/** * Browser import service - lists importable sources and writes their cookies * into a T3 Code browser profile's Electron partition. * * @module BrowserImport */import type {  BrowserImportInput,  BrowserImportResult,  BrowserImportSource,  BrowserImportUnavailableReason,} from "@t3tools/contracts";import { BrowserImportFailureReason } from "@t3tools/contracts";import * as Context from "effect/Context";import type { Session } from "electron";import * as Effect from "effect/Effect";import * as FileSystem from "effect/FileSystem";import * as Layer from "effect/Layer";import * as Path from "effect/Path";import * as Schema from "effect/Schema";import * as Scope from "effect/Scope";import { ChildProcessSpawner } from "effect/unstable/process"; import { HostProcessExecutablePath, HostProcessPlatform } from "@t3tools/shared/hostProcess"; import * as BrowserSession from "../BrowserSession.ts";import { ChromiumCookieReadError, readChromiumCookies } from "./ChromiumCookies.ts";import type { CookieReadResult } from "./CookieDatabase.ts";import { FirefoxCookieReadError, readFirefoxCookies } from "./FirefoxCookies.ts";import { readSafariCookies, safariAccessDenied, SafariCookieReadError } from "./SafariCookies.ts";import {  BROWSER_IMPORT_SOURCES,  resolveCookieDatabase,  isSourceInstalled,  isSourceRunning,  listSourceProfiles,  sourcePathContext,  type BrowserImportPathContext,  type BrowserImportSourceDefinition,} from "./Sources.ts"; export class BrowserImportFailedError extends Schema.TaggedError<BrowserImportFailedError>()(  "BrowserImportFailedError",  {    sourceId: Schema.String,    reason: BrowserImportFailureReason,    /** Kept for the log; the user only ever sees the reason's copy. */    cause: Schema.optional(Schema.Defect()),  },) {  // The reason token is part of the message on purpose: IPC flattens the error  // to its message, and the renderer maps that token back to user-facing copy.  override get message(): string {    return `Importing cookies from ${this.sourceId} failed: ${this.reason}.`;  }} export class BrowserCookieWriteError extends Schema.TaggedError<BrowserCookieWriteError>()(  "BrowserCookieWriteError",  {    url: Schema.String,    name: Schema.String,    cause: Schema.Defect(),  },) {  override get message(): string {    return `Could not write imported cookie ${this.name} for ${this.url}.`;  }} export class BrowserImport extends Context.Service<  BrowserImport,  {    readonly listSources: Effect.Effect<ReadonlyArray<BrowserImportSource>>;    readonly importCookies: (input: {      readonly input: BrowserImportInput;      /** Partition scope of the target profile, derived by the caller in main. */      readonly scope: string;      readonly persistent: boolean;      readonly namespace?: BrowserSession.BrowserSessionPartitionNamespace;    }) => Effect.Effect<BrowserImportResult, BrowserImportFailedError>;  }>()("@t3tools/desktop/preview/BrowserImport/BrowserImport") {} const unavailableReason = Effect.fn("BrowserImport.unavailableReason")(function* (  definition: BrowserImportSourceDefinition,  context: BrowserImportPathContext,): Effect.fn.Return<  BrowserImportUnavailableReason | undefined,  never,  FileSystem.FileSystem | ChildProcessSpawner.ChildProcessSpawner> {  if (!definition.platforms.includes(context.platform)) return "unsupportedPlatform";  if (!(yield* isSourceInstalled(definition, context))) return "notInstalled";  if (yield* isSourceRunning(definition, context)) return "browserRunning";  // Safari's jar is found by `stat`, which TCC permits without Full Disk  // Access — so a Safari that lists as ready may still refuse the read. Probe  // the grant here, so the wizard can open on the permission step and a  // post-grant recheck can tell granted from still-denied, rather than only  // discovering it by attempting the import.  if (definition.engine === "safari") {    const jar = yield* resolveCookieDatabase(definition, context, ".");    if (jar !== undefined && (yield* safariAccessDenied(jar))) return "needsFullDiskAccess";  }  return undefined;}); /** The host a constructed cookie URL points at, for naming what was skipped. */const cookieHost = (url: string): string => {  try {    return new URL(url).hostname;  } catch {    return url;  }}; export const writeCookies = Effect.fn("BrowserImport.writeCookies")(function* (  session: { readonly cookies: Pick<Session["cookies"], "set" | "flushStore"> },  read: CookieReadResult,) {  let imported = 0;  let skipped = read.undecryptable;  const skippedDomains = new Set(read.undecryptableHosts);  for (const cookie of read.cookies) {    const written = yield* Effect.tryPromise({      try: () =>        session.cookies.set({          url: cookie.url,          name: cookie.name,          value: cookie.value,          // Omitted for host-only cookies: Electron reads any `domain` as a          // domain cookie and re-adds the leading dot, widening its scope.          ...(cookie.domain === undefined ? {} : { domain: cookie.domain }),          path: cookie.path,          secure: cookie.secure,          httpOnly: cookie.httpOnly,          sameSite: cookie.sameSite,          ...(cookie.expirationDate === undefined ? {} : { expirationDate: cookie.expirationDate }),        }),      catch: (cause) => new BrowserCookieWriteError({ url: cookie.url, name: cookie.name, cause }),    }).pipe(      Effect.as(true),      Effect.tapError((error) => Effect.logDebug(error.message, { cause: error.cause })),      Effect.catchTags({ BrowserCookieWriteError: () => Effect.succeed(false) }),    );    if (written) {      imported += 1;    } else {      skipped += 1;      skippedDomains.add(cookieHost(cookie.url));    }  }  // `set` resolves once the cookie is in memory; Chromium writes the store to  // disk on its own schedule. Flush before reporting "Done", so a crash right  // after does not lose what the user was just told was imported. A failed  // flush is logged rather than surfaced: the cookies are still in the  // session and land on disk at the next scheduled write.  if (imported > 0) {    yield* Effect.tryPromise(() => session.cookies.flushStore()).pipe(      Effect.tapError((error) =>        Effect.logWarning("Imported cookies could not be flushed to disk", { cause: error.cause }),      ),      Effect.ignore,    );  }  return { imported, skipped, skippedDomains: [...skippedDomains].slice(0, 20) };}); /** @public Service construction is part of the canonical Effect module API. */export const make = Effect.gen(function* BrowserImportMake() {  const browserSession = yield* BrowserSession.BrowserSession;  const platform = yield* HostProcessPlatform;  const executablePath = yield* HostProcessExecutablePath;  // Captured here so the service's methods stay free of a requirements  // channel: the layer is built where NodeServices is already in scope.  const platformServices = yield* Effect.context<    FileSystem.FileSystem | Path.Path | ChildProcessSpawner.ChildProcessSpawner  >();  const pathContext = yield* sourcePathContext;   const listSources: Effect.Effect<ReadonlyArray<BrowserImportSource>> = Effect.forEach(    BROWSER_IMPORT_SOURCES,    Effect.fnUntraced(function* (definition) {      const unavailable = yield* unavailableReason(definition, pathContext);      return {        id: definition.id,        name: definition.name,        // Listing profiles touches the source's own files, so skip it when the        // source is unusable anyway.        profiles:          unavailable === undefined ? yield* listSourceProfiles(definition, pathContext) : [],        ...(unavailable === undefined ? {} : { unavailable }),      } satisfies BrowserImportSource;    }),  ).pipe(Effect.provide(platformServices));   const importCookies = Effect.fn("BrowserImport.importCookies")(function* (input: {    readonly input: BrowserImportInput;    readonly scope: string;    readonly persistent: boolean;    readonly namespace?: BrowserSession.BrowserSessionPartitionNamespace;  }) {    const definition = BROWSER_IMPORT_SOURCES.find(      (candidate) => candidate.id === input.input.sourceId,    );    if (!definition) {      return yield* new BrowserImportFailedError({        sourceId: input.input.sourceId,        reason: "unknownSource",      });    }     const blocked = yield* unavailableReason(definition, pathContext).pipe(      Effect.provide(platformServices),    );    if (blocked !== undefined) {      return yield* new BrowserImportFailedError({ sourceId: definition.id, reason: blocked });    }     if (platform === "darwin" && definition.engine === "chromium") {      // macOS attributes the Keychain prompt and the resulting ACL grant to the      // executable that asks, so record which one that was — in a packaged build      // it is the signed app, in dev whatever binary hosts the main process.      yield* Effect.logInfo("Reading browser cookie key from the keychain", {        sourceId: definition.id,        executablePath,      });    }     // The profile directory arrives over IPC, so it is only honoured when the    // source itself reported it. Forwarding it unchecked would let `..