SecureBrowser.cpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
#include "SecureBrowser.hpp"
#include "DistroUtils.hpp"
#include "SettingsStore.hpp"
#include "phishing/local_warning_server.hpp"
 
#include <include/cef_app.h>
#include <include/cef_browser.h>
#include <include/cef_client.h>
#include <include/cef_command_line.h>
#include <include/cef_request_handler.h>
#include <include/cef_ssl_info.h>
#include <include/views/cef_browser_view.h>
#include <include/views/cef_browser_view_delegate.h>
#include <include/views/cef_window.h>
#include <include/views/cef_window_delegate.h>
#include <include/wrapper/cef_helpers.h>
#include <include/cef_callback.h>
#include <glibmm/miscutils.h>
 
#include <atomic>
#include <algorithm>
#include <chrono>
#include <cstdlib>
#include <cstring>
#include <filesystem>
#include <fstream>
#include <iostream>
#include <sstream>
#include <string>
#include <thread>
#include <vector>
#include <unordered_set>
 
#include <fcntl.h>
#include <sys/file.h>
#include <sys/stat.h>
#include <unistd.h>
#include <glibmm/i18n.h>
#include <nlohmann/json.hpp>
 
#define BASTIONGUARD_LOCAL_WARNING_IP "127.0.0.2"
#define BASTIONGUARD_WARNING_DEFAULT_HTTP 81
 
namespace fs = std::filesystem;
 
static std::unique_ptr<LocalWarningServer> g_warning_server;
static std::atomic<bool> g_cef_started{false};
 
static bool is_payment_domain(const std::string& host);
 
static void clear_proxy_env() {
    unsetenv("http_proxy");
    unsetenv("https_proxy");
    unsetenv("ftp_proxy");
    unsetenv("all_proxy");
    unsetenv("HTTP_PROXY");
    unsetenv("HTTPS_PROXY");
    unsetenv("FTP_PROXY");
    unsetenv("ALL_PROXY");
    unsetenv("no_proxy");
    unsetenv("NO_PROXY");
}
 
void start_local_warning_server() {
    if (!g_warning_server) {
        g_warning_server = std::make_unique<LocalWarningServer>(
            BASTIONGUARD_WARNING_DEFAULT_HTTP,
            444,
            BASTIONGUARD_LOCAL_WARNING_IP,
            "",
            "",
            ""
        );
        g_warning_server->start();
    }
}
 
class InstanceLock {
public:
    explicit InstanceLock(const char* path) : fd_(-1), path_(path) {
        fd_ = ::open(path, O_CREAT | O_RDWR, 0600);
        if (fd_ >= 0) {
            if (flock(fd_, LOCK_EX | LOCK_NB) != 0) {
                ::close(fd_);
                fd_ = -1;
            } else {
                ftruncate(fd_, 0);
                std::string pid = std::to_string(getpid());
                ::write(fd_, pid.c_str(), pid.size());
                ::fsync(fd_);
            }
        }
    }
 
    bool acquired() const { return fd_ >= 0; }
 
    ~InstanceLock() {
        if (fd_ >= 0) {
            flock(fd_, LOCK_UN);
            ::close(fd_);
        }
    }
 
private:
    int fd_;
    std::string path_;
};
 
static std::string to_lower(std::string s) {
    std::transform(s.begin(), s.end(), s.begin(),
                   [](unsigned char c){ return static_cast<char>(std::tolower(c)); });
    return s;
}
 
static std::string clean_domain(std::string d) {
    d = to_lower(d);
    if (!d.empty() && d[0] == '.') d.erase(0, 1);
    if (d.rfind("www.", 0) == 0) d.erase(0, 4);
    auto p = d.find(':');
    if (p != std::string::npos) d.erase(p);
    return d;
}
 
static std::string host_from_url(const std::string& url) {
    std::string s = url;
    auto pos = s.find("://");
    if (pos != std::string::npos) s.erase(0, pos + 3);
    pos = s.find('/');
    if (pos != std::string::npos) s.erase(pos);
    pos = s.find('@');
    if (pos != std::string::npos) s = s.substr(pos + 1);
    return clean_domain(s);
}
 
static void load_list_file(const std::string& path, std::vector<std::string>& out) {
    if (!fs::exists(path)) {
        std::cerr << _("[SecureBrowser] ⚠ File non trovato: ") << path << "\n";
        return;
    }
 
    try {
        std::ifstream f(path, std::ios::binary);
        if (!f.good()) {
            std::cerr << _("[SecureBrowser] ⚠ Impossibile aprire: ") << path << "\n";
            return;
        }
 
        std::string data((std::istreambuf_iterator<char>(f)), std::istreambuf_iterator<char>());
        data.erase(std::remove(data.begin(), data.end(), '\0'), data.end());
 
        nlohmann::json j = nlohmann::json::parse(data, nullptr, true, true);
 
        auto push_domain = [&](const std::string& d_raw) {
            std::string d = clean_domain(d_raw);
            if (!d.empty()) out.push_back(d);
        };
 
