external/secretive
1
0
Fork 0
mirror of https://github.com/maxgoedjen/secretive.git synced 2025-04-04 06:37:07 +00:00
Code Issues Projects Releases Wiki Activity

Merge bab76da2ab into ad56019901

Browse Source
This commit is contained in:
Max Goedjen 2025-01-06 00:27:46 +00:00 committed by GitHub
commit 1217e4727e
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
49 changed files with 746 additions and 793 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
.github/workflows/nightly.yml vendored
View File

@ -6,7 +6,7 @@ on:
jobs: jobs:
build: build:
# runs-on: macOS-latest # runs-on: macOS-latest
runs-on: macos-14 runs-on: macos-15
timeout-minutes: 10 timeout-minutes: 10
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
@ -20,7 +20,7 @@ jobs:
APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }} APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
run: ./.github/scripts/signing.sh run: ./.github/scripts/signing.sh
- name: Set Environment - name: Set Environment
run: sudo xcrun xcode-select -s /Applications/Xcode_15.4.app run: sudo xcrun xcode-select -s /Applications/Xcode_16.2.app
- name: Update Build Number - name: Update Build Number
env: env:
RUN_ID: ${{ github.run_id }} RUN_ID: ${{ github.run_id }}

8
.github/workflows/release.yml vendored
View File

@ -7,7 +7,7 @@ on:
jobs: jobs:
test: test:
# runs-on: macOS-latest # runs-on: macOS-latest
runs-on: macos-14 runs-on: macos-15
timeout-minutes: 10 timeout-minutes: 10
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
@ -21,7 +21,7 @@ jobs:
APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }} APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
run: ./.github/scripts/signing.sh run: ./.github/scripts/signing.sh
- name: Set Environment - name: Set Environment
run: sudo xcrun xcode-select -s /Applications/Xcode_15.4.app run: sudo xcrun xcode-select -s /Applications/Xcode_16.2.app
- name: Test - name: Test
run: | run: |
pushd Sources/Packages pushd Sources/Packages
@ -29,7 +29,7 @@ jobs:
popd popd
build: build:
# runs-on: macOS-latest # runs-on: macOS-latest
runs-on: macos-14 runs-on: macos-15
timeout-minutes: 10 timeout-minutes: 10
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
@ -43,7 +43,7 @@ jobs:
APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }} APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
run: ./.github/scripts/signing.sh run: ./.github/scripts/signing.sh
- name: Set Environment - name: Set Environment
run: sudo xcrun xcode-select -s /Applications/Xcode_15.4.app run: sudo xcrun xcode-select -s /Applications/Xcode_16.2.app
- name: Update Build Number - name: Update Build Number
env: env:
TAG_NAME: ${{ github.ref }} TAG_NAME: ${{ github.ref }}

4
.github/workflows/test.yml vendored
View File

@ -4,12 +4,12 @@ on: [push, pull_request]
jobs: jobs:
test: test:
# runs-on: macOS-latest # runs-on: macOS-latest
runs-on: macos-14 runs-on: macos-15
timeout-minutes: 10 timeout-minutes: 10
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
- name: Set Environment - name: Set Environment
run: sudo xcrun xcode-select -s /Applications/Xcode_15.4.app run: sudo xcrun xcode-select -s /Applications/Xcode_16.2.app
- name: Test - name: Test
run: | run: |
pushd Sources/Packages pushd Sources/Packages

21
Sources/Packages/Package.swift
View File

@ -1,4 +1,4 @@
// swift-tools-version:5.9 // swift-tools-version:6.0
// The swift-tools-version declares the minimum version of Swift required to build this package. // The swift-tools-version declares the minimum version of Swift required to build this package.
import PackageDescription import PackageDescription
@ -6,7 +6,7 @@ import PackageDescription
let package = Package( let package = Package(
name: "SecretivePackages", name: "SecretivePackages",
platforms: [ platforms: [
.macOS(.v12) .macOS(.v15)
], ],
products: [ products: [
.library( .library(
@ -34,27 +34,27 @@ let package = Package(
.target( .target(
name: "SecretKit", name: "SecretKit",
dependencies: [], dependencies: [],
swiftSettings: [.unsafeFlags(["-warnings-as-errors"])] swiftSettings: swiftSettings
), ),
.testTarget( .testTarget(
name: "SecretKitTests", name: "SecretKitTests",
dependencies: ["SecretKit", "SecureEnclaveSecretKit", "SmartCardSecretKit"], dependencies: ["SecretKit", "SecureEnclaveSecretKit", "SmartCardSecretKit"],
swiftSettings: [.unsafeFlags(["-warnings-as-errors"])] swiftSettings: swiftSettings
), ),
.target( .target(
name: "SecureEnclaveSecretKit", name: "SecureEnclaveSecretKit",
dependencies: ["SecretKit"], dependencies: ["SecretKit"],
swiftSettings: [.unsafeFlags(["-warnings-as-errors"])] swiftSettings: swiftSettings
), ),
.target( .target(
name: "SmartCardSecretKit", name: "SmartCardSecretKit",
dependencies: ["SecretKit"], dependencies: ["SecretKit"],
swiftSettings: [.unsafeFlags(["-warnings-as-errors"])] swiftSettings: swiftSettings
), ),
.target( .target(
name: "SecretAgentKit", name: "SecretAgentKit",
dependencies: ["SecretKit", "SecretAgentKitHeaders"], dependencies: ["SecretKit", "SecretAgentKitHeaders"],
swiftSettings: [.unsafeFlags(["-warnings-as-errors"])] swiftSettings: swiftSettings
), ),
.systemLibrary( .systemLibrary(
name: "SecretAgentKitHeaders" name: "SecretAgentKitHeaders"
@ -73,3 +73,10 @@ let package = Package(
), ),
] ]
) )
var swiftSettings: [PackageDescription.SwiftSetting] {
[
.swiftLanguageMode(.v6),
.unsafeFlags(["-warnings-as-errors"])
]
}

2
Sources/Packages/Sources/Brief/Release.swift
View File

@ -1,7 +1,7 @@
import Foundation import Foundation
/// A release is a representation of a downloadable update. /// A release is a representation of a downloadable update.
public struct Release: Codable { public struct Release: Codable, Sendable {
/// The user-facing name of the release. Typically "Secretive 1.2.3" /// The user-facing name of the release. Typically "Secretive 1.2.3"
public let name: String public let name: String

2
Sources/Packages/Sources/Brief/SemVer.swift
View File

@ -1,7 +1,7 @@
import Foundation import Foundation
/// A representation of a Semantic Version. /// A representation of a Semantic Version.
public struct SemVer { public struct SemVer: Sendable {
/// The SemVer broken into an array of integers. /// The SemVer broken into an array of integers.
let versionNumbers: [Int] let versionNumbers: [Int]

48
Sources/Packages/Sources/Brief/Updater.swift
View File

@ -1,10 +1,14 @@
import Foundation import Foundation
import Combine import Observation
import Synchronization
/// A concrete implementation of ``UpdaterProtocol`` which considers the current release and OS version. /// A concrete implementation of ``UpdaterProtocol`` which considers the current release and OS version.
public final class Updater: ObservableObject, UpdaterProtocol { @Observable public final class Updater: UpdaterProtocol, ObservableObject, Sendable {
@Published public var update: Release? public var update: Release? {
_update.withLock { $0 }
}
private let _update: Mutex<Release?> = .init(nil)
public let testBuild: Bool public let testBuild: Bool
/// The current OS version. /// The current OS version.
@ -24,30 +28,34 @@ public final class Updater: ObservableObject, UpdaterProtocol {
testBuild = currentVersion == SemVer("0.0.0") testBuild = currentVersion == SemVer("0.0.0")
if checkOnLaunch { if checkOnLaunch {
// Don't do a launch check if the user hasn't seen the setup prompt explaining updater yet. // Don't do a launch check if the user hasn't seen the setup prompt explaining updater yet.
checkForUpdates() Task {
await checkForUpdates()
}
} }
let timer = Timer.scheduledTimer(withTimeInterval: checkFrequency, repeats: true) { _ in Task {
self.checkForUpdates() while !Task.isCancelled {
try? await Task.sleep(for: .seconds(Int(checkFrequency)))
await checkForUpdates()
}
} }
timer.tolerance = 60*60
} }
/// Manually trigger an update check. /// Manually trigger an update check.
public func checkForUpdates() { public func checkForUpdates() async {
URLSession.shared.dataTask(with: Constants.updateURL) { data, _, _ in guard let (data, _) = try? await URLSession.shared.data(from: Constants.updateURL) else { return }
guard let data = data else { return } guard let releases = try? JSONDecoder().decode([Release].self, from: data) else { return }
guard let releases = try? JSONDecoder().decode([Release].self, from: data) else { return } await evaluate(releases: releases)
self.evaluate(releases: releases)
}.resume()
} }
/// Ignores a specified release. `update` will be nil if the user has ignored the latest available release. /// Ignores a specified release. `update` will be nil if the user has ignored the latest available release.
/// - Parameter release: The release to ignore. /// - Parameter release: The release to ignore.
public func ignore(release: Release) { public func ignore(release: Release) async {
guard !release.critical else { return } guard !release.critical else { return }
defaults.set(true, forKey: release.name) defaults.set(true, forKey: release.name)
DispatchQueue.main.async { await MainActor.run {
self.update = nil _update.withLock { value in
value = nil
}
} }
} }
@ -57,7 +65,7 @@ extension Updater {
/// Evaluates the available downloadable releases, and selects the newest non-prerelease release that the user is able to run. /// Evaluates the available downloadable releases, and selects the newest non-prerelease release that the user is able to run.
/// - Parameter releases: An array of ``Release`` objects. /// - Parameter releases: An array of ``Release`` objects.
func evaluate(releases: [Release]) { func evaluate(releases: [Release]) async {
guard let release = releases guard let release = releases
.sorted() .sorted()
.reversed() .reversed()
@ -67,8 +75,10 @@ extension Updater {
guard !release.prerelease else { return } guard !release.prerelease else { return }
let latestVersion = SemVer(release.name) let latestVersion = SemVer(release.name)
if latestVersion > currentVersion { if latestVersion > currentVersion {
DispatchQueue.main.async { await MainActor.run {
self.update = release _update.withLock { value in
value = release
}
} }
} }
} }

4
Sources/Packages/Sources/Brief/UpdaterProtocol.swift
View File

@ -1,8 +1,8 @@
import Foundation import Foundation
import Combine import Synchronization
/// A protocol for retreiving the latest available version of an app. /// A protocol for retreiving the latest available version of an app.
public protocol UpdaterProtocol: ObservableObject { public protocol UpdaterProtocol: Observable {
/// The latest update /// The latest update
var update: Release? { get } var update: Release? { get }

18
Sources/Packages/Sources/SecretAgentKit/Agent.swift
View File

@ -5,7 +5,7 @@ import SecretKit
import AppKit import AppKit
/// The `Agent` is an implementation of an SSH agent. It manages coordination and access between a socket, traces requests, notifies witnesses and passes requests to stores. /// The `Agent` is an implementation of an SSH agent. It manages coordination and access between a socket, traces requests, notifies witnesses and passes requests to stores.
public final class Agent { public final class Agent: Sendable {
private let storeList: SecretStoreList private let storeList: SecretStoreList
private let witness: SigningWitness? private let witness: SigningWitness?
@ -54,7 +54,7 @@ extension Agent {
func handle(requestType: SSHAgent.RequestType, data: Data, reader: FileHandleReader) async -> Data { func handle(requestType: SSHAgent.RequestType, data: Data, reader: FileHandleReader) async -> Data {
// Depending on the launch context (such as after macOS update), the agent may need to reload secrets before acting // Depending on the launch context (such as after macOS update), the agent may need to reload secrets before acting
reloadSecretsIfNeccessary() await reloadSecretsIfNeccessary()
var response = Data() var response = Data()
do { do {
switch requestType { switch requestType {
@ -65,7 +65,7 @@ extension Agent {
case .signRequest: case .signRequest:
let provenance = requestTracer.provenance(from: reader) let provenance = requestTracer.provenance(from: reader)
response.append(SSHAgent.ResponseType.agentSignResponse.data) response.append(SSHAgent.ResponseType.agentSignResponse.data)
response.append(try sign(data: data, provenance: provenance)) response.append(try await sign(data: data, provenance: provenance))
logger.debug("Agent returned \(SSHAgent.ResponseType.agentSignResponse.debugDescription)") logger.debug("Agent returned \(SSHAgent.ResponseType.agentSignResponse.debugDescription)")
} }
} catch { } catch {
@ -112,7 +112,7 @@ extension Agent {
/// - data: The data to sign. /// - data: The data to sign.
/// - provenance: A ``SecretKit.SigningRequestProvenance`` object describing the origin of the request. /// - provenance: A ``SecretKit.SigningRequestProvenance`` object describing the origin of the request.
/// - Returns: An OpenSSH formatted Data payload containing the signed data response. /// - Returns: An OpenSSH formatted Data payload containing the signed data response.
func sign(data: Data, provenance: SigningRequestProvenance) throws -> Data { func sign(data: Data, provenance: SigningRequestProvenance) async throws -> Data {
let reader = OpenSSHReader(data: data) let reader = OpenSSHReader(data: data)
let payloadHash = reader.readNextChunk() let payloadHash = reader.readNextChunk()
let hash: Data let hash: Data
@ -129,11 +129,11 @@ extension Agent {
} }
if let witness = witness { if let witness = witness {
try witness.speakNowOrForeverHoldYourPeace(forAccessTo: secret, from: store, by: provenance) try await witness.speakNowOrForeverHoldYourPeace(forAccessTo: secret, from: store, by: provenance)
} }
let dataToSign = reader.readNextChunk() let dataToSign = reader.readNextChunk()
let signed = try store.sign(data: dataToSign, with: secret, for: provenance) let signed = try await store.sign(data: dataToSign, with: secret, for: provenance)
let derSignature = signed let derSignature = signed
let curveData = writer.curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)! let curveData = writer.curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!
@ -175,7 +175,7 @@ extension Agent {
signedData.append(writer.lengthAndData(of: sub)) signedData.append(writer.lengthAndData(of: sub))
if let witness = witness { if let witness = witness {
try witness.witness(accessTo: secret, from: store, by: provenance) try await witness.witness(accessTo: secret, from: store, by: provenance)
} }
logger.debug("Agent signed request") logger.debug("Agent signed request")
@ -188,11 +188,11 @@ extension Agent {
extension Agent { extension Agent {
/// Gives any store with no loaded secrets a chance to reload. /// Gives any store with no loaded secrets a chance to reload.
func reloadSecretsIfNeccessary() { func reloadSecretsIfNeccessary() async {
for store in storeList.stores { for store in storeList.stores {
if store.secrets.isEmpty { if store.secrets.isEmpty {
logger.debug("Store \(store.name, privacy: .public) has no loaded secrets. Reloading.") logger.debug("Store \(store.name, privacy: .public) has no loaded secrets. Reloading.")
store.reloadSecrets() await store.reloadSecrets()
} }
} }
} }

6
Sources/Packages/Sources/SecretAgentKit/SigningWitness.swift
View File

@ -2,7 +2,7 @@ import Foundation
import SecretKit import SecretKit
/// A protocol that allows conformers to be notified of access to secrets, and optionally prevent access. /// A protocol that allows conformers to be notified of access to secrets, and optionally prevent access.
public protocol SigningWitness { public protocol SigningWitness: Sendable {
/// A ridiculously named method that notifies the callee that a signing operation is about to be performed using a secret. The callee may `throw` an `Error` to prevent access from occurring. /// A ridiculously named method that notifies the callee that a signing operation is about to be performed using a secret. The callee may `throw` an `Error` to prevent access from occurring.
/// - Parameters: /// - Parameters:
@ -10,13 +10,13 @@ public protocol SigningWitness {
/// - store: The `Store` being asked to sign the request.. /// - store: The `Store` being asked to sign the request..
/// - provenance: A `SigningRequestProvenance` object describing the origin of the request. /// - provenance: A `SigningRequestProvenance` object describing the origin of the request.
/// - Note: This method being called does not imply that the requst has been authorized. If a secret requires authentication, authentication will still need to be performed by the user before the request will be performed. If the user declines or fails to authenticate, the request will fail. /// - Note: This method being called does not imply that the requst has been authorized. If a secret requires authentication, authentication will still need to be performed by the user before the request will be performed. If the user declines or fails to authenticate, the request will fail.
func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws
/// Notifies the callee that a signing operation has been performed for a given secret. /// Notifies the callee that a signing operation has been performed for a given secret.
/// - Parameters: /// - Parameters:
/// - secret: The `Secret` that will was used to sign the request. /// - secret: The `Secret` that will was used to sign the request.
/// - store: The `Store` that signed the request.. /// - store: The `Store` that signed the request..
/// - provenance: A `SigningRequestProvenance` object describing the origin of the request. /// - provenance: A `SigningRequestProvenance` object describing the origin of the request.
func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws
} }