`    // segments walk out of the browser's user-data directory and read any    // cookie database reachable on disk.    const sourceProfiles = yield* listSourceProfiles(definition, pathContext).pipe(      Effect.provide(platformServices),    );    const requestedProfile = sourceProfiles.find(      (profile) => profile.directory === input.input.sourceProfileDirectory,    );    if (requestedProfile === undefined) {      return yield* new BrowserImportFailedError({        sourceId: definition.id,        reason: "unknownSourceProfile",      });    }     // The profile was listed against a database moments ago; resolve it again    // rather than assume a path, since a Chromium jar may sit under `Network/`.    const databasePath = yield* resolveCookieDatabase(      definition,      pathContext,      requestedProfile.directory,    ).pipe(Effect.provide(platformServices));    if (databasePath === undefined) {      // A profile we listed moments ago can lose its database before the      // import runs (browser data cleanup, a profile reset). That is a read      // failure, not a platform problem.      return yield* new BrowserImportFailedError({ sourceId: definition.id, reason: "readFailed" });    }     // Both branches fail with a tagged error, so the union stays structurally    // identifiable and each tag is handled on its own below. The success side    // is normalized to one shape too, so the skipped tally survives either    // engine — Firefox stores plaintext, so nothing there is ever unreadable.    const userDataDirectory = definition.userDataDirectory(pathContext);    const read: Effect.Effect<      CookieReadResult,      ChromiumCookieReadError | FirefoxCookieReadError | SafariCookieReadError,      FileSystem.FileSystem | Path.Path | Scope.Scope | ChildProcessSpawner.ChildProcessSpawner    > =      definition.engine === "safari"        ? readSafariCookies(databasePath).pipe(            Effect.map((cookies) => ({ cookies, undecryptable: 0, undecryptableHosts: [] })),          )        : definition.engine === "firefox"          ? readFirefoxCookies(databasePath).pipe(              Effect.map((cookies) => ({ cookies, undecryptable: 0, undecryptableHosts: [] })),            )          : readChromiumCookies({              cookieDatabasePath: databasePath,              keychainService: definition.keychainService,              keychainAccount: definition.keychainAccount,              linuxSecretApplication: definition.linuxSecretApplication,              ...(platform === "win32" && userDataDirectory !== undefined                ? {                    windowsLocalStatePath: pathContext.path.join(userDataDirectory, "Local State"),                  }                : {}),              platform,            });     const result = yield* read.pipe(      Effect.scoped,      Effect.provide(platformServices),      Effect.catchTags({        ChromiumCookieReadError: (cause) =>          Effect.fail(            new BrowserImportFailedError({ sourceId: definition.id, reason: cause.reason, cause }),          ),        // Firefox has one failure mode — its plaintext database would not open        // — so its error carries no reason of its own and the user-facing one        // is supplied here.        FirefoxCookieReadError: (cause) =>          Effect.fail(            new BrowserImportFailedError({ sourceId: definition.id, reason: "readFailed", cause }),          ),        // Safari's reasons are already user-facing: a TCC refusal is the Full        // Disk Access prompt, anything else is a read failure.        SafariCookieReadError: (cause) =>          Effect.fail(            new BrowserImportFailedError({ sourceId: definition.id, reason: cause.reason, cause }),          ),      }),    );     const session = yield* browserSession      .getSession(input.scope, input.persistent, input.namespace)      .pipe(        Effect.mapError(          (cause) =>            new BrowserImportFailedError({              sourceId: definition.id,              reason: "sessionUnavailable",              cause,            }),        ),      );     // Written one at a time rather than in parallel: Chromium's cookie store    // serialises writes anyway, and a rejected cookie should only cost itself.    return yield* writeCookies(session, result);  });   return BrowserImport.of({ listSources, importCookies });}); export const layer = Layer.effect(BrowserImport, make);