            if (j.is_object()) {
                if (j.contains("list") && j["list"].is_array()) {
                    for (const auto& v : j["list"]) {
                        if (v.is_string()) push_domain(v.get<std::string>());
                    }
                } else if (j.contains("domains") && j["domains"].is_array()) {
                    for (const auto& v : j["domains"]) {
                        if (v.is_string()) push_domain(v.get<std::string>());
                    }
                } else if (j.contains("whitelist") && j["whitelist"].is_array()) {
                    for (const auto& v : j["whitelist"]) {
                        if (v.is_string()) push_domain(v.get<std::string>());
                    }
                }
            } else if (j.is_array()) {
                for (const auto& v : j) {
                    if (v.is_string()) push_domain(v.get<std::string>());
                }
            }
 
            std::cerr << _("[SecureBrowser] ✅ Caricati ") << out.size()
            << _(" domini trusted da ") << path << "\n";
    } catch (const std::exception& e) {
        std::cerr << Glib::ustring::compose(
            _("[SecureBrowser] ❌ Errore parsing JSON (%1): %2"),
                                            path,
                                            e.what()
        ) << "\n";
    }
}
 
static bool is_trusted_domain(const std::string& host) {
    static std::unordered_set<std::string> trusted_domains;
    static bool initialized = false;
 
    if (!initialized) {
        std::vector<std::string> tmp;
        std::cerr << _("[SecureBrowser] 🔍 Caricamento domini trusted...\n");
        load_list_file("/usr/share/BastionGuard/data/bank/banks.json", tmp);
 
        const char* home = std::getenv("HOME");
        if (home) {
            load_list_file(std::string(home) + "/.local/share/BastionGuard/banks.json", tmp);
            load_list_file(std::string(home) + "/.config/BastionGuard/whitelist.json", tmp);
        }
 
        for (auto& d : tmp) {
            trusted_domains.insert(clean_domain(d));
        }
 
        std::cerr << _("[SecureBrowser] ✅ Cache inizializzata: ")
        << trusted_domains.size() << _(" domini trusted.\n");
 
        if (trusted_domains.count("intesasanpaolo.com"))
            std::cerr << _("[SecureBrowser] 🔎 Verifica: 'intesasanpaolo.com' presente in cache.\n");
        else
            std::cerr << _("[SecureBrowser] 🔎 Verifica: 'intesasanpaolo.com' NON presente in cache.\n");
 
        initialized = true;
    }
 
    const std::string h = clean_domain(host);
 
    if (trusted_domains.count(h)) {
        std::cerr << _("[SecureBrowser] 🟢 Trusted (match diretto): ") << h << "\n";
        return true;
    }
 
    auto dot = h.find('.');
    while (dot != std::string::npos) {
        std::string parent = h.substr(dot + 1);
        if (trusted_domains.count(parent)) {
            std::cerr << Glib::ustring::compose(
                _("[SecureBrowser] 🟢 Trusted (match parent '%1'): %2"),
                                                parent,
                                                h
            ) << "\n";
            return true;
        }
        dot = h.find('.', dot + 1);
    }
 
    std::cerr << _("[SecureBrowser] 🔴 NON trusted: ") << h << "\n";
    return false;
}
 
class SimpleHandler : public CefClient,
public CefLifeSpanHandler,
public CefDisplayHandler,
public CefRequestHandler {
public:
    CefRefPtr<CefLifeSpanHandler> GetLifeSpanHandler() override { return this; }
    CefRefPtr<CefDisplayHandler> GetDisplayHandler() override { return this; }
    CefRefPtr<CefRequestHandler> GetRequestHandler() override { return this; }
 
    void OnAfterCreated(CefRefPtr<CefBrowser> browser) override {
        CEF_REQUIRE_UI_THREAD();
        browsers_.push_back(browser);
        std::cout << _("[SecureBrowser] 🌐 Browser creato.\n");
    }
 
    void OnTitleChange(CefRefPtr<CefBrowser> browser, const CefString&) override {
        CEF_REQUIRE_UI_THREAD();
        inject_watermark(browser);
    }
 
    void OnBeforeClose(CefRefPtr<CefBrowser> browser) override {
        CEF_REQUIRE_UI_THREAD();
        browsers_.erase(
            std::remove_if(
                browsers_.begin(),
                           browsers_.end(),
                           [&](auto& b){ return b->IsSame(browser); }
            ),
            browsers_.end()
        );
 
        if (browsers_.empty()) {
            std::cout << _("[SecureBrowser] 🔒 Tutte le finestre chiuse — uscita loop.\n");
            CefQuitMessageLoop();
        }
    }
 
    bool OnBeforeBrowse(CefRefPtr<CefBrowser> browser,
                        CefRefPtr<CefFrame> frame,
                        CefRefPtr<CefRequest> request,
                        bool,
                        bool) override {
                            CEF_REQUIRE_UI_THREAD();
 
                            const std::string url  = request->GetURL();
                            const std::string host = host_from_url(url);
 
                            std::cout << _("[SecureBrowser] 🌍 URL richiesto: ") << url << "\n";
                            std::cout << _("[SecureBrowser] 🧩 Host estratto: ") << host << "\n";
 
