From 0df423a84f8f32e34fb5301d0eea2fabbffadbba Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Thu, 8 Oct 2026 12:00:17 -0400
Subject: [PATCH] fix(ui): support secure UUIDs on LAN HTTP

Avoid eager consent component crashes and registration approval failures where crypto.randomUUID is unavailable. Share the companion audio CSPRNG fallback, preserve UUIDv4/session semantics and fail closed without secure randomness.

Validation: 24 focused UUID, consent mount, registration recovery and companion audio tests passed. Independent review passed; full UI typecheck/build qualification remains in progress.
---
 .../components/MediaRegistrationConsent.vue   |  3 ++-
 .../MediaRegistrationConsentHttp.test.ts      | 19 +++++++++++++
 .../useMediaRegistrationBridge.test.ts        | 13 +++++++++
 neode-ui/src/composables/useCompanionAudio.ts | 12 ++-------
 .../composables/useMediaRegistrationBridge.ts |  5 ++--
 .../src/utils/__tests__/secureUuid.test.ts    | 27 +++++++++++++++++++
 neode-ui/src/utils/secureUuid.ts              | 13 +++++++++
 7 files changed, 79 insertions(+), 13 deletions(-)
 create mode 100644 neode-ui/src/components/__tests__/MediaRegistrationConsentHttp.test.ts
 create mode 100644 neode-ui/src/utils/__tests__/secureUuid.test.ts
 create mode 100644 neode-ui/src/utils/secureUuid.ts

diff --git a/neode-ui/src/components/MediaRegistrationConsent.vue b/neode-ui/src/components/MediaRegistrationConsent.vue
index 4f634c16..70e13b8e 100644
--- a/neode-ui/src/components/MediaRegistrationConsent.vue
+++ b/neode-ui/src/components/MediaRegistrationConsent.vue
@@ -41,6 +41,7 @@
 </template>
 <script setup lang="ts">
 import { computed, ref, watch } from 'vue'
+import { secureUuid } from '@/utils/secureUuid'
 import { fileBrowserClient, type FileBrowserItem } from '@/api/filebrowser-client'
 import { useModalKeyboard } from '@/composables/useModalKeyboard'
 import type { RegistrationRequest, CloudSelection } from '@/composables/useMediaRegistrationBridge'
@@ -48,7 +49,7 @@ const props = defineProps<{ request: RegistrationRequest | null; phase: 'select'
 const emit = defineEmits<{ approve: [selection: CloudSelection]; cancel: []; resolve: [] }>()
 const modal = ref<HTMLElement | null>(null), directory = ref('/'), files = ref<FileBrowserItem[]>([])
 const selected = ref<FileBrowserItem | null>(null), loading = ref(false), localError = ref('')
-const titleId = `media-registration-${crypto.randomUUID()}`
+const titleId = `media-registration-${secureUuid()}`
 let generation = 0
 const visible = computed(() => files.value.filter(item => item.isDir || /\.(mp4|m4v|webm|mov)$/i.test(item.name)))
 const duration = computed(() => { const seconds = props.request?.intent.viewingSeconds ?? 0; return seconds % 3600 === 0 ? `${seconds / 3600} hours` : `${Math.ceil(seconds / 60)} minutes` })
diff --git a/neode-ui/src/components/__tests__/MediaRegistrationConsentHttp.test.ts b/neode-ui/src/components/__tests__/MediaRegistrationConsentHttp.test.ts
new file mode 100644
index 00000000..d419c169
--- /dev/null
+++ b/neode-ui/src/components/__tests__/MediaRegistrationConsentHttp.test.ts
@@ -0,0 +1,19 @@
+import { mount, flushPromises } from '@vue/test-utils'
+import { afterEach, expect, it, vi } from 'vitest'
+import { webcrypto } from 'node:crypto'
+const files = vi.hoisted(() => ({ login: vi.fn(async () => true), listDirectory: vi.fn(async () => []) }))
+vi.mock('@/api/filebrowser-client', () => ({ fileBrowserClient: files }))
+import MediaRegistrationConsent from '../MediaRegistrationConsent.vue'
+afterEach(() => { vi.unstubAllGlobals(); vi.clearAllMocks() })
+it('mounts the inactive dashboard consent and opens its labelled dialog on LAN HTTP', async () => {
+  vi.stubGlobal('crypto', { getRandomValues: webcrypto.getRandomValues.bind(webcrypto) })
+  const wrapper = mount(MediaRegistrationConsent, { props: { request: null, phase: 'select', error: '' } })
+  expect(files.login).not.toHaveBeenCalled()
+  await wrapper.setProps({ request: { intent: { viewingSeconds: 3600, priceSats: 15 } } as any })
+  await flushPromises()
+  const dialog = wrapper.get('[role="dialog"]')
+  const label = dialog.attributes('aria-labelledby')
+  expect(label).toMatch(/^media-registration-[0-9a-f-]{36}$/)
+  expect(wrapper.get('#' + label).text()).toBeTruthy()
+  wrapper.unmount()
+})
diff --git a/neode-ui/src/composables/__tests__/useMediaRegistrationBridge.test.ts b/neode-ui/src/composables/__tests__/useMediaRegistrationBridge.test.ts
index 85ae15f3..5eeba061 100644
--- a/neode-ui/src/composables/__tests__/useMediaRegistrationBridge.test.ts
+++ b/neode-ui/src/composables/__tests__/useMediaRegistrationBridge.test.ts
@@ -1,6 +1,7 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 const rpc = vi.hoisted(() => ({ call: vi.fn() }))
 vi.mock('@/api/rpc-client', () => ({ rpcClient: rpc }))
+import { webcrypto } from 'node:crypto'
 import { installedOriginMatches, useMediaRegistrationBridge } from '../useMediaRegistrationBridge'
 
