logiguard fork: GPUI xdg-activation keyboard-focus serial fix

Single-commit orphan branch: full zed-industries/zed @ 8c74db0 source tree
with a 3-file patch applied (no upstream history).

Patch (crates/gpui_linux/src/linux/wayland/):
  - serial.rs: add SerialKind::KeyboardEnter
  - client.rs: store wl_keyboard.enter serial; add latest_serial_of()
  - window.rs: activate() uses keyboard-enter serial (Mutter focus gate)

Mutter honors window activation only when the token carries the keyboard-
focus serial from wl_keyboard.enter; GPUI used a stale mouse-press serial.
See docs/tray-window-focus-wayland.md in logiguard.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/livekit_api/src/livekit_api.rs

@@ -0,0 +1,182 @@
+pub mod proto;
+pub mod token;
+
+use anyhow::Result;
+use async_trait::async_trait;
+use prost::Message;
+use reqwest::header::CONTENT_TYPE;
+use std::{future::Future, sync::Arc, time::Duration};
+
+#[async_trait]
+pub trait Client: Send + Sync {
+    fn url(&self) -> &str;
+    async fn create_room(&self, name: String) -> Result<()>;
+    async fn delete_room(&self, name: String) -> Result<()>;
+    async fn remove_participant(&self, room: String, identity: String) -> Result<()>;
+    async fn update_participant(
+        &self,
+        room: String,
+        identity: String,
+        permission: proto::ParticipantPermission,
+    ) -> Result<()>;
+    fn room_token(&self, room: &str, identity: &str) -> Result<String>;
+    fn guest_token(&self, room: &str, identity: &str) -> Result<String>;
+}
+
+pub struct LiveKitParticipantUpdate {}
+
+#[derive(Clone)]
+pub struct LiveKitClient {
+    http: reqwest::Client,
+    url: Arc<str>,
+    key: Arc<str>,
+    secret: Arc<str>,
+}
+
+impl LiveKitClient {
+    pub fn new(mut url: String, key: String, secret: String) -> Self {
+        if url.ends_with('/') {
+            url.pop();
+        }
+
+        Self {
+            http: reqwest::ClientBuilder::new()
+                .timeout(Duration::from_secs(5))
+                .build()
+                .unwrap(),
+            url: url.into(),
+            key: key.into(),
+            secret: secret.into(),
+        }
+    }
+
+    fn request<Req, Res>(
+        &self,
+        path: &str,
+        grant: token::VideoGrant,
+        body: Req,
+    ) -> impl Future<Output = Result<Res>>
+    where
+        Req: Message,
+        Res: Default + Message,
+    {
+        let client = self.http.clone();
+        let token = token::create(&self.key, &self.secret, None, grant);
+        let url = format!("{}/{}", self.url, path);
+        log::info!("Request {}: {:?}", url, body);
+        async move {
+            let token = token?;
+            let response = client
+                .post(&url)
+                .header(CONTENT_TYPE, "application/protobuf")
+                .bearer_auth(token)
+                .body(body.encode_to_vec())
+                .send()
+                .await?;
+
+            if response.status().is_success() {
+                log::info!("Response {}: {:?}", url, response.status());
+                Ok(Res::decode(response.bytes().await?)?)
+            } else {
+                log::error!("Response {}: {:?}", url, response.status());
+                anyhow::bail!(
+                    "POST {} failed with status code {:?}, {:?}",
+                    url,
+                    response.status(),
+                    response.text().await
+                );
+            }
+        }
+    }
+}
+
+#[async_trait]
+impl Client for LiveKitClient {
+    fn url(&self) -> &str {
+        &self.url
+    }
+
+    async fn create_room(&self, name: String) -> Result<()> {
+        let _: proto::Room = self
+            .request(
+                "twirp/livekit.RoomService/CreateRoom",
+                token::VideoGrant {
+                    room_create: Some(true),
+                    ..Default::default()
+                },
+                proto::CreateRoomRequest {
+                    name,
+                    ..Default::default()
+                },
+            )
+            .await?;
+        Ok(())
+    }
+
+    async fn delete_room(&self, name: String) -> Result<()> {
+        let _: proto::DeleteRoomResponse = self
+            .request(
+                "twirp/livekit.RoomService/DeleteRoom",
+                token::VideoGrant {
+                    room_create: Some(true),
+                    ..Default::default()
+                },
+                proto::DeleteRoomRequest { room: name },
+            )
+            .await?;
+        Ok(())
+    }
+
+    async fn remove_participant(&self, room: String, identity: String) -> Result<()> {
+        let _: proto::RemoveParticipantResponse = self
+            .request(
+                "twirp/livekit.RoomService/RemoveParticipant",
+                token::VideoGrant::to_admin(&room),
+                proto::RoomParticipantIdentity {
+                    room: room.clone(),
+                    identity,
+                },
+            )
+            .await?;
+        Ok(())
+    }
+
+    async fn update_participant(
+        &self,
+        room: String,
+        identity: String,
+        permission: proto::ParticipantPermission,
+    ) -> Result<()> {
+        let _: proto::ParticipantInfo = self
+            .request(
+                "twirp/livekit.RoomService/UpdateParticipant",
+                token::VideoGrant::to_admin(&room),
+                proto::UpdateParticipantRequest {
+                    room: room.clone(),
+                    identity,
+                    metadata: "".to_string(),
+                    permission: Some(permission),
+                },
+            )
+            .await?;
+        Ok(())
+    }
+
+    fn room_token(&self, room: &str, identity: &str) -> Result<String> {
+        token::create(
+            &self.key,
+            &self.secret,
+            Some(identity),
+            token::VideoGrant::to_join(room),
+        )
+    }
+
+    fn guest_token(&self, room: &str, identity: &str) -> Result<String> {
+        token::create(
+            &self.key,
+            &self.secret,
+            Some(identity),
+            token::VideoGrant::for_guest(room),
+        )
+    }
+}