                            if (host == "127.0.0.2" || host == "127.0.0.1" || host == "localhost") {
                                std::cout << _("[SecureBrowser] ✅ Dominio locale consentito.\n");
                                return false;
                            }
 
                            const bool is_main_frame = frame && frame->IsMain();
 
                            const bool bank_ok = is_trusted_domain(host);
                            const bool pay_ok  = is_payment_domain(host);
                            const bool https_url = url.rfind("https://", 0) == 0;
 
                            // A previously authorized page never grants permission to
                            // navigate the main frame to a different, untrusted origin.
                            if (is_main_frame) {
                                if (https_url && (bank_ok || pay_ok)) {
                                    std::cout << _("[SecureBrowser] 🟢 Navigazione attendibile: ") << host << "\n";
                                    return false;
                                }
                            } else if (https_url) {
                                // Third-party HTTPS subframes are needed by some bank
                                // sign-in/payment flows; main-frame trust is independent.
                                return false;
                            }
 
                            std::cout << _("[SecureBrowser] 🚫 Navigazione bloccata verso dominio non trusted: ") << host << "\n";
                            load_block_page_inline(browser, host);
                            return true;
                        }
 
                        bool OnCertificateError(CefRefPtr<CefBrowser> browser,
                                                cef_errorcode_t cert_error,
                                                const CefString& request_url,
                                                CefRefPtr<CefSSLInfo>,
                                                CefRefPtr<CefCallback> callback) override {
                                                    CEF_REQUIRE_UI_THREAD();
 
                                                    const std::string url  = request_url;
                                                    const std::string host = host_from_url(url);
 
                                                    std::cout << _("[SecureBrowser] ⛔ Cert error (") << cert_error
                                                    << _(") per dominio: ") << host << "\n";
 
                                                    // A trusted-domain allowlist must never override TLS
                                                    // certificate validation. Fail closed for every host.
                                                    if (browser && browser->GetMainFrame())
                                                        load_block_page_inline(browser, host);
                                                    if (callback) callback->Cancel();
                                                    return true;
                                                }
 
private:
    static void load_block_page_inline(CefRefPtr<CefBrowser> browser,
                                       const std::string& host) {
        std::string safe_host;
        for (char c : host) {
            if (c == '<') safe_host += "&lt;";
            else if (c == '>') safe_host += "&gt;";
            else if (c == '&') safe_host += "&amp;";
            else if (c == '"') safe_host += "&quot;";
            else safe_host += c;
        }
 
        const std::string html =
        "<!DOCTYPE html><html><head><meta charset='UTF-8'>"
        "<style>"
        "body{margin:0;height:100vh;display:flex;align-items:center;"
        "justify-content:center;background:#1a1a2e;font-family:system-ui,sans-serif;}"
        ".card{background:#16213e;border:1px solid #0f3460;border-radius:12px;"
        "padding:40px 36px;max-width:460px;text-align:center;color:#e0e0e0;}"
        "h1{color:#e94560;font-size:1.3rem;margin:0 0 16px;}"
        "p{color:#a0a0b0;font-size:.9rem;line-height:1.6;margin:0 0 24px;}"
        ".domain{font-family:monospace;color:#4fc3f7;background:#0d1b2a;"
        "padding:4px 10px;border-radius:4px;}"
        "button{background:#0f3460;color:#fff;border:none;border-radius:8px;"
        "padding:10px 24px;font-size:.9rem;cursor:pointer;}"
        "button:hover{background:#1a4a80;}"
        "</style></head><body>"
        "<div class='card'>"
        "<h1>🛡️ BastionGuard — Navigazione bloccata</h1>"
        "<p>Il dominio <span class='domain'>" + safe_host + "</span> "
        "non è accessibile dalla sessione sicura.<br><br>"
        "Chiudi questa finestra e aprilo nel tuo browser normale.</p>"
        "<button onclick='window.close()'>Chiudi</button>"
        "</div></body></html>";
 
        std::string encoded;
        for (unsigned char c : html) {
            if (std::isalnum(c) || c == '-' || c == '_' || c == '.' ||
                c == '!' || c == '~' || c == '*' || c == '\'' ||
                c == '(' || c == ')') {
                encoded += static_cast<char>(c);
                } else {
                    char buf[4];
                    std::snprintf(buf, sizeof(buf), "%%%02X", c);
                    encoded += buf;
                }
        }
 
        if (browser && browser->GetMainFrame())
            browser->GetMainFrame()->LoadURL("data:text/html," + encoded);
                                       }
 
                                       void inject_watermark(CefRefPtr<CefBrowser> browser) {
                                           static const char kJS[] = R"JS(
            (function(){
                if (document.getElementById('BastionGuard_wm')) return;
                const wm = document.createElement('div');
                wm.id = 'BastionGuard_wm';
                wm.textContent = '🟢 BastionGuard Secure Browser';
                Object.assign(wm.style, {
                    position: 'fixed',
                    bottom: '14px',
                    right: '16px',
                    background: 'rgba(46,125,50,0.9)',
                    color: '#fff',
                    fontFamily: 'system-ui, sans-serif',
                    fontWeight: '600',
                    fontSize: '13px',
                    padding: '6px 12px',
                    borderRadius: '10px',
                    zIndex: '2147483647',
                    pointerEvents: 'none',
                    boxShadow: '0 2px 6px rgba(0,0,0,0.3)'
                });
                if (document.body) document.body.appendChild(wm);
            })();
        )JS";
 
