@parlor/shell-desktop 0.0.0-stage → 0.2.0

package/package.json

@@ -1,6 +1,48 @@
 {
   "name": "@parlor/shell-desktop",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.2.0",
+  "homepage": "https://cychien.github.io/parlor",
+  "bugs": "https://github.com/cychien/parlor/issues",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cychien/parlor.git",
+    "directory": "packages/shell-desktop"
+  },
+  "files": [
+    "dist",
+    "assets",
+    "rust/Cargo.toml",
+    "rust/src"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "dependencies": {
+    "@tauri-apps/api": "^2.12.1",
+    "@tauri-apps/cli": "^2.12.1",
+    "@tauri-apps/plugin-deep-link": "^2.6.1",
+    "@tauri-apps/plugin-dialog": "^2.8.3",
+    "@tauri-apps/plugin-fs": "^2.7.1",
+    "@tauri-apps/plugin-notification": "^2.5.1",
+    "@parlor/shell-web": "0.2.0",
+    "@parlor/config": "0.2.0"
+  },
+  "devDependencies": {
+    "@types/node": "^24.14.0",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.3"
+  },
+  "optionalDependencies": {
+    "@parlor/agent-host-darwin-arm64": "0.2.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
 }

package/rust/Cargo.toml

@@ -0,0 +1,37 @@
+[package]
+name = "parlor-shell"
+version = "0.0.0"
+edition = "2024"
+publish = false
+
+[lib]
+name = "parlor_shell"
+
+[dependencies]
+tauri = { version = "2", features = [] }
+tauri-plugin-dialog = "2"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+base64 = "0.22"
+sha2 = "0.10"
+
+[target.'cfg(target_os = "macos")'.dependencies]
+security-framework = "3"
+security-framework-sys = "2"
+core-foundation = "0.10"
+core-foundation-sys = "0.8"
+objc2 = "0.6"
+objc2-foundation = "0.3"
+objc2-local-authentication = "0.3"
+objc2-app-kit = { version = "0.3", default-features = false, features = [
+  "std",
+  "NSResponder",
+  "NSWindow",
+] }
+objc2-authentication-services = { version = "0.3", default-features = false, features = [
+  "std",
+  "block2",
+  "ASFoundation",
+  "ASWebAuthenticationSession",
+] }
+block2 = "0.6"