2
Sources/Packages/Sources/SecretKit/Erasers/AnySecret.swift
View File

@ -1,7 +1,7 @@
import Foundation import Foundation
/// Type eraser for Secret. /// Type eraser for Secret.
public struct AnySecret: Secret { public struct AnySecret: Secret, @unchecked Sendable {
let base: Any let base: Any
private let hashable: AnyHashable private let hashable: AnyHashable

81
Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift
View File

@ -2,20 +2,18 @@ import Foundation
import Combine import Combine
/// Type eraser for SecretStore. /// Type eraser for SecretStore.
public class AnySecretStore: SecretStore { public class AnySecretStore: SecretStore, @unchecked Sendable {
let base: Any let base: Any
private let _isAvailable: () -> Bool private let _isAvailable: @Sendable () -> Bool
private let _id: () -> UUID private let _id: @Sendable () -> UUID
private let _name: () -> String private let _name: @Sendable () -> String
private let _secrets: () -> [AnySecret] private let _secrets: @Sendable () -> [AnySecret]
private let _sign: (Data, AnySecret, SigningRequestProvenance) throws -> Data private let _sign: @Sendable (Data, AnySecret, SigningRequestProvenance) async throws -> Data
private let _verify: (Data, Data, AnySecret) throws -> Bool private let _verify: @Sendable (Data, Data, AnySecret) async throws -> Bool
private let _existingPersistedAuthenticationContext: (AnySecret) -> PersistedAuthenticationContext? private let _existingPersistedAuthenticationContext: @Sendable (AnySecret) async -> PersistedAuthenticationContext?
private let _persistAuthentication: (AnySecret, TimeInterval) throws -> Void private let _persistAuthentication: @Sendable (AnySecret, TimeInterval) async throws -> Void
private let _reloadSecrets: () -> Void private let _reloadSecrets: @Sendable () async -> Void
private var sink: AnyCancellable?
public init<SecretStoreType>(_ secretStore: SecretStoreType) where SecretStoreType: SecretStore { public init<SecretStoreType>(_ secretStore: SecretStoreType) where SecretStoreType: SecretStore {
base = secretStore base = secretStore
@ -23,14 +21,11 @@ public class AnySecretStore: SecretStore {
_name = { secretStore.name } _name = { secretStore.name }
_id = { secretStore.id } _id = { secretStore.id }
_secrets = { secretStore.secrets.map { AnySecret($0) } } _secrets = { secretStore.secrets.map { AnySecret($0) } }
_sign = { try secretStore.sign(data: $0, with: $1.base as! SecretStoreType.SecretType, for: $2) } _sign = { try await secretStore.sign(data: $0, with: $1.base as! SecretStoreType.SecretType, for: $2) }
_verify = { try secretStore.verify(signature: $0, for: $1, with: $2.base as! SecretStoreType.SecretType) } _verify = { try await secretStore.verify(signature: $0, for: $1, with: $2.base as! SecretStoreType.SecretType) }
_existingPersistedAuthenticationContext = { secretStore.existingPersistedAuthenticationContext(secret: $0.base as! SecretStoreType.SecretType) } _existingPersistedAuthenticationContext = { await secretStore.existingPersistedAuthenticationContext(secret: $0.base as! SecretStoreType.SecretType) }
_persistAuthentication = { try secretStore.persistAuthentication(secret: $0.base as! SecretStoreType.SecretType, forDuration: $1) } _persistAuthentication = { try await secretStore.persistAuthentication(secret: $0.base as! SecretStoreType.SecretType, forDuration: $1) }
_reloadSecrets = { secretStore.reloadSecrets() } _reloadSecrets = { await secretStore.reloadSecrets() }
sink = secretStore.objectWillChange.sink { _ in
self.objectWillChange.send()
}
} }
public var isAvailable: Bool { public var isAvailable: Bool {
@ -49,51 +44,51 @@ public class AnySecretStore: SecretStore {
return _secrets() return _secrets()
} }
public func sign(data: Data, with secret: AnySecret, for provenance: SigningRequestProvenance) throws -> Data { public func sign(data: Data, with secret: AnySecret, for provenance: SigningRequestProvenance) async throws -> Data {
try _sign(data, secret, provenance) try await _sign(data, secret, provenance)
} }
public func verify(signature: Data, for data: Data, with secret: AnySecret) throws -> Bool { public func verify(signature: Data, for data: Data, with secret: AnySecret) async throws -> Bool {
try _verify(signature, data, secret) try await _verify(signature, data, secret)
} }
public func existingPersistedAuthenticationContext(secret: AnySecret) -> PersistedAuthenticationContext? { public func existingPersistedAuthenticationContext(secret: AnySecret) async -> PersistedAuthenticationContext? {
_existingPersistedAuthenticationContext(secret) await _existingPersistedAuthenticationContext(secret)
} }
public func persistAuthentication(secret: AnySecret, forDuration duration: TimeInterval) throws { public func persistAuthentication(secret: AnySecret, forDuration duration: TimeInterval) async throws {
try _persistAuthentication(secret, duration) try await _persistAuthentication(secret, duration)
} }
public func reloadSecrets() { public func reloadSecrets() async {
_reloadSecrets() await _reloadSecrets()
} }
} }
public final class AnySecretStoreModifiable: AnySecretStore, SecretStoreModifiable { public final class AnySecretStoreModifiable: AnySecretStore, SecretStoreModifiable, @unchecked Sendable {
private let _create: (String, Bool) throws -> Void private let _create: @Sendable (String, Bool) async throws -> Void
private let _delete: (AnySecret) throws -> Void private let _delete: @Sendable (AnySecret) async throws -> Void
private let _update: (AnySecret, String) throws -> Void private let _update: @Sendable (AnySecret, String) async throws -> Void
public init<SecretStoreType>(modifiable secretStore: SecretStoreType) where SecretStoreType: SecretStoreModifiable { public init<SecretStoreType>(modifiable secretStore: SecretStoreType) where SecretStoreType: SecretStoreModifiable {
_create = { try secretStore.create(name: $0, requiresAuthentication: $1) } _create = { try await secretStore.create(name: $0, requiresAuthentication: $1) }
_delete = { try secretStore.delete(secret: $0.base as! SecretStoreType.SecretType) } _delete = { try await secretStore.delete(secret: $0.base as! SecretStoreType.SecretType) }
_update = { try secretStore.update(secret: $0.base as! SecretStoreType.SecretType, name: $1) } _update = { try await secretStore.update(secret: $0.base as! SecretStoreType.SecretType, name: $1) }
super.init(secretStore) super.init(secretStore)
} }
public func create(name: String, requiresAuthentication: Bool) throws { public func create(name: String, requiresAuthentication: Bool) async throws {
try _create(name, requiresAuthentication) try await _create(name, requiresAuthentication)
} }
public func delete(secret: AnySecret) throws { public func delete(secret: AnySecret) async throws {
try _delete(secret) try await _delete(secret)
} }
public func update(secret: AnySecret, name: String) throws { public func update(secret: AnySecret, name: String) async throws {
try _update(secret, name) try await _update(secret, name)
} }
} }

20
Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHCertificateHandler.swift
View File

@ -1,13 +1,14 @@
import Foundation import Foundation
import OSLog import OSLog
import Synchronization
/// Manages storage and lookup for OpenSSH certificates. /// Manages storage and lookup for OpenSSH certificates.
public final class OpenSSHCertificateHandler { public final class OpenSSHCertificateHandler: Sendable {
private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: NSHomeDirectory()) private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: NSHomeDirectory())
private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "OpenSSHCertificateHandler") private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "OpenSSHCertificateHandler")
private let writer = OpenSSHKeyWriter() private let writer = OpenSSHKeyWriter()
private var keyBlobsAndNames: [AnySecret: (Data, Data)] = [:] private let keyBlobsAndNames: Mutex<[AnySecret: (Data, Data)]> = .init([:])
/// Initializes an OpenSSHCertificateHandler. /// Initializes an OpenSSHCertificateHandler.
public init() { public init() {
@ -20,8 +21,10 @@ public final class OpenSSHCertificateHandler {
logger.log("No certificates, short circuiting") logger.log("No certificates, short circuiting")
return return
} }
keyBlobsAndNames = secrets.reduce(into: [:]) { partialResult, next in keyBlobsAndNames.withLock {
partialResult[next] = try? loadKeyblobAndName(for: next) $0 = secrets.reduce(into: [:]) { partialResult, next in
partialResult[next] = try? loadKeyblobAndName(for: next)
}
} }
} }
@ -29,7 +32,10 @@ public final class OpenSSHCertificateHandler {
/// - Parameter secret: The secret to check for a certificate. /// - Parameter secret: The secret to check for a certificate.
/// - Returns: A boolean describing whether or not the certificate handler has a certifiicate associated with a given secret /// - Returns: A boolean describing whether or not the certificate handler has a certifiicate associated with a given secret
public func hasCertificate<SecretType: Secret>(for secret: SecretType) -> Bool { public func hasCertificate<SecretType: Secret>(for secret: SecretType) -> Bool {
keyBlobsAndNames[AnySecret(secret)] != nil keyBlobsAndNames.withLock {
$0[AnySecret(secret)] != nil
}
} }
@ -61,7 +67,9 @@ public final class OpenSSHCertificateHandler {
/// - Parameter secret: The secret to search for a certificate with /// - Parameter secret: The secret to search for a certificate with
/// - Returns: A (``Data``, ``Data``) tuple containing the certificate and certificate name, respectively. /// - Returns: A (``Data``, ``Data``) tuple containing the certificate and certificate name, respectively.
public func keyBlobAndName<SecretType: Secret>(for secret: SecretType) throws -> (Data, Data)? { public func keyBlobAndName<SecretType: Secret>(for secret: SecretType) throws -> (Data, Data)? {
keyBlobsAndNames[AnySecret(secret)] keyBlobsAndNames.withLock {
$0[AnySecret(secret)]
}
} }
/// Attempts to find an OpenSSH Certificate that corresponds to a ``Secret`` /// Attempts to find an OpenSSH Certificate that corresponds to a ``Secret``

2
Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHKeyWriter.swift
View File

@ -2,7 +2,7 @@ import Foundation
import CryptoKit import CryptoKit
/// Generates OpenSSH representations of Secrets. /// Generates OpenSSH representations of Secrets.
public struct OpenSSHKeyWriter { public struct OpenSSHKeyWriter: Sendable {
/// Initializes the writer. /// Initializes the writer.
public init() { public init() {

2
Sources/Packages/Sources/SecretKit/PublicKeyStandinFileController.swift
View File

@ -2,7 +2,7 @@ import Foundation
import OSLog import OSLog
/// Controller responsible for writing public keys to disk, so that they're easily accessible by scripts. /// Controller responsible for writing public keys to disk, so that they're easily accessible by scripts.
public final class PublicKeyFileStoreController { public final class PublicKeyFileStoreController: Sendable {
private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "PublicKeyFileStoreController") private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "PublicKeyFileStoreController")
private let directory: String private let directory: String

48
Sources/Packages/Sources/SecretKit/SecretStoreList.swift
View File

@ -1,14 +1,21 @@
import Foundation import Foundation
import Combine import Observation
import Synchronization
/// A "Store Store," which holds a list of type-erased stores. /// A "Store Store," which holds a list of type-erased stores.
public final class SecretStoreList: ObservableObject { @Observable public final class SecretStoreList: Sendable {
/// The Stores managed by the SecretStoreList. /// The Stores managed by the SecretStoreList.
@Published public var stores: [AnySecretStore] = [] public var stores: [AnySecretStore] {
__stores.withLock { $0 }
}
private let __stores: Mutex<[AnySecretStore]> = .init([])
/// A modifiable store, if one is available. /// A modifiable store, if one is available.
@Published public var modifiableStore: AnySecretStoreModifiable? public var modifiableStore: AnySecretStoreModifiable? {
private var cancellables: Set<AnyCancellable> = [] __modifiableStore.withLock { $0 }
}
private let __modifiableStore: Mutex<AnySecretStoreModifiable?> = .init(nil)
/// Initializes a SecretStoreList. /// Initializes a SecretStoreList.
public init() { public init() {
@ -16,34 +23,33 @@ public final class SecretStoreList: ObservableObject {
/// Adds a non-type-erased SecretStore to the list. /// Adds a non-type-erased SecretStore to the list.
public func add<SecretStoreType: SecretStore>(store: SecretStoreType) { public func add<SecretStoreType: SecretStore>(store: SecretStoreType) {
addInternal(store: AnySecretStore(store)) __stores.withLock {
$0.append(AnySecretStore(store))
}
} }
/// Adds a non-type-erased modifiable SecretStore. /// Adds a non-type-erased modifiable SecretStore.
public func add<SecretStoreType: SecretStoreModifiable>(store: SecretStoreType) { public func add<SecretStoreType: SecretStoreModifiable>(store: SecretStoreType) {
let modifiable = AnySecretStoreModifiable(modifiable: store) let modifiable = AnySecretStoreModifiable(modifiable: store)
modifiableStore = modifiable __modifiableStore.withLock {
addInternal(store: modifiable) $0 = modifiable
}
__stores.withLock {
$0.append(modifiable)
}
} }
/// A boolean describing whether there are any Stores available. /// A boolean describing whether there are any Stores available.
public var anyAvailable: Bool { public var anyAvailable: Bool {
stores.reduce(false, { $0 || $1.isAvailable }) __stores.withLock {
$0.reduce(false, { $0 || $1.isAvailable })
}
} }
public var allSecrets: [AnySecret] { public var allSecrets: [AnySecret] {
stores.flatMap(\.secrets) __stores.withLock {
} $0.flatMap(\.secrets)
}
}
extension SecretStoreList {
private func addInternal(store: AnySecretStore) {
stores.append(store)
store.objectWillChange.sink {
self.objectWillChange.send()
}.store(in: &cancellables)
} }
} }

2
Sources/Packages/Sources/SecretKit/Types/PersistedAuthenticationContext.swift
View File

@ -1,7 +1,7 @@
import Foundation import Foundation
/// Protocol describing a persisted authentication context. This is an authorization that can be reused for multiple access to a secret that requires authentication for a specific period of time. /// Protocol describing a persisted authentication context. This is an authorization that can be reused for multiple access to a secret that requires authentication for a specific period of time.
public protocol PersistedAuthenticationContext { public protocol PersistedAuthenticationContext: Sendable {
/// Whether the context remains valid. /// Whether the context remains valid.
var valid: Bool { get } var valid: Bool { get }
/// The date at which the authorization expires and the context becomes invalid. /// The date at which the authorization expires and the context becomes invalid.

4
Sources/Packages/Sources/SecretKit/Types/Secret.swift
View File

@ -1,7 +1,7 @@
import Foundation import Foundation
/// The base protocol for describing a Secret /// The base protocol for describing a Secret
public protocol Secret: Identifiable, Hashable { public protocol Secret: Identifiable, Hashable, Sendable {
/// A user-facing string identifying the Secret. /// A user-facing string identifying the Secret.
var name: String { get } var name: String { get }
@ -17,7 +17,7 @@ public protocol Secret: Identifiable, Hashable {
} }
/// The type of algorithm the Secret uses. Currently, only elliptic curve algorithms are supported. /// The type of algorithm the Secret uses. Currently, only elliptic curve algorithms are supported.
public enum Algorithm: Hashable { public enum Algorithm: Hashable, Sendable {
case ellipticCurve case ellipticCurve
case rsa case rsa

