WIP

Sources/Packages/Resources/Localizable.xcstrings

@@ -3879,6 +3879,21 @@
           }
         }
       }
+    },
+    "All" : {
+
+    },
+    "Allow Connection Operations" : {
+
+    },
+    "Allow Forwarding" : {
+
+    },
+    "Allow Signing Operations" : {
+
+    },
+    "Allowed Domains" : {
+
     },
     "app_menu_help_button" : {
       "extractionState" : "manual",
@@ -12333,6 +12348,9 @@
           }
         }
       }
+    },
+    "example.com" : {
+
     },
     "export SSH_AUTH_SOCK=%@" : {
       "localizations" : {
@@ -19205,6 +19223,9 @@
           }
         }
       }
+    },
+    "Key Properties" : {
+
     },
     "no_secure_storage_description" : {
       "extractionState" : "manual",
@@ -20154,6 +20175,9 @@
           }
         }
       }
+    },
+    "Restrictions" : {
+
     },
     "reveal_in_finder_button" : {
       "extractionState" : "manual",
@@ -24973,6 +24997,9 @@
           }
         }
       }
+    },
+    "Specific" : {
+
     },
     "unnamed_secret" : {
       "extractionState" : "manual",

Sources/Packages/Sources/SecretAgentKit/Agent.swift

@@ -86,6 +86,7 @@ extension Agent {
                 response = try await MainActor.run {
                     guard sessionID == nil else {
                         logger.error("Agent received bind request, but already bound.")
+                        // FIXME: This will break forwarding for now.
                         throw BindingFailure()
                     }
                     logger.debug("Agent bound")
@@ -147,6 +148,8 @@ extension Agent {
             throw NoMatchingKeyError()
         }
 
+        try evaluateRestrictions(secret.attributes.restrictions, from: provenance, for: target)
+
         try await witness?.speakNowOrForeverHoldYourPeace(forAccessTo: secret, from: store, by: provenance, target: target)
 
         let rawRepresentation = try await store.sign(data: data, with: secret, for: provenance, target: target)
@@ -161,6 +164,22 @@ extension Agent {
 
 }
 
+extension Agent {
+
+    func evaluateRestrictions(_ restrictions: Restrictions?, from provenance: SigningRequestProvenance, for target: SigningRequestTarget?) throws(RestrictionError) {
+        guard let restrictions else { return }
+        print(restrictions)
+        throw .connectionsNotPermitted
+    }
+
+    enum RestrictionError: Error {
+        case signingNotPermitted
+        case connectionsNotPermitted
+        case hostNotAllowed(String)
+    }
+
+}
+
 extension Agent {
 
     /// Gives any store with no loaded secrets a chance to reload.

Sources/Packages/Sources/SecretKit/Types/CreationOptions.swift

@@ -7,7 +7,10 @@ public struct Attributes: Sendable, Codable, Hashable {
 
     /// The authentication requirements for the key. This is simply a description of the option recorded at creation – modifying it doers not modify the key's authentication requirements.
     public let authentication: AuthenticationRequirement
-    
+
+    /// The authentication restrictions for the key.
+    public var restrictions: Restrictions?
+
     /// The string appended to the end of the SSH Public Key.
     /// If nil, a default value will be used.
     public var publicKeyAttribution: String?
@@ -15,10 +18,12 @@ public struct Attributes: Sendable, Codable, Hashable {
     public init(
         keyType: KeyType,
         authentication: AuthenticationRequirement,
+        restrictions: Restrictions?,
         publicKeyAttribution: String? = nil
     ) {
         self.keyType = keyType
         self.authentication = authentication
+        self.restrictions = restrictions
         self.publicKeyAttribution = publicKeyAttribution
     }
 
@@ -33,17 +38,17 @@ public enum AuthenticationRequirement: String, Hashable, Sendable, Codable, Iden
 
