser: bool,
 
@@ -76,69 +66,30 @@ struct Cli {
     help = "The browser to use for authentication, e.g., `default`, `firefox`, `chrome`, `chromium`, or the path to the browser executable"
   )]
   browser: Option<String>,
+
+  #[cfg(feature = "webview-auth")]
+  #[arg(long, help = "The HiDPI mode, useful for high-resolution screens")]
+  hidpi: bool,
+
+  #[cfg(feature = "webview-auth")]
+  #[arg(long, help = "Clean the cache of the embedded browser")]
+  pub clean: bool,
+}
+
+impl Args for Cli {
+  fn fix_openssl(&self) -> bool {
+    self.fix_openssl
+  }
+
+  fn ignore_tls_errors(&self) -> bool {
+    self.ignore_tls_errors
+  }
 }
 
 impl Cli {
-  async fn run(&mut self) -> anyhow::Result<()> {
-    if self.ignore_tls_errors {
-      info!("TLS errors will be ignored");
-    }
-
-    let mut openssl_conf = self.prepare_env()?;
-
-    self.server = normalize_server(&self.server)?;
-    let gp_params = self.build_gp_params();
-
-    // Get the initial SAML request
-    let saml_request = match self.saml_request {
-      Some(ref saml_request) => saml_request.clone(),
-      None => portal_prelogin(&self.server, &gp_params).await?,
-    };
-
-    let browser_auth = if let Some(browser) = &self.browser {
-      Some(BrowserAuthenticator::new_with_browser(&saml_request, browser))
-    } else if self.default_browser {
-      Some(BrowserAuthenticator::new(&saml_request))
-    } else {
-      None
-    };
-
-    if let Some(browser_auth) = browser_auth {
-      browser_auth.authenticate()?;
-
-      info!("Please continue the authentication process in the default browser");
-
-      let auth_result = match wait_auth_data().await {
-        Ok(auth_data) => SamlAuthResult::Success(auth_data),
-        Err(err) => SamlAuthResult::Failure(format!("{}", err)),
-      };
-
-      info!("Authentication completed");
-
-      println!("{}", json!(auth_result));
-
-      return Ok(());
-    }
-
-    self.saml_request.replace(saml_request);
-
-    let app = create_app(self.clone())?;
-
-    app.run(move |_app_handle, event| {
-      if let RunEvent::Exit = event {
-        if let Some(file) = openssl_conf.take() {
-          if let Err(err) = file.close() {
-            info!("Error closing OpenSSL config file: {}", err);
-          }
-        }
-      }
-    });
-
-    Ok(())
-  }
-
   fn prepare_env(&self) -> anyhow::Result<Option<NamedTempFile>> {
-    env_utils::patch_gui_runtime_env(self.hidpi);
+    #[cfg(feature = "webview-auth")]
+    gpapi::utils::env_utils::patch_gui_runtime_env(self.hidpi);
 
     if self.fix_openssl {
       info!("Fixing OpenSSL environment");
@@ -150,6 +101,49 @@ impl Cli {
     Ok(None)
   }
 
+  async fn run(&self) -> anyhow::Result<()> {
+    if self.ignore_tls_errors {
+      info!("TLS errors will be ignored");
+    }
+
+    let openssl_conf = self.prepare_env()?;
+
+    let server = normalize_server(&self.server)?;
+    let server: &'static str = Box::leak(server.into_boxed_str());
+    let gp_params: &'static GpParams = Box::leak(Box::new(self.build_gp_params()));
+
+    let auth_request = match self.saml_request.as_deref() {
+      Some(auth_request) => Cow::Borrowed(auth_request),
+      None => Cow::Owned(auth_prelogin(server, gp_params).await?),
+    };
+
+    let auth_request: &'static str = Box::leak(auth_request.into_owned().into_boxed_str());
+    let auth_window = AuthWindow::new(&server, gp_params).with_auth_request(&auth_request);
+
+    let browser = if cfg!(feature = "webview-auth") {
+      self
+        .browser
+        .as_deref()
+        .or_else(|| self.default_browser.then_some("default"))
+    } else {
+      self.browser.as_deref().or(Some("default"))
+    };
+
+    if browser.is_some() {
+      let auth_result = auth_window.browser_authenticate(browser).await;
+      print_auth_result(auth_result);
+
+      // explicitly drop openssl_conf to avoid the unused variable warning
+      drop(openssl_conf);
+      return Ok(());
+    }
+
+    #[cfg(feature = "webview-auth")]
+    crate::webview_auth::authenticate(&self, auth_window, openssl_conf)?;
+
+    Ok(())
+  }
+
   fn build_gp_params(&self) -> GpParams {
     let gp_params = GpParams::builder()
       .user_agent(&self.user_agent)
@@ -161,37 +155,6 @@ impl Cli {
 
     gp_params
   }
-
-  async fn saml_auth(&self, app_handle: AppHandle) -> anyhow::Result<SamlAuthData> {
-    let auth_window = AuthWindow::new(app_handle)
-      .server(&self.server)
-      .user_agent(&self.user_agent)
-      .gp_params(self.build_gp_params())
-      .saml_request(self.saml_request.as_ref().unwrap())
-      .clean(self.clean);
-
-    auth_window.open().await
-  }
-}
-
-fn create_app(cli: Cli) -> anyhow::Result<App> {
-  let app = tauri::Builder::default()
-    .setup(|app| {
-      let app_handle = app.handle();
-
-      tauri::async_runtime::spawn(async move {
-        let auth_result = match cli.saml_auth(app_handle.clone()).await {
-          Ok(auth_data) => SamlAuthResult::Success(auth_data),
-          Err(err) => SamlAuthResult::Failure(format!("{}", err)),
-        };
-
-        println!("{}", json!(auth_result));
-      });
-      Ok(())
-    })
-    .build(tauri::generate_context!())?;
-
-  Ok(app)
 }
 
