fix: report legacy TLS subscription failures

src-tauri/src/utils/network.rs

@@ -121,6 +121,10 @@ impl NetworkManager {
     }
 
     fn should_retry_with_static_webpki_roots(err: &anyhow::Error) -> bool {
+        if err.chain().any(Self::is_legacy_tls_protocol_error) {
+            return false;
+        }
+
         err.chain().any(|e| {
             let msg = e.to_string().to_ascii_lowercase();
             [
@@ -141,6 +145,22 @@ impl NetworkManager {
         })
     }
 
+    fn context_reqwest_error(err: reqwest::Error, context: &'static str) -> anyhow::Error {
+        let legacy_tls = Self::is_legacy_tls_protocol_error(&err);
+        let err = anyhow::Error::new(err).context(context);
+
+        if legacy_tls {
+            err.context("Subscription server uses legacy TLS; only TLS 1.2/1.3 is supported. TLS 1.0/1.1 is insecure")
+        } else {
+            err
+        }
+    }
+
+    fn is_legacy_tls_protocol_error(err: &(dyn std::error::Error + 'static)) -> bool {
+        let detail = format!("{err:#?}").to_ascii_lowercase();
+        detail.contains("protocolversion") || detail.contains("protocol version")
+    }
+
     pub async fn create_request(
         &self,
         proxy_type: ProxyType,
@@ -207,7 +227,7 @@ impl NetworkManager {
         let response = match request_builder.send().await {
             Ok(resp) => resp,
             Err(e) => {
-                return Err(anyhow::Error::new(e).context("Request failed"));
+                return Err(Self::context_reqwest_error(e, "Request failed"));
             }
         };
 
@@ -216,7 +236,7 @@ impl NetworkManager {
         let body = match response.text().await {
             Ok(text) => text.into(),
             Err(e) => {
-                return Err(anyhow::anyhow!("Failed to read response body: {}", e));
+                return Err(Self::context_reqwest_error(e, "Failed to read response body"));
             }
         };
 
@@ -299,9 +319,7 @@ impl NetworkManager {
                 )
                 .await
                 .map_err(|fallback_err| {
-                    anyhow::anyhow!(
-                        "platform TLS verifier failed: {err}; static webpki roots fallback failed: {fallback_err}"
-                    )
+                    fallback_err.context("static webpki roots fallback failed after platform TLS verifier failed")
                 }),
             Err(err) => Err(err),
         }