updater fixed

src/main/gitea-service.cjs

@@ -325,13 +325,15 @@ class GiteaService {
     const token = this.store.getToken();
     let target = new URL(url, `${baseUrl}/`);
     for (let redirects = 0; redirects <= 5; redirects += 1) {
-      if (target.origin !== base.origin)
+      const sameOrigin = target.origin === base.origin;
+      if (!sameOrigin && target.protocol !== "https:") {
         throw new Error(
-          "Refusing to send the Gitea token to a different origin.",
+          "Refusing an insecure cross-origin update download redirect.",
         );
+      }
       const response = await fetch(target, {
         headers: {
-          Authorization: `token ${token}`,
+          ...(sameOrigin && token ? { Authorization: `token ${token}` } : {}),
           Accept: "application/octet-stream",
         },
         signal: AbortSignal.timeout(timeout),
@@ -360,8 +362,20 @@ class GiteaService {
       throw new Error("Gitea returned an invalid release ID.");
     if (!Number.isSafeInteger(numericId) || numericId <= 0)
       throw new Error("Gitea returned an invalid release asset ID.");
-    const assetPath = `/api/v1/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/releases/${numericReleaseId}/assets/${numericId}`;
-    return this.downloadAuthenticated(assetPath, options);
+
+    let downloadUrl = String(options.downloadUrl || "").trim();
+    if (!downloadUrl) {
+      const metadataPath = `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/releases/${numericReleaseId}/assets/${numericId}`;
+      const metadata = (await this.request(metadataPath)).data;
+      if (Number(metadata?.id) !== numericId) {
+        throw new Error("Gitea returned metadata for a different release asset.");
+      }
+      downloadUrl = String(metadata?.browser_download_url || "").trim();
+    }
+    if (!downloadUrl) {
+      throw new Error("Gitea did not provide a release asset download URL.");
+    }
+    return this.downloadAuthenticated(downloadUrl, options);
   }
 
   async dispatchWorkflow({ owner, repo, workflowFile, ref, inputs = {} }) {