18
Sources/Packages/Sources/SecretKit/Types/SecretStore.swift
View File

@ -2,7 +2,7 @@ import Foundation
import Combine import Combine
/// Manages access to Secrets, and performs signature operations on data using those Secrets. /// Manages access to Secrets, and performs signature operations on data using those Secrets.
public protocol SecretStore: ObservableObject, Identifiable { public protocol SecretStore: Identifiable, Sendable {
associatedtype SecretType: Secret associatedtype SecretType: Secret
@ -21,7 +21,7 @@ public protocol SecretStore: ObservableObject, Identifiable {
/// - secret: The ``Secret`` to sign with. /// - secret: The ``Secret`` to sign with.
/// - provenance: A ``SigningRequestProvenance`` describing where the request came from. /// - provenance: A ``SigningRequestProvenance`` describing where the request came from.
/// - Returns: The signed data. /// - Returns: The signed data.
func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> Data func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) async throws -> Data
/// Verifies that a signature is valid over a specified payload. /// Verifies that a signature is valid over a specified payload.
/// - Parameters: /// - Parameters:
@ -29,23 +29,23 @@ public protocol SecretStore: ObservableObject, Identifiable {
/// - data: The data to verify the signature of. /// - data: The data to verify the signature of.
/// - secret: The secret whose signature to verify. /// - secret: The secret whose signature to verify.
/// - Returns: Whether the signature was verified. /// - Returns: Whether the signature was verified.
func verify(signature: Data, for data: Data, with secret: SecretType) throws -> Bool func verify(signature: Data, for data: Data, with secret: SecretType) async throws -> Bool
/// Checks to see if there is currently a valid persisted authentication for a given secret. /// Checks to see if there is currently a valid persisted authentication for a given secret.
/// - Parameters: /// - Parameters:
/// - secret: The ``Secret`` to check if there is a persisted authentication for. /// - secret: The ``Secret`` to check if there is a persisted authentication for.
/// - Returns: A persisted authentication context, if a valid one exists. /// - Returns: A persisted authentication context, if a valid one exists.
func existingPersistedAuthenticationContext(secret: SecretType) -> PersistedAuthenticationContext? func existingPersistedAuthenticationContext(secret: SecretType) async -> PersistedAuthenticationContext?
/// Persists user authorization for access to a secret. /// Persists user authorization for access to a secret.
/// - Parameters: /// - Parameters:
/// - secret: The ``Secret`` to persist the authorization for. /// - secret: The ``Secret`` to persist the authorization for.
/// - duration: The duration that the authorization should persist for. /// - duration: The duration that the authorization should persist for.
/// - Note: This is used for temporarily unlocking access to a secret which would otherwise require authentication every single use. This is useful for situations where the user anticipates several rapid accesses to a authorization-guarded secret. /// - Note: This is used for temporarily unlocking access to a secret which would otherwise require authentication every single use. This is useful for situations where the user anticipates several rapid accesses to a authorization-guarded secret.
func persistAuthentication(secret: SecretType, forDuration duration: TimeInterval) throws func persistAuthentication(secret: SecretType, forDuration duration: TimeInterval) async throws
/// Requests that the store reload secrets from any backing store, if neccessary. /// Requests that the store reload secrets from any backing store, if neccessary.
func reloadSecrets() func reloadSecrets() async
} }
@ -56,18 +56,18 @@ public protocol SecretStoreModifiable: SecretStore {
/// - Parameters: /// - Parameters:
/// - name: The user-facing name for the ``Secret``. /// - name: The user-facing name for the ``Secret``.
/// - requiresAuthentication: A boolean indicating whether or not the user will be required to authenticate before performing signature operations with the secret. /// - requiresAuthentication: A boolean indicating whether or not the user will be required to authenticate before performing signature operations with the secret.
func create(name: String, requiresAuthentication: Bool) throws func create(name: String, requiresAuthentication: Bool) async throws
/// Deletes a Secret in the store. /// Deletes a Secret in the store.
/// - Parameters: /// - Parameters:
/// - secret: The ``Secret`` to delete. /// - secret: The ``Secret`` to delete.
func delete(secret: SecretType) throws func delete(secret: SecretType) async throws
/// Updates the name of a Secret in the store. /// Updates the name of a Secret in the store.
/// - Parameters: /// - Parameters:
/// - secret: The ``Secret`` to update. /// - secret: The ``Secret`` to update.
/// - name: The new name for the Secret. /// - name: The new name for the Secret.
func update(secret: SecretType, name: String) throws func update(secret: SecretType, name: String) async throws
} }

129
Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift
View File

@ -1,38 +1,41 @@
import Foundation import Foundation
import Combine import Observation
import Security import Security
import CryptoTokenKit import CryptoKit
import LocalAuthentication import LocalAuthentication
import SecretKit import SecretKit
import Synchronization
extension SecureEnclave { extension SecureEnclave {
/// An implementation of Store backed by the Secure Enclave. /// An implementation of Store backed by the Secure Enclave.
public final class Store: SecretStoreModifiable { @Observable public final class Store: SecretStoreModifiable {
public var isAvailable: Bool { public var isAvailable: Bool {
// For some reason, as of build time, CryptoKit.SecureEnclave.isAvailable always returns false CryptoKit.SecureEnclave.isAvailable
// error msg "Received error sending GET UNIQUE DEVICE command"
// Verify it with TKTokenWatcher manually.
TKTokenWatcher().tokenIDs.contains("com.apple.setoken")
} }
public let id = UUID() public let id = UUID()
public let name = String(localized: "secure_enclave") public let name = String(localized: "secure_enclave")
@Published public private(set) var secrets: [Secret] = [] public var secrets: [Secret] {
_secrets.withLock { $0 }
}
private let _secrets: Mutex<[Secret]> = .init([])
private var persistedAuthenticationContexts: [Secret: PersistentAuthenticationContext] = [:] private let persistedAuthenticationContexts: Mutex<[Secret: PersistentAuthenticationContext]> = .init([:])
/// Initializes a Store. /// Initializes a Store.
public init() { public init() {
DistributedNotificationCenter.default().addObserver(forName: .secretStoreUpdated, object: nil, queue: .main) { [reload = reloadSecretsInternal(notifyAgent:)] _ in Task {
reload(false) for await _ in DistributedNotificationCenter.default().notifications(named: .secretStoreUpdated) {
await reloadSecretsInternal(notifyAgent: false)
}
} }
loadSecrets() loadSecrets()
} }
// MARK: Public API // MARK: Public API
public func create(name: String, requiresAuthentication: Bool) throws { public func create(name: String, requiresAuthentication: Bool) async throws {
var accessError: SecurityError? var accessError: SecurityError?
let flags: SecAccessControlCreateFlags let flags: SecAccessControlCreateFlags
if requiresAuthentication { if requiresAuthentication {
@ -69,10 +72,10 @@ extension SecureEnclave {
throw KeychainError(statusCode: nil) throw KeychainError(statusCode: nil)
} }
try savePublicKey(publicKey, name: name) try savePublicKey(publicKey, name: name)
reloadSecretsInternal() await reloadSecretsInternal()
} }
public func delete(secret: Secret) throws { public func delete(secret: Secret) async throws {
let deleteAttributes = KeychainDictionary([ let deleteAttributes = KeychainDictionary([
kSecClass: kSecClassKey, kSecClass: kSecClassKey,
kSecAttrApplicationLabel: secret.id as CFData kSecAttrApplicationLabel: secret.id as CFData
@ -81,10 +84,10 @@ extension SecureEnclave {
if status != errSecSuccess { if status != errSecSuccess {
throw KeychainError(statusCode: status) throw KeychainError(statusCode: status)
} }
reloadSecretsInternal() await reloadSecretsInternal()
} }
public func update(secret: Secret, name: String) throws { public func update(secret: Secret, name: String) async throws {
let updateQuery = KeychainDictionary([ let updateQuery = KeychainDictionary([
kSecClass: kSecClassKey, kSecClass: kSecClassKey,
kSecAttrApplicationLabel: secret.id as CFData kSecAttrApplicationLabel: secret.id as CFData
@ -98,44 +101,46 @@ extension SecureEnclave {
if status != errSecSuccess { if status != errSecSuccess {
throw KeychainError(statusCode: status) throw KeychainError(statusCode: status)
} }
reloadSecretsInternal() await reloadSecretsInternal()
} }
public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data { public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data {
let context: LAContext let context: Mutex<LAContext>
if let existing = persistedAuthenticationContexts[secret], existing.valid { // if let existing = persistedAuthenticationContexts.withLock({ $0 })[secret], existing.valid {
context = existing.context // context = existing.context
} else { // } else {
let newContext = LAContext() let newContext = LAContext()
newContext.localizedCancelTitle = String(localized: "auth_context_request_deny_button") newContext.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
context = newContext context = .init(newContext)
} // }
context.localizedReason = String(localized: "auth_context_request_signature_description_\(provenance.origin.displayName)_\(secret.name)") return try context.withLock { context in
let attributes = KeychainDictionary([ context.localizedReason = String(localized: "auth_context_request_signature_description_\(provenance.origin.displayName)_\(secret.name)")
kSecClass: kSecClassKey, let attributes = KeychainDictionary([
kSecAttrKeyClass: kSecAttrKeyClassPrivate, kSecClass: kSecClassKey,
kSecAttrApplicationLabel: secret.id as CFData, kSecAttrKeyClass: kSecAttrKeyClassPrivate,
kSecAttrKeyType: Constants.keyType, kSecAttrApplicationLabel: secret.id as CFData,
kSecAttrTokenID: kSecAttrTokenIDSecureEnclave, kSecAttrKeyType: Constants.keyType,
kSecAttrApplicationTag: Constants.keyTag, kSecAttrTokenID: kSecAttrTokenIDSecureEnclave,
kSecUseAuthenticationContext: context, kSecAttrApplicationTag: Constants.keyTag,
kSecReturnRef: true kSecUseAuthenticationContext: context,
kSecReturnRef: true
]) ])
var untyped: CFTypeRef? var untyped: CFTypeRef?
let status = SecItemCopyMatching(attributes, &untyped) let status = SecItemCopyMatching(attributes, &untyped)
if status != errSecSuccess { if status != errSecSuccess {
throw KeychainError(statusCode: status) throw KeychainError(statusCode: status)
}
guard let untypedSafe = untyped else {
throw KeychainError(statusCode: errSecSuccess)
}
let key = untypedSafe as! SecKey
var signError: SecurityError?
guard let signature = SecKeyCreateSignature(key, .ecdsaSignatureMessageX962SHA256, data as CFData, &signError) else {
throw SigningError(error: signError)
}
return signature as Data
} }
guard let untypedSafe = untyped else {
throw KeychainError(statusCode: errSecSuccess)
}
let key = untypedSafe as! SecKey
var signError: SecurityError?
guard let signature = SecKeyCreateSignature(key, .ecdsaSignatureMessageX962SHA256, data as CFData, &signError) else {
throw SigningError(error: signError)
}
return signature as Data
} }
public func verify(signature: Data, for data: Data, with secret: Secret) throws -> Bool { public func verify(signature: Data, for data: Data, with secret: Secret) throws -> Bool {
@ -174,7 +179,7 @@ extension SecureEnclave {
} }
public func existingPersistedAuthenticationContext(secret: Secret) -> PersistedAuthenticationContext? { public func existingPersistedAuthenticationContext(secret: Secret) -> PersistedAuthenticationContext? {
guard let persisted = persistedAuthenticationContexts[secret], persisted.valid else { return nil } guard let persisted = persistedAuthenticationContexts.withLock({ $0 })[secret], persisted.valid else { return nil }
return persisted return persisted
} }
@ -193,14 +198,16 @@ extension SecureEnclave {
newContext.localizedReason = String(localized: "auth_context_persist_for_duration_unknown_\(secret.name)") newContext.localizedReason = String(localized: "auth_context_persist_for_duration_unknown_\(secret.name)")
} }
newContext.evaluatePolicy(LAPolicy.deviceOwnerAuthentication, localizedReason: newContext.localizedReason) { [weak self] success, _ in newContext.evaluatePolicy(LAPolicy.deviceOwnerAuthentication, localizedReason: newContext.localizedReason) { [weak self] success, _ in
guard success else { return } guard success, let self else { return }
let context = PersistentAuthenticationContext(secret: secret, context: newContext, duration: duration) let context = PersistentAuthenticationContext(secret: secret, context: newContext, duration: duration)
self?.persistedAuthenticationContexts[secret] = context self.persistedAuthenticationContexts.withLock {
$0[secret] = context
}
} }
} }
public func reloadSecrets() { public func reloadSecrets() async {
reloadSecretsInternal(notifyAgent: false) await reloadSecretsInternal(notifyAgent: false)
} }
} }
@ -211,9 +218,11 @@ extension SecureEnclave.Store {
/// Reloads all secrets from the store. /// Reloads all secrets from the store.
/// - Parameter notifyAgent: A boolean indicating whether a distributed notification should be posted, notifying other processes (ie, the SecretAgent) to reload their stores as well. /// - Parameter notifyAgent: A boolean indicating whether a distributed notification should be posted, notifying other processes (ie, the SecretAgent) to reload their stores as well.
private func reloadSecretsInternal(notifyAgent: Bool = true) { private func reloadSecretsInternal(notifyAgent: Bool = true) async {
let before = secrets let before = secrets
secrets.removeAll() _secrets.withLock {
$0.removeAll()
}
loadSecrets() loadSecrets()
if secrets != before { if secrets != before {
NotificationCenter.default.post(name: .secretStoreReloaded, object: self) NotificationCenter.default.post(name: .secretStoreReloaded, object: self)
@ -275,7 +284,9 @@ extension SecureEnclave.Store {
} }
return SecureEnclave.Secret(id: id, name: name, requiresAuthentication: requiresAuth, publicKey: publicKey) return SecureEnclave.Secret(id: id, name: name, requiresAuthentication: requiresAuth, publicKey: publicKey)
} }
secrets.append(contentsOf: wrapped) _secrets.withLock {
$0.append(contentsOf: wrapped)
}
} }
/// Saves a public key. /// Saves a public key.
@ -304,8 +315,8 @@ extension SecureEnclave.Store {
extension SecureEnclave { extension SecureEnclave {
enum Constants { enum Constants {
static let keyTag = "com.maxgoedjen.secretive.secureenclave.key".data(using: .utf8)! as CFData static let keyTag = Data("com.maxgoedjen.secretive.secureenclave.key".utf8)
static let keyType = kSecAttrKeyTypeECSECPrimeRandom static let keyType = kSecAttrKeyTypeECSECPrimeRandom as String
static let unauthenticatedThreshold: TimeInterval = 0.05 static let unauthenticatedThreshold: TimeInterval = 0.05
} }
@ -314,12 +325,12 @@ extension SecureEnclave {
extension SecureEnclave { extension SecureEnclave {
/// A context describing a persisted authentication. /// A context describing a persisted authentication.
private struct PersistentAuthenticationContext: PersistedAuthenticationContext { private final class PersistentAuthenticationContext: PersistedAuthenticationContext {
/// The Secret to persist authentication for. /// The Secret to persist authentication for.
let secret: Secret let secret: Secret
/// The LAContext used to authorize the persistent context. /// The LAContext used to authorize the persistent context.
let context: LAContext nonisolated(unsafe) let context: LAContext
/// An expiration date for the context. /// An expiration date for the context.
/// - Note - Monotonic time instead of Date() to prevent people setting the clock back. /// - Note - Monotonic time instead of Date() to prevent people setting the clock back.
let monotonicExpiration: UInt64 let monotonicExpiration: UInt64

99
Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift
View File

@ -1,38 +1,51 @@
import Foundation import Foundation
import Combine import Synchronization
import Observation
import Security import Security
import CryptoTokenKit import CryptoTokenKit
import LocalAuthentication import LocalAuthentication
import SecretKit import SecretKit
extension SmartCard { extension SmartCard {
private struct State {
var isAvailable = false
var name = String(localized: "smart_card")
var secrets: [Secret] = []
let watcher = TKTokenWatcher()
var tokenID: String? = nil
}
/// An implementation of Store backed by a Smart Card. /// An implementation of Store backed by a Smart Card.
public final class Store: SecretStore { @Observable public final class Store: SecretStore {
private let state: Mutex<State> = .init(.init())
public var isAvailable: Bool {
state.withLock { $0.isAvailable }
}
@Published public var isAvailable: Bool = false
public let id = UUID() public let id = UUID()
public private(set) var name = String(localized: "smart_card") public var name: String {
@Published public private(set) var secrets: [Secret] = [] state.withLock { $0.name }
private let watcher = TKTokenWatcher() }
private var tokenID: String? public var secrets: [Secret] {
state.withLock { $0.secrets }
}
/// Initializes a Store. /// Initializes a Store.
public init() { public init() {
tokenID = watcher.nonSecureEnclaveTokens.first state.withLock { state in
watcher.setInsertionHandler { [reload = reloadSecretsInternal] string in if let tokenID = state.tokenID {
guard self.tokenID == nil else { return } state.isAvailable = true
guard !string.contains("setoken") else { return } state.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: tokenID)
}
self.tokenID = string state.watcher.setInsertionHandler { id in
DispatchQueue.main.async { // Setting insertion handler will cause it to be called immediately.
reload() // Make a thread jump so we don't hit a recursive lock attempt.
Task {
self.smartcardInserted(for: id)
}
} }
self.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: string)
}
if let tokenID = tokenID {
self.isAvailable = true
self.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: tokenID)
} }
loadSecrets() loadSecrets()
} }
@ -48,7 +61,7 @@ extension SmartCard {
} }
public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data { public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data {
guard let tokenID = tokenID else { fatalError() } guard let tokenID = state.withLock({ $0.tokenID }) else { fatalError() }
let context = LAContext() let context = LAContext()
context.localizedReason = String(localized: "auth_context_request_signature_description_\(provenance.origin.displayName)_\(secret.name)") context.localizedReason = String(localized: "auth_context_request_signature_description_\(provenance.origin.displayName)_\(secret.name)")
context.localizedCancelTitle = String(localized: "auth_context_request_deny_button") context.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
@ -118,31 +131,51 @@ extension SmartCard {
extension SmartCard.Store { extension SmartCard.Store {
private func reloadSecretsInternal() { private func reloadSecretsInternal() {
self.isAvailable = self.tokenID != nil let before = state.withLock {
let before = self.secrets $0.isAvailable = $0.tokenID != nil
self.secrets.removeAll() let before = $0.secrets
$0.secrets.removeAll()
return before
}
self.loadSecrets() self.loadSecrets()
if self.secrets != before { if self.secrets != before {
NotificationCenter.default.post(name: .secretStoreReloaded, object: self) NotificationCenter.default.post(name: .secretStoreReloaded, object: self)
} }
} }
/// Resets the token ID and reloads secrets.
/// - Parameter tokenID: The ID of the token that was inserted.
private func smartcardInserted(for tokenID: String? = nil) {
state.withLock { state in
guard let string = state.watcher.nonSecureEnclaveTokens.first else { return }
guard state.tokenID == nil else { return }
guard !string.contains("setoken") else { return }
state.tokenID = string
state.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: string)
state.tokenID = string
}
}
/// Resets the token ID and reloads secrets. /// Resets the token ID and reloads secrets.
/// - Parameter tokenID: The ID of the token that was removed. /// - Parameter tokenID: The ID of the token that was removed.
private func smartcardRemoved(for tokenID: String? = nil) { private func smartcardRemoved(for tokenID: String? = nil) {
self.tokenID = nil state.withLock {
$0.tokenID = nil
}
reloadSecrets() reloadSecrets()
} }
/// Loads all secrets from the store. /// Loads all secrets from the store.
private func loadSecrets() { private func loadSecrets() {
guard let tokenID = tokenID else { return } guard let tokenID = state.withLock({ $0.tokenID }) else { return }
let fallbackName = String(localized: "smart_card") let fallbackName = String(localized: "smart_card")
if let driverName = watcher.tokenInfo(forTokenID: tokenID)?.driverName { state.withLock {
name = driverName if let driverName = $0.watcher.tokenInfo(forTokenID: tokenID)?.driverName {
} else { $0.name = driverName
name = fallbackName } else {
$0.name = fallbackName
}
} }
let attributes = KeychainDictionary([ let attributes = KeychainDictionary([
@ -166,7 +199,9 @@ extension SmartCard.Store {
let publicKey = publicKeyAttributes[kSecValueData] as! Data let publicKey = publicKeyAttributes[kSecValueData] as! Data
return SmartCard.Secret(id: tokenID, name: name, algorithm: algorithm, keySize: keySize, publicKey: publicKey) return SmartCard.Secret(id: tokenID, name: name, algorithm: algorithm, keySize: keySize, publicKey: publicKey)
} }
secrets.append(contentsOf: wrapped) state.withLock {
$0.secrets.append(contentsOf: wrapped)
}
} }
} }
@ -210,7 +245,7 @@ extension SmartCard.Store {
/// - Returns: The decrypted data. /// - Returns: The decrypted data.
/// - Warning: Encryption functions are deliberately only exposed on a library level, and are not exposed in Secretive itself to prevent users from data loss. Any pull requests which expose this functionality in the app will not be merged. /// - Warning: Encryption functions are deliberately only exposed on a library level, and are not exposed in Secretive itself to prevent users from data loss. Any pull requests which expose this functionality in the app will not be merged.
public func decrypt(data: Data, with secret: SecretType) throws -> Data { public func decrypt(data: Data, with secret: SecretType) throws -> Data {
guard let tokenID = tokenID else { fatalError() } guard let tokenID = state.withLock({ $0.tokenID }) else { fatalError() }
let context = LAContext() let context = LAContext()
context.localizedReason = String(localized: "auth_context_request_decrypt_description_\(secret.name)") context.localizedReason = String(localized: "auth_context_request_decrypt_description_\(secret.name)")
context.localizedCancelTitle = String(localized: "auth_context_request_deny_button") context.localizedCancelTitle = String(localized: "auth_context_request_deny_button")