 const intent = { version: 1 as const, requestId: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa', nonce: 'a'.repeat(64),
@@ -27,6 +28,17 @@ beforeEach(() => {
 afterEach(() => { vi.restoreAllMocks(); vi.unstubAllGlobals() })
 
 describe('native Cloud registration ownership and interrupted operation boundary', () => {
+  it('persists and resumes the same secure approval on LAN HTTP without randomUUID', async () => {
+    vi.stubGlobal('crypto', { getRandomValues: webcrypto.getRandomValues.bind(webcrypto) })
+    const f = fixture(); await f.send('select'); f.bridge.approve(selection)
+    const approved = f.child.postMessage.mock.lastCall![0].result
+    expect(approved.approvalId).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/)
+    f.bridge.dispose()
+    const resumed = fixture(); await resumed.send('resume')
+    expect(resumed.child.postMessage.mock.lastCall![0].result).toEqual(approved)
+    resumed.bridge.dispose()
+  })
+
   it('ignores other windows/origins and checks installer scope before showing Cloud selection', async () => {
     const f = fixture()
     await f.send('select', {}, 'https://evil.test'); await f.send('select', {}, undefined, {})
@@ -93,6 +105,7 @@ describe('native Cloud registration ownership and interrupted operation boundary
   })
   it('recovers resolution approval across reload and cannot use it to prepare a file', async () => {
     vi.mocked(Date.now).mockReturnValue(1700_000)
+    vi.stubGlobal('crypto', { getRandomValues: webcrypto.getRandomValues.bind(webcrypto) })
     const first = fixture(); await first.send('resolve')
     expect(first.bridge.phase.value).toBe('resolve')
     first.bridge.approveResolution()
diff --git a/neode-ui/src/composables/useCompanionAudio.ts b/neode-ui/src/composables/useCompanionAudio.ts
index 9f9c5bd4..bb76e765 100644
--- a/neode-ui/src/composables/useCompanionAudio.ts
+++ b/neode-ui/src/composables/useCompanionAudio.ts
@@ -1,18 +1,10 @@
 import { onBeforeUnmount, watch } from 'vue'
 import { useAudioPlayer } from './useAudioPlayer'
+import { secureUuid } from '@/utils/secureUuid'
 
 type AudioBridge = { postMessage: (message: string) => void; onmessage: ((event: { data: string }) => void) | null }
 type NativeWindow = Window & { ArchipelagoAudio?: AudioBridge }
 
-/** LAN HTTP WebViews expose getRandomValues, but not secure-context randomUUID. */
-function audioSessionId(): string {
-  const bytes = crypto.getRandomValues(new Uint8Array(16))
-  bytes[6] = (bytes[6]! & 0x0f) | 0x40
-  bytes[8] = (bytes[8]! & 0x3f) | 0x80
-  const hex = Array.from(bytes, byte => byte.toString(16).padStart(2, '0')).join('')
-  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`
-}
-
 /** Send a small decoded thumbnail, never a protected URL or authorization data. */
 async function thumbnail(url: string, admittedOrigin: string, signal: AbortSignal): Promise<string> {
   if (!url) return ''
@@ -100,7 +92,7 @@ export function useCompanionAudio(player = useAudioPlayer()) {
     if (!player.currentSrc.value || !player.currentName.value) { release(); return }
     if (!session || source !== player.currentSrc.value) {
       if (!player.playing.value) { release(); return }
-      release(); session = audioSessionId(); source = player.currentSrc.value; sequence = 0
+      release(); session = secureUuid(); source = player.currentSrc.value; sequence = 0
       loadArtwork()
     }
     const duration = Number.isFinite(player.duration.value) ? Math.max(0, Math.min(player.duration.value, 604800)) : 0
diff --git a/neode-ui/src/composables/useMediaRegistrationBridge.ts b/neode-ui/src/composables/useMediaRegistrationBridge.ts
index 57ff64be..30ef847f 100644
--- a/neode-ui/src/composables/useMediaRegistrationBridge.ts
+++ b/neode-ui/src/composables/useMediaRegistrationBridge.ts
@@ -1,4 +1,5 @@
 import { ref, shallowRef } from 'vue'
+import { secureUuid } from '@/utils/secureUuid'
 import { rpcClient } from '@/api/rpc-client'
 import { appPortIsGateFronted } from '@/views/appSession/appSessionConfig'
 
