refactor(main): split monolithic ipcHandlers.js into six domain modules under src/main/ipc/

src/core/featureFlags.js

@@ -0,0 +1,58 @@
+// src/core/featureFlags.js
+// Single source of truth for feature-flag defaults, typed keys, and
+// get/set semantics. Falls back to defaults when a key is missing from
+// the database, and rejects writes to unknown keys in debug builds.
+
+const DEFAULT_FLAGS = Object.freeze({
+  realtimeProtection: true,
+  autoReports: true,
+  scanHistory: true,
+  externalLookups: true,
+  geoLookup: true,
+  networkPerimeterMap: true,
+  notificationsEnabled: true,
+  scanNotifications: true,
+  launchAtStartup: false,
+  folderWatch: true,
+  networkAlerts: true,
+  networkTrafficHistory: true,
+});
+
+const FLAG_KEYS = Object.freeze(Object.keys(DEFAULT_FLAGS));
+
+function isKnownFlag(key) {
+  return Object.prototype.hasOwnProperty.call(DEFAULT_FLAGS, key);
+}
+
+function getFlag(db, key, fallback) {
+  if (!isKnownFlag(key)) {
+    throw new Error(`Unknown feature flag: ${key}`);
+  }
+  const raw = db.getSetting(key, undefined);
+  if (raw === undefined || raw === null) {
+    return typeof fallback === 'undefined' ? DEFAULT_FLAGS[key] : fallback;
+  }
+  return Boolean(raw);
+}
+
+function setFlag(db, key, value) {
+  if (!isKnownFlag(key)) {
+    throw new Error(`Unknown feature flag: ${key}`);
+  }
+  const boolValue = Boolean(value);
+  db.setSetting(key, boolValue);
+  return boolValue;
+}
+
+function getDefaults() {
+  return { ...DEFAULT_FLAGS };
+}
+
+module.exports = {
+  DEFAULT_FLAGS,
+  FLAG_KEYS,
+  isKnownFlag,
+  getFlag,
+  setFlag,
+  getDefaults,
+};

src/core/scanProgress.js

@@ -0,0 +1,14 @@
+// src/core/scanProgress.js
+// Centralised progress normalisation used by the scan engine and IPC
+// handlers. Guarantees finite integers in the 0-100 range so every
+// caller does not have to re-implement the same guards.
+
+function clampProgress(value) {
+  const n = Number(value);
+  if (!Number.isFinite(n)) return 0;
+  return Math.max(0, Math.min(100, Math.round(n)));
+}
+
+module.exports = {
+  clampProgress,
+};

src/main/ipc/_shared.js

@@ -0,0 +1,23 @@
+const https = require('https');
+
+function requestText(url, options = {}) {
+  return new Promise((resolve, reject) => {
+    const req = https.request(url, {
+      method: 'GET',
+      headers: {
+        'User-Agent': 'Soterios',
+        ...options.headers,
+      },
+    }, (res) => {
+      let body = '';
+      res.setEncoding('utf8');
+      res.on('data', chunk => { body += chunk; });
+      res.on('end', () => resolve({ statusCode: res.statusCode, body }));
+    });
+    req.on('error', reject);
+    req.setTimeout(15000, () => req.destroy(new Error('Request timed out')));
+    req.end();
+  });
+}
+
+module.exports = { requestText };