        CefRefPtr<CefFrame> frame = browser->GetMainFrame();
        if (frame && frame->IsValid())
            frame->ExecuteJavaScript(kJS, frame->GetURL(), 0);
                                       }
 
                                       std::vector<CefRefPtr<CefBrowser>> browsers_;
                                       IMPLEMENT_REFCOUNTING(SimpleHandler);
};
 
// -----------------------------------------------------------------------------
// Popup CEF Views
//
// Il browser principale usa CefBrowserView. Senza un delegate Views esplicito i
// popup creati da window.open()/target=_blank possono finire nella finestra CEF
// predefinita invece che in una finestra BastionGuard. Questo e' particolarmente
// visibile nei flussi OTP/3-D Secure.
//
// Manteniamo lo stesso CefClient/SimpleHandler e creiamo SOLO il contenitore
// grafico del popup. Nessun cambio a routing, proxy, sandbox o policy domini.
// -----------------------------------------------------------------------------
class SecurePopupWindowDelegate : public CefWindowDelegate {
public:
    explicit SecurePopupWindowDelegate(CefRefPtr<CefBrowserView> view)
        : view_(view) {}
 
    void OnWindowCreated(CefRefPtr<CefWindow> window) override {
        CEF_REQUIRE_UI_THREAD();
        if (!view_) return;
 
        window->AddChildView(view_);
        window->SetBounds(CefRect(160, 120, 1000, 720));
        view_->SetBounds(CefRect(0, 0, 1000, 720));
        window->SetTitle("BastionGuard Secure Browser");
        window->Show();
        view_->RequestFocus();
 
        std::cout << _("[SecureBrowser] 🪟 Popup CEF mostrato nella sessione sicura.\n");
    }
 
    void OnWindowDestroyed(CefRefPtr<CefWindow>) override {
        CEF_REQUIRE_UI_THREAD();
        // Non uscire dal message loop quando si chiude solo il popup.
        // SimpleHandler::OnBeforeClose() mantiene il conteggio dei browser.
        view_ = nullptr;
    }
 
    IMPLEMENT_REFCOUNTING(SecurePopupWindowDelegate);
 
private:
    CefRefPtr<CefBrowserView> view_;
};
 
class SecureBrowserViewDelegate : public CefBrowserViewDelegate {
public:
    CefRefPtr<CefBrowserViewDelegate> GetDelegateForPopupBrowserView(
        CefRefPtr<CefBrowserView>,
        const CefBrowserSettings&,
        CefRefPtr<CefClient>,
        bool) override {
        // Riusa lo stesso delegate anche per eventuali popup annidati.
        return this;
    }
 
    bool OnPopupBrowserViewCreated(
        CefRefPtr<CefBrowserView>,
        CefRefPtr<CefBrowserView> popup_browser_view,
        bool is_devtools) override {
        CEF_REQUIRE_UI_THREAD();
 
        if (is_devtools || !popup_browser_view)
            return false;
 
        CefWindow::CreateTopLevelWindow(
            new SecurePopupWindowDelegate(popup_browser_view));
 
        // La finestra e' stata creata da BastionGuard: evita la finestra popup
        // predefinita di CEF/Chromium.
        return true;
    }
 
    IMPLEMENT_REFCOUNTING(SecureBrowserViewDelegate);
};
 
class ClamApp : public CefApp, public CefBrowserProcessHandler {
public:
    CefRefPtr<CefBrowserProcessHandler> GetBrowserProcessHandler() override { return this; }
 
    void OnBeforeCommandLineProcessing(const CefString&, CefRefPtr<CefCommandLine> cmd) override {
        // Il Secure Browser usa un profilo CEF dedicato e persistente. Non
        // forzare --incognito nel processo bancario/payment: gli auth cookie
        // di sessione devono poter sopravvivere alla chiusura della finestra,
        // altrimenti ogni riapertura appare come un nuovo device/sessione ai
        // sistemi SCA/3DS/anti-abuso. La finestra notify resta invece
        // incognito perché BG_CEF_PERSIST_SESSION non viene impostato lì.
        if (std::getenv("BG_CEF_PERSIST_SESSION"))
            cmd->AppendSwitch("persist-session-cookies");
        else
            cmd->AppendSwitch("incognito");
 
        cmd->AppendSwitch("disable-extensions");
        cmd->AppendSwitch("disable-sync");
        cmd->AppendSwitch("disable-component-update");
        cmd->AppendSwitch("disable-print-preview");
 
