On ramp integration cleanup

apps/desktop-wallet/electron/main.ts

@@ -9,6 +9,7 @@ import { configureAutoUpdater, handleAutoUpdaterUserActions, setupAutoUpdaterLis
 import { setupLedgerDevicePermissions } from './ledger'
 import { setupAppMenu } from './menu'
 import { handleNativeThemeUserActions, setupNativeThemeListeners } from './nativeTheme'
+import { handleOnRampWindows } from './onRamp'
 import { ICON_PATH, RENDERER_PATH } from './paths'
 import { IS_RC, isIpcSenderValid, isMac, isWindows } from './utils'
 import {
@@ -34,8 +35,6 @@ contextMenu()
 // Keep a global reference of the window object, if you don't, the window will
 // be closed automatically when the JavaScript object is garbage collected.
 let mainWindow: BrowserWindow | null
-// Window for on-ramp services
-let onRampWindow: BrowserWindow | null
 
 function createWindow() {
   mainWindow = new BrowserWindow({
@@ -127,6 +126,8 @@ app.on('ready', async function () {
 
   handleAutoUpdaterUserActions()
 
+  handleOnRampWindows(mainWindow)
+
   ipcMain.handle('app:hide', ({ senderFrame }) => {
     if (!isIpcSenderValid(senderFrame)) return null
 
@@ -208,68 +209,6 @@ app.on('ready', async function () {
     mainWindow?.webContents.send('window:maximized', false)
   })
 
-  ipcMain.handle('app:openOnRampServiceWindow', (event, { url, targetLocation }) => {
-    if (onRampWindow) {
-      onRampWindow.show()
-      return
-    }
-
-    onRampWindow = new BrowserWindow({
-      width: 1000,
-      height: 800,
-      webPreferences: {
-        contextIsolation: true,
-        webSecurity: true
-      }
-    })
-
-    onRampWindow.loadURL(url)
-
-    onRampWindow.webContents.on('did-navigate', (event, currentUrl) => {
-      console.log(`Navigated to: ${currentUrl}`)
-      if (currentUrl.includes(targetLocation)) {
-        onRampWindow?.close()
-        onRampWindow = null
-
-        mainWindow?.webContents.send('target-location-reached')
-      }
-    })
-
-    // Ensure window reference is cleaned up
-    onRampWindow.on('closed', () => {
-      onRampWindow = null
-    })
-
-    // Handle child windows opening (onramper opens provider in a new window)
-    onRampWindow.webContents.setWindowOpenHandler(({ url }) => {
-      const childWindow = new BrowserWindow({
-        parent: onRampWindow!,
-        width: 800,
-        height: 600,
-        webPreferences: {
-          contextIsolation: true,
-          webSecurity: true
-        }
-      })
-      childWindow.loadURL(url)
-
-      // Listen for navigation events on the new window
-      childWindow.webContents.on('did-navigate', (event, currentUrl) => {
-        console.log(`Child window navigated to: ${currentUrl}`)
-        if (currentUrl.includes(targetLocation)) {
-          childWindow?.close()
-          onRampWindow?.close()
-          onRampWindow = null
-
-          mainWindow?.webContents.send('target-location-reached')
-        }
-      })
-
-      // Prevent the default action (which would be Electron creating a default window)
-      return { action: 'deny' }
-    })
-  })
-
   createWindow()
 })
 

apps/desktop-wallet/electron/onRamp.ts

@@ -0,0 +1,63 @@
+import { BrowserWindow, ipcMain } from 'electron'
+
+export const handleOnRampWindows = (mainWindow: BrowserWindow | null) => {
+  let onRampWindow: BrowserWindow | null
+
+  ipcMain.handle('app:openOnRampServiceWindow', (event, { url, targetLocation }) => {
+    if (onRampWindow) {
+      onRampWindow.show()
+      return
+    }
+
+    onRampWindow = new BrowserWindow({
+      width: 1000,
+      height: 800,
+      webPreferences: {
+        contextIsolation: true,
+        webSecurity: true
+      }
+    })
+
+    // Ensure window reference is cleaned up when closed
+    onRampWindow.on('closed', () => {
+      onRampWindow = null
+    })
+
+    onRampWindow.loadURL(url)
+
+    onRampWindow.webContents.on('did-navigate', (event, currentUrl) => {
+      if (currentUrl.includes(targetLocation)) {
+        onRampWindow?.close()
+
+        mainWindow?.webContents.send('target-location-reached')
+      }
+    })
+
+    // Handle child windows opening (onramper opens provider in a new window)
+    onRampWindow.webContents.setWindowOpenHandler(({ url }) => {
+      const childWindow = new BrowserWindow({
+        parent: onRampWindow!,
+        width: 800,
+        height: 600,
+        webPreferences: {
+          contextIsolation: true,
+          webSecurity: true
+        }
+      })
+      childWindow.loadURL(url)
+
+      // Listen for navigation events on the new window
+      childWindow.webContents.on('did-navigate', (event, currentUrl) => {
+        if (currentUrl.includes(targetLocation)) {
+          childWindow?.close()
+          onRampWindow?.close()
+
+          mainWindow?.webContents.send('target-location-reached')
+        }
+      })
+
+      // Prevent the default action (which would be Electron creating a default window)
+      return { action: 'deny' }
+    })
+  })
+}

apps/desktop-wallet/electron/preload.ts

@@ -65,9 +65,13 @@ contextBridge.exposeInMainWorld('electron', {
     openOnRampServiceWindow: ({ url, targetLocation }: { url: string; targetLocation: string }) =>
       ipcRenderer.invoke('app:openOnRampServiceWindow', { url, targetLocation }),
     onOnRampTargetLocationReached: (callback: () => void) => {
-      ipcRenderer.on('target-location-reached', callback)
+      // Don't pass the event object to the callback for security reasons (cf. https://www.electronjs.org/docs/latest/tutorial/security#20-do-not-expose-electron-apis-to-untrusted-web-content)
+      const sanitizedCallback = (_event: IpcRendererEvent) => {
+        callback()
+      }
+      ipcRenderer.on('target-location-reached', sanitizedCallback)
 
-      return () => ipcRenderer.removeListener('target-location-reached', callback)
+      return () => ipcRenderer.removeListener('target-location-reached', sanitizedCallback)
     },
     setProxySettings: (proxySettings: ProxySettings) => ipcRenderer.invoke('app:setProxySettings', proxySettings),
     restart: () => ipcRenderer.invoke('app:restart')