src/main/ipc/firewall.js

@@ -0,0 +1,130 @@
+const { ipcMain, dialog, BrowserWindow } = require('electron');
+const path = require('path');
+const fs = require('fs');
+const { requestText } = require('../ipc/_shared');
+const {
+  isPathInScanReportsDir,
+} = require('../../security/reportExport');
+
+const VALID_FIREWALL_PROFILES = ['Domain', 'Private', 'Public'];
+
+function isValidFirewallProfile(name) {
+  return typeof name === 'string' && VALID_FIREWALL_PROFILES.includes(name);
+}
+
+function isValidIp(ip) {
+  const v4 = /^(\d{1,3}\.){3}\d{1,3}$/;
+  const v6 = /^[0-9a-fA-F:]+$/;
+  return v4.test(ip) || (v6.test(ip) && ip.includes(':'));
+}
+
+function register(mainWindow, { db, firewallManager }) {
+  ipcMain.handle('firewall:status', async () => {
+    return firewallManager.getStatus();
+  });
+
+  ipcMain.handle('firewall:rules', async () => {
+    return firewallManager.getRules();
+  });
+
+  ipcMain.handle('firewall:listRules', async () => {
+    return firewallManager.listRules();
+  });
+
+  ipcMain.handle('firewall:createRule', async (_event, spec) => {
+    return firewallManager.createRule(spec);
+  });
+
+  ipcMain.handle('firewall:deleteRule', async (_event, name) => {
+    return firewallManager.deleteRule(name);
+  });
+
+  ipcMain.handle('firewall:setRuleEnabled', async (_event, { name, enabled }) => {
+    return firewallManager.setRuleEnabled(name, enabled);
+  });
+
+  ipcMain.handle('firewall:setProfileEnabled', async (_event, { profile, enabled }) => {
+    if (!isValidFirewallProfile(profile)) throw new Error(`Invalid firewall profile: ${profile}`);
+    return firewallManager.setProfileEnabled(profile, !!enabled);
+  });
+
+  ipcMain.handle('firewall:exportRules', async () => {
+    const data = await firewallManager.exportRules();
+    const result = await dialog.showSaveDialog(mainWindow || BrowserWindow.getFocusedWindow(), {
+      title: 'Export Soterios firewall rules',
+      defaultPath: 'soterios-firewall-rules.json',
+      filters: [{ name: 'JSON', extensions: ['json'] }],
+    });
+    if (result.canceled || !result.filePath) return { canceled: true };
+    await fs.promises.writeFile(result.filePath, JSON.stringify(data, null, 2), 'utf8');
+    return { success: true, path: result.filePath, count: data.rules.length };
+  });
+
+  ipcMain.handle('firewall:importRules', async (_event, options = {}) => {
+    const onConflict = ['skip', 'overwrite', 'rename'].includes(options && options.onConflict)
+      ? options.onConflict
+      : 'skip';
+    const result = await dialog.showOpenDialog(mainWindow || BrowserWindow.getFocusedWindow(), {
+      title: 'Import Soterios firewall rules',
+      properties: ['openFile'],
+      filters: [{ name: 'JSON', extensions: ['json'] }],
+    });
+    if (result.canceled || !result.filePaths.length) return { canceled: true };
+    const filePath = result.filePaths[0];
+    const stat = await fs.promises.stat(filePath);
+    const MAX_IMPORT_BYTES = 2 * 1024 * 1024;
+    if (stat.size > MAX_IMPORT_BYTES) {
+      throw new Error('Import file is too large (limit 2 MB).');
+    }
+    let payload;
+    try {
+      const raw = await fs.promises.readFile(filePath, 'utf8');
+      payload = JSON.parse(raw);
+    } catch (e) {
+      throw new Error('Could not parse import file as JSON.');
+    }
+    const summary = await firewallManager.importRules(payload, { onConflict });
+    return { ...summary, path: filePath };
+  });
+
+  const TRUSTED_IPS_KEY = 'firewall.trustedIps';
+
+  ipcMain.handle('firewall:getTrusted', () => {
+    return db.getSetting(TRUSTED_IPS_KEY, []);
+  });
+
+  ipcMain.handle('firewall:trustConnection', (_event, ip) => {
+    if (!ip || !isValidIp(ip)) throw new Error('Invalid address.');
+    const current = db.getSetting(TRUSTED_IPS_KEY, []);
+    if (!current.includes(ip)) current.push(ip);
+    db.setSetting(TRUSTED_IPS_KEY, current);
+    return current;
+  });
+
+  ipcMain.handle('firewall:untrustConnection', (_event, ip) => {
+    const current = (db.getSetting(TRUSTED_IPS_KEY, []) || []).filter((x) => x !== ip);
+    db.setSetting(TRUSTED_IPS_KEY, current);
+    return current;
+  });
+
+  // -- WHOIS lookup (no API key required) --
+  ipcMain.handle('network:whois', async (_event, ip) => {
+    if (!ip || !isValidIp(ip)) throw new Error('Invalid address.');
+    const res = await requestText(`https://ipwho.is/${encodeURIComponent(ip)}`);
+    if (res.statusCode !== 200) throw new Error(`WHOIS lookup failed (${res.statusCode}).`);
+    const data = JSON.parse(res.body || '{}');
+    if (data.success === false) return { found: false };
+    return {
+      found: true,
+      ip: data.ip,
+      country: data.country,
+      region: data.region,
+      city: data.city,
+      org: (data.connection && data.connection.org) || data.org || null,
+      isp: (data.connection && data.connection.isp) || null,
+      asn: (data.connection && data.connection.asn) || null,
+    };
+  });
+}
+
+module.exports = { register };