mirror of
https://github.com/rustdesk/rustdesk.git
synced 2026-08-26 16:16:46 +00:00
Login options error feedback (#15727)
* fix(flutter): show error and retry when fetching login options fails The third-party login section of the login dialog was silently hidden whenever /api/login-options could not be fetched (e.g. TLS handshake aborted by a router/ISP scam filter, discussion #15700), leaving users staring at a dialog with no feedback. The pure-Dart HTTP path also had no timeout, so a black-holed connection could hang indefinitely. - let transport errors propagate from queryOidcLoginOptions instead of swallowing them; a non-JSON response still means "no third-party login" so self-hosted servers without this API keep the old behavior - show network_error_tip, a Retry button, and the underlying error in the login dialog so users and supporters can see what failed - bound the Dart HTTP branch with a 15s timeout; the Rust branch keeps its own bounded per-attempt timeouts and is awaited to completion so a retry never races the URL-keyed ASYNC_HTTP_STATUS entry of an abandoned in-flight request Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(flutter): surface currentUser refresh failures that were only logged Non-transport failures of the token auto-login (/api/currentUser) -- a bad HTTP status, a filter's HTML block page, or an error field in the body -- were only debugPrinted, so the address book / group tabs showed nothing and offered no retry. Reuse the existing networkError channel so netWorkErrorWidget shows the error with its Retry button. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(flutter): keep retry row visible with progress while refetching login options Review follow-ups: clicking Retry used to clear the error and hide the row with no pending feedback, which could read as a dead click while the Rust fallback chain runs; keep the row, disable the button, and show the usual LinearProgressIndicator instead. Also raise the Dart HTTP branch timeout to 30s so large web address book pulls on slow links do not newly time out; it still bounds the previously unbounded hang and stays above the Rust side's 12s per-attempt timeout. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore: update webpki-roots to latest Mozilla root store 0.26.9 -> 0.26.11 (now a forwarding shim over 1.x, used by tungstenite) 1.0.4 -> 1.0.9 (used by reqwest / hyper-rustls / hbb_common) The 0.26.9 line carried its own root snapshot frozen in early 2025, so the websocket TLS path was building against a stale bundle. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci: weekly workflow to PR webpki-roots root store updates webpki-roots is a transitive dependency, so dependabot's cargo version updates would not cover it. A scheduled job runs cargo update for every webpki-roots instance in each lockfile and opens a PR when the pinned Mozilla root snapshot is behind, keeping root store changes reviewable instead of baking them silently into release builds. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(flutter): hide network tip for server-reported currentUser errors Review follow-up: when /api/currentUser fails with an error the server itself reported (an error field in a JSON body, or an unexpected schema), "Please check your network connection" was misleading. Track whether the surfaced error came from a server response and skip the network tip for those; FormatException (a non-JSON body such as a filter's block page) keeps it, since that still indicates a network or middlebox problem. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(flutter): close timed-out HTTP clients * fix(flutter): flag server-reported errors at the throw site Review follow-up (CodeRabbit). Classifying by `e is! FormatException` mislabeled ambiguous failures: a middlebox block page returning 200 with valid-but-wrong-shape JSON throws a TypeError from fromJson and was shown without the check-your-network tip, though it is a network artifact. Set networkErrorFromServer only at the one site that is certainly server-reported (an error field in the body); every other failure keeps the network tip plus the raw error text. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci: serialize webpki-roots update runs, null-delimit lockfile paths Review follow-up (CodeRabbit). A manual dispatch overlapping the weekly cron could have an older run force-push over the newer branch state; queue runs via a concurrency group without cancel-in-progress. Also iterate lockfiles with git ls-files -z so a path with spaces cannot be word-split, and keep the loop failing the step on any cargo error. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(flutter): improve login retry feedback Use the theme primary color for the Retry button and hide stale error messages while a retry is in progress. Signed-off-by: fufesou <linlong1266@gmail.com> * fix(flutter): surface login option response errors Signed-off-by: fufesou <linlong1266@gmail.com> --------- Signed-off-by: fufesou <linlong1266@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: fufesou <linlong1266@gmail.com>
This commit is contained in:
