From 9589680a81c443ea648b5738cb9bdcf19451c62b Mon Sep 17 00:00:00 2001
From: litruv <litruv@gmail.com>
Date: Thu, 23 Jul 2026 15:13:53 +1000
Subject: [PATCH] Use paarrot://desktop SSO redirect so consent identifies the
 app.

---
 src/app/hooks/usePathWithOrigin.ts | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/src/app/hooks/usePathWithOrigin.ts b/src/app/hooks/usePathWithOrigin.ts
index 4430d06..128579d 100644
--- a/src/app/hooks/usePathWithOrigin.ts
+++ b/src/app/hooks/usePathWithOrigin.ts
@@ -1,12 +1,30 @@
 import { useMemo } from 'react';
 import { useClientConfig } from './useClientConfig';
 import { trimLeadingSlash, trimSlash, trimTrailingSlash } from '../utils/common';
+import { isElectron } from '../utils/tauri';
 
+/** Authority shown on Matrix SSO consent ("Continue to paarrot://desktop"). */
+export const ELECTRON_PROTOCOL_HOST = 'desktop';
+
+/**
+ * Build an absolute URL for the given in-app path.
+ *
+ * In Electron, SSO (and other browser handoffs) must return via paarrot://desktop/...
+ * — a named host so consent UI identifies the desktop app, and a real pathname
+ * (not a hash) because browsers strip fragments when launching custom protocols.
+ */
 export const usePathWithOrigin = (path: string): string => {
   const { hashRouter } = useClientConfig();
   const { origin } = window.location;
 
   const pathWithOrigin = useMemo(() => {
+    if (isElectron()) {
+      const basename = trimSlash(hashRouter?.basename ?? '');
+      const routeParts = [basename, trimLeadingSlash(path)].filter(Boolean);
+      const route = `/${routeParts.join('/')}`.replace(/\/{2,}/g, '/');
+      return `paarrot://${ELECTRON_PROTOCOL_HOST}${route}`;
+    }
+
     let url: string = trimSlash(origin);
 
     url += `/${trimSlash(import.meta.env.BASE_URL ?? '')}`;