        // Alcuni flussi bancari/3-D Secure aprono la finestra di conferma dopo
        // una callback asincrona e Chromium puo' classificarla come popup non
        // direttamente associato al click. Nel processo SecureBrowser i popup
        // devono restare consentiti e vengono comunque contenuti nel CEF Views
        // gestito sopra.
        cmd->AppendSwitch("disable-popup-blocking");
 
        cmd->AppendSwitchWithValue("disable-features", "TranslateUI");
        cmd->AppendSwitchWithValue("ssl-certificates-file", "/etc/ssl/certs/ca-certificates.crt");
 
        cmd->AppendSwitchWithValue("dns-over-https-mode", "automatic");
        cmd->AppendSwitchWithValue(
            "dns-over-https-servers",
            "https://cloudflare-dns.com/dns-query,https://dns.google/dns-query"
        );
 
        cmd->AppendSwitch("no-proxy-server");
        cmd->AppendSwitchWithValue("proxy-server", "direct://");
        cmd->AppendSwitch("proxy-bypass-list=*");
 
        cmd->AppendSwitch("enable-gpu");
        cmd->AppendSwitch("disable-gpu-compositing");
        cmd->AppendSwitch("use-gl=desktop");
 
        // -----------------------------------------------------------------
        //  Selezione backend Ozone (Wayland o X11).
        //
        //  L'ordine di priorità è (high → low):
        //    1) BastionGuard_CEF_BACKEND = wayland|x11  (override interno usato
        //       dal fallback in SecureBrowser::open per ritentare con X11)
        //    2) OZONE_PLATFORM = wayland|x11             (env standard Chromium)
        //    3) XDG_SESSION_TYPE = wayland|x11           (logind)
        //    4) WAYLAND_DISPLAY presente → wayland, altrimenti DISPLAY → x11
        //  Se nulla di tutto questo è presente, default = x11 (più resiliente).
        // -----------------------------------------------------------------
        auto eq = [](const char* a, const char* b) -> bool {
            return a && b && std::strcmp(a, b) == 0;
        };
 
        const char* internal_be = std::getenv("BastionGuard_CEF_BACKEND");
        const char* ozone_be    = std::getenv("OZONE_PLATFORM");
        const char* sess_type   = std::getenv("XDG_SESSION_TYPE");
        const char* wl_disp     = std::getenv("WAYLAND_DISPLAY");
        const char* x_disp      = std::getenv("DISPLAY");
 
        bool want_wayland;
        const char* picked_by;
 
        if      (eq(internal_be, "wayland")) { want_wayland = true;  picked_by = "BastionGuard_CEF_BACKEND"; }
        else if (eq(internal_be, "x11"))     { want_wayland = false; picked_by = "BastionGuard_CEF_BACKEND"; }
        else if (eq(ozone_be,    "wayland")) { want_wayland = true;  picked_by = "OZONE_PLATFORM"; }
        else if (eq(ozone_be,    "x11"))     { want_wayland = false; picked_by = "OZONE_PLATFORM"; }
        else if (eq(sess_type,   "wayland")) { want_wayland = true;  picked_by = "XDG_SESSION_TYPE"; }
        else if (eq(sess_type,   "x11"))     { want_wayland = false; picked_by = "XDG_SESSION_TYPE"; }
        else if (wl_disp && *wl_disp)        { want_wayland = true;  picked_by = "WAYLAND_DISPLAY"; }
        else if (x_disp  && *x_disp)         { want_wayland = false; picked_by = "DISPLAY"; }
        else                                 { want_wayland = false; picked_by = "default(x11)"; }
 
        std::cerr << "[SecureBrowser] Ozone backend: "
                  << (want_wayland ? "wayland" : "x11")
                  << " (via " << picked_by << ")\n";
 
        cmd->AppendSwitchWithValue(
            "enable-features",
            "UseOzonePlatform,VaapiVideoDecoder,UseSkiaRenderer,DnsOverHttps"
        );
 
        if (want_wayland) {
            cmd->AppendSwitchWithValue("ozone-platform", "wayland");
            cmd->AppendSwitch("enable-webrtc-pipewire-capturer");
        } else {
            cmd->AppendSwitchWithValue("ozone-platform", "x11");
            // Su X11 puro evita warning di Chromium su Wayland mancante
            cmd->AppendSwitchWithValue("ozone-platform-hint", "x11");
        }
 
        cmd->AppendSwitch("no-default-browser-check");
        cmd->AppendSwitch("no-first-run");
        cmd->AppendSwitch("disable-crash-reporter");
        cmd->AppendSwitch("disable-background-networking");
        cmd->AppendSwitch("disable-breakpad");
    }
 
    IMPLEMENT_REFCOUNTING(ClamApp);
};
 
CefRefPtr<CefApp> SecureBrowser::createApp() {
    return new ClamApp();
}
 
bool SecureBrowser::open(const std::string& url, int argc, char** argv) {
    if (!BastionGuard::Platform::cef_available()) {
        std::cerr << _("[SecureBrowser] CEF disabilitato su questa build o distribuzione.\n");
        return false;
    }
 
    if (!std::getenv("BG_SANDBOX"))
        start_local_warning_server();
 
    bool expected = false;
    if (!g_cef_started.compare_exchange_strong(expected, true)) {
        std::cerr << _("[SecureBrowser] ⚠️ Richiesta duplicata nello stesso processo.\n");
        return false;
    }
 