82
Sources/Packages/Tests/BriefTests/ReleaseParsingTests.swift
View File

@ -1,54 +1,66 @@
import XCTest import Testing
import Foundation
@testable import Brief @testable import Brief
class ReleaseParsingTests: XCTestCase {
func testNonCritical() { @Suite struct ReleaseParsingTests {
@Test
func nonCritical() {
let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Initial release") let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Initial release")
XCTAssert(release.critical == false) #expect(release.critical == false)
} }
func testCritical() { @Test
func critical() {
let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update") let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update")
XCTAssert(release.critical == true) #expect(release.critical == true)
} }
func testOSMissing() { @Test
func osMissing() {
let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update") let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update")
XCTAssert(release.minimumOSVersion == SemVer("11.0.0")) #expect(release.minimumOSVersion == SemVer("11.0.0"))
} }
func testOSPresentWithContentBelow() { @Test
func osPresentWithContentBelow() {
let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update ##Minimum macOS Version\n1.2.3\nBuild info") let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update ##Minimum macOS Version\n1.2.3\nBuild info")
XCTAssert(release.minimumOSVersion == SemVer("1.2.3")) #expect(release.minimumOSVersion == SemVer("1.2.3"))
} }
func testOSPresentAtEnd() { @Test
func osPresentAtEnd() {
let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: 1.2.3") let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: 1.2.3")
XCTAssert(release.minimumOSVersion == SemVer("1.2.3")) #expect(release.minimumOSVersion == SemVer("1.2.3"))
} }
func testOSWithMacOSPrefix() { @Test
func osWithMacOSPrefix() {
let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: macOS 1.2.3") let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: macOS 1.2.3")
XCTAssert(release.minimumOSVersion == SemVer("1.2.3")) #expect(release.minimumOSVersion == SemVer("1.2.3"))
} }
func testOSGreaterThanMinimum() { @Test
func osGreaterThanMinimum() {
let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: 1.2.3") let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: 1.2.3")
XCTAssert(release.minimumOSVersion < SemVer("11.0.0")) #expect(release.minimumOSVersion < SemVer("11.0.0"))
} }
func testOSEqualToMinimum() { @Test
func osEqualToMinimum() {
let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: 11.2.3") let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: 11.2.3")
XCTAssert(release.minimumOSVersion <= SemVer("11.2.3")) #expect(release.minimumOSVersion <= SemVer("11.2.3"))
} }
func testOSLessThanMinimum() { @Test
func osLessThanMinimum() {
let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: 1.2.3") let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: 1.2.3")
XCTAssert(release.minimumOSVersion > SemVer("1.0.0")) #expect(release.minimumOSVersion > SemVer("1.0.0"))
} }
func testGreatestSelectedIfOldPatchIsPublishedLater() { @Test
func greatestSelectedIfOldPatchIsPublishedLater() async throws {
// If 2.x.x series has been published, and a patch for 1.x.x is issued // If 2.x.x series has been published, and a patch for 1.x.x is issued
// 2.x.x should still be selected if user can run it. // 2.x.x should still be selected if user can run it.
let updater = Updater(checkOnLaunch: false, osVersion: SemVer("2.2.3"), currentVersion: SemVer("1.0.0")) let updater = Updater(checkOnLaunch: false, osVersion: SemVer("2.2.3"), currentVersion: SemVer("1.0.0"))
@ -60,16 +72,13 @@ class ReleaseParsingTests: XCTestCase {
Release(name: "1.0.2", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Emergency patch! Minimum macOS Version: 1.2.3"), Release(name: "1.0.2", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Emergency patch! Minimum macOS Version: 1.2.3"),
] ]
let expectation = XCTestExpectation() await updater.evaluate(releases: releases)
updater.evaluate(releases: releases) try await Task.sleep(nanoseconds: 1)
DispatchQueue.main.async { #expect(updater.update == two)
XCTAssert(updater.update == two)
expectation.fulfill()
}
wait(for: [expectation], timeout: 1)
} }
func testLatestVersionIsRunnable() { @Test
func latestVersionIsRunnable() async throws {
// If the 2.x.x series has been published but the user can't run it // If the 2.x.x series has been published but the user can't run it
// the last version the user can run should be selected. // the last version the user can run should be selected.
let updater = Updater(checkOnLaunch: false, osVersion: SemVer("1.2.3"), currentVersion: SemVer("1.0.0")) let updater = Updater(checkOnLaunch: false, osVersion: SemVer("1.2.3"), currentVersion: SemVer("1.0.0"))
@ -80,16 +89,13 @@ class ReleaseParsingTests: XCTestCase {
Release(name: "2.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "2.0 available! Minimum macOS Version: 2.2.3"), Release(name: "2.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "2.0 available! Minimum macOS Version: 2.2.3"),
Release(name: "1.0.2", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Emergency patch! Minimum macOS Version: 1.2.3"), Release(name: "1.0.2", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Emergency patch! Minimum macOS Version: 1.2.3"),
] ]
let expectation = XCTestExpectation() await updater.evaluate(releases: releases)
updater.evaluate(releases: releases) try await Task.sleep(nanoseconds: 1)
DispatchQueue.main.async { #expect(updater.update == oneOhTwo)
XCTAssert(updater.update == oneOhTwo)
expectation.fulfill()
}
wait(for: [expectation], timeout: 1)
} }
func testSorting() { @Test
func sorting() {
let two = Release(name: "2.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "2.0 available!") let two = Release(name: "2.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "2.0 available!")
let releases = [ let releases = [
Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Initial release"), Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Initial release"),
@ -98,7 +104,7 @@ class ReleaseParsingTests: XCTestCase {
Release(name: "1.0.2", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Emergency patch!"), Release(name: "1.0.2", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Emergency patch!"),
] ]
let sorted = releases.sorted().reversed().first let sorted = releases.sorted().reversed().first
XCTAssert(sorted == two) #expect(sorted == two)
} }
} }

37
Sources/Packages/Tests/BriefTests/SemVerTests.swift
View File

@ -1,51 +1,52 @@
import XCTest import Testing
import Foundation
@testable import Brief @testable import Brief
class SemVerTests: XCTestCase { @Suite struct SemVerTests {
func testEqual() { @Test func equal() {
let current = SemVer("1.0.2") let current = SemVer("1.0.2")
let old = SemVer("1.0.2") let old = SemVer("1.0.2")
XCTAssert(!(current > old)) #expect(!(current > old))
} }
func testPatchGreaterButMinorLess() { @Test func patchGreaterButMinorLess() {
let current = SemVer("1.1.0") let current = SemVer("1.1.0")
let old = SemVer("1.0.2") let old = SemVer("1.0.2")
XCTAssert(current > old) #expect(current > old)
} }
func testMajorSameMinorGreater() { @Test func majorSameMinorGreater() {
let current = SemVer("1.0.2") let current = SemVer("1.0.2")
let new = SemVer("1.0.3") let new = SemVer("1.0.3")
XCTAssert(current < new) #expect(current < new)
} }
func testMajorGreaterMinorLesser() { @Test func majorGreaterMinorLesser() {
let current = SemVer("1.0.2") let current = SemVer("1.0.2")
let new = SemVer("2.0.0") let new = SemVer("2.0.0")
XCTAssert(current < new) #expect(current < new)
} }
func testRegularParsing() { @Test func regularParsing() {
let current = SemVer("1.0.2") let current = SemVer("1.0.2")
XCTAssert(current.versionNumbers == [1, 0, 2]) #expect(current.versionNumbers == [1, 0, 2])
} }
func testNoPatch() { @Test func noPatch() {
let current = SemVer("1.1") let current = SemVer("1.1")
XCTAssert(current.versionNumbers == [1, 1, 0]) #expect(current.versionNumbers == [1, 1, 0])
} }
func testGarbage() { @Test func garbage() {
let current = SemVer("Test") let current = SemVer("Test")
XCTAssert(current.versionNumbers == [0, 0, 0]) #expect(current.versionNumbers == [0, 0, 0])
} }
func testBeta() { @Test func beta() {
let current = SemVer("1.0.2") let current = SemVer("1.0.2")
let new = SemVer("1.1.0_beta1") let new = SemVer("1.1.0_beta1")
XCTAssert(current < new) #expect(current < new)
} }
} }

62
Sources/Packages/Tests/SecretAgentKitTests/AgentTests.swift
View File

@ -1,41 +1,41 @@
import Foundation import Foundation
import XCTest import Testing
import CryptoKit import CryptoKit
@testable import SecretKit @testable import SecretKit
@testable import SecretAgentKit @testable import SecretAgentKit
class AgentTests: XCTestCase { @Suite struct AgentTests {
let stubWriter = StubFileHandleWriter() let stubWriter = StubFileHandleWriter()
// MARK: Identity Listing // MARK: Identity Listing
func testEmptyStores() async { @Test func emptyStores() async {
let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestIdentities) let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestIdentities)
let agent = Agent(storeList: SecretStoreList()) let agent = Agent(storeList: SecretStoreList())
await agent.handle(reader: stubReader, writer: stubWriter) await agent.handle(reader: stubReader, writer: stubWriter)
XCTAssertEqual(stubWriter.data, Constants.Responses.requestIdentitiesEmpty) #expect(stubWriter.data == Constants.Responses.requestIdentitiesEmpty)
} }
func testIdentitiesList() async { @Test func identitiesList() async {
let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestIdentities) let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestIdentities)
let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret]) let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
let agent = Agent(storeList: list) let agent = Agent(storeList: list)
await agent.handle(reader: stubReader, writer: stubWriter) await agent.handle(reader: stubReader, writer: stubWriter)
XCTAssertEqual(stubWriter.data, Constants.Responses.requestIdentitiesMultiple) #expect(stubWriter.data == Constants.Responses.requestIdentitiesMultiple)
} }
// MARK: Signatures // MARK: Signatures
func testNoMatchingIdentities() async { @Test func noMatchingIdentities() async {
let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignatureWithNoneMatching) let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignatureWithNoneMatching)
let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret]) let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
let agent = Agent(storeList: list) let agent = Agent(storeList: list)
await agent.handle(reader: stubReader, writer: stubWriter) await agent.handle(reader: stubReader, writer: stubWriter)
// XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure) #expect(stubWriter.data == Constants.Responses.requestFailure)
} }
func testSignature() async { @Test func signature() async throws {
let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature) let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
let requestReader = OpenSSHReader(data: Constants.Requests.requestSignature[5...]) let requestReader = OpenSSHReader(data: Constants.Requests.requestSignature[5...])
_ = requestReader.readNextChunk() _ = requestReader.readNextChunk()
@ -63,20 +63,20 @@ class AgentTests: XCTestCase {
let signature = try! P256.Signing.ECDSASignature(rawRepresentation: rs) let signature = try! P256.Signing.ECDSASignature(rawRepresentation: rs)
let referenceValid = try! P256.Signing.PublicKey(x963Representation: Constants.Secrets.ecdsa256Secret.publicKey).isValidSignature(signature, for: dataToSign) let referenceValid = try! P256.Signing.PublicKey(x963Representation: Constants.Secrets.ecdsa256Secret.publicKey).isValidSignature(signature, for: dataToSign)
let store = list.stores.first! let store = list.stores.first!
let derVerifies = try! store.verify(signature: signature.derRepresentation, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa256Secret)) let derVerifies = try await store.verify(signature: signature.derRepresentation, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa256Secret))
let invalidRandomSignature = try? store.verify(signature: "invalid".data(using: .utf8)!, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa256Secret)) let invalidRandomSignature = try await store.verify(signature: "invalid".data(using: .utf8)!, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa256Secret))
let invalidRandomData = try? store.verify(signature: signature.derRepresentation, for: "invalid".data(using: .utf8)!, with: AnySecret(Constants.Secrets.ecdsa256Secret)) let invalidRandomData = try await store.verify(signature: signature.derRepresentation, for: "invalid".data(using: .utf8)!, with: AnySecret(Constants.Secrets.ecdsa256Secret))
let invalidWrongKey = try? store.verify(signature: signature.derRepresentation, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa384Secret)) let invalidWrongKey = try await store.verify(signature: signature.derRepresentation, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa384Secret))
XCTAssertTrue(referenceValid) #expect(referenceValid)
XCTAssertTrue(derVerifies) #expect(derVerifies)
XCTAssert(invalidRandomSignature == false) #expect(invalidRandomSignature == false)
XCTAssert(invalidRandomData == false) #expect(invalidRandomData == false)
XCTAssert(invalidWrongKey == false) #expect(invalidWrongKey == false)
} }
// MARK: Witness protocol // MARK: Witness protocol
func testWitnessObjectionStopsRequest() async { @Test func witnessObjectionStopsRequest() async {
let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature) let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
let list = storeList(with: [Constants.Secrets.ecdsa256Secret]) let list = storeList(with: [Constants.Secrets.ecdsa256Secret])
let witness = StubWitness(speakNow: { _,_ in let witness = StubWitness(speakNow: { _,_ in
@ -84,10 +84,10 @@ class AgentTests: XCTestCase {
}, witness: { _, _ in }) }, witness: { _, _ in })
let agent = Agent(storeList: list, witness: witness) let agent = Agent(storeList: list, witness: witness)
await agent.handle(reader: stubReader, writer: stubWriter) await agent.handle(reader: stubReader, writer: stubWriter)
XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure) #expect(stubWriter.data == Constants.Responses.requestFailure)
} }
func testWitnessSignature() async { @Test func witnessSignature() async {
let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature) let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
let list = storeList(with: [Constants.Secrets.ecdsa256Secret]) let list = storeList(with: [Constants.Secrets.ecdsa256Secret])
var witnessed = false var witnessed = false
@ -98,10 +98,10 @@ class AgentTests: XCTestCase {
}) })
let agent = Agent(storeList: list, witness: witness) let agent = Agent(storeList: list, witness: witness)
await agent.handle(reader: stubReader, writer: stubWriter) await agent.handle(reader: stubReader, writer: stubWriter)
XCTAssertTrue(witnessed) #expect(witnessed)
} }
func testRequestTracing() async { @Test func requestTracing() async {
let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature) let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
let list = storeList(with: [Constants.Secrets.ecdsa256Secret]) let list = storeList(with: [Constants.Secrets.ecdsa256Secret])
var speakNowTrace: SigningRequestProvenance! = nil var speakNowTrace: SigningRequestProvenance! = nil
@ -114,31 +114,31 @@ class AgentTests: XCTestCase {
}) })
let agent = Agent(storeList: list, witness: witness) let agent = Agent(storeList: list, witness: witness)
await agent.handle(reader: stubReader, writer: stubWriter) await agent.handle(reader: stubReader, writer: stubWriter)
XCTAssertEqual(witnessTrace, speakNowTrace) #expect(witnessTrace == speakNowTrace)
XCTAssertEqual(witnessTrace.origin.displayName, "Finder") #expect(witnessTrace.origin.displayName == "Finder")
XCTAssertEqual(witnessTrace.origin.validSignature, true) #expect(witnessTrace.origin.validSignature == true)
XCTAssertEqual(witnessTrace.origin.parentPID, 1) #expect(witnessTrace.origin.parentPID == 1)
} }
// MARK: Exception Handling // MARK: Exception Handling
func testSignatureException() async { @Test func signatureException() async {
let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature) let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret]) let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
let store = list.stores.first?.base as! Stub.Store let store = list.stores.first?.base as! Stub.Store
store.shouldThrow = true store.shouldThrow = true
let agent = Agent(storeList: list) let agent = Agent(storeList: list)
await agent.handle(reader: stubReader, writer: stubWriter) await agent.handle(reader: stubReader, writer: stubWriter)
XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure) #expect(stubWriter.data == Constants.Responses.requestFailure)
} }
// MARK: Unsupported // MARK: Unsupported
func testUnhandledAdd() async { @Test func unhandledAdd() async {
let stubReader = StubFileHandleReader(availableData: Constants.Requests.addIdentity) let stubReader = StubFileHandleReader(availableData: Constants.Requests.addIdentity)
let agent = Agent(storeList: SecretStoreList()) let agent = Agent(storeList: SecretStoreList())
await agent.handle(reader: stubReader, writer: stubWriter) await agent.handle(reader: stubReader, writer: stubWriter)
XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure) #expect(stubWriter.data == Constants.Responses.requestFailure)
} }
} }

