Fix CSP for Electron

packages/apps-electron/src/electron/contentSecurityPolicy.ts

@@ -18,10 +18,10 @@ export function setupContentSecurityPolicy (_: string): void {
           " connect-src 'self' wss: ws:;" +
           " img-src 'self' data:;" +
           // react-qr-reader uses an embedded blob
-          " worker-src 'self' blob: filesystem:;" +
+          " worker-src 'self' blob:;" +
           // unsafe-eval is needed for the WASM content - same as the extension
           // script hashes here are for the window.top script (not technically needed)
-          " script-src 'self' 'unsafe-eval' 'sha256-02/ejyoV/iwRdJ4NAsxjzF6WVUtLMPM6Nv96EbAm6u8=' 'sha256-wW/WsLudCDaPo/ibpeK0KslHqYpCzcAKNFxFBXwCHJg='"
+          " script-src 'self' app: 'unsafe-eval' 'sha256-02/ejyoV/iwRdJ4NAsxjzF6WVUtLMPM6Nv96EbAm6u8=' 'sha256-wW/WsLudCDaPo/ibpeK0KslHqYpCzcAKNFxFBXwCHJg='"
         ]
       }
     });

packages/apps-electron/src/electron/index.ts

@@ -1,7 +1,10 @@
 // Copyright 2017-2025 @polkadot/apps authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import { app } from 'electron';
+import { app, protocol } from 'electron';
+import mime from 'mime';
+import { readFile } from 'node:fs/promises';
+import path from 'path';
 
 import { registerAccountStoreHandlers } from '../main/account-store.js';
 import { setupAutoUpdater } from './autoUpdater.js';
@@ -17,6 +20,41 @@
 app
   .whenReady()
   .then(async (): Promise<void> => {
+    // eslint-disable-next-line deprecation/deprecation
+    // protocol.registerFileProtocol('app', (request, callback) => {
+    //   const url = request.url.slice(6); // strip off "app://"
+    //   const resolvedPath = path.join(__dirname, '..', 'build', url); // adjust "build" as needed
+
+    //   callback({ path: resolvedPath });
+    // });
+
+    protocol.handle('app', async (request) => {
+      const url = new URL(request.url);
+
+      console.log(request.url, url, 'request url');
+      const pathname = url.pathname === '/' ? '/index.html' : url.pathname;
+
+      const filePath = path.join(__dirname, request.url.slice(6));
+      const mimeType = mime.getType(filePath) || 'text/plain';
+
+      console.log(filePath, 'file path');
+
+      try {
+        const data = await readFile(filePath);
+
+        return new Response(data, {
+          headers: {
+            // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
+            'Content-Type': mimeType
+          }
+        });
+      } catch (err) {
+        console.error('Failed to load:', filePath, err);
+
+        return new Response('Not found', { status: 404 });
+      }
+    });
+
     registerAccountStoreHandlers();
     setupContentSecurityPolicy(ENV);
 

packages/apps-electron/src/electron/window.ts

@@ -44,7 +44,7 @@ export function createWindow (environment: string): Promise<unknown> {
     }
   });
 
-  const mainFilePath = path.resolve(__dirname, 'index.html');
+  const mainFilePath = 'app://index.html';
 
-  return win.loadFile(mainFilePath);
+  return win.loadURL(mainFilePath);
 }