    InstanceLock lock("/tmp/BastionGuard-bankopener.lock");
    if (!lock.acquired()) {
        std::cerr << _("[SecureBrowser] ℹ️ Istanza già attiva. Rifiuto nuovo avvio.\n");
        g_cef_started = false;
        return false;
    }
 
    auto fail = [&](const std::string& msg) -> bool {
        std::cerr << msg << "\n";
        g_cef_started = false;
        return false;
    };
 
    std::cout << _("[SecureBrowser] 🧩 Avvio sandbox Blink/CEF per URL: ") << url << std::endl;
 
    clear_proxy_env();
 
    setenv("SSL_CERT_DIR", "/etc/ssl/certs", 1);
    setenv("SSL_CERT_FILE", "/etc/ssl/certs/ca-certificates.crt", 1);
    setenv("NSS_CERT_FILE", "/etc/ssl/certs/ca-certificates.crt", 1);
    setenv("NSS_CERT_DIR", "/etc/ssl/certs", 1);
 
    const std::string cef_dir   = "/usr/share/BastionGuard/cef";
    const std::string cache_dir = Glib::get_home_dir() + "/.cache/BastionGuard/cef_sandbox";
    std::error_code ec;
    fs::create_directories(cache_dir, ec);
    if (ec) {
        std::cerr << _("[SecureBrowser] ⚠️ Creazione cache_dir fallita: ") << ec.message() << "\n";
    }
 
    // Profilo CEF dedicato persistente: non importiamo cookie dal browser
    // esterno (Firefox/Chrome), ma manteniamo quelli creati dalla sessione
    // sicura. Questo evita di mischiare token legati a fingerprint diversi.
    setenv("BG_CEF_PERSIST_SESSION", "1", 1);
 
    CefMainArgs args(argc, argv);
    CefRefPtr<CefApp> app = createApp();
 
    auto try_init_cef = [&](const char* backend) -> bool {
        if (backend) setenv("BastionGuard_CEF_BACKEND", backend, 1);
 
        CefSettings settings;
        settings.no_sandbox = true;
        settings.windowless_rendering_enabled = false;
        settings.log_severity = LOGSEVERITY_WARNING;
        settings.background_color = CefColorSetARGB(0xFF, 0xFF, 0xFF, 0xFF);
 
        CefString(&settings.resources_dir_path) = cef_dir;
        CefString(&settings.locales_dir_path)   = cef_dir + "/locales";
        CefString(&settings.cache_path)         = cache_dir;
 
        // Il tuo SDK CEF espone persist_session_cookies (a differenza di
        // persist_user_preferences, che nella build in uso non esiste).
        // Con cache_path non vuoto conserva anche i cookie senza Expires/Max-Age.
        settings.persist_session_cookies = true;
 
        bool init_ok = CefInitialize(args, settings, app, nullptr);
        if (!init_ok) {
            std::cerr << _("[SecureBrowser] ❌ CefInitialize returned false for backend: ")
            << (backend ? backend : "auto") << "\n";
        }
        return init_ok;
    };
 
    // -------------------------------------------------------------------------
    //  Scelta backend prima di CefInitialize.
    //
    //  CEF chiama OnBeforeCommandLineProcessing UNA VOLTA SOLA, prima del primo
    //  CefInitialize, e CefInitialize non si può ri-eseguire dentro lo stesso
    //  processo. Quindi il backend va deciso QUI, e l'eventuale fallback X11
    //  va impostato via env (BastionGuard_CEF_BACKEND/OZONE_PLATFORM) prima di
    //  toccare CefInitialize. Se CefInitialize fallisce, il processo deve
    //  ri-execvp se stesso impostando l'env diverso.
    // -------------------------------------------------------------------------
    auto pick_backend = []() -> const char* {
        if (const char* b = std::getenv("BastionGuard_CEF_BACKEND")) {
            if (std::strcmp(b, "wayland") == 0 || std::strcmp(b, "x11") == 0)
                return b;
        }
        if (const char* o = std::getenv("OZONE_PLATFORM")) {
            if (std::strcmp(o, "wayland") == 0 || std::strcmp(o, "x11") == 0)
                return o;
        }
        if (const char* s = std::getenv("XDG_SESSION_TYPE")) {
            if (std::strcmp(s, "wayland") == 0) return "wayland";
            if (std::strcmp(s, "x11")     == 0) return "x11";
        }
        if (std::getenv("WAYLAND_DISPLAY")) return "wayland";
        if (std::getenv("DISPLAY"))         return "x11";
        return "x11"; // default safe
    };
 
    const char* backend_pref = pick_backend();
    std::cerr << _("[SecureBrowser] backend preferito: ") << backend_pref << "\n";
 
    bool ok = try_init_cef(backend_pref);
 