2
Sources/Packages/Tests/SecretAgentKitTests/StubFileHandleWriter.swift
View File

@ -1,7 +1,7 @@
import Foundation import Foundation
import SecretAgentKit import SecretAgentKit
class StubFileHandleWriter: FileHandleWriter { class StubFileHandleWriter: FileHandleWriter, @unchecked Sendable {
var data = Data() var data = Data()

2
Sources/Packages/Tests/SecretAgentKitTests/StubStore.swift
View File

@ -6,7 +6,7 @@ struct Stub {}
extension Stub { extension Stub {
public final class Store: SecretStore { public final class Store: SecretStore, @unchecked Sendable {
public let isAvailable = true public let isAvailable = true
public let id = UUID() public let id = UUID()

16
Sources/Packages/Tests/SecretKitTests/AnySecretTests.swift
View File

@ -1,19 +1,19 @@
import Foundation import Foundation
import XCTest import Testing
@testable import SecretKit @testable import SecretKit
@testable import SecureEnclaveSecretKit @testable import SecureEnclaveSecretKit
@testable import SmartCardSecretKit @testable import SmartCardSecretKit
class AnySecretTests: XCTestCase { @Suite struct AnySecretTests {
func testEraser() { @Test func eraser() {
let secret = SmartCard.Secret(id: UUID().uuidString.data(using: .utf8)!, name: "Name", algorithm: .ellipticCurve, keySize: 256, publicKey: UUID().uuidString.data(using: .utf8)!) let secret = SmartCard.Secret(id: UUID().uuidString.data(using: .utf8)!, name: "Name", algorithm: .ellipticCurve, keySize: 256, publicKey: UUID().uuidString.data(using: .utf8)!)
let erased = AnySecret(secret) let erased = AnySecret(secret)
XCTAssert(erased.id == secret.id as AnyHashable) #expect(erased.id == secret.id as AnyHashable)
XCTAssert(erased.name == secret.name) #expect(erased.name == secret.name)
XCTAssert(erased.algorithm == secret.algorithm) #expect(erased.algorithm == secret.algorithm)
XCTAssert(erased.keySize == secret.keySize) #expect(erased.keySize == secret.keySize)
XCTAssert(erased.publicKey == secret.publicKey) #expect(erased.publicKey == secret.publicKey)
} }
} }

12
Sources/Packages/Tests/SecretKitTests/OpenSSHReaderTests.swift
View File

@ -1,19 +1,19 @@
import Foundation import Foundation
import XCTest import Testing
@testable import SecretKit @testable import SecretKit
@testable import SecureEnclaveSecretKit @testable import SecureEnclaveSecretKit
@testable import SmartCardSecretKit @testable import SmartCardSecretKit
class OpenSSHReaderTests: XCTestCase { @Suite struct OpenSSHReaderTests {
func testSignatureRequest() { @Test func signatureRequest() {
let reader = OpenSSHReader(data: Constants.signatureRequest) let reader = OpenSSHReader(data: Constants.signatureRequest)
let hash = reader.readNextChunk() let hash = reader.readNextChunk()
XCTAssert(hash == Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBEqCbkJbOHy5S1wVCaJoKPmpS0egM4frMqllgnlRRQ/Uvnn6EVS8oV03cPA2Bz0EdESyRKA/sbmn0aBtgjIwGELxu45UXEW1TEz6TxyS0u3vuIqR3Wo1CrQWRDnkrG/pBQ==")) #expect(hash == Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBEqCbkJbOHy5S1wVCaJoKPmpS0egM4frMqllgnlRRQ/Uvnn6EVS8oV03cPA2Bz0EdESyRKA/sbmn0aBtgjIwGELxu45UXEW1TEz6TxyS0u3vuIqR3Wo1CrQWRDnkrG/pBQ=="))
let dataToSign = reader.readNextChunk() let dataToSign = reader.readNextChunk()
XCTAssert(dataToSign == Data(base64Encoded: "AAAAICi5xf1ixOestUlxdjvt/BDcM+rzhwy7Vo8cW5YcxA8+MgAAAANnaXQAAAAOc3NoLWNvbm5lY3Rpb24AAAAJcHVibGlja2V5AQAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAAiAAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAACG5pc3RwMzg0AAAAYQRKgm5CWzh8uUtcFQmiaCj5qUtHoDOH6zKpZYJ5UUUP1L55+hFUvKFdN3DwNgc9BHREskSgP7G5p9GgbYIyMBhC8buOVFxFtUxM+k8cktLt77iKkd1qNQq0FkQ55Kxv6QU=")) #expect(dataToSign == Data(base64Encoded: "AAAAICi5xf1ixOestUlxdjvt/BDcM+rzhwy7Vo8cW5YcxA8+MgAAAANnaXQAAAAOc3NoLWNvbm5lY3Rpb24AAAAJcHVibGlja2V5AQAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAAiAAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAACG5pc3RwMzg0AAAAYQRKgm5CWzh8uUtcFQmiaCj5qUtHoDOH6zKpZYJ5UUUP1L55+hFUvKFdN3DwNgc9BHREskSgP7G5p9GgbYIyMBhC8buOVFxFtUxM+k8cktLt77iKkd1qNQq0FkQ55Kxv6QU="))
let empty = reader.readNextChunk() let empty = reader.readNextChunk()
XCTAssert(empty.isEmpty) #expect(empty.isEmpty)
} }
} }

36
Sources/Packages/Tests/SecretKitTests/OpenSSHWriterTests.swift
View File

@ -1,45 +1,45 @@
import Foundation import Foundation
import XCTest import Testing
@testable import SecretKit @testable import SecretKit
@testable import SecureEnclaveSecretKit @testable import SecureEnclaveSecretKit
@testable import SmartCardSecretKit @testable import SmartCardSecretKit
class OpenSSHWriterTests: XCTestCase { @Suite struct OpenSSHWriterTests {
let writer = OpenSSHKeyWriter() let writer = OpenSSHKeyWriter()
func testECDSA256MD5Fingerprint() { @Test func ecdsa256MD5Fingerprint() {
XCTAssertEqual(writer.openSSHMD5Fingerprint(secret: Constants.ecdsa256Secret), "dc:60:4d:ff:c2:d9:18:8b:2f:24:40:b5:7f:43:47:e5") #expect(writer.openSSHMD5Fingerprint(secret: Constants.ecdsa256Secret) == "dc:60:4d:ff:c2:d9:18:8b:2f:24:40:b5:7f:43:47:e5")
} }
func testECDSA256SHA256Fingerprint() { @Test func ecdsa256SHA256Fingerprint() {
XCTAssertEqual(writer.openSSHSHA256Fingerprint(secret: Constants.ecdsa256Secret), "SHA256:/VQFeGyM8qKA8rB6WGMuZZxZLJln2UgXLk3F0uTF650") #expect(writer.openSSHSHA256Fingerprint(secret: Constants.ecdsa256Secret) == "SHA256:/VQFeGyM8qKA8rB6WGMuZZxZLJln2UgXLk3F0uTF650")
} }
func testECDSA256PublicKey() { @Test func ecdsa256PublicKey() {
XCTAssertEqual(writer.openSSHString(secret: Constants.ecdsa256Secret), #expect(writer.openSSHString(secret: Constants.ecdsa256Secret) ==
"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo=") "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo=")
} }
func testECDSA256Hash() { @Test func ecdsa256Hash() {
XCTAssertEqual(writer.data(secret: Constants.ecdsa256Secret), Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo=")) #expect(writer.data(secret: Constants.ecdsa256Secret) == Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo="))
} }
func testECDSA384MD5Fingerprint() { @Test func ecdsa384MD5Fingerprint() {
XCTAssertEqual(writer.openSSHMD5Fingerprint(secret: Constants.ecdsa384Secret), "66:e0:66:d7:41:ed:19:8e:e2:20:df:ce:ac:7e:2b:6e") #expect(writer.openSSHMD5Fingerprint(secret: Constants.ecdsa384Secret) == "66:e0:66:d7:41:ed:19:8e:e2:20:df:ce:ac:7e:2b:6e")
} }
func testECDSA384SHA256Fingerprint() { @Test func ecdsa384SHA256Fingerprint() {
XCTAssertEqual(writer.openSSHSHA256Fingerprint(secret: Constants.ecdsa384Secret), "SHA256:GJUEymQNL9ymaMRRJCMGY4rWIJHu/Lm8Yhao/PAiz1I") #expect(writer.openSSHSHA256Fingerprint(secret: Constants.ecdsa384Secret) == "SHA256:GJUEymQNL9ymaMRRJCMGY4rWIJHu/Lm8Yhao/PAiz1I")
} }
func testECDSA384PublicKey() { @Test func ecdsa384PublicKey() {
XCTAssertEqual(writer.openSSHString(secret: Constants.ecdsa384Secret), #expect(writer.openSSHString(secret: Constants.ecdsa384Secret) ==
"ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ==") "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ==")
} }
func testECDSA384Hash() { @Test func ecdsa384Hash() {
XCTAssertEqual(writer.data(secret: Constants.ecdsa384Secret), Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ==")) #expect(writer.data(secret: Constants.ecdsa384Secret) == Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ=="))
} }
} }

28
Sources/SecretAgent/AppDelegate.swift
View File

@ -6,8 +6,9 @@ import SecureEnclaveSecretKit
import SmartCardSecretKit import SmartCardSecretKit
import SecretAgentKit import SecretAgentKit
import Brief import Brief
import Observation
@NSApplicationMain @main
class AppDelegate: NSObject, NSApplicationDelegate { class AppDelegate: NSObject, NSApplicationDelegate {
private let storeList: SecretStoreList = { private let storeList: SecretStoreList = {
@ -31,19 +32,28 @@ class AppDelegate: NSObject, NSApplicationDelegate {
func applicationDidFinishLaunching(_ aNotification: Notification) { func applicationDidFinishLaunching(_ aNotification: Notification) {
logger.debug("SecretAgent finished launching") logger.debug("SecretAgent finished launching")
DispatchQueue.main.async { Task { @MainActor in
self.socketController.handler = self.agent.handle(reader:writer:) socketController.handler = { [agent] reader, writer in
await agent.handle(reader: reader, writer: writer)
}
} }
NotificationCenter.default.addObserver(forName: .secretStoreReloaded, object: nil, queue: .main) { [self] _ in Task {
try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true) for await _ in NotificationCenter.default.notifications(named: .secretStoreReloaded) {
try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true)
}
} }
try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true) try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true)
notifier.prompt() notifier.prompt()
updateSink = updater.$update.sink { update in _ = withObservationTracking {
guard let update = update else { return } updater.update
self.notifier.notify(update: update, ignore: self.updater.ignore(release:)) } onChange: { [updater, notifier] in
notifier.notify(update: updater.update!) { release in
Task {
await updater.ignore(release: release)
}
}
} }
} }
} }

