#251 Support scoped native popup windows for social login flows

[Anonymous]

Originally created by: kristofferR

Problem

Carrier classifies Google, Apple, and Microsoft authentication URLs as internal, but it has no native new-window handler. Wry denies programmatic window.open requests when no handler is installed, so popup-based login can lose opener/callback semantics or fall back to an in-place navigation.

This is separate from File > New Window. Authentication popups are related child windows with a shared session and a short lifetime.

Goal

Support social-login popups without turning arbitrary remote window.open calls into native windows.

Design

• Add an on_new_window handler to Messenger WebViews.
• Reuse the existing Rust URL classifier:
• approved Facebook/Messenger and dedicated authentication URLs may create a related popup;
• ordinary external HTTP(S) URLs open in the default browser;
• file, data, javascript, unknown schemes, and malformed URLs are denied.
• Share the parent WebView profile/session so authentication cookies and callbacks work.
• Bound requested position and size to a visible screen and apply Carrier theme and always-on-top state.
• Give popups unique labels and do not make them part of normal File > New Window persistence.
• Allow programmatic close only for windows that Carrier created as authentication popups. Do not globally replace window.close on the main Messenger page.
• Keep remote-origin capabilities narrow. The page must not gain a general window-management command.

Verification

• Live Google, Apple, and Microsoft login flows, including cancel and successful callback.
• Popup focus, close, parent destruction, and multiple-window behavior.
• External and dangerous popup targets remain outside Carrier or are denied.
• Unit tests for URL disposition and requested-window bounds.

[Anonymous]

Originally posted by: kristofferR

[!NOTE]
🤖 Claude Opus 5.5 responding on behalf of Kristoffer

Done in [#344] (on main, first released in v2.1.0). Messenger windows now have an on_new_window handler (open_popup in src-tauri/src/window.rs). popup_route (src-tauri/src/url_rules.rs) opens blank pages, Facebook hosts and the Google, Apple and Microsoft sign-in hosts as popup-* windows that share the opener's session. Other web pages open in the browser, and everything else is denied. Popups get unique labels, open centred on the opener's screen, stay out of window persistence, and only these popups can close themselves through window.close().

Not done: a live Google, Apple or Microsoft sign-in, since Facebook's login page doesn't currently offer one. Messenger call windows use the same path and work on macOS.

[Anonymous]

Ticket changed by: kristofferR

• status: open --> closed