Moodle OS

A macOS-style desktop shell for Universitas Terbuka Moodle, running as a real Windows desktop app.

What it does

• Desktop app (Electron). The Moodle surface is a native WebContentsView pinned to a window inside your OS shell. Because it loads Moodle as a top-level page, UT's X-Frame-Options: SAMEORIGIN no longer applies and live Moodle renders inside the app.
• Browser build. The same shell runs in a normal browser, where Moodle cannot be embedded by policy, so each app opens the live page in a real tab.

Run it

npm install
npm run check        # 31 tests + production build
npm start            # local shell on 127.0.0.1:3000
npm run desktop      # the desktop app

Security model

• The desktop shell is locked to loopback; it cannot navigate off 127.0.0.1.
• The native Moodle view may only ever load https://elearning.ut.ac.id. Anything else is handed to the system browser.
• Moodle cookies live in their own persistent partition (persist:moodle-os), never in the shell's.
• The renderer runs with contextIsolation: true, nodeIntegration: false, and reaches the main process only through the preload bridge.
• No UT password is ever collected, stored, or transmitted by this app.

Authentication

Moodle authentication is browser-owned. UT sets its cookie on its own origin; a local app cannot read or verify it. The local server keeps only a short-lived shell session (shellOpen) that exists purely to open the desktop — it carries no authorization claim.

The local session expires after 7 days, is validated on every read, and expired entries are swept hourly.

What needs a Moodle Web Services token

Native data windows (populated course lists, grade tables, deadlines) require an official Moodle Web Services token issued by UT Moodle admin. Without one the app still shows live Moodle content; it just cannot pre-render data natively.

Architecture

• Electron main process + React/Vite renderer
• Express server bound to loopback only
• Native WebContentsView for Moodle, isolated in its own session partition
• Browser fallback opens the live UT page in a real tab
• Local productivity apps use localStorage
• No database, no credential persistence, no third-party servers

Current state

See HANDOFF.md for the full engineering log, the audit findings, and what is deliberately deferred.