RustDesk
co-authored by
Claude Fable 5
fufesou
Claude Fable 5
fufesou
parent
a5018a022b
commit
ffe20bb297
@@ -0,0 +1,71 @@
|
||||
name: Update webpki-roots
|
||||
|
||||
# Weekly refresh of the compiled-in TLS root certificates (the webpki-roots
|
||||
# crate, a snapshot of the Mozilla root store). Roots are otherwise frozen at
|
||||
# whatever Cargo.lock pins, so old builds miss newly added CAs and keep
|
||||
# removed (distrusted) ones. Changes go through a PR on purpose: added or
|
||||
# removed roots should be reviewed, not silently baked into releases.
|
||||
#
|
||||
# Note: PRs created with the default GITHUB_TOKEN do not trigger other
|
||||
# workflows (GitHub limitation). Close and reopen the PR, or push to its
|
||||
# branch, to run CI on it.
|
||||
|
||||
on:
|
||||
schedule:
|
||||
- cron: "0 3 * * 1"
|
||||
workflow_dispatch:
|
||||
|
||||
# A manual dispatch overlapping the weekly run would race it force-pushing
|
||||
# the same branch; queue instead of overlapping, and never cancel a run
|
||||
# that may have already pushed.
|
||||
concurrency:
|
||||
group: update-webpki-roots
|
||||
cancel-in-progress: false
|
||||
|
||||
jobs:
|
||||
update:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: write
|
||||
pull-requests: write
|
||||
env:
|
||||
BRANCH: auto-update-webpki-roots
|
||||
steps:
|
||||
- name: Checkout source code
|
||||
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
||||
|
||||
- name: Update webpki-roots in all lockfiles
|
||||
id: update
|
||||
run: |
|
||||
set -e
|
||||
git ls-files -z '*Cargo.lock' | while IFS= read -r -d '' lock; do
|
||||
dir=$(dirname "$lock")
|
||||
for v in $(sed -n '/name = "webpki-roots"/{n;s/.*version = "\(.*\)"/\1/p;}' "$lock" | sort -u); do
|
||||
echo "updating webpki-roots@$v in $dir"
|
||||
(cd "$dir" && cargo update -p "webpki-roots@$v")
|
||||
done
|
||||
done
|
||||
if git diff --quiet -- '*Cargo.lock'; then
|
||||
echo "changed=0" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "changed=1" >> "$GITHUB_OUTPUT"
|
||||
git --no-pager diff -- '*Cargo.lock'
|
||||
fi
|
||||
|
||||
- name: Create pull request
|
||||
if: steps.update.outputs.changed == '1'
|
||||
env:
|
||||
GH_TOKEN: ${{ github.token }}
|
||||
run: |
|
||||
set -e
|
||||
git config user.name "github-actions[bot]"
|
||||
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
||||
git checkout -B "$BRANCH"
|
||||
git add -- '*Cargo.lock'
|
||||
git commit -m "chore: update webpki-roots to latest Mozilla root store"
|
||||
git push -f origin "$BRANCH"
|
||||
if [ -z "$(gh pr list --head "$BRANCH" --state open --json number --jq '.[].number')" ]; then
|
||||
gh pr create \
|
||||
--title "chore: update webpki-roots to latest Mozilla root store" \
|
||||
--body "Automated weekly refresh of the compiled-in TLS root certificates (webpki-roots). Please review the added/removed roots. CI does not run automatically on PRs created by GITHUB_TOKEN; close and reopen this PR to trigger it."