    // Fallback: se Wayland fallisce e DISPLAY è disponibile, ri-execvp con X11.
    // (CefInitialize non si può richiamare nello stesso processo.)
    if (!ok && std::strcmp(backend_pref, "wayland") == 0 &&
        std::getenv("DISPLAY") && !std::getenv("BG_CEF_X11_FALLBACK")) {
        std::cerr << _("[SecureBrowser] ⚠️ CEF Wayland fallito → re-exec con X11.\n");
        setenv("BG_CEF_X11_FALLBACK",        "1",   1);
        setenv("BastionGuard_CEF_BACKEND",   "x11", 1);
        setenv("OZONE_PLATFORM",             "x11", 1);
        setenv("GDK_BACKEND",                "x11", 1);
        unsetenv("WAYLAND_DISPLAY");
        // execvp con argv originale: re-entry sicuro, niente stato CEF a metà.
        if (argv && argv[0]) {
            std::vector<char*> reargv;
            for (int i = 0; i < argc; ++i) reargv.push_back(argv[i]);
            reargv.push_back(nullptr);
            execvp(argv[0], reargv.data());
            std::perror("execvp(x11 fallback)");
        }
    }
 
    if (!ok) {
        return fail(_("[SecureBrowser] ❌ CefInitialize fallito definitivamente."));
    }
 
    CefRefPtr<SimpleHandler> handler = new SimpleHandler();
    CefRefPtr<SecureBrowserViewDelegate> view_delegate =
        new SecureBrowserViewDelegate();
 
    CefBrowserSettings bset;
    bset.javascript = STATE_ENABLED;
    bset.webgl = STATE_ENABLED;
 
    CefRefPtr<CefBrowserView> mainView =
    CefBrowserView::CreateBrowserView(
        handler, url, bset, nullptr, nullptr, view_delegate);
 
    if (!mainView) {
        CefShutdown();
        return fail(_("[SecureBrowser] ❌ CreateBrowserView() ha restituito nullptr."));
    }
 
    class WindowDelegate : public CefWindowDelegate {
    public:
        explicit WindowDelegate(CefRefPtr<CefBrowserView> main) : mainView_(main) {}
 
        void OnWindowCreated(CefRefPtr<CefWindow> window) override {
            window->AddChildView(mainView_);
            window->SetBounds(CefRect(100, 100, 1200, 800));
            mainView_->SetBounds(CefRect(0, 0, 1200, 800));
            window->SetTitle("BastionGuard Secure Browser");
            window->Show();
        }
 
        void OnWindowDestroyed(CefRefPtr<CefWindow>) override {
            CefQuitMessageLoop();
        }
 
        IMPLEMENT_REFCOUNTING(WindowDelegate);
 
    private:
        CefRefPtr<CefBrowserView> mainView_;
    };
 
    CefWindow::CreateTopLevelWindow(new WindowDelegate(mainView));
 
    std::cout << _("[SecureBrowser] ✅ Finestra sandbox creata, avvio message loop.\n");
 
    CefRunMessageLoop();
    CefShutdown();
 
    g_cef_started = false;
    std::cout << _("[SecureBrowser] ✅ Sandbox chiusa correttamente.\n");
    return true;
}
 
static bool is_payment_domain(const std::string& host) {
    if (!SettingsStore::get_secure_payments_enabled())
        return false;
 
    // Provider di pagamento "navigabili" riconosciuti SEMPRE: senza questo,
    // il filtro di navigazione del SecureBrowser bloccherebbe Stripe/PayPal/
    // ecc. quando non sono in payments.json, lasciando una pagina vuota nella
    // sandbox. NON includere endpoint tecnici (js./api./hooks./cdn.): quelli
    // sono comunque consentiti come subframe in sessione trusted.
    {
        static const std::unordered_set<std::string> builtin = {
            "stripe.com", "paypal.com", "paypalobjects.com", "adyen.com",
            "checkout.com", "klarna.com", "worldpay.com", "braintreegateway.com",
            "nexi.it", "nexigroup.com", "sisalpay.it", "satispay.com",
            "sumup.com", "square.com", "squareup.com", "mollie.com",
            "gocardless.com", "wise.com", "revolut.com", "skrill.com",
            "neteller.com", "paysafecard.com", "amazonpay.com",
            "wallet.google.com", "pay.google.com",
        };
        const std::string hb = clean_domain(host);
        if (builtin.count(hb)) return true;
        auto d = hb.find('.');
        while (d != std::string::npos) {
            if (builtin.count(hb.substr(d + 1))) return true;
            d = hb.find('.', d + 1);
        }
    }
 
    static std::unordered_set<std::string> payment_domains;
    static bool initialized = false;
 
    if (!initialized) {
        std::vector<std::string> tmp;
        std::cerr << _("[SecureBrowser] 🔍 Caricamento domini pagamenti...\n");
 
        load_list_file("/usr/share/BastionGuard/data/payments/payments.json", tmp);
 
        const char* home = std::getenv("HOME");
        if (home) {
            load_list_file(std::string(home) + "/.local/share/BastionGuard/payments/payments.json", tmp);
            load_list_file(std::string(home) + "/.config/BastionGuard/payments.json", tmp);
        }
 
        for (auto& d : tmp) {
            payment_domains.insert(clean_domain(d));
        }
 
        std::cerr << _("[SecureBrowser] ✅ Cache pagamenti inizializzata: ")
        << payment_domains.size() << _(" domini.\n");
 