     /// Authentication is not required for usage.
     case notRequired
-    
+
     /// The user needs to authenticate, using either a biometric option, a connected authorized watch, or password entry..
     case presenceRequired
-    
+
     /// ONLY the current set of biometric data, as matching at time of creation, is accepted.
     /// - Warning: This is a dangerous option prone to data loss. The user should be warned before configuring this key that if they modify their enrolled biometry INCLUDING by simply adding a new entry (ie, adding another fingeprting), the key will no longer be able to be accessed. This cannot be overridden with a password.
     case biometryCurrent
-    
+
     /// The authentication requirement was not recorded at creation, and is unknown.
     case unknown
-    
+
     /// Whether or not the key is known to require authentication.
     public var required: Bool {
         self == .presenceRequired || self == .biometryCurrent
@@ -53,3 +58,46 @@ public enum AuthenticationRequirement: String, Hashable, Sendable, Codable, Iden
         self
     }
 }
+
+/// The restrictions for the key.
+public struct Restrictions: Hashable, Sendable, Codable, Identifiable {
+
+    public enum AllowedDomains: Hashable, Sendable, Codable {
+        case all
+        case specific([String])
+
+        public func hash(into hasher: inout Hasher) {
+            switch self {
+            case .all:
+                break
+            case .specific(let values):
+                values.hash(into: &hasher)
+            }
+        }
+
+    }
+
+    public enum AllowedProvenancePaths: Hashable, Sendable, Codable, Identifiable {
+        case all
+        case specific([String])
+
+        public var id: Int {
+            hashValue
+        }
+        
+    }
+
+    public var allowForwarding: Bool
+    public var allowSigning: Bool
+    public var allowConnections: Bool
+    public var allowedDomains: AllowedDomains
+    public var allowedProvenancePaths: AllowedProvenancePaths
+
+    public var id: Restrictions {
+        self
+    }
+
+//    public static let `default` = Restrictions(allowForwarding: true, allowSigning: true, allowConnections: true, allowedDomains: .all, allowedProvenancePaths: .all)
+    public static let `default` = Restrictions(allowForwarding: true, allowSigning: true, allowConnections: true, allowedDomains: .specific(["example.com"]), allowedProvenancePaths: .all)
+
+}

Sources/Packages/Sources/SecureEnclaveSecretKit/CryptoKitMigrator.swift

@@ -47,7 +47,7 @@ extension SecureEnclave {
                     .contains("DeviceOwnerAuthentication") ? .presenceRequired : .unknown
                 do {
                     let parsed = try CryptoKit.SecureEnclave.P256.Signing.PrivateKey(dataRepresentation: tokenObjectID)
-                    let secret = Secret(id: UUID().uuidString, name: name, publicKey: parsed.publicKey.x963Representation, attributes: Attributes(keyType: .init(algorithm: .ecdsa, size: 256), authentication: auth))
+                    let secret = Secret(id: UUID().uuidString, name: name, publicKey: parsed.publicKey.x963Representation, attributes: Attributes(keyType: .init(algorithm: .ecdsa, size: 256), authentication: auth, restrictions: .default))
                     guard !migratedPublicKeys.contains(parsed.publicKey.x963Representation) else {
                         logger.log("Skipping \(name), public key already present. Marking as migrated.")
                         markMigrated(secret: secret, oldID: id)

Sources/Packages/Sources/SmartCardSecretKit/SmartCardSecret.swift

@@ -10,6 +10,7 @@ extension SmartCard {
         public let name: String
         public let publicKey: Data
         public var attributes: Attributes
+        public var restrictions: Restrictions?
 
     }
 

Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift

@@ -171,7 +171,7 @@ extension SmartCard.Store {
             let publicKeySecRef = SecKeyCopyPublicKey(publicKeyRef)!
             let publicKeyAttributes = SecKeyCopyAttributes(publicKeySecRef) as! [CFString: Any]
             let publicKey = publicKeyAttributes[kSecValueData] as! Data
-            let attributes = Attributes(keyType: KeyType(secAttr: algorithmSecAttr, size: keySize)!, authentication: .presenceRequired)
+            let attributes = Attributes(keyType: KeyType(secAttr: algorithmSecAttr, size: keySize)!, authentication: .presenceRequired, restrictions: .default)
             let secret = SmartCard.Secret(id: tokenID, name: name, publicKey: publicKey, attributes: attributes)
             guard signatureAlgorithm(for: secret) != nil else { return nil }
             return secret