external/secretive
1
0
Fork 0
mirror of https://github.com/maxgoedjen/secretive.git synced 2026-10-02 12:49:55 +02:00
Code Issues Projects Releases Wiki Activity

Fix bug where LAContext will be evaluated with incorrect policy for biometricCurrent secrets (#845)

Browse Source 
* Fix bug where LAContext will be evaluated with deviceOwnerAuthentication instead of deviceOwnerAuthenticationWithBiometrics

* Fix test
This commit is contained in:
Max Goedjen
2026-10-01 00:02:40 -05:00
committed by GitHub
parent 54e0d00d87
commit 9edc879900
3 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Sources/Packages/Sources/SecretAgentKit/AuthenticationHandler.swift
+6 -5
View File
@@ -73,9 +73,10 @@ public final class AuthenticationContext: AuthenticationContextProtocol {
} }
} }
public func evaluate() async throws -> Bool { public func evaluate(requireBiometrics: Bool) async throws -> Bool {
guard let laContext else { return false } guard let laContext else { return false }
return try await laContext.evaluatePolicy(.deviceOwnerAuthentication, localizedReason: laContext.localizedReason) let policy: LAPolicy = requireBiometrics ? .deviceOwnerAuthenticationWithBiometrics : .deviceOwnerAuthentication
return try await laContext.evaluatePolicy(policy, localizedReason: laContext.localizedReason)
} }
public func cancel() async { public func cancel() async {
@@ -141,7 +142,7 @@ public final class AuthenticationContext: AuthenticationContextProtocol {
activeContext = context activeContext = context
let currentTask = Task<Bool, any Error> { let currentTask = Task<Bool, any Error> {
logger.log("Beginning individual auth prompt") logger.log("Beginning individual auth prompt")
let result = (try? await context.evaluate()) ?? false let result = (try? await context.evaluate(requireBiometrics: request.secret.authenticationRequirement == .biometryCurrent)) ?? false
logger.log("Ended individual auth prompt") logger.log("Ended individual auth prompt")
return result return result
} }
@@ -195,7 +196,7 @@ public final class AuthenticationContext: AuthenticationContextProtocol {
public func persistAuthentication<SecretType: Secret>(secret: SecretType, forDuration duration: TimeInterval) async throws { public func persistAuthentication<SecretType: Secret>(secret: SecretType, forDuration duration: TimeInterval) async throws {
let context = AuthenticationContext(secret: secret, duration: duration) let context = AuthenticationContext(secret: secret, duration: duration)
let success = try await context.evaluate() let success = try await context.evaluate(requireBiometrics: secret.authenticationRequirement == .biometryCurrent)
guard success else { return } guard success else { return }
authenticatedContexts[AnySecret(secret)] = context authenticatedContexts[AnySecret(secret)] = context
} }
@@ -204,7 +205,7 @@ public final class AuthenticationContext: AuthenticationContextProtocol {
activeTask?.cancel() activeTask?.cancel()
guard let first = requests.first else { return } guard let first = requests.first else { return }
let context = AuthenticationContext(secret: first.secret, requests: requests) let context = AuthenticationContext(secret: first.secret, requests: requests)
let success = (try? await context.evaluate()) ?? false let success = (try? await context.evaluate(requireBiometrics: first.secret.authenticationRequirement == .biometryCurrent)) ?? false
guard success else { guard success else {
waitingRequests.subtract(requests) waitingRequests.subtract(requests)
return return
Sources/Packages/Sources/SecretKit/Types/AuthenticationContext.swift
+1 -1
View File
@@ -6,7 +6,7 @@ public protocol AuthenticationContextProtocol: Sendable, Identifiable {
var secret: AnySecret { get } var secret: AnySecret { get }
func valid(for request: SignatureRequest) -> Bool func valid(for request: SignatureRequest) -> Bool
var laContext: LAContext? { get } var laContext: LAContext? { get }
func evaluate() async throws -> Bool func evaluate(requireBiometrics: Bool) async throws -> Bool
func cancel() async func cancel() async
} }
Sources/Packages/Tests/SecretAgentKitTests/AuthenticationHandlerTests.swift
+1 -2
View File
@@ -41,9 +41,8 @@ public struct TestSecret: Secret {
nonisolated func valid(for request: SecretKit.SignatureRequest) -> Bool { nonisolated func valid(for request: SecretKit.SignatureRequest) -> Bool {
true true
} }
func evaluate() async throws -> Bool { func evaluate(requireBiometrics: Bool) async throws -> Bool {
if case let .duration(duration) = approval { if case let .duration(duration) = approval {
try await Task.sleep(for: duration) try await Task.sleep(for: duration)
} else { } else {