fix(update): embed asInvoker manifest in updater

TelegramSearchBot.Test/ModerUpdateIntegrationTests.cs

@@ -4,6 +4,7 @@
 using System.Diagnostics;
 using System.Linq;
 using System.Runtime.InteropServices;
+using System.Xml.Linq;
 using Xunit;
 
 namespace TelegramSearchBot.Test {
@@ -135,6 +136,31 @@ public void RustUpdater_BuildsFromLocalPath() {
             }
         }
 
+        [Fact]
+        public void RustUpdater_WindowsManifest_DisablesInstallerElevationHeuristic() {
+            var updaterRoot = Path.Combine(SolutionRoot, "external", "moder-update", "src", "updater");
+            var buildScriptPath = Path.Combine(updaterRoot, "build.rs");
+            var manifestPath = Path.Combine(updaterRoot, "updater.exe.manifest");
+
+            Assert.True(File.Exists(buildScriptPath), "Rust updater should have a build script to embed its manifest.");
+            Assert.True(File.Exists(manifestPath), "Rust updater should ship an explicit Windows app manifest.");
+
+            var manifest = XDocument.Load(manifestPath);
+            XNamespace asmV3 = "urn:schemas-microsoft-com:asm.v3";
+            var requestedExecutionLevel = manifest
+                .Descendants(asmV3 + "requestedExecutionLevel")
+                .SingleOrDefault();
+
+            Assert.NotNull(requestedExecutionLevel);
+            Assert.Equal("asInvoker", requestedExecutionLevel.Attribute("level")?.Value);
+            Assert.Equal("false", requestedExecutionLevel.Attribute("uiAccess")?.Value);
+
+            var buildScript = File.ReadAllText(buildScriptPath);
+            Assert.Contains("/MANIFEST:EMBED", buildScript);
+            Assert.Contains("/MANIFESTINPUT:", buildScript);
+            Assert.Contains("updater.exe.manifest", buildScript);
+        }
+
         [Fact]
         public void ModerUpdate_Projects_HaveCorrectReferences() {
             // Verifies Moder.Update projects exist and have correct references

external/moder-update/src/updater/build.rs

@@ -0,0 +1,25 @@
+use std::{env, path::Path};
+
+fn main() {
+    println!("cargo:rerun-if-changed=build.rs");
+    println!("cargo:rerun-if-changed=updater.exe.manifest");
+
+    if env::var_os("CARGO_CFG_WINDOWS").is_none() {
+        return;
+    }
+
+    let target_env = env::var("CARGO_CFG_TARGET_ENV").unwrap_or_default();
+    if target_env != "msvc" {
+        return;
+    }
+
+    let manifest_dir = env::var("CARGO_MANIFEST_DIR")
+        .expect("Cargo should set CARGO_MANIFEST_DIR for build scripts.");
+    let manifest_path = Path::new(&manifest_dir).join("updater.exe.manifest");
+
+    println!("cargo:rustc-link-arg-bin=moder_update_updater=/MANIFEST:EMBED");
+    println!(
+        "cargo:rustc-link-arg-bin=moder_update_updater=/MANIFESTINPUT:{}",
+        manifest_path.display()
+    );
+}

external/moder-update/src/updater/updater.exe.manifest

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
+  <assemblyIdentity
+    name="Moder.Update.Updater"
+    processorArchitecture="*"
+    type="win32"
+    version="1.0.0.0" />
+  <description>Moder.Update updater</description>
+  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
+    <security>
+      <requestedPrivileges>
+        <requestedExecutionLevel level="asInvoker" uiAccess="false" />
+      </requestedPrivileges>
+    </security>
+  </trustInfo>
+</assembly>