@livx.cc/appwrap 0.42.3 → 0.43.0

package/runtime-desktop/src-tauri/Cargo.toml

@@ -0,0 +1,38 @@
+[package]
+name = "appwrap-desktop-shell"
+version = "0.1.0"
+edition = "2021"
+
+[build-dependencies]
+tauri-build = { version = "2", features = [] }
+
+[dependencies]
+tauri = { version = "2", features = [] }
+tauri-plugin-deep-link = "2"
+tauri-plugin-window-state = "2"
+tauri-plugin-notification = "2"
+tauri-plugin-autostart = "2"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+arboard = "3"
+
+# macOS oauth.authorize — ASWebAuthenticationSession (system-browser auth sheet, exact parity with the
+# iOS shell path in runtime/app/shell/handlers-oauth.ts: auto-close on redirect, user-cancel signal).
+[target.'cfg(target_os = "macos")'.dependencies]
+objc2 = "0.6"
+objc2-foundation = "0.3"
+objc2-app-kit = "0.3"
+objc2-authentication-services = "0.3"
+objc2-web-kit = "0.3"
+objc2-local-authentication = "0.3"  # Touch ID — LAContext (biometrics.available / .authenticate)
+block2 = "0.6"
+# local notifications (notifications.schedule): UNUserNotificationCenter + a delegate so a tapped
+# notification carrying a deepLink routes through deeplink.open (tauri-plugin-notification has no click callback).
+objc2-user-notifications = { version = "0.3", default-features = false, features = [
+  "std", "block2",
+  "UNUserNotificationCenter", "UNNotificationContent", "UNNotificationRequest",
+  "UNNotificationResponse", "UNNotificationTrigger", "UNNotification",
+] }
+
+[profile.dev]
+incremental = true

package/runtime-desktop/src-tauri/build.rs

@@ -0,0 +1,3 @@
+fn main() {
+    tauri_build::build()
+}

package/runtime-desktop/src-tauri/capabilities/default.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "../gen/schemas/desktop-schema.json",
+  "identifier": "default",
+  "windows": ["main"],
+  "permissions": ["core:default", "notification:default"]
+}

package/runtime-desktop/src-tauri/shell_config.json

@@ -0,0 +1,10 @@
+{
+  "appId": "cc.livx.hellopwa.desktop",
+  "name": "Hello PWA (desktop)",
+  "version": "0.1.0",
+  "title": "Hello PWA — appwrap desktop",
+  "width": 430,
+  "height": 800,
+  "urlScheme": "hellowrap",
+  "identifier": "cc.livx.hellopwa.desktop"
+}