package/rust/src/auth_browser.rs

@@ -0,0 +1,195 @@
+use tauri::{Url, WebviewWindow};
+
+fn sign_in_page(url: &str) -> Result<Url, String> {
+    match Url::parse(url) {
+        Ok(page) if matches!(page.scheme(), "https" | "http") => Ok(page),
+        _ => Err(format!("The sign-in page must be an http(s) URL: {url:?}")),
+    }
+}
+
+fn url_scheme(scheme: &str) -> Result<&str, String> {
+    let mut chars = scheme.chars();
+    let valid = chars.next().is_some_and(|first| first.is_ascii_lowercase())
+        && chars.all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || "+.-".contains(c));
+    if valid {
+        Ok(scheme)
+    } else {
+        Err(format!("The callback must be the app's URL scheme: {scheme:?}"))
+    }
+}
+
+#[cfg(target_os = "macos")]
+mod apple {
+    use std::cell::RefCell;
+    use std::rc::Rc;
+    use std::sync::mpsc;
+
+    use block2::RcBlock;
+    use objc2::rc::Retained;
+    use objc2::runtime::ProtocolObject;
+    use objc2::{AnyThread, DefinedClass, MainThreadMarker, MainThreadOnly, define_class, msg_send};
+    use objc2_app_kit::NSWindow;
+    use objc2_authentication_services::{
+        ASWebAuthenticationPresentationContextProviding, ASWebAuthenticationSession,
+        ASWebAuthenticationSessionErrorCode, ASWebAuthenticationSessionErrorDomain,
+    };
+    use objc2_foundation::{NSError, NSObject, NSObjectProtocol, NSString, NSURL};
+    use tauri::{Url, WebviewWindow};
+
+    type Outcome = Result<Option<String>, String>;
+    /// The session presents over its anchor, which it holds weakly.
+    type Running = (Retained<ASWebAuthenticationSession>, Retained<Anchor>);
+
+    define_class!(
+        #[unsafe(super(NSObject))]
+        #[thread_kind = MainThreadOnly]
+        #[ivars = Retained<NSWindow>]
+        struct Anchor;
+
+        unsafe impl NSObjectProtocol for Anchor {}
+
+        unsafe impl ASWebAuthenticationPresentationContextProviding for Anchor {
+            #[unsafe(method_id(presentationAnchorForWebAuthenticationSession:))]
+            fn anchor(&self, _session: &ASWebAuthenticationSession) -> Retained<NSWindow> {
+                self.ivars().clone()
+            }
+        }
+    );
+
+    impl Anchor {
+        fn new(mtm: MainThreadMarker, window: Retained<NSWindow>) -> Retained<Self> {
+            let this = Self::alloc(mtm).set_ivars(window);
+            unsafe { msg_send![super(this), init] }
+        }
+    }
+
+    fn outcome(url: *mut NSURL, error: *mut NSError) -> Outcome {
+        if let Some(url) = unsafe { url.as_ref() } {
+            return Ok(url.absoluteString().map(|text| text.to_string()));
+        }
+        let Some(error) = (unsafe { error.as_ref() }) else {
+            return Err("Sign-in did not finish.".to_string());
+        };
+        let cancelled = error.domain().to_string()
+            == unsafe { ASWebAuthenticationSessionErrorDomain }.to_string()
+            && error.code() == ASWebAuthenticationSessionErrorCode::CanceledLogin.0;
+        if cancelled {
+            Ok(None)
+        } else {
+            Err(error.localizedDescription().to_string())
+        }
+    }
+
+    /// Runs on the main thread; the session and its anchor stay alive until it completes.
+    fn start(window: &WebviewWindow, page: &Url, scheme: &str, done: mpsc::Sender<Outcome>) {
+        let fail = |done: &mpsc::Sender<Outcome>, message: &str| {
+            let _ = done.send(Err(message.to_string()));
+        };
+        let Some(mtm) = MainThreadMarker::new() else {
+            return fail(&done, "The sign-in browser must open on the main thread.");
+        };
+        let Some(ns_window) = window
+            .ns_window()
+            .ok()
+            .and_then(|pointer| unsafe { Retained::retain(pointer.cast::<NSWindow>()) })
+        else {