|
||||
fi
|
||||
Generated
+10
-10
@@ -3821,7 +3821,7 @@ dependencies = [
|
||||
"url",
|
||||
"users 0.11.0",
|
||||
"uuid",
|
||||
"webpki-roots 1.0.4",
|
||||
"webpki-roots 1.0.9",
|
||||
"webrtc",
|
||||
"whoami",
|
||||
"winapi 0.3.9",
|
||||
@@ -4020,7 +4020,7 @@ dependencies = [
|
||||
"tokio",
|
||||
"tokio-rustls",
|
||||
"tower-service",
|
||||
"webpki-roots 1.0.4",
|
||||
"webpki-roots 1.0.9",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -7112,7 +7112,7 @@ dependencies = [
|
||||
"wasm-bindgen",
|
||||
"wasm-bindgen-futures",
|
||||
"web-sys",
|
||||
"webpki-roots 1.0.4",
|
||||
"webpki-roots 1.0.9",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -8826,7 +8826,7 @@ dependencies = [
|
||||
"tokio-native-tls",
|
||||
"tokio-rustls",
|
||||
"tungstenite",
|
||||
"webpki-roots 0.26.9",
|
||||
"webpki-roots 0.26.11",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -9140,7 +9140,7 @@ dependencies = [
|
||||
"sha1",
|
||||
"thiserror 2.0.17",
|
||||
"utf-8",
|
||||
"webpki-roots 0.26.9",
|
||||
"webpki-roots 0.26.11",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -9813,18 +9813,18 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "webpki-roots"
|
||||
version = "0.26.9"
|
||||
version = "0.26.11"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "29aad86cec885cafd03e8305fd727c418e970a521322c91688414d5b8efba16b"
|
||||
checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
|
||||
dependencies = [
|
||||
"rustls-pki-types",
|
||||
"webpki-roots 1.0.9",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "webpki-roots"
|
||||
version = "1.0.4"
|
||||
version = "1.0.9"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "b2878ef029c47c6e8cf779119f20fcf52bde7ad42a731b2a304bc221df17571e"
|
||||
checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
|
||||
dependencies = [
|
||||
"rustls-pki-types",
|
||||
]
|
||||
|
||||
@@ -4048,7 +4048,8 @@ Widget netWorkErrorWidget() {
|
||||
mainAxisAlignment: MainAxisAlignment.center,
|
||||
crossAxisAlignment: CrossAxisAlignment.center,
|
||||
children: [
|
||||
Text(translate("network_error_tip")),
|
||||
if (!gFFI.userModel.networkErrorFromServer.value)
|
||||
Text(translate("network_error_tip")),
|
||||
ElevatedButton(
|
||||
onPressed: gFFI.userModel.refreshCurrentUser,
|
||||
child: Text(translate("Retry")))
|
||||
|
||||
@@ -267,8 +267,7 @@ class _WidgetOPState extends State<WidgetOP> {
|
||||
Padding(
|
||||
padding: const EdgeInsets.only(top: 8.0),
|
||||
child: Builder(builder: (context) {
|
||||
final errorColor =
|
||||
Theme.of(context).colorScheme.error;
|
||||
final errorColor = Theme.of(context).colorScheme.error;
|
||||
final bgColor = Theme.of(context)
|
||||
.colorScheme
|
||||
.errorContainer
|
||||
@@ -289,12 +288,11 @@ class _WidgetOPState extends State<WidgetOP> {
|
||||
Flexible(
|
||||
child: SelectableText(
|
||||
translate(_failedMsg),
|
||||
style: DefaultTextStyle.of(context)
|
||||
.style
|
||||
.copyWith(
|
||||
fontSize: 13,
|
||||
color: errorColor,
|
||||
),
|
||||
style:
|
||||
DefaultTextStyle.of(context).style.copyWith(
|
||||
fontSize: 13,
|
||||
color: errorColor,
|
||||
),
|
||||
),
|
||||
),
|
||||
],
|
||||
@@ -468,9 +466,22 @@ Future<bool?> loginDialog() async {
|
||||
bool isCloseHovered = false;
|
||||
|
||||
final loginOptions = [].obs;
|
||||
Future.delayed(Duration.zero, () async {
|
||||
loginOptions.value = await UserModel.queryOidcLoginOptions();
|
||||
});
|
||||
final loginOptionsError = Rxn<String>();
|
||||
final loginOptionsInProgress = false.obs;
|
||||
fetchLoginOptions() async {
|
||||
loginOptionsInProgress.value = true;
|
||||
try {
|
||||
loginOptions.value = await UserModel.queryOidcLoginOptions();
|
||||
loginOptionsError.value = null;