 fn init_logger() {
@@ -199,53 +162,22 @@ fn init_logger() {
 }
 
 pub async fn run() {
-  let mut cli = Cli::parse();
+  let cli = Cli::parse();
 
   init_logger();
   info!("gpauth started: {}", VERSION);
 
   if let Err(err) = cli.run().await {
-    eprintln!("\nError: {}", err);
-
-    if err.to_string().contains("unsafe legacy renegotiation") && !cli.fix_openssl {
-      eprintln!("\nRe-run it with the `--fix-openssl` option to work around this issue, e.g.:\n");
-      // Print the command
-      let args = std::env::args().collect::<Vec<_>>();
-      eprintln!("{} --fix-openssl {}\n", args[0], args[1..].join(" "));
-    }
-
+    handle_error(err, &cli);
     std::process::exit(1);
   }
 }
 
-async fn wait_auth_data() -> anyhow::Result<SamlAuthData> {
-  // Start a local server to receive the browser authentication data
-  let listener = TcpListener::bind("127.0.0.1:0").await?;
-  let port = listener.local_addr()?.port();
-  let port_file = temp_dir().join("gpcallback.port");
+pub fn print_auth_result(auth_result: anyhow::Result<SamlAuthData>) {
+  let auth_result = match auth_result {
+    Ok(auth_data) => SamlAuthResult::Success(auth_data),
+    Err(err) => SamlAuthResult::Failure(format!("{}", err)),
+  };
 
-  // Write the port to a file
-  fs::write(&port_file, port.to_string())?;
-  fs::set_permissions(&port_file, fs::Permissions::from_mode(0o600))?;
-
-  // Remove the previous log file
-  let callback_log = temp_dir().join("gpcallback.log");
-  let _ = fs::remove_file(&callback_log);
-
-  info!("Listening authentication data on port {}", port);
-  info!(
-    "If it hangs, please check the logs at `{}` for more information",
-    callback_log.display()
-  );
-  let (mut socket, _) = listener.accept().await?;
-
-  info!("Received the browser authentication data from the socket");
-  let mut data = String::new();
-  socket.read_to_string(&mut data).await?;
-
-  // Remove the port file
-  fs::remove_file(&port_file)?;
-
-  let auth_data = SamlAuthData::from_gpcallback(&data)?;
-  Ok(auth_data)
+  println!("{}", json!(auth_result));
 }

apps/gpauth/src/main.rs

@@ -1,7 +1,8 @@
 #![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
 
-mod auth_window;
 mod cli;
+#[cfg(feature = "webview-auth")]
+mod webview_auth;
 
 #[tokio::main]
 async fn main() {

apps/gpauth/src/webview_auth.rs

@@ -0,0 +1,41 @@
+use auth::{AuthWindow, WebviewAuthenticator};
+use log::info;
+use tauri::RunEvent;
+use tempfile::NamedTempFile;
+
+use crate::cli::{print_auth_result, Cli};
+
+pub fn authenticate(
+  cli: &Cli,
+  auth_window: AuthWindow<'static>,
+  mut openssl_conf: Option<NamedTempFile>,
+) -> anyhow::Result<()> {
+  let auth_window = auth_window.with_clean(cli.clean);
+
+  tauri::Builder::default()
+    .setup(move |app| {
+      let app_handle = app.handle().clone();
+
+      tauri::async_runtime::spawn(async move {
+        let auth_result = auth_window.webview_authenticate(&app_handle).await;
+        print_auth_result(auth_result);
+
+        // Ensure the app exits after the authentication process
+        app_handle.exit(0);
+      });
+
+      Ok(())
+    })
+    .build(tauri::generate_context!())?
+    .run(move |_app_handle, event| {
+      if let RunEvent::Exit = event {
+        if let Some(file) = openssl_conf.take() {
+          if let Err(err) = file.close() {
+            info!("Error closing OpenSSL config file: {}", err);
+          }
+        }
+      }
+    });
+
+  Ok(())
+}

apps/gpauth/tauri.conf.json

@@ -1,47 +1,16 @@
 {
-  "$schema": "https://cdn.jsdelivr.net/gh/tauri-apps/tauri@tauri-v1.5.0/tooling/cli/schema.json",
+  "$schema": "https://cdn.jsdelivr.net/gh/tauri-apps/tauri@tauri-v2.1.1/crates/tauri-cli/config.schema.json",
   "build": {
-    "distDir": [
-      "index.html"
-    ],
-    "devPath": [
-      "index.html"
-    ],
+    "frontendDist": ["index.html"],
     "beforeDevCommand": "",
-    "beforeBuildCommand": "",
-    "withGlobalTauri": false
+    "beforeBuildCommand": ""
   },
-  "package": {
-    "productName": "gpauth",
-    "version": "0.0.0"
-  },
-  "tauri": {
-    "allowlist": {
-      "all": false,
-      "http": {
-        "all": true,
-        "request": true,
-        "scope": [
-          "http://*",
-          "https://*"
-        ]
-      }
-    },
-    "bundle": {
-      "active": true,
-      "targets": "deb",
-      "identifier": "com.yuezk.gpauth",
-      "icon": [
-        "icons/32x32.png",
-        "icons/128x128.png",
-        "icons/128x128@2x.png",
-        "icons/icon.icns",
-        "icons/icon.ico"
-      ]
-    },
+  "identifier": "com.yuezk.gpauth",
+  "productName": "gpauth",
+  "app": {
+    "withGlobalTauri": false,
     "security": {
       "csp": null
-    },
-    "windows": []
+    }
   }
 }