+            return fail(&done, "The app has no window to show the sign-in browser over.");
+        };
+        let Some(url) = NSURL::URLWithString(&NSString::from_str(page.as_str())) else {
+            return fail(&done, "The sign-in page URL is not valid.");
+        };
+        let anchor = Anchor::new(mtm, ns_window);
+        let running: Rc<RefCell<Option<Running>>> = Rc::new(RefCell::new(None));
+        let keep = running.clone();
+        let reply = RefCell::new(Some(done.clone()));
+        let completion = RcBlock::new(move |url: *mut NSURL, error: *mut NSError| {
+            keep.borrow_mut().take();
+            if let Some(done) = reply.borrow_mut().take() {
+                let _ = done.send(outcome(url, error));
+            }
+        });
+        #[allow(deprecated)]
+        let session = unsafe {
+            ASWebAuthenticationSession::initWithURL_callbackURLScheme_completionHandler(
+                ASWebAuthenticationSession::alloc(),
+                &url,
+                Some(&NSString::from_str(scheme)),
+                RcBlock::as_ptr(&completion),
+            )
+        };
+        unsafe {
+            session.setPresentationContextProvider(Some(ProtocolObject::from_ref(&*anchor)));
+            session.setPrefersEphemeralWebBrowserSession(false);
+        }
+        *running.borrow_mut() = Some((session.clone(), anchor));
+        if !unsafe { session.start() } {
+            running.borrow_mut().take();
+            fail(&done, "The sign-in browser could not open.");
+        }
+    }
+
+    pub async fn open(window: WebviewWindow, page: Url, scheme: String) -> Outcome {
+        let (done, outcome) = mpsc::channel();
+        let target = window.clone();
+        window
+            .run_on_main_thread(move || start(&target, &page, &scheme, done))
+            .map_err(|e| e.to_string())?;
+        tauri::async_runtime::spawn_blocking(move || outcome.recv())
+            .await
+            .map_err(|e| e.to_string())?
+            .map_err(|_| "The sign-in browser closed without an answer.".to_string())?
+    }
+}
+
+#[cfg(not(target_os = "macos"))]
+mod apple {
+    use tauri::{Url, WebviewWindow};
+
+    pub async fn open(
+        _window: WebviewWindow,
+        _page: Url,
+        _scheme: String,
+    ) -> Result<Option<String>, String> {
+        Err("unsupported".to_string())
+    }
+}
+
+/// Opens `url` in ASWebAuthenticationSession and resolves with the URL it returned to under
+/// `callback_scheme`, or `None` when the user closed it.
+#[tauri::command]
+pub async fn parlor_auth_browser_open(
+    window: WebviewWindow,
+    url: String,
+    callback_scheme: String,
+) -> Result<Option<String>, String> {
+    let page = sign_in_page(&url)?;
+    let scheme = url_scheme(&callback_scheme)?.to_string();
+    apple::open(window, page, scheme).await
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn only_an_http_page_and_a_url_scheme_are_accepted() {
+        assert!(sign_in_page("https://app.example.com/_parlor/auth/native").is_ok());
+        assert!(sign_in_page("http://localhost:3000/x").is_ok());
+        for bad in ["", "javascript:alert(1)", "file:///etc/passwd", "hello://x"] {
+            assert!(sign_in_page(bad).is_err(), "{bad}");
+        }
+        assert_eq!(url_scheme("hello"), Ok("hello"));
+        assert_eq!(url_scheme("dev.parlor-app+x"), Ok("dev.parlor-app+x"));
+        for bad in ["", "Hello", "1app", "a b", "https://x"] {
+            assert!(url_scheme(bad).is_err(), "{bad}");
+        }
+    }
+
+    #[test]
+    fn a_refused_probe_never_reads_as_unavailable() {
+        for error in [sign_in_page("").unwrap_err(), url_scheme("").unwrap_err()] {
+            let lower = error.to_lowercase();
+            assert!(!lower.contains("not found") && !lower.contains("unsupported"));
+        }
+    }
+}

