webPreferences: {
  nodeIntegration: true,
  contextIsolation: false
}

const webPreferences: WebPreferences = {
  nodeIntegration: false,
  nodeIntegrationInSubFrames: false,
  contextIsolation: true,
  sandbox: true, // Enable chromium-level process sandboxing
  preload: path.join(app.getAppPath(), 'app/preload.js'),
  webviewTag: false, // Transition webviews to iframe sandboxes where possible
};

import { contextBridge, ipcRenderer } from 'electron';

// Explicitly define and freeze the allowed IPC channels
const ALLOWED_SEND_CHANNELS = new Set([
  'server-touch',
  'min-window',
  'max-window',
  'close-window',
  'open-external-url',
]);

const ALLOWED_RECEIVE_CHANNELS = new Set([
  'server-selected',
  'update-downloaded',
  'power-state-change',
]);

contextBridge.revealInMainWorld('RocketChatDesktop', {
  send: (channel: string, data: any) => {
    if (ALLOWED_SEND_CHANNELS.has(channel)) {
      // Strip prototype pollution and ensure deep cloning of data
      const safeData = JSON.parse(JSON.stringify(data));
      ipcRenderer.send(channel, safeData);
    } else {
      console.warn(`Blocked unauthorized outgoing IPC channel: ${channel}`);
    }
  },
  on: (channel: string, callback: (...args: any[]) => void) => {
    if (ALLOWED_RECEIVE_CHANNELS.has(channel)) {
      const subscription = (_event: any, ...args: any[]) => callback(...args);
      ipcRenderer.on(channel, subscription);
      return () => {
        ipcRenderer.removeListener(channel, subscription);
      };
    } else {
      console.warn(`Blocked unauthorized incoming IPC channel: ${channel}`);
      return () => {};
    }
  }
});

import { autoUpdater } from 'electron-updater';
import { promises as fs } from 'fs';
import * as crypto from 'crypto';
import { execFile } from 'child_process';

autoUpdater.on('update-downloaded', async (info) => {
  const downloadedFile = info.downloadedFile;
  if (!downloadedFile) {
    console.error('Update downloaded but file path is missing.');
    return;
  }

  try {
    // 1. Perform SHA256 Checksum Verification
    const fileBuffer = await fs.readFile(downloadedFile);
    const hash = crypto.createHash('sha256').update(fileBuffer).digest('hex');
    
    // Fetch target hash from a signed, secure manifest hosted on a separate secure endpoint
    const expectedHash = await fetchExpectedHashFromSignedManifest(info.version);
    
    if (hash !== expectedHash) {
      throw new Error(`Checksum mismatch! Expected ${expectedHash}, got ${hash}`);
    }

    // 2. Perform Native Platform Signature Check
    await verifyNativeSignature(downloadedFile);

    console.log('Update package verified successfully. Safe to install.');
    // Notify renderer that update is verified and ready
    rootWindow.webContents.send('update-downloaded', { verified: true, version: info.version });

  } catch (error) {
    console.error('CRITICAL: Update package validation failed!', error);
    // Secure deletion of the invalid binary to prevent execution
    await fs.unlink(downloadedFile).catch(() => {});
  }
});

// Platform-specific signature checks
function verifyNativeSignature(filePath: string): Promise<void> {
  return new Promise((resolve, reject) => {
    if (process.platform === 'win32') {
      // Use Windows PowerShell to verify digital signature
      execFile('powershell.exe', [
        '-NoProfile',
        '-NonInteractive',
        '-Command',
        `Get-AuthenticodeSignature "${filePath}" | Where-Object { $_.Status -eq "Valid" }`
      ], (err, stdout) => {
        if (err || !stdout.trim()) {
          reject(new Error('Windows code signature validation failed.'));
        } else {
          resolve();
        }
      });
    } else if (process.platform === 'darwin') {
      // Use macOS codesign utility to verify developer ID signature
      execFile('codesign', ['-v', '--verbose=4', filePath], (err) => {
        if (err) {
          reject(new Error('macOS codesign verification failed.'));
        } else {
          resolve();
        }
      });
    } else {
      // For Linux, verify package hash signatures if built with GPG signatures
      resolve();
    }
  });
}

setupReactiveFeatures();
setInterval(setupReactiveFeatures, 1000); // Check every second for newly loaded modules

// Replacement for the active polling loop in src/injected.ts
const registerObserver = () => {
  const targetNode = document.body;
  
  const config = { 
    childList: true, 
    subtree: true 
  };

  const callback = (mutationsList: MutationRecord[]) => {
    let moduleAdded = false;
    for (const mutation of mutationsList) {
      if (mutation.type === 'childList') {
        // Check if Meteor-related or target React/Tracker modules were added
        const hasReactRoots = Array.from(mutation.addedNodes).some(
          (node) => node instanceof Element && node.querySelector('[data-reactroot], #react-root')
        );
        if (hasReactRoots) {
          moduleAdded = true;
          break;
        }
      }
    }

    if (moduleAdded) {
      setupReactiveFeatures();
    }
  };

  const observer = new MutationObserver(callback);
  observer.observe(targetNode, config);
  
  // Return disconnect handle for cleanup
  return () => observer.disconnect();
};

import { powerMonitor, powerSaveBlocker } from 'electron';

// Track active background processes and throttle
powerMonitor.on('suspend', () => {
  console.log('System is suspending. Throttling all background renderers.');
  throttleAllWindows(true);
});

powerMonitor.on('resume', () => {
  console.log('System resumed. Restoring normal performance profile.');
  throttleAllWindows(false);
});

powerMonitor.on('lock-screen', () => {
  console.log('Screen locked. Pausing non-essential tasks.');
  throttleAllWindows(true);
});

powerMonitor.on('unlock-screen', () => {
  throttleAllWindows(false);
});

function throttleAllWindows(throttle: boolean) {
  const windows = BrowserWindow.getAllWindows();
  for (const win of windows) {
    if (win.isDestroyed()) continue;
    
    if (throttle) {
      // Throttle rendering and background intervals completely
      win.webContents.setFrameRate(10); // Throttle rendering to 10 FPS
      win.webContents.send('power-state-change', 'idle');
    } else {
      win.webContents.setFrameRate(60); // Restore normal 60 FPS rendering
      win.webContents.send('power-state-change', 'active');
    }
  }
}