From 103e080664e110528301ab7eb3e193972264b79f Mon Sep 17 00:00:00 2001
From: alwaysmesmerizingyou <alwaysmesmerizingyou@gmail.com>
Date: Thu, 20 Aug 2026 21:52:14 -0700
Subject: [PATCH] support artifact redirect hosts and explicit express port
 binding

---
 main.js          |  4 ++--
 update-client.js | 37 +++++++++++++++++++++++++++----------
 2 files changed, 29 insertions(+), 12 deletions(-)

diff --git a/main.js b/main.js
index d37a8de..c832b13 100644
--- a/main.js
+++ b/main.js
@@ -138,7 +138,7 @@ async function start() {
     playerExpressApp.get('*', (req, res) => {
       res.sendFile(path.join(playerDir, 'index.html'));
     });
-    playerExpressServer = playerExpressApp.listen(3001, () => {
+    playerExpressServer = playerExpressApp.listen(3001, '0.0.0.0', () => {
       console.log('[DEBUG] Player Express server listening on 3001');
     });
 
@@ -155,7 +155,7 @@ async function start() {
     });
 
     const FRONTEND_PORT = 4890;
-    expressServer = expressApp.listen(FRONTEND_PORT, () => {
+    expressServer = expressApp.listen(FRONTEND_PORT, '0.0.0.0', () => {
       console.log(`[DEBUG] Frontend Express server active at http://localhost:${FRONTEND_PORT}`);
       sendToTauri('ready', { url: `http://localhost:${FRONTEND_PORT}` });
     });
diff --git a/update-client.js b/update-client.js
index e5d9512..de27015 100644
--- a/update-client.js
+++ b/update-client.js
@@ -4,11 +4,20 @@ const fs = require('fs');
 const GITLAB_GROUP = 'vyla-entertainment';
 const GITLAB_REPO = 'home';
 const RELEASES_API = `https://gitlab.com/api/v4/projects/${GITLAB_GROUP}%2F${GITLAB_REPO}/releases`;
-const ALLOWED_REDIRECT_HOSTS = ['gitlab.com'];
+
+const ALLOWED_REDIRECT_HOSTS = [
+  'gitlab.com',
+  'storage.googleapis.com'
+];
 
 function isAllowedHost(url) {
   try {
-    return ALLOWED_REDIRECT_HOSTS.includes(new URL(url).hostname);
+    const hostname = new URL(url).hostname;
+    return ALLOWED_REDIRECT_HOSTS.includes(hostname) ||
+      hostname.endsWith('.gitlab.com') ||
+      hostname.endsWith('.storage.googleapis.com') ||
+      hostname.endsWith('.amazonaws.com') ||
+      hostname.endsWith('.cloudfront.net');
   } catch (e) {
     return false;
   }
@@ -80,13 +89,14 @@ class UpdateClient {
           'Accept': 'application/octet-stream'
         };
 
-        if (this.token) {
+        const isGitLabHost = urlObj.hostname === 'gitlab.com' || urlObj.hostname.endsWith('.gitlab.com');
+        if (this.token && isGitLabHost) {
           headers['PRIVATE-TOKEN'] = this.token;
         }
 
         const requestOptions = {
           hostname: urlObj.hostname,
-          port: 443,
+          port: urlObj.port || (urlObj.protocol === 'https:' ? 443 : 80),
           path: urlObj.pathname + urlObj.search,
           headers
         };
@@ -94,11 +104,12 @@ class UpdateClient {
         const req = https.get(requestOptions, (res) => {
           if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
             res.resume();
-            if (!isAllowedHost(res.headers.location)) {
-              reject(new Error(`Redirect to disallowed host: ${res.headers.location}`));
+            const redirectUrl = new URL(res.headers.location, requestUrl).toString();
+            if (!isAllowedHost(redirectUrl)) {
+              reject(new Error(`Redirect to disallowed host: ${redirectUrl}`));
               return;
             }
-            doRequest(res.headers.location, redirectCount + 1);
+            doRequest(redirectUrl, redirectCount + 1);
             return;
           }
 
@@ -160,13 +171,14 @@ class UpdateClient {
           'Accept': 'application/octet-stream'
         };
 
-        if (this.token) {
+        const isGitLabHost = urlObj.hostname === 'gitlab.com' || urlObj.hostname.endsWith('.gitlab.com');
+        if (this.token && isGitLabHost) {
           headers['PRIVATE-TOKEN'] = this.token;
         }
 
         const requestOptions = {
           hostname: urlObj.hostname,
-          port: 443,
+          port: urlObj.port || (urlObj.protocol === 'https:' ? 443 : 80),
           path: urlObj.pathname + urlObj.search,
           headers
         };
@@ -174,7 +186,12 @@ class UpdateClient {
         const req = https.get(requestOptions, (res) => {
           if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
             res.resume();
-            doRequest(res.headers.location, redirectCount + 1);
+            const redirectUrl = new URL(res.headers.location, requestUrl).toString();
+            if (!isAllowedHost(redirectUrl)) {
+              reject(new Error(`Redirect to disallowed host: ${redirectUrl}`));
+              return;
+            }
+            doRequest(redirectUrl, redirectCount + 1);
             return;
           }