|
||||
} catch (e) {
|
||||
debugPrint("queryOidcLoginOptions failed: $e");
|
||||
loginOptionsError.value = e.toString();
|
||||
} finally {
|
||||
loginOptionsInProgress.value = false;
|
||||
}
|
||||
}
|
||||
|
||||
Future.delayed(Duration.zero, fetchLoginOptions);
|
||||
|
||||
final res = await gFFI.dialogManager.show<bool>((setState, close, context) {
|
||||
username.addListener(() {
|
||||
@@ -574,6 +585,36 @@ Future<bool?> loginDialog() async {
|
||||
}
|
||||
|
||||
thirdAuthWidget() => Obx(() {
|
||||
final error = loginOptionsError.value;
|
||||
final inProgress = loginOptionsInProgress.value;
|
||||
if (error != null) {
|
||||
return Column(
|
||||
children: [
|
||||
const SizedBox(height: 8.0),
|
||||
// NOT use Offstage to wrap LinearProgressIndicator
|
||||
if (inProgress) const LinearProgressIndicator(),
|
||||
if (!inProgress)
|
||||
Text(
|
||||
translate('network_error_tip'),
|
||||
style: const TextStyle(fontSize: 12),
|
||||
textAlign: TextAlign.center,
|
||||
),
|
||||
TextButton(
|
||||
style: TextButton.styleFrom(
|
||||
foregroundColor: Theme.of(context).colorScheme.primary,
|
||||
),
|
||||
onPressed: inProgress ? null : fetchLoginOptions,
|
||||
child: Text(translate('Retry')),
|
||||
),
|
||||
if (!inProgress)
|
||||
SelectableText(
|
||||
error,
|
||||
style: const TextStyle(fontSize: 11, color: Colors.red),
|
||||
textAlign: TextAlign.center,
|
||||
),
|
||||
],
|
||||
);
|
||||
}
|
||||
return Offstage(
|
||||
offstage: loginOptions.isEmpty,
|
||||
child: Column(
|
||||
|
||||
@@ -20,6 +20,9 @@ class UserModel {
|
||||
final RxString avatar = ''.obs;
|
||||
final RxBool isAdmin = false.obs;
|
||||
final RxString networkError = ''.obs;
|
||||
// True when networkError carries a server-reported error rather than a
|
||||
// connectivity failure; netWorkErrorWidget hides the network tip then.
|
||||
final RxBool networkErrorFromServer = false.obs;
|
||||
bool get isLogin => userName.isNotEmpty;
|
||||
String get displayNameOrUserName =>
|
||||
displayName.value.trim().isEmpty ? userName.value : displayName.value;
|
||||
@@ -50,6 +53,7 @@ class UserModel {
|
||||
void refreshCurrentUser() async {
|
||||
if (bind.isDisableAccount()) return;
|
||||
networkError.value = '';
|
||||
networkErrorFromServer.value = false;
|
||||
final token = bind.mainGetLocalOption(key: 'access_token');
|
||||
if (token == '') {
|
||||
await updateOtherModels();
|
||||
@@ -85,6 +89,10 @@ class UserModel {
|
||||
final data = json.decode(decode_http_response(response));
|
||||
final error = data['error'];
|
||||
if (error != null) {
|
||||
// The only failure known to come from the server itself, so the
|
||||
// check-your-network tip does not apply. Flag before the message is
|
||||
// set in the catch below so rebuilds read a consistent pair.
|
||||
networkErrorFromServer.value = true;
|
||||
throw error;
|
||||
}
|
||||
|
||||
@@ -92,6 +100,13 @@ class UserModel {
|
||||
_parseAndUpdateUser(user);
|
||||
} catch (e) {
|
||||
debugPrint('Failed to refreshCurrentUser: $e');
|
||||
// Surface failures in the address book / group tabs, which offer a
|
||||
// retry. Anything not flagged above -- transport errors, non-JSON or
|
||||
// unexpected-schema bodies (e.g. a filter's block page) -- keeps the
|
||||
// check-your-network tip.
|
||||
if (networkError.value.isEmpty) {
|
||||
networkError.value = e.toString();
|
||||
}
|
||||
} finally {
|
||||
refreshingUser = false;
|
||||
await updateOtherModels();
|
||||
@@ -219,28 +234,31 @@ class UserModel {
|
||||
return loginResponse;
|
||||
}
|
||||
|
||||
/// Throws on network failure so callers can surface the error and offer a
|
||||
/// retry; returns an empty list when the server has no third-party login.
