external/secretive
1
0
Fork 0
mirror of https://github.com/maxgoedjen/secretive.git synced 2026-09-19 14:48:01 +02:00
Code Issues Projects Releases Wiki Activity

WIP Restrictions support

Browse Source
This commit is contained in:
Max Goedjen
2026-09-06 21:35:24 -07:00
parent 70e32dcf99
commit 45359b5960
7 changed files with 128 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Sources/Packages/Sources/SecretAgentKit/Agent.swift
+17
View File
@@ -152,6 +152,7 @@ extension Agent {
throw NoMatchingKeyError()
}
try evaluateRestrictions(secret.attributes.restrictions, from: provenance, for: target)
try await witness?.speakNowOrForeverHoldYourPeace(forAccessTo: secret, from: store, by: provenance, target: target)
@@ -167,6 +168,22 @@ extension Agent {
}
extension Agent {
func evaluateRestrictions(_ restrictions: Restrictions?, from provenance: SigningRequestProvenance, for target: SigningRequestTarget?) throws(RestrictionError) {
guard let restrictions else { return }
print(restrictions)
throw .connectionsNotPermitted
}
enum RestrictionError: Error {
case signingNotPermitted
case connectionsNotPermitted
case hostNotAllowed(String)
}
}
extension Agent {
/// Gives any store with no loaded secrets a chance to reload.
Sources/Packages/Sources/SecretKit/Types/CreationOptions.swift
+53 -5
View File
@@ -7,7 +7,10 @@ public struct Attributes: Sendable, Codable, Hashable {
/// The authentication requirements for the key. This is simply a description of the option recorded at creation – modifying it doers not modify the key's authentication requirements.
public let authentication: AuthenticationRequirement
/// The authentication restrictions for the key.
public var restrictions: Restrictions?
/// The string appended to the end of the SSH Public Key.
/// If nil, a default value will be used.
public var publicKeyAttribution: String?
@@ -15,10 +18,12 @@ public struct Attributes: Sendable, Codable, Hashable {
public init(
keyType: KeyType,
authentication: AuthenticationRequirement,
restrictions: Restrictions?,
publicKeyAttribution: String? = nil
) {
self.keyType = keyType
self.authentication = authentication
self.restrictions = restrictions
self.publicKeyAttribution = publicKeyAttribution
}
@@ -33,17 +38,17 @@ public enum AuthenticationRequirement: String, Hashable, Sendable, Codable, Iden
/// Authentication is not required for usage.
case notRequired
/// The user needs to authenticate, using either a biometric option, a connected authorized watch, or password entry..
case presenceRequired
/// ONLY the current set of biometric data, as matching at time of creation, is accepted.
/// - Warning: This is a dangerous option prone to data loss. The user should be warned before configuring this key that if they modify their enrolled biometry INCLUDING by simply adding a new entry (ie, adding another fingeprting), the key will no longer be able to be accessed. This cannot be overridden with a password.
case biometryCurrent
/// The authentication requirement was not recorded at creation, and is unknown.
case unknown
/// Whether or not the key is known to require authentication.
public var required: Bool {
self == .presenceRequired || self == .biometryCurrent
@@ -53,3 +58,46 @@ public enum AuthenticationRequirement: String, Hashable, Sendable, Codable, Iden
self
}
}
/// The restrictions for the key.
public struct Restrictions: Hashable, Sendable, Codable, Identifiable {
public enum AllowedDomains: Hashable, Sendable, Codable {
case all
case specific([String])
public func hash(into hasher: inout Hasher) {
switch self {
case .all:
break
case .specific(let values):
values.hash(into: &hasher)
}
}
}
public enum AllowedProvenancePaths: Hashable, Sendable, Codable, Identifiable {
case all
case specific([String])
public var id: Int {
hashValue
}
}
public var allowForwarding: Bool
public var allowSigning: Bool
public var allowConnections: Bool
public var allowedDomains: AllowedDomains
public var allowedProvenancePaths: AllowedProvenancePaths
public var id: Restrictions {
self
}
// public static let `default` = Restrictions(allowForwarding: true, allowSigning: true, allowConnections: true, allowedDomains: .all, allowedProvenancePaths: .all)
public static let `default` = Restrictions(allowForwarding: true, allowSigning: true, allowConnections: true, allowedDomains: .specific(["example.com"]), allowedProvenancePaths: .all)
}
Sources/Packages/Sources/SecureEnclaveSecretKit/CryptoKitMigrator.swift
+1 -1
View File
@@ -47,7 +47,7 @@ extension SecureEnclave {
.contains("DeviceOwnerAuthentication") ? .presenceRequired : .unknown
do {
let parsed = try CryptoKit.SecureEnclave.P256.Signing.PrivateKey(dataRepresentation: tokenObjectID)
let secret = Secret(id: UUID().uuidString, name: name, publicKey: parsed.publicKey.x963Representation, attributes: Attributes(keyType: .init(algorithm: .ecdsa, size: 256), authentication: auth))
let secret = Secret(id: UUID().uuidString, name: name, publicKey: parsed.publicKey.x963Representation, attributes: Attributes(keyType: .init(algorithm: .ecdsa, size: 256), authentication: auth, restrictions: .default))
guard !migratedPublicKeys.contains(parsed.publicKey.x963Representation) else {
logger.log("Skipping \(name), public key already present. Marking as migrated.")