crates/livekit_api/src/proto.rs

@@ -0,0 +1 @@
+include!(concat!(env!("OUT_DIR"), "/livekit.rs"));

crates/livekit_api/src/token.rs

@@ -0,0 +1,110 @@
+use anyhow::Result;
+use jsonwebtoken::{DecodingKey, EncodingKey, Header, Validation};
+use serde::{Deserialize, Serialize};
+use std::{
+    borrow::Cow,
+    ops::Add,
+    time::{Duration, SystemTime, UNIX_EPOCH},
+};
+
+const DEFAULT_TTL: Duration = Duration::from_secs(6 * 60 * 60); // 6 hours
+
+#[derive(Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ClaimGrants<'a> {
+    pub iss: Cow<'a, str>,
+    pub sub: Option<Cow<'a, str>>,
+    pub iat: u64,
+    pub exp: u64,
+    pub nbf: u64,
+    pub jwtid: Option<Cow<'a, str>>,
+    pub video: VideoGrant<'a>,
+}
+
+#[derive(Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct VideoGrant<'a> {
+    pub room_create: Option<bool>,
+    pub room_join: Option<bool>,
+    pub room_list: Option<bool>,
+    pub room_record: Option<bool>,
+    pub room_admin: Option<bool>,
+    pub room: Option<Cow<'a, str>>,
+    pub can_publish: Option<bool>,
+    pub can_subscribe: Option<bool>,
+    pub can_publish_data: Option<bool>,
+    pub hidden: Option<bool>,
+    pub recorder: Option<bool>,
+}
+
+impl<'a> VideoGrant<'a> {
+    pub fn to_admin(room: &'a str) -> Self {
+        Self {
+            room_admin: Some(true),
+            room: Some(Cow::Borrowed(room)),
+            ..Default::default()
+        }
+    }
+
+    pub fn to_join(room: &'a str) -> Self {
+        Self {
+            room: Some(Cow::Borrowed(room)),
+            room_join: Some(true),
+            can_publish: Some(true),
+            can_subscribe: Some(true),
+            ..Default::default()
+        }
+    }
+
+    pub fn for_guest(room: &'a str) -> Self {
+        Self {
+            room: Some(Cow::Borrowed(room)),
+            room_join: Some(true),
+            can_publish: Some(false),
+            can_subscribe: Some(true),
+            ..Default::default()
+        }
+    }
+}
+
+pub fn create(
+    api_key: &str,
+    secret_key: &str,
+    identity: Option<&str>,
+    video_grant: VideoGrant,
+) -> Result<String> {
+    if video_grant.room_join.is_some() && identity.is_none() {
+        anyhow::bail!("identity is required for room_join grant, but it is none");
+    }
+
+    let now = SystemTime::now();
+
+    let claims = ClaimGrants {
+        iss: Cow::Borrowed(api_key),
+        sub: identity.map(Cow::Borrowed),
+        iat: now.duration_since(UNIX_EPOCH).unwrap().as_secs(),
+        exp: now
+            .add(DEFAULT_TTL)
+            .duration_since(UNIX_EPOCH)
+            .unwrap()
+            .as_secs(),
+        nbf: 0,
+        jwtid: identity.map(Cow::Borrowed),
+        video: video_grant,
+    };
+    Ok(jsonwebtoken::encode(
+        &Header::default(),
+        &claims,
+        &EncodingKey::from_secret(secret_key.as_ref()),
+    )?)
+}
+
+pub fn validate<'a>(token: &'a str, secret_key: &str) -> Result<ClaimGrants<'a>> {
+    let token = jsonwebtoken::decode(
+        token,
+        &DecodingKey::from_secret(secret_key.as_ref()),
+        &Validation::default(),
+    )?;
+
+    Ok(token.claims)
+}