        initialized = true;
    }
 
    const std::string h = clean_domain(host);
 
    if (payment_domains.count(h)) {
        std::cerr << _("[SecureBrowser] 🟢 Payment trusted (match diretto): ") << h << "\n";
        return true;
    }
 
    auto dot = h.find('.');
    while (dot != std::string::npos) {
        std::string parent = h.substr(dot + 1);
        if (payment_domains.count(parent)) {
            std::cerr << _("[SecureBrowser] 🟢 Payment trusted (match parent '")
            << parent << "'): " << h << "\n";
            return true;
        }
        dot = h.find('.', dot + 1);
    }
 
    return false;
}
 
void SecureBrowser::open_notify(const std::string& url, int argc, char** argv) {
    if (!BastionGuard::Platform::cef_available()) {
        std::cerr << _("[SecureBrowser] Notifiche CEF disabilitate su questa build o distribuzione.\n");
        return;
    }
 
    static std::atomic<bool> s_running{false};
    bool expected = false;
    if (!s_running.compare_exchange_strong(expected, true)) {
        std::cerr << _("[SecureBrowser] open_notify: già in esecuzione, ignoro\n");
        return;
    }
 
    InstanceLock lock("/tmp/BastionGuard-notify.lock");
    if (!lock.acquired()) {
        std::cerr << _("[SecureBrowser] open_notify: istanza notifica già attiva\n");
        s_running = false;
        return;
    }
 
    std::cout << _("[SecureBrowser] 🛡️ Apertura finestra notifica: ") << url << "\n";
 
    clear_proxy_env();
 
    setenv("SSL_CERT_DIR", "/etc/ssl/certs", 1);
    setenv("SSL_CERT_FILE", "/etc/ssl/certs/ca-certificates.crt", 1);
 
    const std::string cef_dir   = "/usr/share/BastionGuard/cef";
    const std::string cache_dir = Glib::get_home_dir() + "/.cache/BastionGuard/cef_notify";
    std::error_code ec;
    fs::create_directories(cache_dir, ec);
 
    CefMainArgs args(argc ? argc : 0, argv);
    CefRefPtr<CefApp> app = createApp();
 
    CefSettings settings;
    settings.no_sandbox                   = true;
    settings.windowless_rendering_enabled = false;
    settings.log_severity                 = LOGSEVERITY_DISABLE;
    settings.background_color             = CefColorSetARGB(0xFF, 0x07, 0x09, 0x0F);
 
    CefString(&settings.resources_dir_path) = cef_dir;
    CefString(&settings.locales_dir_path)   = cef_dir + "/locales";
    CefString(&settings.cache_path)         = cache_dir;
 
    if (!CefInitialize(args, settings, app, nullptr)) {
        std::cerr << _("[SecureBrowser] ❌ open_notify: CefInitialize fallito\n");
        s_running = false;
        return;
    }
 
    class NotifyHandler : public CefClient,
    public CefLifeSpanHandler,
    public CefDisplayHandler {
    public:
        CefRefPtr<CefLifeSpanHandler> GetLifeSpanHandler() override { return this; }
        CefRefPtr<CefDisplayHandler> GetDisplayHandler() override { return this; }
 
        void OnAfterCreated(CefRefPtr<CefBrowser>) override {}
 
        void OnBeforeClose(CefRefPtr<CefBrowser>) override {
            CEF_REQUIRE_UI_THREAD();
            CefQuitMessageLoop();
        }
 
        IMPLEMENT_REFCOUNTING(NotifyHandler);
    };
 
    CefRefPtr<NotifyHandler> handler = new NotifyHandler();
    CefBrowserSettings bset;
    bset.javascript = STATE_ENABLED;
 
    CefRefPtr<CefBrowserView> view =
    CefBrowserView::CreateBrowserView(handler, url, bset, nullptr, nullptr, nullptr);
 
    if (!view) {
        std::cerr << _("[SecureBrowser] ❌ open_notify: CreateBrowserView fallito\n");
        CefShutdown();
        s_running = false;
        return;
    }
 
    class NotifyWindowDelegate : public CefWindowDelegate {
    public:
        explicit NotifyWindowDelegate(CefRefPtr<CefBrowserView> v) : view_(v) {}
 
        void OnWindowCreated(CefRefPtr<CefWindow> w) override {
            w->AddChildView(view_);
            w->SetBounds(CefRect(200, 200, 560, 420));
            view_->SetBounds(CefRect(0, 0, 560, 420));
            w->SetTitle(_("BastionGuard — Protected Session"));
            w->Show();
        }
 
        void OnWindowDestroyed(CefRefPtr<CefWindow>) override {
            CefQuitMessageLoop();
        }
 
        IMPLEMENT_REFCOUNTING(NotifyWindowDelegate);
 
    private:
        CefRefPtr<CefBrowserView> view_;
    };
 
    CefWindow::CreateTopLevelWindow(new NotifyWindowDelegate(view));
    CefRunMessageLoop();
    CefShutdown();
 
    s_running = false;
    std::cout << _("[SecureBrowser] ✅ Finestra notifica chiusa.\n");
}