package/rust/src/control.rs

@@ -0,0 +1,104 @@
+use std::io::{BufRead, BufReader, Write};
+use std::os::unix::net::UnixStream;
+use std::path::PathBuf;
+use std::time::Duration;
+
+use serde_json::Value;
+
+pub const REPLY_TIMEOUT: Duration = Duration::from_secs(30);
+
+pub fn home() -> Result<PathBuf, String> {
+    std::env::var_os("HOME")
+        .map(PathBuf::from)
+        .ok_or_else(|| "HOME is not set".to_string())
+}
+
+pub fn socket_path(home: &std::path::Path) -> PathBuf {
+    home.join(".parlor")
+        .join("host")
+        .join("run")
+        .join("control.sock")
+}
+
+pub fn exchange(socket: &std::path::Path, request: &Value) -> Result<Value, String> {
+    let mut stream = UnixStream::connect(socket).map_err(|e| e.to_string())?;
+    stream
+        .set_read_timeout(Some(REPLY_TIMEOUT))
+        .map_err(|e| e.to_string())?;
+    let line = format!("{request}\n");
+    stream
+        .write_all(line.as_bytes())
+        .map_err(|e| e.to_string())?;
+    let mut reply = String::new();
+    BufReader::new(stream)
+        .read_line(&mut reply)
+        .map_err(|e| e.to_string())?;
+    parse_reply(&reply)
+}
+
+pub fn parse_reply(line: &str) -> Result<Value, String> {
+    if line.trim().is_empty() {
+        return Err("Parlor Host closed the connection.".to_string());
+    }
+    serde_json::from_str(line).map_err(|e| e.to_string())
+}
+
+pub fn request(socket: &std::path::Path, request: Value) -> Result<Value, String> {
+    let reply = exchange(socket, &request)?;
+    if reply.get("ok").and_then(Value::as_bool) == Some(true) {
+        return Ok(reply);
+    }
+    let error = reply
+        .get("error")
+        .and_then(Value::as_str)
+        .unwrap_or("Parlor Host refused the request.");
+    Err(error.to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+    use std::os::unix::net::UnixListener;
+
+    #[test]
+    fn socket_lives_under_the_home_host_run_directory() {
+        assert_eq!(
+            socket_path(std::path::Path::new("/Users/a")),
+            PathBuf::from("/Users/a/.parlor/host/run/control.sock")
+        );
+    }
+
+    #[test]
+    fn a_reply_is_one_json_line() {
+        assert_eq!(parse_reply("{\"ok\":true}\n").unwrap(), json!({"ok": true}));
+        assert!(parse_reply("").is_err());
+        assert!(parse_reply("not json").is_err());
+    }
+
+    #[test]
+    fn request_writes_one_line_and_surfaces_a_refusal() {
+        let dir = std::env::temp_dir().join(format!("ps-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("c.sock");
+        let listener = UnixListener::bind(&path).unwrap();
+        let server = std::thread::spawn(move || {
+            let (mut stream, _) = listener.accept().unwrap();
+            let mut line = String::new();
+            BufReader::new(stream.try_clone().unwrap())
+                .read_line(&mut line)
+                .unwrap();
+            assert_eq!(
+                serde_json::from_str::<Value>(&line).unwrap(),
+                json!({"op": "status"})
+            );
+            stream
+                .write_all(b"{\"ok\":false,\"error\":\"declined_locally\"}\n")
+                .unwrap();
+        });
+        let outcome = request(&path, json!({"op": "status"}));
+        server.join().unwrap();
+        std::fs::remove_dir_all(&dir).ok();
+        assert_eq!(outcome, Err("declined_locally".to_string()));
+    }
+}

