Fix broken checkboxes on Beta Steam client (#710)

Co-authored-by: ayssia <nynaevealmearah@gmail.com>

backend/decky_loader/locales/zh-CN.json

@@ -191,6 +191,15 @@
         "testing_title": "测试"
     },
     "Store": {
+        "download_progress_info": {
+            "download_zip": "正在下载插件",
+            "increment_count": "正在计入下载次数",
+            "installing_plugin": "正在安装插件",
+            "open_zip": "正在打开 ZIP 文件",
+            "parse_zip": "正在解析 ZIP 文件",
+            "start": "正在初始化",
+            "uninstalling_previous": "正在卸载之前的版本"
+        },
         "store_contrib": {
             "desc": "如果你想要提交你的插件到 Decky 插件商店，请访问 GitHub 上的 SteamDeckHomebrew/decky-plugin-template 存储库。有关开发和分发插件的信息，请查看 README 文件。",
             "label": "贡献"
@@ -239,7 +248,11 @@
         }
     },
     "Testing": {
-        "download": "下载"
+        "download": "下载",
+        "error": "安装 PR 时出错",
+        "header": "以下版本的 Decky Loader 是根据开放的第三方 Pull Request 构建的。Decky Loader 团队尚未验证这些版本的功能或安全性，且它们可能已经过期。",
+        "loading": "正在加载尚未合并的 Pull Request ...",
+        "start_download_toast": "正在下载 PR #{{id}}"
     },
     "TitleView": {
         "decky_store_desc": "打开 Decky 商店",

backend/decky_loader/utilities.py

@@ -9,7 +9,7 @@ from traceback import format_exc
 from stat import FILE_ATTRIBUTE_HIDDEN # pyright: ignore [reportAttributeAccessIssue, reportUnknownVariableType]
 
 from asyncio import StreamReader, StreamWriter, start_server, gather, open_connection
-from aiohttp import ClientSession
+from aiohttp import ClientSession, hdrs
 from aiohttp.web import Request, StreamResponse, Response, json_response, post
 from typing import TYPE_CHECKING, Callable, Coroutine, Dict, Any, List, TypedDict
 
@@ -153,14 +153,14 @@ class Utilities:
         headers["User-Agent"] = helpers.user_agent
 
         for excluded_header in excluded_default_headers:
-            self.logger.debug(f"Excluding default header {excluded_header}")
             if excluded_header in headers:
+                self.logger.debug(f"Excluding default header {excluded_header}: {headers[excluded_header]}")
                 del headers[excluded_header]
 
         if "X-Decky-Fetch-Excluded-Headers" in req.headers:
             for excluded_header in req.headers["X-Decky-Fetch-Excluded-Headers"].split(", "):
-                self.logger.debug(f"Excluding header {excluded_header}")
                 if excluded_header in headers:
+                    self.logger.debug(f"Excluding header {excluded_header}: {headers[excluded_header]}")
                     del headers[excluded_header]
 
         for header in req.headers:
@@ -187,7 +187,21 @@ class Utilities:
         # defeat the point of this proxy.
         async with ClientSession(auto_decompress=False) as web:
             async with web.request(req.method, url, headers=headers, data=body, ssl=helpers.get_ssl_context()) as web_res:
-                res = StreamResponse(headers=web_res.headers, status=web_res.status)
+                # Whenever the aiohttp_cors is used, it expects a near complete control over whatever headers are needed
+                # for `aiohttp_cors.ResourceOptions`. As a server, if you delegate CORS handling to aiohttp_cors,
+                # the headers below must NOT be set. Otherwise they would be overwritten by aiohttp_cors and there would be 
+                # logic bugs, so it was probably a smart choice to assert if the headers are present.
+                #
+                # However, this request handler method does not act like our own local server, it always acts like a proxy 
+                # where we do not have control over the response headers. For responses that do not allow CORS, we add the support
+                # via aiohttp_cors. For responses that allow CORS, we have to remove the conflicting headers to allow
+                # aiohttp_cors handle it for us as if there was no CORS support.
+                aiohttp_cors_compatible_headers = web_res.headers.copy()
+                aiohttp_cors_compatible_headers.popall(hdrs.ACCESS_CONTROL_ALLOW_ORIGIN, default=None)
+                aiohttp_cors_compatible_headers.popall(hdrs.ACCESS_CONTROL_ALLOW_CREDENTIALS, default=None)
+                aiohttp_cors_compatible_headers.popall(hdrs.ACCESS_CONTROL_EXPOSE_HEADERS, default=None)
+
+                res = StreamResponse(headers=aiohttp_cors_compatible_headers, status=web_res.status)
                 if web_res.headers.get('Transfer-Encoding', '').lower() == 'chunked':
                     res.enable_chunked_encoding()
 

frontend/package.json

@@ -47,7 +47,7 @@
     }
   },
   "dependencies": {
-    "@decky/ui": "^4.7.3",
+    "@decky/ui": "^4.7.4",
     "compare-versions": "^6.1.1",
     "filesize": "^10.1.2",
     "i18next": "^23.11.5",

frontend/pnpm-lock.yaml

@@ -9,8 +9,8 @@ importers:
   .:
     dependencies:
       '@decky/ui':
-        specifier: ^4.7.3
-        version: 4.7.3
+        specifier: ^4.7.4
+        version: 4.7.4
       compare-versions:
         specifier: ^6.1.1
         version: 6.1.1
@@ -218,8 +218,8 @@ packages:
   '@decky/api@1.1.1':
     resolution: {integrity: sha512-R5fkBRHBt5QIQY7Q0AlbVIhlIZ/nTzwBOoi8Rt4Go2fjFnoMKPInCJl6cPjXzimGwl2pyqKJgY6VnH6ar0XrHQ==}
 
-  '@decky/ui@4.7.3':
-    resolution: {integrity: sha512-yjCKOt7WxCoaQ2M1Sf7qAkNQhq/H+BzYyo0GYHPqLg0U6qwIdwGsSGp/dugTbb6edIRYRisgSra25J4QTjb5EQ==}
+  '@decky/ui@4.7.4':
+    resolution: {integrity: sha512-ziCP3akLJVYG5FFoS0ao9MYEYJ09g44FP4xMmOUFe8SFRjC9BqBvbJBF0+OUOKgp2C7SJ0rNPSIFm4RwCUvoug==}
 
   '@esbuild/aix-ppc64@0.20.2':
     resolution: {integrity: sha512-D+EBOJHXdNZcLJRBkhENNG8Wji2kgc9AZ9KiPr1JuZjsNtyHzrsfLRrY0tk2H2aoFu6RANO1y1iPPUCDYWkb5g==}
@@ -2295,7 +2295,7 @@ snapshots:
 
   '@decky/api@1.1.1': {}
 
-  '@decky/ui@4.7.3': {}
+  '@decky/ui@4.7.4': {}
 
   '@esbuild/aix-ppc64@0.20.2':
     optional: true