package/runtime-desktop/src-tauri/src/biometrics_mac.rs

@@ -0,0 +1,138 @@
+// macOS Touch ID / biometrics — LocalAuthentication LAContext, exact parity with the iOS shell path
+// (runtime/app/shell/handlers-extended.ts):
+//   biometrics.available    → { available: bool, type: 'face' | 'touch' | 'none' }
+//   biometrics.authenticate → { success: true }  OR  rejects with code 'DENIED'
+//
+// Policy: LAPolicyDeviceOwnerAuthenticationWithBiometrics — biometrics ONLY, no passcode fallback.
+// The kit's biometrics.authenticate(reason) contract carries NO "allow passcode" flag (see
+// packages/native-kit/src/modules/biometrics.ts) and the iOS handler uses the WithBiometrics policy,
+// so we mirror that exactly. (DeviceOwnerAuthentication — biometry-or-password — is intentionally not
+// wired: it would over-deliver vs the mobile contract.)
+//
+// Threading: `available` (canEvaluatePolicy) is a pure query, safe off the main thread — computed on
+// the worker thread and delivered inline. `authenticate` is initiated on the main thread (mirrors the
+// other native lanes); its reply block runs on a private LA queue and delivers via the window. The
+// LAContext MUST stay alive for the whole evaluation (ARC would otherwise cancel it mid-prompt), so it
+// is parked in a static for the flight's lifetime — single-flight, like oauth/push.
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::Mutex;
+
+use block2::RcBlock;
+use objc2::rc::Retained;
+use objc2::runtime::Bool;
+use objc2_foundation::{NSError, NSString};
+use objc2_local_authentication::{LABiometryType, LAContext, LAPolicy};
+use serde_json::{json, Value};
+
+use crate::deliver;
+
+/// Human-readable diagnostic for an LAError availability code (kit shape only carries `available:bool`,
+/// so this is for the shell log, not the response). Codes: LocalAuthentication LAError.
+fn availability_reason(code: isize) -> &'static str {
+    match code {
+        -5 => "passcode not set",
+        -6 => "no biometric hardware",
+        -7 => "biometrics not enrolled",
+        -8 => "biometrics locked out (too many attempts)",
+        _ => "unavailable",
+    }
+}
+
+fn biometry_type_str(t: LABiometryType) -> &'static str {
+    match t {
+        LABiometryType::FaceID => "face",
+        LABiometryType::TouchID => "touch",
+        _ => "none",
+    }
+}
+
+/// `biometrics.available` — { available, type }. Synchronous; safe on the worker thread.
+pub fn available() -> Value {
+    let ctx = unsafe { LAContext::new() };
+    // biometryType is only populated AFTER a canEvaluatePolicy call, so evaluate first.
+    let available = match unsafe { ctx.canEvaluatePolicy_error(LAPolicy::DeviceOwnerAuthenticationWithBiometrics) } {
+        Ok(()) => true,
+        Err(e) => {
+            let code = e.code();
+            eprintln!("[biometrics] unavailable: {} (code {code})", availability_reason(code));
+            false
+        }
+    };
+    let ty = biometry_type_str(unsafe { ctx.biometryType() });
+    json!({ "available": available, "type": ty })
+}
+
+/// Strong ref to the in-flight context, held for the evaluation's lifetime. Only ever touched here;
+/// the Send impl exists purely so the (framework-confined) context can live in a static Mutex.
+struct ActiveFlow(Option<Retained<LAContext>>);
+unsafe impl Send for ActiveFlow {}
+static ACTIVE: Mutex<ActiveFlow> = Mutex::new(ActiveFlow(None));
+
+/// Synchronous single-flight reservation, claimed on the INVOKE thread before the main-thread hop
+/// (mirrors main.rs OAUTH_IN_FLIGHT). Guarding on ACTIVE alone is a TOCTOU: ACTIVE is only set
+/// inside the run_on_main_thread closure, so two quick authenticate calls could both pass the check
+/// and the second context would overwrite (and drop) the first mid-prompt.
+static IN_FLIGHT: AtomicBool = AtomicBool::new(false);
+
+fn deliver_success(window: &tauri::WebviewWindow, id: &str) {
+    let resp = json!({ "v": 1, "id": id, "kind": "response", "result": { "success": true } });
+    deliver(window, &resp);
+}
+
+fn deliver_denied(window: &tauri::WebviewWindow, id: &str, msg: &str) {
+    // Kit contract: authenticate rejects with 'DENIED' on user cancel/failure.
+    let resp = json!({ "v": 1, "id": id, "kind": "response", "error": { "code": "DENIED", "message": msg } });
+    deliver(window, &resp);
+}
+
+/// `biometrics.authenticate` — prompt Touch ID; reply delivered from the LA completion block.
+/// Single-flight: a second prompt while one is up is refused (only one LA sheet at a time).
+pub fn authenticate(window: tauri::WebviewWindow, id: String, reason: String) {
+    // Atomic reservation BEFORE the main-thread hop — see IN_FLIGHT doc for why ACTIVE can't guard.
+    if IN_FLIGHT.swap(true, Ordering::SeqCst) {
+        return deliver_denied(&window, &id, "a biometric prompt is already in progress");
+    }
+    let reason = if reason.trim().is_empty() { "Authenticate".to_string() } else { reason };
+    let w = window.clone();
+    let fail_id = id.clone();
+    let res = window.run_on_main_thread(move || {
+        let ctx = unsafe { LAContext::new() };
+
+        let cb_window = w.clone();
+        let cb_id = id.clone();
+        let block = RcBlock::new(move |success: Bool, error: *mut NSError| {
+            // Release the parked context + reservation first — a follow-up authenticate must be
+            // legal from here.
+            ACTIVE.lock().unwrap().0 = None;
+            IN_FLIGHT.store(false, Ordering::SeqCst);
+            if success.as_bool() {
+                eprintln!("[biometrics] authenticate succeeded");
+                deliver_success(&cb_window, &cb_id);
+            } else {
+                let msg = if error.is_null() {
+                    "authentication failed".to_string()
+                } else {
+                    unsafe { (*error).localizedDescription() }.to_string()
+                };
+                eprintln!("[biometrics] authenticate failed: {msg}");
+                deliver_denied(&cb_window, &cb_id, &msg);
+            }
+        });
+
+        // Park the context BEFORE evaluate — the reply can fire from a private queue at any moment.
+        ACTIVE.lock().unwrap().0 = Some(ctx.clone());
+        unsafe {
+            ctx.evaluatePolicy_localizedReason_reply(
+                LAPolicy::DeviceOwnerAuthenticationWithBiometrics,
+                &NSString::from_str(&reason),
+                &block,
+            );
+        }
+        eprintln!("[biometrics] evaluatePolicy started");
+    });
+    if let Err(e) = res {
+        ACTIVE.lock().unwrap().0 = None;
+        IN_FLIGHT.store(false, Ordering::SeqCst);
+        deliver_denied(&window, &fail_id, &format!("failed to reach main thread: {e}"));
+    }
+}