package/rust/src/device_key.rs

@@ -0,0 +1,282 @@
+use base64::Engine;
+use base64::engine::general_purpose::URL_SAFE_NO_PAD;
+use serde::Serialize;
+use sha2::{Digest, Sha256};
+use tauri::AppHandle;
+
+use crate::keystore::{self, PublicPoint};
+
+#[derive(Serialize, Debug, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct PublicJwk {
+    pub kty: &'static str,
+    pub crv: &'static str,
+    pub x: String,
+    pub y: String,
+}
+
+#[derive(Serialize, Debug, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct KeyReport {
+    pub key_id: String,
+    pub public_key: PublicJwk,
+}
+
+#[derive(Serialize, Debug, PartialEq)]
+pub struct Proof {
+    pub signature: String,
+}
+
+#[derive(Serialize, Debug, PartialEq)]
+pub struct PublicKeys {
+    pub signing: KeyReport,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub presence: Option<KeyReport>,
+    pub proof: Proof,
+}
+
+#[derive(Serialize, Debug, PartialEq)]
+pub struct Signature {
+    pub signature: String,
+}
+
+pub fn encode(bytes: &[u8]) -> String {
+    URL_SAFE_NO_PAD.encode(bytes)
+}
+
+pub fn thumbprint(x: &str, y: &str) -> String {
+    let canonical = format!(r#"{{"crv":"P-256","kty":"EC","x":"{x}","y":"{y}"}}"#);
+    encode(&Sha256::digest(canonical.as_bytes()))
+}
+
+pub fn report_of(point: &PublicPoint) -> KeyReport {
+    let (x, y) = (encode(&point.x), encode(&point.y));
+    KeyReport {
+        key_id: thumbprint(&x, &y),
+        public_key: PublicJwk {
+            kty: "EC",
+            crv: "P-256",
+            x,
+            y,
+        },
+    }
+}
+
+fn point_json(key: &PublicJwk) -> String {
+    format!(
+        r#"{{"crv":"P-256","kty":"EC","x":"{}","y":"{}"}}"#,
+        key.x, key.y
+    )
+}
+
+pub fn enrollment_bytes(
+    challenge: &str,
+    signing: &KeyReport,
+    presence: Option<&KeyReport>,
+) -> Vec<u8> {
+    let challenge = serde_json::to_string(challenge).unwrap_or_default();
+    let presence = match presence {
+        Some(report) => format!(
+            r#"{{"format":"es256-raw","id":"{}","publicKey":{}}}"#,
+            report.key_id,
+            point_json(&report.public_key)
+        ),
+        None => "null".to_string(),
+    };
+    format!(
+        r#"{{"challenge":{challenge},"presence":{presence},"signing":{}}}"#,
+        point_json(&signing.public_key)
+    )
+    .into_bytes()
+}
+
+pub fn der_to_raw(der: &[u8]) -> Result<[u8; 64], String> {
+    fn length(bytes: &[u8], at: &mut usize) -> Result<usize, String> {
+        let first = *bytes.get(*at).ok_or("short signature")?;
+        *at += 1;
+        if first < 0x80 {
+            return Ok(first as usize);
+        }
+        let count = (first & 0x7f) as usize;
+        let mut value = 0usize;
+        for _ in 0..count {
+            value = (value << 8) | *bytes.get(*at).ok_or("short signature")? as usize;
+            *at += 1;
+        }
+        Ok(value)
+    }
+    fn integer(bytes: &[u8], at: &mut usize) -> Result<[u8; 32], String> {
+        if bytes.get(*at) != Some(&0x02) {
+            return Err("not an integer".to_string());
+        }
+        *at += 1;
+        let size = length(bytes, at)?;
+        let body = bytes.get(*at..*at + size).ok_or("short signature")?;
+        *at += size;
+        let trimmed = match body.iter().position(|byte| *byte != 0) {
+            Some(first) => &body[first..],
+            None => &[0u8][..],
+        };
+        if trimmed.len() > 32 {
+            return Err("integer too long".to_string());
+        }
+        let mut out = [0u8; 32];
+        out[32 - trimmed.len()..].copy_from_slice(trimmed);
+        Ok(out)
+    }
+    let mut at = 0;
+    if der.first() != Some(&0x30) {
+        return Err("not a sequence".to_string());
+    }
+    at += 1;
+    length(der, &mut at)?;
+    let r = integer(der, &mut at)?;
+    let s = integer(der, &mut at)?;
+    let mut raw = [0u8; 64];
+    raw[..32].copy_from_slice(&r);
+    raw[32..].copy_from_slice(&s);
+    Ok(raw)
+}
+
+pub fn decode_payload(payload: &str) -> Result<Vec<u8>, String> {
+    URL_SAFE_NO_PAD.decode(payload).map_err(|e| e.to_string())
+}
+
+async fn blocking<T: Send + 'static>(
+    work: impl FnOnce() -> Result<T, String> + Send + 'static,
+) -> Result<T, String> {
+    tauri::async_runtime::spawn_blocking(work)
+        .await
+        .map_err(|e| e.to_string())?
+}
+
+#[tauri::command]
+pub async fn parlor_device_key_public(
+    app: AppHandle,
+    presence: bool,
+    challenge: String,
+) -> Result<PublicKeys, String> {
+    let identifier = app.config().identifier.clone();
+    blocking(move || {
+        let signing = report_of(&keystore::signing_key(&identifier)?.point()?);
