fix(update): embed asInvoker manifest in updater

[ModerRAS]

Summary

• embed an explicit Windows asInvoker manifest into the Rust updater binary
• add a build script that passes the manifest to the MSVC linker during CI/release builds
• add regression coverage so the manifest and linker flags stay present

Why

Windows can treat executables with names like *_updater.exe as installers when they do not carry an explicit manifest. The existing 570 client launches the downloaded updater with CreateProcess (UseShellExecute=false), so Windows returns Win32Exception 740 instead of showing UAC. Embedding asInvoker in the updater itself prevents the heuristic and fixes existing clients once they download the updated updater artifact.

Validation

• cargo build --manifest-path external/moder-update/src/updater/Cargo.toml --release
• read the release updater RT_MANIFEST resource and verified requestedExecutionLevel level="asInvoker"
• cargo test --manifest-path external/moder-update/src/updater/Cargo.toml
• dotnet test TelegramSearchBot.Test/TelegramSearchBot.Test.csproj --filter "FullyQualifiedName~ModerUpdateIntegrationTests|FullyQualifiedName~SelfUpdateBootstrapTests"

Summary by CodeRabbit

• Tests

  • Added integration test to validate Windows updater security configuration and manifest behavior.

• Chores

  • Configured Windows updater to run with standard user privileges instead of elevated permissions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 8d2036c8-3561-4b88-bdf0-02f0f3ab81c7

📥 Commits

Reviewing files that changed from the base of the PR and between 5f11d86 and 2201cfc.

📒 Files selected for processing (3)

• TelegramSearchBot.Test/ModerUpdateIntegrationTests.cs
• external/moder-update/src/updater/build.rs
• external/moder-update/src/updater/updater.exe.manifest

---

📝 Walkthrough

Walkthrough

This PR adds Windows manifest support to the Rust updater binary by introducing an executable manifest with minimal privileges, a Rust build script to embed the manifest during compilation, and integration tests to validate the configuration.

Changes

Windows Manifest Embedding for Rust Updater

Layer / File(s)	Summary
Windows Manifest Definition external/moder-update/src/updater/updater.exe.manifest	New manifest declaring assembly identity Moder.Update.Updater (version 1.0.0.0) with requestedExecutionLevel set to asInvoker and uiAccess="false" to prevent installer elevation heuristics.
Rust Build Script Manifest Embedding external/moder-update/src/updater/build.rs	New Cargo build script that registers change triggers, conditionally (on Windows+MSVC targets only) resolves the manifest path and emits MSVC linker directives (/MANIFEST:EMBED and /MANIFESTINPUT:) to embed the manifest into the moder_update_updater binary.
Integration Test Validation TelegramSearchBot.Test/ModerUpdateIntegrationTests.cs	New integration test RustUpdater_WindowsManifest_DisablesInstallerElevationHeuristic() that loads the manifest XML and validates execution level and UI access attributes, then reads the build script and asserts manifest-embedding flags and file references are present.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• ModerRAS/TelegramSearchBot#294: Both PRs touch the Moder.Update Windows updater; PR #294 integrates and builds the updater in CI while this PR adds the updater.exe.manifest and Rust build script to embed it.
• ModerRAS/TelegramSearchBot#329: PR #329 introduced the updater build-script and manifest files that this PR's additions directly touch and validate.

Poem

🐰 A manifest whispers asInvoker grace,
Build script weaves it in its rightful place,
No elevation heuristics dare to creep,
Windows trust runs shallow, secure, and deep! 🛡️

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: embedding an asInvoker manifest in the updater binary to fix elevation heuristic issues.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-updater-elevation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

PR Check Report

Summary

• PR: fix(update): embed asInvoker manifest in updater #338
• Branch: codex/fix-updater-elevation <- master
• Event: pull_request
• Commit: 1a37528

Test Results

Platform	Status	Details
Ubuntu	Passed	Tests passed, artifacts uploaded
Windows	Passed	Tests passed, artifacts uploaded

Code Quality

• Code formatting check
• Security vulnerability scan
• Dependency analysis
• Code coverage collection

Test Artifacts

• Test results artifacts count: 2
• Code coverage uploaded to Codecov

Links

• PR Page
• Actions Logs

---

This report is auto-generated by GitHub Actions