108
Sources/SecretAgent/Notifier.swift
View File

@ -4,8 +4,9 @@ import AppKit
import SecretKit import SecretKit
import SecretAgentKit import SecretAgentKit
import Brief import Brief
import Synchronization
class Notifier { final class Notifier: Sendable {
private let notificationDelegate = NotificationDelegate() private let notificationDelegate = NotificationDelegate()
@ -34,7 +35,9 @@ class Notifier {
guard let string = formatter.string(from: seconds)?.capitalized else { continue } guard let string = formatter.string(from: seconds)?.capitalized else { continue }
let identifier = Constants.persistAuthenticationCategoryIdentitifier.appending("\(seconds)") let identifier = Constants.persistAuthenticationCategoryIdentitifier.appending("\(seconds)")
let action = UNNotificationAction(identifier: identifier, title: string, options: []) let action = UNNotificationAction(identifier: identifier, title: string, options: [])
notificationDelegate.persistOptions[identifier] = seconds notificationDelegate.state.withLock { state in
state.persistOptions[identifier] = seconds
}
allPersistenceActions.append(action) allPersistenceActions.append(action)
} }
@ -45,9 +48,11 @@ class Notifier {
UNUserNotificationCenter.current().setNotificationCategories([updateCategory, criticalUpdateCategory, persistAuthenticationCategory]) UNUserNotificationCenter.current().setNotificationCategories([updateCategory, criticalUpdateCategory, persistAuthenticationCategory])
UNUserNotificationCenter.current().delegate = notificationDelegate UNUserNotificationCenter.current().delegate = notificationDelegate
notificationDelegate.persistAuthentication = { secret, store, duration in notificationDelegate.state.withLock { state in
guard let duration = duration else { return } state.persistAuthentication = { secret, store, duration in
try? store.persistAuthentication(secret: secret, forDuration: duration) guard let duration = duration else { return }
try? await store.persistAuthentication(secret: secret, forDuration: duration)
}
} }
} }
@ -57,9 +62,11 @@ class Notifier {
notificationCenter.requestAuthorization(options: .alert) { _, _ in } notificationCenter.requestAuthorization(options: .alert) { _, _ in }
} }
func notify(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) { func notify(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async {
notificationDelegate.pendingPersistableSecrets[secret.id.description] = secret notificationDelegate.state.withLock { state in
notificationDelegate.pendingPersistableStores[store.id.description] = store state.pendingPersistableSecrets[secret.id.description] = secret
state.pendingPersistableStores[store.id.description] = store
}
let notificationCenter = UNUserNotificationCenter.current() let notificationCenter = UNUserNotificationCenter.current()
let notificationContent = UNMutableNotificationContent() let notificationContent = UNMutableNotificationContent()
notificationContent.title = String(localized: "signed_notification_title_\(provenance.origin.displayName)") notificationContent.title = String(localized: "signed_notification_title_\(provenance.origin.displayName)")
@ -67,19 +74,21 @@ class Notifier {
notificationContent.userInfo[Constants.persistSecretIDKey] = secret.id.description notificationContent.userInfo[Constants.persistSecretIDKey] = secret.id.description
notificationContent.userInfo[Constants.persistStoreIDKey] = store.id.description notificationContent.userInfo[Constants.persistStoreIDKey] = store.id.description
notificationContent.interruptionLevel = .timeSensitive notificationContent.interruptionLevel = .timeSensitive
if secret.requiresAuthentication && store.existingPersistedAuthenticationContext(secret: secret) == nil { if await store.existingPersistedAuthenticationContext(secret: secret) == nil && secret.requiresAuthentication {
notificationContent.categoryIdentifier = Constants.persistAuthenticationCategoryIdentitifier notificationContent.categoryIdentifier = Constants.persistAuthenticationCategoryIdentitifier
} }
if let iconURL = provenance.origin.iconURL, let attachment = try? UNNotificationAttachment(identifier: "icon", url: iconURL, options: nil) { if let iconURL = provenance.origin.iconURL, let attachment = try? UNNotificationAttachment(identifier: "icon", url: iconURL, options: nil) {
notificationContent.attachments = [attachment] notificationContent.attachments = [attachment]
} }
let request = UNNotificationRequest(identifier: UUID().uuidString, content: notificationContent, trigger: nil) let request = UNNotificationRequest(identifier: UUID().uuidString, content: notificationContent, trigger: nil)
notificationCenter.add(request, withCompletionHandler: nil) try? await notificationCenter.add(request)
} }
func notify(update: Release, ignore: ((Release) -> Void)?) { func notify(update: Release, ignore: ((Release) -> Void)?) {
notificationDelegate.release = update notificationDelegate.state.withLock { [update] state in
notificationDelegate.ignore = ignore state.release = update
// state.ignore = ignore
}
let notificationCenter = UNUserNotificationCenter.current() let notificationCenter = UNUserNotificationCenter.current()
let notificationContent = UNMutableNotificationContent() let notificationContent = UNMutableNotificationContent()
if update.critical { if update.critical {
@ -99,11 +108,11 @@ class Notifier {
extension Notifier: SigningWitness { extension Notifier: SigningWitness {
func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws { func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws {
} }
func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws { func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws {
notify(accessTo: secret, from: store, by: provenance) await notify(accessTo: secret, from: store, by: provenance)
} }
} }
@ -129,55 +138,66 @@ extension Notifier {
} }
class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate { final class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate, Sendable {
fileprivate var release: Release?
fileprivate var ignore: ((Release) -> Void)?
fileprivate var persistAuthentication: ((AnySecret, AnySecretStore, TimeInterval?) -> Void)?
fileprivate var persistOptions: [String: TimeInterval] = [:]
fileprivate var pendingPersistableStores: [String: AnySecretStore] = [:]
fileprivate var pendingPersistableSecrets: [String: AnySecret] = [:]
struct State {
typealias PersistAuthentication = ((AnySecret, AnySecretStore, TimeInterval?) async -> Void)
typealias Ignore = ((Release) -> Void)
fileprivate var release: Release?
fileprivate var ignore: Ignore?
fileprivate var persistAuthentication: PersistAuthentication?
fileprivate var persistOptions: [String: TimeInterval] = [:]
fileprivate var pendingPersistableStores: [String: AnySecretStore] = [:]
fileprivate var pendingPersistableSecrets: [String: AnySecret] = [:]
}
fileprivate let state: Mutex<State> = .init(.init())
func userNotificationCenter(_ center: UNUserNotificationCenter, openSettingsFor notification: UNNotification?) { func userNotificationCenter(_ center: UNUserNotificationCenter, openSettingsFor notification: UNNotification?) {
} }
func userNotificationCenter(_ center: UNUserNotificationCenter, didReceive response: UNNotificationResponse, withCompletionHandler completionHandler: @escaping () -> Void) { func userNotificationCenter(_ center: UNUserNotificationCenter, didReceive response: UNNotificationResponse) async {
let category = response.notification.request.content.categoryIdentifier let category = response.notification.request.content.categoryIdentifier
switch category { switch category {
case Notifier.Constants.updateCategoryIdentitifier: case Notifier.Constants.updateCategoryIdentitifier:
handleUpdateResponse(response: response) handleUpdateResponse(response: response)
case Notifier.Constants.persistAuthenticationCategoryIdentitifier: case Notifier.Constants.persistAuthenticationCategoryIdentitifier:
handlePersistAuthenticationResponse(response: response) await handlePersistAuthenticationResponse(response: response)
default: default:
break break
} }
completionHandler()
} }
func handleUpdateResponse(response: UNNotificationResponse) { func handleUpdateResponse(response: UNNotificationResponse) {
guard let update = release else { return } state.withLock { state in
switch response.actionIdentifier { guard let update = state.release else { return }
case Notifier.Constants.updateActionIdentitifier, UNNotificationDefaultActionIdentifier: switch response.actionIdentifier {
NSWorkspace.shared.open(update.html_url) case Notifier.Constants.updateActionIdentitifier, UNNotificationDefaultActionIdentifier:
case Notifier.Constants.ignoreActionIdentitifier: NSWorkspace.shared.open(update.html_url)
ignore?(update) case Notifier.Constants.ignoreActionIdentitifier:
default: state.ignore?(update)
fatalError() default:
fatalError()
}
} }
} }
func handlePersistAuthenticationResponse(response: UNNotificationResponse) { func handlePersistAuthenticationResponse(response: UNNotificationResponse) async {
guard let secretID = response.notification.request.content.userInfo[Notifier.Constants.persistSecretIDKey] as? String, let secret = pendingPersistableSecrets[secretID], // let (secret, store, persistOptions, callback): (AnySecret?, AnySecretStore?, TimeInterval?, State.PersistAuthentication?) = state.withLock { state in
let storeID = response.notification.request.content.userInfo[Notifier.Constants.persistStoreIDKey] as? String, let store = pendingPersistableStores[storeID] // guard let secretID = response.notification.request.content.userInfo[Notifier.Constants.persistSecretIDKey] as? String, let secret = state.pendingPersistableSecrets[secretID],
else { return } // let storeID = response.notification.request.content.userInfo[Notifier.Constants.persistStoreIDKey] as? String, let store = state.pendingPersistableStores[storeID]
pendingPersistableSecrets[secretID] = nil // else { return (nil, nil, nil, nil) }
persistAuthentication?(secret, store, persistOptions[response.actionIdentifier]) // state.pendingPersistableSecrets[secretID] = nil
// return (secret, store, state.persistOptions[response.actionIdentifier], state.persistAuthentication)
// }
// guard let secret, let store, let persistOptions else { return }
// await callback?(secret, store, persistOptions)
} }
func userNotificationCenter(_ center: UNUserNotificationCenter, willPresent notification: UNNotification, withCompletionHandler completionHandler: @escaping (UNNotificationPresentationOptions) -> Void) {
completionHandler([.list, .banner]) func userNotificationCenter(_ center: UNUserNotificationCenter, willPresent notification: UNNotification) async -> UNNotificationPresentationOptions {
[.list, .banner]
} }
} }

167
Sources/Secretive.xcodeproj/project.pbxproj
View File

@ -30,7 +30,6 @@
50617D8523FCE48E0099B055 /* ContentView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50617D8423FCE48E0099B055 /* ContentView.swift */; }; 50617D8523FCE48E0099B055 /* ContentView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50617D8423FCE48E0099B055 /* ContentView.swift */; };
50617D8723FCE48E0099B055 /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 50617D8623FCE48E0099B055 /* Assets.xcassets */; }; 50617D8723FCE48E0099B055 /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 50617D8623FCE48E0099B055 /* Assets.xcassets */; };
50617D8A23FCE48E0099B055 /* Preview Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 50617D8923FCE48E0099B055 /* Preview Assets.xcassets */; }; 50617D8A23FCE48E0099B055 /* Preview Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 50617D8923FCE48E0099B055 /* Preview Assets.xcassets */; };
50617D9923FCE48E0099B055 /* SecretiveTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50617D9823FCE48E0099B055 /* SecretiveTests.swift */; };
50617DD223FCEFA90099B055 /* PreviewStore.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50617DD123FCEFA90099B055 /* PreviewStore.swift */; }; 50617DD223FCEFA90099B055 /* PreviewStore.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50617DD123FCEFA90099B055 /* PreviewStore.swift */; };
5065E313295517C500E16645 /* ToolbarButtonStyle.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5065E312295517C500E16645 /* ToolbarButtonStyle.swift */; }; 5065E313295517C500E16645 /* ToolbarButtonStyle.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5065E312295517C500E16645 /* ToolbarButtonStyle.swift */; };
5066A6C22516F303004B5A36 /* SetupView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5066A6C12516F303004B5A36 /* SetupView.swift */; }; 5066A6C22516F303004B5A36 /* SetupView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5066A6C12516F303004B5A36 /* SetupView.swift */; };
@ -63,13 +62,6 @@
remoteGlobalIDString = 50A3B78924026B7500D209EA; remoteGlobalIDString = 50A3B78924026B7500D209EA;
remoteInfo = SecretAgent; remoteInfo = SecretAgent;
}; };
50617D9523FCE48E0099B055 /* PBXContainerItemProxy */ = {
isa = PBXContainerItemProxy;
containerPortal = 50617D7723FCE48D0099B055 /* Project object */;
proxyType = 1;
remoteGlobalIDString = 50617D7E23FCE48D0099B055;
remoteInfo = Secretive;
};
/* End PBXContainerItemProxy section */ /* End PBXContainerItemProxy section */
/* Begin PBXCopyFilesBuildPhase section */ /* Begin PBXCopyFilesBuildPhase section */
@ -123,9 +115,6 @@
50617D8923FCE48E0099B055 /* Preview Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = "Preview Assets.xcassets"; sourceTree = "<group>"; }; 50617D8923FCE48E0099B055 /* Preview Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = "Preview Assets.xcassets"; sourceTree = "<group>"; };
50617D8E23FCE48E0099B055 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; }; 50617D8E23FCE48E0099B055 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
50617D8F23FCE48E0099B055 /* Secretive.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = Secretive.entitlements; sourceTree = "<group>"; }; 50617D8F23FCE48E0099B055 /* Secretive.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = Secretive.entitlements; sourceTree = "<group>"; };
50617D9423FCE48E0099B055 /* SecretiveTests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = SecretiveTests.xctest; sourceTree = BUILT_PRODUCTS_DIR; };
50617D9823FCE48E0099B055 /* SecretiveTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SecretiveTests.swift; sourceTree = "<group>"; };
50617D9A23FCE48E0099B055 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
50617DD123FCEFA90099B055 /* PreviewStore.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = PreviewStore.swift; sourceTree = "<group>"; }; 50617DD123FCEFA90099B055 /* PreviewStore.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = PreviewStore.swift; sourceTree = "<group>"; };
5065E312295517C500E16645 /* ToolbarButtonStyle.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ToolbarButtonStyle.swift; sourceTree = "<group>"; }; 5065E312295517C500E16645 /* ToolbarButtonStyle.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ToolbarButtonStyle.swift; sourceTree = "<group>"; };
5066A6C12516F303004B5A36 /* SetupView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SetupView.swift; sourceTree = "<group>"; }; 5066A6C12516F303004B5A36 /* SetupView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SetupView.swift; sourceTree = "<group>"; };
@ -166,13 +155,6 @@
); );
runOnlyForDeploymentPostprocessing = 0; runOnlyForDeploymentPostprocessing = 0;
}; };
50617D9123FCE48E0099B055 /* Frameworks */ = {
isa = PBXFrameworksBuildPhase;
buildActionMask = 2147483647;
files = (
);
runOnlyForDeploymentPostprocessing = 0;
};
50A3B78724026B7500D209EA /* Frameworks */ = { 50A3B78724026B7500D209EA /* Frameworks */ = {
isa = PBXFrameworksBuildPhase; isa = PBXFrameworksBuildPhase;
buildActionMask = 2147483647; buildActionMask = 2147483647;
@ -201,7 +183,6 @@
children = ( children = (
5003EF39278005C800DF2006 /* Packages */, 5003EF39278005C800DF2006 /* Packages */,
50617D8123FCE48E0099B055 /* Secretive */, 50617D8123FCE48E0099B055 /* Secretive */,
50617D9723FCE48E0099B055 /* SecretiveTests */,
50A3B78B24026B7500D209EA /* SecretAgent */, 50A3B78B24026B7500D209EA /* SecretAgent */,
508A58AF241E144C0069DC07 /* Config */, 508A58AF241E144C0069DC07 /* Config */,
50617D8023FCE48E0099B055 /* Products */, 50617D8023FCE48E0099B055 /* Products */,
@ -213,7 +194,6 @@
isa = PBXGroup; isa = PBXGroup;
children = ( children = (
50617D7F23FCE48E0099B055 /* Secretive.app */, 50617D7F23FCE48E0099B055 /* Secretive.app */,
50617D9423FCE48E0099B055 /* SecretiveTests.xctest */,
50A3B78A24026B7500D209EA /* SecretAgent.app */, 50A3B78A24026B7500D209EA /* SecretAgent.app */,
); );
name = Products; name = Products;
@ -248,15 +228,6 @@
path = "Preview Content"; path = "Preview Content";
sourceTree = "<group>"; sourceTree = "<group>";
}; };
50617D9723FCE48E0099B055 /* SecretiveTests */ = {
isa = PBXGroup;
children = (
50617D9823FCE48E0099B055 /* SecretiveTests.swift */,
50617D9A23FCE48E0099B055 /* Info.plist */,
);
path = SecretiveTests;
sourceTree = "<group>";
};
508A58AF241E144C0069DC07 /* Config */ = { 508A58AF241E144C0069DC07 /* Config */ = {
isa = PBXGroup; isa = PBXGroup;
children = ( children = (
@ -357,24 +328,6 @@
productReference = 50617D7F23FCE48E0099B055 /* Secretive.app */; productReference = 50617D7F23FCE48E0099B055 /* Secretive.app */;
productType = "com.apple.product-type.application"; productType = "com.apple.product-type.application";
}; };
50617D9323FCE48E0099B055 /* SecretiveTests */ = {
isa = PBXNativeTarget;
buildConfigurationList = 50617DA023FCE48E0099B055 /* Build configuration list for PBXNativeTarget "SecretiveTests" */;
buildPhases = (
50617D9023FCE48E0099B055 /* Sources */,
50617D9123FCE48E0099B055 /* Frameworks */,
50617D9223FCE48E0099B055 /* Resources */,
);
buildRules = (
);
dependencies = (
50617D9623FCE48E0099B055 /* PBXTargetDependency */,
);
name = SecretiveTests;
productName = SecretiveTests;
productReference = 50617D9423FCE48E0099B055 /* SecretiveTests.xctest */;
productType = "com.apple.product-type.bundle.unit-test";
};
50A3B78924026B7500D209EA /* SecretAgent */ = { 50A3B78924026B7500D209EA /* SecretAgent */ = {
isa = PBXNativeTarget; isa = PBXNativeTarget;
buildConfigurationList = 50A3B79A24026B7600D209EA /* Build configuration list for PBXNativeTarget "SecretAgent" */; buildConfigurationList = 50A3B79A24026B7600D209EA /* Build configuration list for PBXNativeTarget "SecretAgent" */;
@ -413,10 +366,6 @@
50617D7E23FCE48D0099B055 = { 50617D7E23FCE48D0099B055 = {
CreatedOnToolsVersion = 11.3; CreatedOnToolsVersion = 11.3;
}; };
50617D9323FCE48E0099B055 = {
CreatedOnToolsVersion = 11.3;
TestTargetID = 50617D7E23FCE48D0099B055;
};
50A3B78924026B7500D209EA = { 50A3B78924026B7500D209EA = {
CreatedOnToolsVersion = 11.4; CreatedOnToolsVersion = 11.4;
}; };
@ -443,7 +392,6 @@
projectRoot = ""; projectRoot = "";
targets = ( targets = (
50617D7E23FCE48D0099B055 /* Secretive */, 50617D7E23FCE48D0099B055 /* Secretive */,
50617D9323FCE48E0099B055 /* SecretiveTests */,
50A3B78924026B7500D209EA /* SecretAgent */, 50A3B78924026B7500D209EA /* SecretAgent */,
); );
}; };
@ -462,13 +410,6 @@
); );
runOnlyForDeploymentPostprocessing = 0; runOnlyForDeploymentPostprocessing = 0;
}; };
50617D9223FCE48E0099B055 /* Resources */ = {
isa = PBXResourcesBuildPhase;
buildActionMask = 2147483647;
files = (
);
runOnlyForDeploymentPostprocessing = 0;
};
50A3B78824026B7500D209EA /* Resources */ = { 50A3B78824026B7500D209EA /* Resources */ = {
isa = PBXResourcesBuildPhase; isa = PBXResourcesBuildPhase;
buildActionMask = 2147483647; buildActionMask = 2147483647;
@ -514,14 +455,6 @@
); );
runOnlyForDeploymentPostprocessing = 0; runOnlyForDeploymentPostprocessing = 0;
}; };
50617D9023FCE48E0099B055 /* Sources */ = {
isa = PBXSourcesBuildPhase;
buildActionMask = 2147483647;
files = (
50617D9923FCE48E0099B055 /* SecretiveTests.swift in Sources */,
);
runOnlyForDeploymentPostprocessing = 0;
};
50A3B78624026B7500D209EA /* Sources */ = { 50A3B78624026B7500D209EA /* Sources */ = {
isa = PBXSourcesBuildPhase; isa = PBXSourcesBuildPhase;
buildActionMask = 2147483647; buildActionMask = 2147483647;
@ -539,11 +472,6 @@
target = 50A3B78924026B7500D209EA /* SecretAgent */; target = 50A3B78924026B7500D209EA /* SecretAgent */;
targetProxy = 50142166278126B500BBAA70 /* PBXContainerItemProxy */; targetProxy = 50142166278126B500BBAA70 /* PBXContainerItemProxy */;
}; };
50617D9623FCE48E0099B055 /* PBXTargetDependency */ = {
isa = PBXTargetDependency;
target = 50617D7E23FCE48D0099B055 /* Secretive */;
targetProxy = 50617D9523FCE48E0099B055 /* PBXContainerItemProxy */;
};
/* End PBXTargetDependency section */ /* End PBXTargetDependency section */
/* Begin PBXVariantGroup section */ /* Begin PBXVariantGroup section */
@ -610,7 +538,7 @@
GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE; GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
GCC_WARN_UNUSED_FUNCTION = YES; GCC_WARN_UNUSED_FUNCTION = YES;
GCC_WARN_UNUSED_VARIABLE = YES; GCC_WARN_UNUSED_VARIABLE = YES;
MACOSX_DEPLOYMENT_TARGET = 11.0; MACOSX_DEPLOYMENT_TARGET = 15.0;
MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE; MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
MTL_FAST_MATH = YES; MTL_FAST_MATH = YES;
ONLY_ACTIVE_ARCH = YES; ONLY_ACTIVE_ARCH = YES;
@ -621,6 +549,7 @@
SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG; SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG;
SWIFT_EMIT_LOC_STRINGS = YES; SWIFT_EMIT_LOC_STRINGS = YES;
SWIFT_OPTIMIZATION_LEVEL = "-Onone"; SWIFT_OPTIMIZATION_LEVEL = "-Onone";
SWIFT_VERSION = 6.0;
}; };
name = Debug; name = Debug;
}; };
@ -670,7 +599,7 @@
GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE; GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
GCC_WARN_UNUSED_FUNCTION = YES; GCC_WARN_UNUSED_FUNCTION = YES;
GCC_WARN_UNUSED_VARIABLE = YES; GCC_WARN_UNUSED_VARIABLE = YES;
MACOSX_DEPLOYMENT_TARGET = 11.0; MACOSX_DEPLOYMENT_TARGET = 15.0;
MTL_ENABLE_DEBUG_INFO = NO; MTL_ENABLE_DEBUG_INFO = NO;
MTL_FAST_MATH = YES; MTL_FAST_MATH = YES;
OTHER_SWIFT_FLAGS = ""; OTHER_SWIFT_FLAGS = "";
@ -680,6 +609,7 @@
SWIFT_COMPILATION_MODE = wholemodule; SWIFT_COMPILATION_MODE = wholemodule;
SWIFT_EMIT_LOC_STRINGS = YES; SWIFT_EMIT_LOC_STRINGS = YES;
SWIFT_OPTIMIZATION_LEVEL = "-O"; SWIFT_OPTIMIZATION_LEVEL = "-O";
SWIFT_VERSION = 6.0;
}; };
name = Release; name = Release;
}; };
@ -702,12 +632,10 @@
"$(inherited)", "$(inherited)",
"@executable_path/../Frameworks", "@executable_path/../Frameworks",
); );
MACOSX_DEPLOYMENT_TARGET = 12.0;
MARKETING_VERSION = 1; MARKETING_VERSION = 1;
PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.Host; PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.Host;
PRODUCT_NAME = "$(TARGET_NAME)"; PRODUCT_NAME = "$(TARGET_NAME)";
PROVISIONING_PROFILE_SPECIFIER = ""; PROVISIONING_PROFILE_SPECIFIER = "";
SWIFT_VERSION = 5.0;
}; };
name = Debug; name = Debug;
}; };
@ -730,54 +658,10 @@
"$(inherited)", "$(inherited)",
"@executable_path/../Frameworks", "@executable_path/../Frameworks",
); );
MACOSX_DEPLOYMENT_TARGET = 12.0;
MARKETING_VERSION = 1; MARKETING_VERSION = 1;
PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.Host; PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.Host;
PRODUCT_NAME = "$(TARGET_NAME)"; PRODUCT_NAME = "$(TARGET_NAME)";
PROVISIONING_PROFILE_SPECIFIER = "Secretive - Host"; PROVISIONING_PROFILE_SPECIFIER = "Secretive - Host";
SWIFT_VERSION = 5.0;
};
name = Release;
};
50617DA123FCE48E0099B055 /* Debug */ = {
isa = XCBuildConfiguration;
buildSettings = {
ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES;
BUNDLE_LOADER = "$(TEST_HOST)";
CODE_SIGN_STYLE = Automatic;
COMBINE_HIDPI_IMAGES = YES;
DEVELOPMENT_TEAM = Z72PRUAWF6;
INFOPLIST_FILE = SecretiveTests/Info.plist;
LD_RUNPATH_SEARCH_PATHS = (
"$(inherited)",
"@executable_path/../Frameworks",
"@loader_path/../Frameworks",
);
PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.SecretiveTests;
PRODUCT_NAME = "$(TARGET_NAME)";
SWIFT_VERSION = 5.0;
TEST_HOST = "$(BUILT_PRODUCTS_DIR)/Secretive.app/Contents/MacOS/Secretive";
};
name = Debug;
};
50617DA223FCE48E0099B055 /* Release */ = {
isa = XCBuildConfiguration;
buildSettings = {
ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES;
BUNDLE_LOADER = "$(TEST_HOST)";
CODE_SIGN_STYLE = Automatic;
COMBINE_HIDPI_IMAGES = YES;
DEVELOPMENT_TEAM = Z72PRUAWF6;
INFOPLIST_FILE = SecretiveTests/Info.plist;
LD_RUNPATH_SEARCH_PATHS = (
"$(inherited)",
"@executable_path/../Frameworks",
"@loader_path/../Frameworks",
);
PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.SecretiveTests;
PRODUCT_NAME = "$(TARGET_NAME)";
SWIFT_VERSION = 5.0;
TEST_HOST = "$(BUILT_PRODUCTS_DIR)/Secretive.app/Contents/MacOS/Secretive";
}; };
name = Release; name = Release;
}; };
@ -833,7 +717,7 @@
GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE; GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
GCC_WARN_UNUSED_FUNCTION = YES; GCC_WARN_UNUSED_FUNCTION = YES;
GCC_WARN_UNUSED_VARIABLE = YES; GCC_WARN_UNUSED_VARIABLE = YES;
MACOSX_DEPLOYMENT_TARGET = 11.0; MACOSX_DEPLOYMENT_TARGET = 15.0;
MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE; MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
MTL_FAST_MATH = YES; MTL_FAST_MATH = YES;
ONLY_ACTIVE_ARCH = YES; ONLY_ACTIVE_ARCH = YES;
@ -844,6 +728,7 @@
SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG; SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG;
SWIFT_EMIT_LOC_STRINGS = YES; SWIFT_EMIT_LOC_STRINGS = YES;
SWIFT_OPTIMIZATION_LEVEL = "-Onone"; SWIFT_OPTIMIZATION_LEVEL = "-Onone";
SWIFT_VERSION = 6.0;
}; };
name = Test; name = Test;
}; };
@ -863,33 +748,9 @@
"$(inherited)", "$(inherited)",
"@executable_path/../Frameworks", "@executable_path/../Frameworks",
); );
MACOSX_DEPLOYMENT_TARGET = 12.0;
MARKETING_VERSION = 1; MARKETING_VERSION = 1;
PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.Host; PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.Host;
PRODUCT_NAME = "$(TARGET_NAME)"; PRODUCT_NAME = "$(TARGET_NAME)";
SWIFT_VERSION = 5.0;
};
name = Test;
};
508A5916241EF1A00069DC07 /* Test */ = {
isa = XCBuildConfiguration;
buildSettings = {
ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES;
BUNDLE_LOADER = "$(TEST_HOST)";
CODE_SIGN_IDENTITY = "-";
CODE_SIGN_STYLE = Manual;
COMBINE_HIDPI_IMAGES = YES;
INFOPLIST_FILE = SecretiveTests/Info.plist;
LD_RUNPATH_SEARCH_PATHS = (
"$(inherited)",
"@executable_path/../Frameworks",
"@loader_path/../Frameworks",
);
PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.SecretiveTests;
PRODUCT_NAME = "$(TARGET_NAME)";
PROVISIONING_PROFILE_SPECIFIER = "";
SWIFT_VERSION = 5.0;
TEST_HOST = "$(BUILT_PRODUCTS_DIR)/Secretive.app/Contents/MacOS/Secretive";
}; };
name = Test; name = Test;
}; };
@ -907,11 +768,9 @@
"$(inherited)", "$(inherited)",
"@executable_path/../Frameworks", "@executable_path/../Frameworks",
); );
MACOSX_DEPLOYMENT_TARGET = 12.0;
MARKETING_VERSION = 1; MARKETING_VERSION = 1;
PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgent; PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgent;
PRODUCT_NAME = "$(TARGET_NAME)"; PRODUCT_NAME = "$(TARGET_NAME)";
SWIFT_VERSION = 5.0;
}; };
name = Test; name = Test;
}; };
@ -931,11 +790,9 @@
"$(inherited)", "$(inherited)",
"@executable_path/../Frameworks", "@executable_path/../Frameworks",
); );
MACOSX_DEPLOYMENT_TARGET = 12.0;
MARKETING_VERSION = 1; MARKETING_VERSION = 1;
PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgent; PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgent;
PRODUCT_NAME = "$(TARGET_NAME)"; PRODUCT_NAME = "$(TARGET_NAME)";
SWIFT_VERSION = 5.0;
}; };
name = Debug; name = Debug;
}; };
@ -956,12 +813,10 @@
"$(inherited)", "$(inherited)",
"@executable_path/../Frameworks", "@executable_path/../Frameworks",
); );
MACOSX_DEPLOYMENT_TARGET = 12.0;
MARKETING_VERSION = 1; MARKETING_VERSION = 1;
PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgent; PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgent;
PRODUCT_NAME = "$(TARGET_NAME)"; PRODUCT_NAME = "$(TARGET_NAME)";
PROVISIONING_PROFILE_SPECIFIER = "Secretive - Secret Agent"; PROVISIONING_PROFILE_SPECIFIER = "Secretive - Secret Agent";
SWIFT_VERSION = 5.0;
}; };
name = Release; name = Release;
}; };
@ -988,16 +843,6 @@
defaultConfigurationIsVisible = 0; defaultConfigurationIsVisible = 0;
defaultConfigurationName = Release; defaultConfigurationName = Release;
}; };
50617DA023FCE48E0099B055 /* Build configuration list for PBXNativeTarget "SecretiveTests" */ = {
isa = XCConfigurationList;
buildConfigurations = (
50617DA123FCE48E0099B055 /* Debug */,
508A5916241EF1A00069DC07 /* Test */,
50617DA223FCE48E0099B055 /* Release */,
);
defaultConfigurationIsVisible = 0;
defaultConfigurationName = Release;
};
50A3B79A24026B7600D209EA /* Build configuration list for PBXNativeTarget "SecretAgent" */ = { 50A3B79A24026B7600D209EA /* Build configuration list for PBXNativeTarget "SecretAgent" */ = {
isa = XCConfigurationList; isa = XCConfigurationList;
buildConfigurations = ( buildConfigurations = (

