src/ipc/channels.ts (1)

27-33: Extract shared credential IPC types to prevent type drift.

The same credential shapes are duplicated across multiple files. Consider exporting shared types from this module and reusing them in preload/main to keep contracts in sync.

♻️ Suggested refactor

+export type VideoCallAuthCredentials = {
+  userId: string;
+  authToken: string;
+};
+
+export type VideoCallAuthCredentialsResponse = VideoCallAuthCredentials & {
+  serverUrl: string;
+};
+
+export type VideoCallWindowOpenOptions = {
+  providerName?: string;
+  credentials?: VideoCallAuthCredentials;
+};

   'video-call-window/open-window': (
     url: string,
-    options?: {
-      providerName?: string;
-      credentials?: { userId: string; authToken: string };
-    }
+    options?: VideoCallWindowOpenOptions
   ) => void;

   'video-call-window/get-credentials': () => {
-    userId: string;
-    authToken: string;
-    serverUrl: string;
-  } | null;
+    VideoCallAuthCredentialsResponse | null;

Also applies to: 54-58

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/ipc/channels.ts` around lines 27 - 33, The IPC channel type for
'video-call-window/open-window' duplicates credential shapes; extract a shared
exported type (e.g., VideoCallCredentials or VideoCallOptions and a Credentials
interface) from the module that currently declares the channel types and replace
the inline shapes with those exported types, then import and reuse them in
preload/main and any other places (also update the similar declarations around
the other channel at lines 54-58) so all IPC contracts reference the single
shared exported credential/type definitions to avoid drift.

src/videoCallWindow/ipc.ts (1)

557-572: ⚠️ Potential issue | 🔴 Critical

Gate credential persistence behind trusted destination validation

Line 557 stores videoCallProviderName/videoCallCredentials before destination validation at Line 607. This still allows sensitive credentials to be bound prior to trust checks. Persist credentials only after validating a trusted Pexip destination.

🔐 Suggested hardening

-    // Store provider name and credentials
-    videoCallProviderName = options?.providerName ?? null;
-    videoCallCredentials = null;
-    if (options?.providerName === 'pexip' && options?.credentials) {
-      try {
-        const serverOrigin = new URL(_wc.getURL()).origin;
-        videoCallCredentials = {
-          userId: options.credentials.userId,
-          authToken: options.credentials.authToken,
-          serverUrl: serverOrigin,
-        };
-      } catch {
-        // _wc.getURL() may not be a valid URL in edge cases
-        videoCallCredentials = null;
-      }
-    }
+    // Initialize as empty; assign only after destination validation
+    videoCallProviderName = null;
+    videoCallCredentials = null;
...
     const validUrl = new URL(url);
     const allowedProtocols = ['http:', 'https:'];
...
     if (allowedProtocols.includes(validUrl.protocol)) {
+      videoCallProviderName = options?.providerName ?? null;
+
+      const isTrustedPexipDestination =
+        videoCallProviderName === 'pexip' &&
+        validUrl.protocol === 'https:' &&
+        /* apply existing trusted-origin check here */;
+
+      if (isTrustedPexipDestination && options?.credentials) {
+        try {
+          const serverOrigin = new URL(_wc.getURL()).origin;
+          videoCallCredentials = {
+            userId: options.credentials.userId,
+            authToken: options.credentials.authToken,
+            serverUrl: serverOrigin,
+          };
+        } catch {
+          videoCallCredentials = null;
+        }
+      }

Also applies to: 607-623

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/videoCallWindow/ipc.ts` around lines 557 - 572, Do not assign
videoCallProviderName or videoCallCredentials until after the
trusted-Pexip-destination check succeeds: remove the early assignments (the
block that sets videoCallProviderName = options?.providerName ?? null and
computes videoCallCredentials from _wc.getURL() when options?.providerName ===
'pexip') and instead set videoCallProviderName and compute videoCallCredentials
only after the existing destination validation logic completes and confirms the
destination is trusted; preserve the try/catch around new URL(_wc.getURL()) and
ensure credentials are cleared (set to null) when validation fails or URL
parsing throws.