+        let presence = if presence {
+            keystore::presence_key(&identifier)?
+                .map(|key| key.point().map(|point| report_of(&point)))
+                .transpose()?
+        } else {
+            None
+        };
+        let bytes = enrollment_bytes(&challenge, &signing, presence.as_ref());
+        let raw = keystore::signing_key(&identifier)?.sign(&bytes)?;
+        Ok(PublicKeys {
+            signing,
+            presence,
+            proof: Proof {
+                signature: encode(&raw),
+            },
+        })
+    })
+    .await
+}
+
+#[tauri::command]
+pub async fn parlor_device_key_sign(
+    app: AppHandle,
+    key_id: String,
+    payload: String,
+) -> Result<Signature, String> {
+    let identifier = app.config().identifier.clone();
+    blocking(move || {
+        let bytes = decode_payload(&payload)?;
+        let key = keystore::find(&identifier, &key_id)?;
+        Ok(Signature {
+            signature: encode(&key.sign(&bytes)?),
+        })
+    })
+    .await
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn report(x: &str, y: &str) -> KeyReport {
+        KeyReport {
+            key_id: thumbprint(x, y),
+            public_key: PublicJwk {
+                kty: "EC",
+                crv: "P-256",
+                x: x.to_string(),
+                y: y.to_string(),
+            },
+        }
+    }
+
+    #[test]
+    fn the_enrollment_bytes_match_the_canonical_json_of_the_web_adapter() {
+        let signing = report("AAA", "BBB");
+        let text = String::from_utf8(enrollment_bytes("chal", &signing, None)).unwrap();
+        assert_eq!(
+            text,
+            r#"{"challenge":"chal","presence":null,"signing":{"crv":"P-256","kty":"EC","x":"AAA","y":"BBB"}}"#
+        );
+        let presence = report("CCC", "DDD");
+        let text = String::from_utf8(enrollment_bytes("chal", &signing, Some(&presence))).unwrap();
+        assert_eq!(
+            text,
+            format!(
+                r#"{{"challenge":"chal","presence":{{"format":"es256-raw","id":"{}","publicKey":{{"crv":"P-256","kty":"EC","x":"CCC","y":"DDD"}}}},"signing":{{"crv":"P-256","kty":"EC","x":"AAA","y":"BBB"}}}}"#,
+                presence.key_id
+            )
+        );
+    }
+
+    #[test]
+    fn the_key_id_is_the_sha256_thumbprint_of_the_sorted_point() {
+        assert_eq!(
+            thumbprint("x", "y"),
+            encode(&Sha256::digest(
+                br#"{"crv":"P-256","kty":"EC","x":"x","y":"y"}"#
+            ))
+        );
+        assert_eq!(thumbprint("x", "y").len(), 43);
+    }
+
+    #[test]
+    fn der_signatures_become_raw_r_and_s() {
+        let mut der = vec![0x30, 0x44, 0x02, 0x20];
+        der.extend([1u8; 32]);
+        der.extend([0x02, 0x20]);
+        der.extend([2u8; 32]);
+        let raw = der_to_raw(&der).unwrap();
+        assert_eq!(&raw[..32], &[1u8; 32]);
+        assert_eq!(&raw[32..], &[2u8; 32]);
+    }
+
+    #[test]
+    fn der_integers_lose_their_sign_padding_and_gain_leading_zeros() {
+        let mut der = vec![0x30, 0x26, 0x02, 0x21, 0x00];
+        der.extend([0xffu8; 32]);
+        der.extend([0x02, 0x01, 0x05]);
+        let raw = der_to_raw(&der).unwrap();
+        assert_eq!(&raw[..32], &[0xffu8; 32]);
+        assert_eq!(raw[63], 5);
+        assert_eq!(&raw[32..63], &[0u8; 31]);
+        assert!(der_to_raw(&[0x31, 0x00]).is_err());
+    }
+
+    #[test]
+    fn a_missing_presence_key_is_left_out_of_the_reply() {
+        let keys = PublicKeys {
+            signing: report("a", "b"),
+            presence: None,
+            proof: Proof {
+                signature: "s".to_string(),
+            },
+        };
+        let json = serde_json::to_value(&keys).unwrap();
+        assert!(json.get("presence").is_none());
+        assert_eq!(json["signing"]["publicKey"]["kty"], "EC");
+        assert_eq!(json["signing"]["keyId"], keys.signing.key_id);
+    }
+}

package/rust/src/dialog.rs

@@ -0,0 +1,22 @@
+pub fn title(app_name: &str) -> String {
+    format!("Connect this Mac to {app_name}")
+}
+
+pub fn message(app_name: &str, account: &str, matching_code: &str) -> String {
+    format!(
+        "Let {app_name} use the agents on this Mac as {account}?\n\nCode: {matching_code}\n\nContinue only if you started this in {app_name}."
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_dialog_names_the_app_the_account_and_the_code() {
+        assert_eq!(title("Hello"), "Connect this Mac to Hello");
+        let text = message("Hello", "alice@example.com", "ABC-234");
+        assert!(text.contains("alice@example.com"));
+        assert!(text.contains("ABC-234"));
+    }
+}