37
Sources/Secretive/App.swift
View File

@ -5,9 +5,20 @@ import SecureEnclaveSecretKit
import SmartCardSecretKit import SmartCardSecretKit
import Brief import Brief
extension EnvironmentValues {
@Entry var secretStoreList: SecretStoreList = {
let list = SecretStoreList()
list.add(store: SecureEnclave.Store())
list.add(store: SmartCard.Store())
return list
}()
@Entry var agentStatusChecker: any AgentStatusCheckerProtocol = AgentStatusChecker()
@Entry var updater: any UpdaterProtocol = Updater(checkOnLaunch: false)
}
@main @main
struct Secretive: App { struct Secretive: App {
private let storeList: SecretStoreList = { private let storeList: SecretStoreList = {
let list = SecretStoreList() let list = SecretStoreList()
list.add(store: SecureEnclave.Store()) list.add(store: SecureEnclave.Store())
@ -23,10 +34,10 @@ struct Secretive: App {
@SceneBuilder var body: some Scene { @SceneBuilder var body: some Scene {
WindowGroup { WindowGroup {
ContentView<Updater, AgentStatusChecker>(showingCreation: $showingCreation, runningSetup: $showingSetup, hasRunSetup: $hasRunSetup) ContentView(showingCreation: $showingCreation, runningSetup: $showingSetup, hasRunSetup: $hasRunSetup)
.environmentObject(storeList) .environment(storeList)
.environmentObject(Updater(checkOnLaunch: hasRunSetup)) .environment(Updater(checkOnLaunch: hasRunSetup))
.environmentObject(agentStatusChecker) .environment(agentStatusChecker)
.onAppear { .onAppear {
if !hasRunSetup { if !hasRunSetup {
showingSetup = true showingSetup = true
@ -70,13 +81,12 @@ extension Secretive {
private func reinstallAgent() { private func reinstallAgent() {
justUpdatedChecker.check() justUpdatedChecker.check()
LaunchAgentController().install { Task {
// Wait a second for launchd to kick in (next runloop isn't enough). await LaunchAgentController().install()
DispatchQueue.main.asyncAfter(deadline: .now() + 1) { try? await Task.sleep(for: .seconds(1))
agentStatusChecker.check() agentStatusChecker.check()
if !agentStatusChecker.running { if !agentStatusChecker.running {
forceLaunchAgent() forceLaunchAgent()
}
} }
} }
} }
@ -84,7 +94,8 @@ extension Secretive {
private func forceLaunchAgent() { private func forceLaunchAgent() {
// We've run setup, we didn't just update, launchd is just not doing it's thing. // We've run setup, we didn't just update, launchd is just not doing it's thing.
// Force a launch directly. // Force a launch directly.
LaunchAgentController().forceLaunch { _ in Task {
_ = await LaunchAgentController().forceLaunch()
agentStatusChecker.check() agentStatusChecker.check()
} }
} }

7
Sources/Secretive/Controllers/AgentStatusChecker.swift
View File

@ -2,15 +2,16 @@ import Foundation
import Combine import Combine
import AppKit import AppKit
import SecretKit import SecretKit
import Observation
protocol AgentStatusCheckerProtocol: ObservableObject { protocol AgentStatusCheckerProtocol: Observable {
var running: Bool { get } var running: Bool { get }
var developmentBuild: Bool { get } var developmentBuild: Bool { get }
} }
class AgentStatusChecker: ObservableObject, AgentStatusCheckerProtocol { @Observable class AgentStatusChecker: AgentStatusCheckerProtocol {
@Published var running: Bool = false var running: Bool = false
init() { init() {
check() check()

37
Sources/Secretive/Controllers/LaunchAgentController.swift
View File

@ -8,38 +8,45 @@ struct LaunchAgentController {
private let logger = Logger(subsystem: "com.maxgoedjen.secretive", category: "LaunchAgentController") private let logger = Logger(subsystem: "com.maxgoedjen.secretive", category: "LaunchAgentController")
func install(completion: (() -> Void)? = nil) { func install() async {
logger.debug("Installing agent") logger.debug("Installing agent")
_ = setEnabled(false) _ = setEnabled(false)
// This is definitely a bit of a "seems to work better" thing but: // This is definitely a bit of a "seems to work better" thing but:
// Seems to more reliably hit if these are on separate runloops, otherwise it seems like it sometimes doesn't kill old // Seems to more reliably hit if these are on separate runloops, otherwise it seems like it sometimes doesn't kill old
// and start new? // and start new?
DispatchQueue.main.asyncAfter(deadline: .now() + 0.1) { try? await Task.sleep(for: .seconds(1))
await MainActor.run {
_ = setEnabled(true) _ = setEnabled(true)
completion?()
} }
} }
func forceLaunch(completion: ((Bool) -> Void)?) { func forceLaunch() async -> Bool {
logger.debug("Agent is not running, attempting to force launch") logger.debug("Agent is not running, attempting to force launch")
let url = Bundle.main.bundleURL.appendingPathComponent("Contents/Library/LoginItems/SecretAgent.app") let url = Bundle.main.bundleURL.appendingPathComponent("Contents/Library/LoginItems/SecretAgent.app")
let config = NSWorkspace.OpenConfiguration() let config = NSWorkspace.OpenConfiguration()
config.activates = false config.activates = false
NSWorkspace.shared.openApplication(at: url, configuration: config) { app, error in do {
DispatchQueue.main.async { try await NSWorkspace.shared.openApplication(at: url, configuration: config)
completion?(error == nil) logger.debug("Agent force launched")
} return true
if let error = error { } catch {
logger.error("Error force launching \(error.localizedDescription)") logger.error("Error force launching \(error.localizedDescription)")
} else { return false
logger.debug("Agent force launched")
}
} }
} }
private func setEnabled(_ enabled: Bool) -> Bool { private func setEnabled(_ enabled: Bool) -> Bool {
SMLoginItemSetEnabled(Bundle.main.agentBundleID as CFString, enabled) let service = SMAppService.loginItem(identifier: Bundle.main.agentBundleID)
do {
if enabled {
try service.register()
} else {
try service.unregister()
}
return true
} catch {
return false
}
} }
} }