markMigrated(secret: secret, oldID: id)
Sources/Packages/Sources/SmartCardSecretKit/SmartCardSecret.swift
+1
View File
@@ -10,6 +10,7 @@ extension SmartCard {
public let name: String
public let publicKey: Data
public var attributes: Attributes
public var restrictions: Restrictions?
}
Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift
+1 -1
View File
@@ -171,7 +171,7 @@ extension SmartCard.Store {
let publicKeySecRef = SecKeyCopyPublicKey(publicKeyRef)!
let publicKeyAttributes = SecKeyCopyAttributes(publicKeySecRef) as! [CFString: Any]
let publicKey = publicKeyAttributes[kSecValueData] as! Data
let attributes = Attributes(keyType: KeyType(secAttr: algorithmSecAttr, size: keySize)!, authentication: .presenceRequired)
let attributes = Attributes(keyType: KeyType(secAttr: algorithmSecAttr, size: keySize)!, authentication: .presenceRequired, restrictions: .default)
let secret = SmartCard.Secret(id: tokenID, name: name, publicKey: publicKey, attributes: attributes)
guard signatureAlgorithm(for: secret) != nil else { return nil }
return secret
Sources/Secretive/Preview Content/PreviewStore.swift
+1
View File
@@ -14,6 +14,7 @@ extension Preview {
Attributes(
keyType: .init(algorithm: .ecdsa, size: 256),
authentication: .presenceRequired,
restrictions: .default
)
}
}
Sources/Secretive/Views/Secrets/CreateSecretView.swift
+54 -4
View File
@@ -10,8 +10,9 @@ struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
@State private var name = ""
@State private var keyAttribution = ""
@State private var authenticationRequirement: AuthenticationRequirement = .presenceRequired
@State private var restrictions: Restrictions = .default
@State private var keyType: KeyType?
@State var advanced = false
@State var advanced = true // FIXME: Set back
@State var errorText: String?
private var authenticationOptions: [AuthenticationRequirement] {
@@ -72,6 +73,7 @@ struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
}
}
if advanced {
SecretRestrictionsView(restrictions: $restrictions)
Section {
VStack {
Picker(.createSecretKeyTypeLabel, selection: $keyType) {
@@ -107,6 +109,8 @@ struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
.font(.subheadline)
.foregroundStyle(.secondary)
}
} header: {
Text("Key Properties")
}
}
if let errorText {
@@ -146,6 +150,7 @@ struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
attributes: .init(
keyType: keyType!,
authentication: authenticationRequirement,
restrictions: restrictions,
publicKeyAttribution: attribution
)
)
@@ -158,7 +163,52 @@ struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
}
}
struct SecretRestrictionsView: View {
//#Preview {
// CreateSecretView(store: Preview.StoreModifiable()) { _ in }
//}
@Binding var restrictions: Restrictions
struct IdentifiedString: Identifiable {
let value: String
var id: String { value }
}
var body: some View {
Section {
Toggle("Allow Forwarding", isOn: $restrictions.allowForwarding)
Toggle("Allow Signing Operations", isOn: $restrictions.allowSigning)
Toggle("Allow Connection Operations", isOn: $restrictions.allowConnections)
Picker(selection: $restrictions.allowedDomains) {
Text("All")
.tag(Restrictions.AllowedDomains.all)
Text("Specific")
.tag(Restrictions.AllowedDomains.specific([]))
} label: {
Text("Allowed Domains")
}
} header: {
Text("Restrictions")
}
if restrictions.allowedDomains != .all {
Section {
switch restrictions.allowedDomains {
case .all:
EmptyView()
case .specific(let array):
if restrictions.allowedDomains != .all {
ForEach((array + [""]).map({IdentifiedString(value: $0)})) {
TextField("", text: .constant($0.value), prompt: Text("example.com"))
.labelsHidden()
}
}
}
} header: {
Text("Allowed Domains")
}
}
}
}
#Preview {
CreateSecretView(store: Preview.StoreModifiable()) { _ in }
.frame(height: 1000)
}