Set CSP & permissions requests handling

apps/desktop/package.json

@@ -55,7 +55,6 @@
     "@emotion/is-prop-valid": "^1.3.0",
     "@emotion/react": "^11.13.3",
     "@emotion/styled": "^11.13.0",
-    "@ledgerhq/hw-transport-webusb": "^6.29.3",
     "@reduxjs/toolkit": "^2.2.7",
     "@tanstack/react-query": "^5.56.2",
     "@tanstack/react-query-devtools": "^5.56.2",

apps/desktop/public/electron.js

@@ -4,7 +4,6 @@ const path = require("path");
 const url = require("url");
 const process = require("process");
 const { autoUpdater } = require("electron-updater");
-
 const APP_PROTOCOL = "app";
 const APP_HOST = "assets";
 
@@ -66,6 +65,38 @@ function createWindow() {
     );
   });
 
+  mainWindow.webContents.session.webRequest.onHeadersReceived((details, callback) => {
+    callback({
+      responseHeaders: {
+        ...details.responseHeaders,
+        "Content-Security-Policy": ["script-src 'self'"],
+      },
+    });
+  });
+
+  mainWindow.webContents.session.setPermissionCheckHandler((_, permission) => {
+    switch (permission) {
+      case "usb":
+      case "clipboard-sanitized-write":
+      case "background-sync":
+      case "accessibility-events":
+        return true;
+      default:
+        return false;
+    }
+  });
+
+  mainWindow.webContents.session.setPermissionRequestHandler((_, permission, callback) => {
+    switch (permission) {
+      case "clipboard-sanitized-write":
+      case "clipboard-read":
+        callback(true);
+        break;
+      default:
+        callback(false);
+    }
+  });
+
   protocol.handle(APP_PROTOCOL, async req => {
     try {
       const uri = new URL(decodeURI(req.url));
@@ -107,15 +138,6 @@ function createWindow() {
     }
   });
 
-  mainWindow.webContents.setWindowOpenHandler(details => {
-    if (details.url.startsWith("https") || details.url.startsWith("mailto")) {
-      shell.openExternal(details.url);
-      return { action: "deny" };
-    } else {
-      return { action: "allow" };
-    }
-  });
-
   // Emitted when the window is closed.
   mainWindow.on("closed", () => {
     // Dereference the window object, usually you would store windows