132
Sources/Secretive/Preview Content/PreviewStore.swift
View File

@ -18,69 +18,69 @@ extension Preview {
} }
extension Preview { //extension Preview {
//
class Store: SecretStore, ObservableObject { // class Store: SecretStore, ObservableObject {
//
let isAvailable = true // let isAvailable = true
let id = UUID() // let id = UUID()
var name: String { "Preview Store" } // var name: String { "Preview Store" }
@Published var secrets: [Secret] = [] // @Published var secrets: [Secret] = []
//
init(secrets: [Secret]) { // init(secrets: [Secret]) {
self.secrets.append(contentsOf: secrets) // self.secrets.append(contentsOf: secrets)
} // }
//
init(numberOfRandomSecrets: Int = 5) { // init(numberOfRandomSecrets: Int = 5) {
let new = (0..<numberOfRandomSecrets).map { Secret(name: String(describing: $0)) } // let new = (0..<numberOfRandomSecrets).map { Secret(name: String(describing: $0)) }
self.secrets.append(contentsOf: new) // self.secrets.append(contentsOf: new)
} // }
//
func sign(data: Data, with secret: Preview.Secret, for provenance: SigningRequestProvenance) throws -> Data { // func sign(data: Data, with secret: Preview.Secret, for provenance: SigningRequestProvenance) throws -> Data {
return data // return data
} // }
//
func verify(signature data: Data, for signature: Data, with secret: Preview.Secret) throws -> Bool { // func verify(signature data: Data, for signature: Data, with secret: Preview.Secret) throws -> Bool {
true // true
} // }
//
func existingPersistedAuthenticationContext(secret: Preview.Secret) -> PersistedAuthenticationContext? { // func existingPersistedAuthenticationContext(secret: Preview.Secret) -> PersistedAuthenticationContext? {
nil // nil
} // }
//
func persistAuthentication(secret: Preview.Secret, forDuration duration: TimeInterval) throws { // func persistAuthentication(secret: Preview.Secret, forDuration duration: TimeInterval) throws {
} // }
//
func reloadSecrets() { // func reloadSecrets() {
} // }
//
} // }
//
class StoreModifiable: Store, SecretStoreModifiable { // class StoreModifiable: Store, SecretStoreModifiable {
override var name: String { "Modifiable Preview Store" } // override var name: String { "Modifiable Preview Store" }
//
func create(name: String, requiresAuthentication: Bool) throws { // func create(name: String, requiresAuthentication: Bool) throws {
} // }
//
func delete(secret: Preview.Secret) throws { // func delete(secret: Preview.Secret) throws {
} // }
//
func update(secret: Preview.Secret, name: String) throws { // func update(secret: Preview.Secret, name: String) throws {
} // }
} // }
} //}
//
extension Preview { //extension Preview {
//
static func storeList(stores: [Store] = [], modifiableStores: [StoreModifiable] = []) -> SecretStoreList { // static func storeList(stores: [Store] = [], modifiableStores: [StoreModifiable] = []) -> SecretStoreList {
let list = SecretStoreList() // let list = SecretStoreList()
for store in stores { // for store in stores {
list.add(store: store) // list.add(store: store)
} // }
for storeModifiable in modifiableStores { // for storeModifiable in modifiableStores {
list.add(store: storeModifiable) // list.add(store: storeModifiable)
} // }
return list // return list
} // }
//
} //}

24
Sources/Secretive/Preview Content/PreviewUpdater.swift
View File

@ -1,20 +1,32 @@
import Foundation import Foundation
import Combine import Synchronization
import Observation
import Brief import Brief
class PreviewUpdater: UpdaterProtocol { @Observable class PreviewUpdater: UpdaterProtocol {
var update: Release? {
_update.withLock { $0 }
}
let _update: Mutex<Release?> = .init(nil)
let update: Release?
let testBuild = false let testBuild = false
init(update: Update = .none) { init(update: Update = .none) {
switch update { switch update {
case .none: case .none:
self.update = nil _update.withLock {
$0 = nil
}
case .advisory: case .advisory:
self.update = Release(name: "10.10.10", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Some regular update") _update.withLock {
$0 = Release(name: "10.10.10", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Some regular update")
}
case .critical: case .critical:
self.update = Release(name: "10.10.10", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update") _update.withLock {
$0 = Release(name: "10.10.10", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update")
}
} }
} }

82
Sources/Secretive/Views/ContentView.swift
View File

@ -4,7 +4,7 @@ import SecureEnclaveSecretKit
import SmartCardSecretKit import SmartCardSecretKit
import Brief import Brief
struct ContentView<UpdaterType: UpdaterProtocol, AgentStatusCheckerType: AgentStatusCheckerProtocol>: View { struct ContentView: View {
@Binding var showingCreation: Bool @Binding var showingCreation: Bool
@Binding var runningSetup: Bool @Binding var runningSetup: Bool
@ -13,9 +13,9 @@ struct ContentView<UpdaterType: UpdaterProtocol, AgentStatusCheckerType: AgentSt
@State var activeSecret: AnySecret.ID? @State var activeSecret: AnySecret.ID?
@Environment(\.colorScheme) var colorScheme @Environment(\.colorScheme) var colorScheme
@EnvironmentObject private var storeList: SecretStoreList @Environment(\.secretStoreList) private var storeList: SecretStoreList
@EnvironmentObject private var updater: UpdaterType @Environment(\.updater) private var updater: any UpdaterProtocol
@EnvironmentObject private var agentStatusChecker: AgentStatusCheckerType @Environment(\.agentStatusChecker) private var agentStatusChecker: any AgentStatusCheckerProtocol
@State private var selectedUpdate: Release? @State private var selectedUpdate: Release?
@State private var showingAppPathNotice = false @State private var showingAppPathNotice = false
@ -193,41 +193,41 @@ extension ContentView {
} }
#if DEBUG //#if DEBUG
//
struct ContentView_Previews: PreviewProvider { //struct ContentView_Previews: PreviewProvider {
//
private static let storeList: SecretStoreList = { // private static let storeList: SecretStoreList = {
let list = SecretStoreList() // let list = SecretStoreList()
list.add(store: SecureEnclave.Store()) // list.add(store: SecureEnclave.Store())
list.add(store: SmartCard.Store()) // list.add(store: SmartCard.Store())
return list // return list
}() // }()
private static let agentStatusChecker = AgentStatusChecker() // private static let agentStatusChecker = AgentStatusChecker()
private static let justUpdatedChecker = JustUpdatedChecker() // private static let justUpdatedChecker = JustUpdatedChecker()
//
@State var hasRunSetup = false // @State var hasRunSetup = false
@State private var showingSetup = false // @State private var showingSetup = false
@State private var showingCreation = false // @State private var showingCreation = false
//
static var previews: some View { // static var previews: some View {
Group { // Group {
// Empty on modifiable and nonmodifiable // // Empty on modifiable and nonmodifiable
ContentView<PreviewUpdater, AgentStatusChecker>(showingCreation: .constant(false), runningSetup: .constant(false), hasRunSetup: .constant(true)) // ContentView<PreviewUpdater, AgentStatusChecker>(showingCreation: .constant(false), runningSetup: .constant(false), hasRunSetup: .constant(true))
.environmentObject(Preview.storeList(stores: [Preview.Store(numberOfRandomSecrets: 0)], modifiableStores: [Preview.StoreModifiable(numberOfRandomSecrets: 0)])) // .environmentObject(Preview.storeList(stores: [Preview.Store(numberOfRandomSecrets: 0)], modifiableStores: [Preview.StoreModifiable(numberOfRandomSecrets: 0)]))
.environmentObject(PreviewUpdater()) // .environmentObject(PreviewUpdater())
.environmentObject(agentStatusChecker) // .environmentObject(agentStatusChecker)
//
// 5 items on modifiable and nonmodifiable // // 5 items on modifiable and nonmodifiable
ContentView<PreviewUpdater, AgentStatusChecker>(showingCreation: .constant(false), runningSetup: .constant(false), hasRunSetup: .constant(true)) // ContentView<PreviewUpdater, AgentStatusChecker>(showingCreation: .constant(false), runningSetup: .constant(false), hasRunSetup: .constant(true))
.environmentObject(Preview.storeList(stores: [Preview.Store()], modifiableStores: [Preview.StoreModifiable()])) // .environmentObject(Preview.storeList(stores: [Preview.Store()], modifiableStores: [Preview.StoreModifiable()]))
.environmentObject(PreviewUpdater()) // .environmentObject(PreviewUpdater())
.environmentObject(agentStatusChecker) // .environmentObject(agentStatusChecker)
} // }
.environmentObject(agentStatusChecker) // .environmentObject(agentStatusChecker)
//
} // }
} //}
//
#endif //#endif

46
Sources/Secretive/Views/CreateSecretView.swift
View File

@ -3,7 +3,7 @@ import SecretKit
struct CreateSecretView<StoreType: SecretStoreModifiable>: View { struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
@ObservedObject var store: StoreType @State var store: StoreType
@Binding var showing: Bool @Binding var showing: Bool
@State private var name = "" @State private var name = ""
@ -45,8 +45,10 @@ struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
} }
func save() { func save() {
try! store.create(name: name, requiresAuthentication: requiresAuthentication) Task {
showing = false try! await store.create(name: name, requiresAuthentication: requiresAuthentication)
showing = false
}
} }
} }
@ -93,14 +95,14 @@ struct ThumbnailPickerView<ValueType: Hashable>: View {
extension ThumbnailPickerView { extension ThumbnailPickerView {
struct Item<ValueType: Hashable>: Identifiable { struct Item<InnerValueType: Hashable>: Identifiable {
let id = UUID() let id = UUID()
let value: ValueType let value: InnerValueType
let name: LocalizedStringKey let name: LocalizedStringKey
let description: LocalizedStringKey let description: LocalizedStringKey
let thumbnail: AnyView let thumbnail: AnyView
init<ViewType: View>(value: ValueType, name: LocalizedStringKey, description: LocalizedStringKey, thumbnail: ViewType) { init<ViewType: View>(value: InnerValueType, name: LocalizedStringKey, description: LocalizedStringKey, thumbnail: ViewType) {
self.value = value self.value = value
self.name = name self.name = name
self.description = description self.description = description
@ -230,19 +232,19 @@ struct NotificationView: View {
} }
#if DEBUG //#if DEBUG
//
struct CreateSecretView_Previews: PreviewProvider { //struct CreateSecretView_Previews: PreviewProvider {
//
static var previews: some View { // static var previews: some View {
Group { // Group {
CreateSecretView(store: Preview.StoreModifiable(), showing: .constant(true)) // CreateSecretView(store: Preview.StoreModifiable(), showing: .constant(true))
AuthenticationView().environment(\.colorScheme, .dark) // AuthenticationView().environment(\.colorScheme, .dark)
AuthenticationView().environment(\.colorScheme, .light) // AuthenticationView().environment(\.colorScheme, .light)
NotificationView().environment(\.colorScheme, .dark) // NotificationView().environment(\.colorScheme, .dark)
NotificationView().environment(\.colorScheme, .light) // NotificationView().environment(\.colorScheme, .light)
} // }
} // }
} //}
//
#endif //#endif

8
Sources/Secretive/Views/DeleteSecretView.swift
View File

@ -3,7 +3,7 @@ import SecretKit
struct DeleteSecretView<StoreType: SecretStoreModifiable>: View { struct DeleteSecretView<StoreType: SecretStoreModifiable>: View {
@ObservedObject var store: StoreType @State var store: StoreType
let secret: StoreType.SecretType let secret: StoreType.SecretType
var dismissalBlock: (Bool) -> () var dismissalBlock: (Bool) -> ()
@ -49,8 +49,10 @@ struct DeleteSecretView<StoreType: SecretStoreModifiable>: View {
} }
func delete() { func delete() {
try! store.delete(secret: secret) Task {
dismissalBlock(true) try! await store.delete(secret: secret)
dismissalBlock(true)
}
} }
} }

6
Sources/Secretive/Views/EmptyStoreView.swift
View File

@ -3,7 +3,7 @@ import SecretKit
struct EmptyStoreView: View { struct EmptyStoreView: View {
@ObservedObject var store: AnySecretStore @State var store: AnySecretStore
@Binding var activeSecret: AnySecret.ID? @Binding var activeSecret: AnySecret.ID?
var body: some View { var body: some View {
@ -22,8 +22,8 @@ struct EmptyStoreView: View {
extension EmptyStoreView { extension EmptyStoreView {
enum Constants { enum Constants {
static let emptyStoreModifiableTag: AnyHashable = "emptyStoreModifiableTag" static let emptyStoreModifiableTag = "emptyStoreModifiableTag"
static let emptyStoreTag: AnyHashable = "emptyStoreTag" static let emptyStoreTag = "emptyStoreTag"
} }
} }

8
Sources/Secretive/Views/RenameSecretView.swift
View File

@ -3,7 +3,7 @@ import SecretKit
struct RenameSecretView<StoreType: SecretStoreModifiable>: View { struct RenameSecretView<StoreType: SecretStoreModifiable>: View {
@ObservedObject var store: StoreType @State var store: StoreType
let secret: StoreType.SecretType let secret: StoreType.SecretType
var dismissalBlock: (_ renamed: Bool) -> () var dismissalBlock: (_ renamed: Bool) -> ()
@ -44,7 +44,9 @@ struct RenameSecretView<StoreType: SecretStoreModifiable>: View {
} }
func rename() { func rename() {
try? store.update(secret: secret, name: newName) Task {
dismissalBlock(true) try? await store.update(secret: secret, name: newName)
dismissalBlock(true)
}
} }
} }

18
Sources/Secretive/Views/SecretDetailView.swift
View File

@ -47,12 +47,12 @@ struct SecretDetailView<SecretType: Secret>: View {
} }
#if DEBUG //#if DEBUG
//
struct SecretDetailView_Previews: PreviewProvider { //struct SecretDetailView_Previews: PreviewProvider {
static var previews: some View { // static var previews: some View {
SecretDetailView(secret: Preview.Store(numberOfRandomSecrets: 1).secrets[0]) // SecretDetailView(secret: Preview.Store(numberOfRandomSecrets: 1).secrets[0])
} // }
} //}
//
#endif //#endif

2
Sources/Secretive/Views/SecretListItemView.swift
View File

@ -3,7 +3,7 @@ import SecretKit
struct SecretListItemView: View { struct SecretListItemView: View {
@ObservedObject var store: AnySecretStore @State var store: AnySecretStore
var secret: AnySecret var secret: AnySecret
@Binding var activeSecret: AnySecret.ID? @Binding var activeSecret: AnySecret.ID?

6
Sources/Secretive/Views/SetupView.swift
View File

@ -156,8 +156,10 @@ struct SecretAgentSetupView: View {
} }
func install() { func install() {
LaunchAgentController().install() Task {
buttonAction() await LaunchAgentController().install()
buttonAction()
}
} }
} }

2
Sources/Secretive/Views/StoreListView.swift
View File

@ -6,7 +6,7 @@ struct StoreListView: View {
@Binding var activeSecret: AnySecret.ID? @Binding var activeSecret: AnySecret.ID?
@EnvironmentObject private var storeList: SecretStoreList @Environment(SecretStoreList.self) private var storeList: SecretStoreList
private func secretDeleted(secret: AnySecret) { private func secretDeleted(secret: AnySecret) {
activeSecret = nextDefaultSecret activeSecret = nextDefaultSecret

6
Sources/Secretive/Views/UpdateView.swift
View File

@ -3,7 +3,7 @@ import Brief
struct UpdateDetailView<UpdaterType: Updater>: View { struct UpdateDetailView<UpdaterType: Updater>: View {
@EnvironmentObject var updater: UpdaterType @Environment(UpdaterType.self) var updater: UpdaterType
let update: Release let update: Release
@ -18,7 +18,9 @@ struct UpdateDetailView<UpdaterType: Updater>: View {
HStack { HStack {
if !update.critical { if !update.critical {
Button("update_ignore_button") { Button("update_ignore_button") {
updater.ignore(release: update) Task {
await updater.ignore(release: update)
}
} }
Spacer() Spacer()
} }

22
Sources/SecretiveTests/Info.plist
View File

@ -1,22 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>CFBundleDevelopmentRegion</key>
<string>$(DEVELOPMENT_LANGUAGE)</string>
<key>CFBundleExecutable</key>
<string>$(EXECUTABLE_NAME)</string>
<key>CFBundleIdentifier</key>
<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
<key>CFBundleInfoDictionaryVersion</key>
<string>6.0</string>
<key>CFBundleName</key>
<string>$(PRODUCT_NAME)</string>
<key>CFBundlePackageType</key>
<string>$(PRODUCT_BUNDLE_PACKAGE_TYPE)</string>
<key>CFBundleShortVersionString</key>
<string>1.0</string>
<key>CFBundleVersion</key>
<string>1</string>
</dict>
</plist>

20
Sources/SecretiveTests/SecretiveTests.swift
View File

@ -1,20 +0,0 @@
import XCTest
@testable import Secretive
class SecretiveTests: XCTestCase {
override func setUp() {
// Put setup code here. This method is called before the invocation of each test method in the class.
}
override func tearDown() {
// Put teardown code here. This method is called after the invocation of each test method in the class.
}
func testExample() {
// This is an example of a functional test case.
// Use XCTAssert and related functions to verify your tests produce the correct results.
}
}