@@ -102,7 +103,7 @@ export function useMediaRegistrationBridge(context: FrameContext) {
       const old = savedApproval(pending.intent)
       if (old && !exact(old.selection, selection)) throw new Error('This operation already approved another file. Resume its original selection.')
       const saved: SavedApproval = old ?? { version: 1, intent: pending.intent, selection: structuredClone(selection),
-        approvalId: crypto.randomUUID(), event: { kind: 27236, created_at: Math.floor(Date.now() / 1000),
+        approvalId: secureUuid(), event: { kind: 27236, created_at: Math.floor(Date.now() / 1000),
           tags: [['d', REGISTRATION_SCOPE]], content: JSON.stringify(approvalContent(pending.intent, selection), null, 2) } }
       // Persist owner approval before replying. Storage failure cannot silently
       // turn a later retry into a newly approved file or a replacement operation.
@@ -114,7 +115,7 @@ export function useMediaRegistrationBridge(context: FrameContext) {
   }
   function approveResolution() {
     if (!pending || pending.mode !== 'resolve' || phase.value !== 'resolve' || !current(pending)) return
-    const approved = { intent: pending.intent, approvalId: crypto.randomUUID(), event: {
+    const approved = { intent: pending.intent, approvalId: secureUuid(), event: {
       kind: 27237, created_at: Math.floor(Date.now() / 1000), tags: [['d', 'archipelago.media-registration.resolution.v1']],
       content: JSON.stringify({ action: 'Recover prepared video or retire this expired incomplete registration',
         scope: 'archipelago.media-registration.resolution.v1', intent: pending.intent }, null, 2),
diff --git a/neode-ui/src/utils/__tests__/secureUuid.test.ts b/neode-ui/src/utils/__tests__/secureUuid.test.ts
new file mode 100644
index 00000000..410594d0
--- /dev/null
+++ b/neode-ui/src/utils/__tests__/secureUuid.test.ts
@@ -0,0 +1,27 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { webcrypto } from 'node:crypto'
+import { secureUuid } from '../secureUuid'
+
+afterEach(() => vi.unstubAllGlobals())
+describe('secure UUIDs across dashboard origins', () => {
+  it('uses the native secure-context API with its receiver', () => {
+    const source = { randomUUID() { expect(this).toBe(source); return 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' }, getRandomValues: vi.fn() }
+    vi.stubGlobal('crypto', source)
+    expect(secureUuid()).toBe('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa')
+    expect(source.getRandomValues).not.toHaveBeenCalled()
+  })
+  it('creates distinct UUIDs on LAN HTTP using only getRandomValues', () => {
+    vi.stubGlobal('crypto', { getRandomValues: webcrypto.getRandomValues.bind(webcrypto) })
+    const ids = Array.from({ length: 32 }, secureUuid)
+    expect(new Set(ids).size).toBe(ids.length)
+    for (const id of ids) expect(id).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/)
+  })
+  it('sets the UUID version and variant without losing other random bits', () => {
+    vi.stubGlobal('crypto', { getRandomValues: (bytes: Uint8Array) => bytes.fill(255) })
+    expect(secureUuid()).toBe('ffffffff-ffff-4fff-bfff-ffffffffffff')
+  })
+  it.each([undefined, {}])('refuses when secure randomness is unavailable (%s)', source => {
+    vi.stubGlobal('crypto', source)
+    expect(() => secureUuid()).toThrow('Secure randomness is unavailable.')
+  })
+})
diff --git a/neode-ui/src/utils/secureUuid.ts b/neode-ui/src/utils/secureUuid.ts
new file mode 100644
index 00000000..f597925d
--- /dev/null
+++ b/neode-ui/src/utils/secureUuid.ts
@@ -0,0 +1,13 @@
+/** Secure UUIDs also work on LAN HTTP, where randomUUID is unavailable. */
+export function secureUuid(): string {
+  const source = globalThis.crypto
+  if (typeof source?.randomUUID === 'function') return source.randomUUID()
+  if (typeof source?.getRandomValues !== 'function') {
+    throw new Error('Secure randomness is unavailable.')
+  }
+  const bytes = source.getRandomValues(new Uint8Array(16))
+  bytes[6] = (bytes[6]! & 0x0f) | 0x40
+  bytes[8] = (bytes[8]! & 0x3f) | 0x80
+  const hex = Array.from(bytes, byte => byte.toString(16).padStart(2, '0')).join('')
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`
+}