|
||||
static Future<List<dynamic>> queryOidcLoginOptions() async {
|
||||
try {
|
||||
final url = await bind.mainGetApiServer();
|
||||
if (url.trim().isEmpty) return [];
|
||||
final resp = await http.get(Uri.parse('$url/api/login-options'));
|
||||
final List<String> ops = [];
|
||||
for (final item in jsonDecode(resp.body)) {
|
||||
ops.add(item as String);
|
||||
}
|
||||
for (final item in ops) {
|
||||
if (item.startsWith('common-oidc/')) {
|
||||
return jsonDecode(item.substring('common-oidc/'.length));
|
||||
}
|
||||
}
|
||||
return ops
|
||||
.where((item) => item.startsWith('oidc/'))
|
||||
.map((item) => {'name': item.substring('oidc/'.length)})
|
||||
.toList();
|
||||
} catch (e) {
|
||||
debugPrint(
|
||||
"queryOidcLoginOptions: jsonDecode resp body failed: ${e.toString()}");
|
||||
return [];
|
||||
final url = await bind.mainGetApiServer();
|
||||
if (url.trim().isEmpty) return [];
|
||||
final resp = await http.get(Uri.parse('$url/api/login-options'));
|
||||
const successStatusCodeStart = 200;
|
||||
const successStatusCodeEnd = 300;
|
||||
if (resp.statusCode < successStatusCodeStart ||
|
||||
resp.statusCode >= successStatusCodeEnd) {
|
||||
throw RequestException(
|
||||
resp.statusCode, resp.reasonPhrase ?? 'Request failed');
|
||||
}
|
||||
final List<String> ops = [];
|
||||
for (final item in jsonDecode(resp.body)) {
|
||||
ops.add(item as String);
|
||||
}
|
||||
for (final item in ops) {
|
||||
if (item.startsWith('common-oidc/')) {
|
||||
return jsonDecode(item.substring('common-oidc/'.length));
|
||||
}
|
||||
}
|
||||
return ops
|
||||
.where((item) => item.startsWith('oidc/'))
|
||||
.map((item) => {'name': item.substring('oidc/'.length)})
|
||||
.toList();
|
||||
}
|
||||
}
|
||||
|
||||
@@ -44,32 +44,51 @@ class HttpService {
|
||||
return _parseHttpResponse(resJson);
|
||||
}
|
||||
|
||||
// Bounds only the pure-Dart branch below, which the OS would otherwise
|
||||
// let hang forever (e.g. a black-holed TLS handshake), see #15700.
|
||||
// The Rust branch has its own 12s-per-attempt timeouts and must be
|
||||
// awaited to completion: a Dart-side timeout there would race the
|
||||
// URL-keyed ASYNC_HTTP_STATUS entry of the abandoned request.
|
||||
static const _requestTimeout = Duration(seconds: 30);
|
||||
|
||||
Future<http.Response> _pollFlutterHttp(
|
||||
Uri url,
|
||||
HttpMethod method, {
|
||||
Map<String, String>? headers,
|
||||
dynamic body,
|
||||
}) async {
|
||||
var response = http.Response('', 400);
|
||||
final client = http.Client();
|
||||
try {
|
||||
var response = http.Response('', 400);
|
||||
|
||||
switch (method) {
|
||||
case HttpMethod.get:
|
||||
response = await http.get(url, headers: headers);
|
||||
break;
|
||||
case HttpMethod.post:
|
||||
response = await http.post(url, headers: headers, body: body);
|
||||
break;
|
||||
case HttpMethod.put:
|
||||
response = await http.put(url, headers: headers, body: body);
|
||||
break;
|
||||
case HttpMethod.delete:
|
||||
response = await http.delete(url, headers: headers, body: body);
|
||||
break;
|
||||
default:
|
||||
throw Exception('Unsupported HTTP method');
|
||||
switch (method) {
|
||||
case HttpMethod.get:
|
||||
response =
|
||||
await client.get(url, headers: headers).timeout(_requestTimeout);
|
||||
break;
|
||||
case HttpMethod.post:
|
||||
response = await client
|
||||
.post(url, headers: headers, body: body)
|
||||
.timeout(_requestTimeout);
|
||||
break;
|
||||
case HttpMethod.put:
|
||||
response = await client
|
||||
.put(url, headers: headers, body: body)
|
||||
.timeout(_requestTimeout);
|
||||
break;
|
||||
case HttpMethod.delete:
|
||||
response = await client
|
||||
.delete(url, headers: headers, body: body)
|
||||
.timeout(_requestTimeout);
|
||||
break;
|
||||
default:
|
||||
throw Exception('Unsupported HTTP method');
|
||||
}
|
||||
|
||||
return response;
|
||||
} finally {
|
||||
client.close();
|
||||
}
|
||||
|
||||
return response;
|
||||
}
|
||||
|
||||
Future<String> _pollForResponse(String url) async {
|
||||
|
||||
Reference in New Issue
Block a user