akanjs 3.0.0-beta.20 → 3.0.0-beta.21

package/vendor/@akanjs/native/native/desktop/src/json.rs

@@ -0,0 +1,272 @@
+//! Minimal JSON reader for the shell config, and string quoting for events.
+//! Kept in-tree because serde is not in the wry/tao dependency tree.
+
+#[allow(dead_code)] // arrays and nulls are parsed but the config does not read them
+pub enum V {
+  Null,
+  Bool(bool),
+  Num(f64),
+  Str(String),
+  Arr(Vec<V>),
+  Obj(Vec<(String, V)>),
+}
+
+impl V {
+  pub fn get(&self, k: &str) -> Option<&V> {
+    if let V::Obj(o) = self {
+      o.iter().find(|(kk, _)| kk == k).map(|(_, v)| v)
+    } else {
+      None
+    }
+  }
+  pub fn as_str(&self) -> Option<&str> {
+    if let V::Str(s) = self {
+      Some(s)
+    } else {
+      None
+    }
+  }
+  pub fn as_f64(&self) -> Option<f64> {
+    if let V::Num(n) = self {
+      Some(*n)
+    } else {
+      None
+    }
+  }
+  pub fn as_bool(&self) -> Option<bool> {
+    if let V::Bool(b) = self {
+      Some(*b)
+    } else {
+      None
+    }
+  }
+}
+
+/// Deeper nesting is refused: each level is a recursive call, and a page could send an array nested
+/// a million deep (menu items reach shell_op on the main thread) to overflow the stack.
+const MAX_DEPTH: usize = 128;
+
+pub fn parse(s: &str) -> Result<V, String> {
+  let mut p = P { b: s.as_bytes(), i: 0, depth: 0 };
+  let v = p.val()?;
+  p.ws();
+  if p.i != p.b.len() {
+    return Err(format!("trailing data at {}", p.i));
+  }
+  Ok(v)
+}
+
+struct P<'a> {
+  b: &'a [u8],
+  i: usize,
+  depth: usize,
+}
+
+impl P<'_> {
+  fn ws(&mut self) {
+    while self.i < self.b.len() && matches!(self.b[self.i], b' ' | b'\n' | b'\r' | b'\t') {
+      self.i += 1;
+    }
+  }
+
+  fn eat(&mut self, c: u8) -> Result<(), String> {
+    self.ws();
+    if self.b.get(self.i) == Some(&c) {
+      self.i += 1;
+      Ok(())
+    } else {
+      Err(format!("expected '{}' at {}", c as char, self.i))
+    }
+  }
+
+  fn val(&mut self) -> Result<V, String> {
+    self.ws();
+    let nested = matches!(self.b.get(self.i), Some(b'{' | b'['));
+    if nested {
+      if self.depth == MAX_DEPTH {
+        return Err(format!("nested deeper than {MAX_DEPTH} at {}", self.i));
+      }
+      self.depth += 1;
+    }
+    let v = self.value();
+    if nested {
+      self.depth -= 1;
+    }
+    v
+  }
+
+  fn value(&mut self) -> Result<V, String> {
+    match self.b.get(self.i).copied() {
+      Some(b'{') => {
+        self.i += 1;
+        let mut o = Vec::new();
+        self.ws();
+        if self.b.get(self.i) == Some(&b'}') {
+          self.i += 1;
+          return Ok(V::Obj(o));
+        }
+        loop {
+          self.ws();
+          let k = self.string()?;
+          self.eat(b':')?;
+          o.push((k, self.val()?));
+          self.ws();
+          match self.b.get(self.i) {
+            Some(b',') => self.i += 1,
+            Some(b'}') => {
+              self.i += 1;
+              return Ok(V::Obj(o));
+            }
+            _ => return Err(format!("bad object at {}", self.i)),
+          }
+        }
+      }
+      Some(b'[') => {
+        self.i += 1;
+        let mut a = Vec::new();
+        self.ws();
+        if self.b.get(self.i) == Some(&b']') {
+          self.i += 1;
+          return Ok(V::Arr(a));
+        }
+        loop {
+          a.push(self.val()?);
+          self.ws();
+          match self.b.get(self.i) {
+            Some(b',') => self.i += 1,
+            Some(b']') => {
+              self.i += 1;
+              return Ok(V::Arr(a));
+            }
+            _ => return Err(format!("bad array at {}", self.i)),
+          }
+        }
+      }
+      Some(b'"') => Ok(V::Str(self.string()?)),
+      Some(b't') if self.b[self.i..].starts_with(b"true") => {
+        self.i += 4;
+        Ok(V::Bool(true))
+      }
+      Some(b'f') if self.b[self.i..].starts_with(b"false") => {
+        self.i += 5;
+        Ok(V::Bool(false))
+      }
+      Some(b'n') if self.b[self.i..].starts_with(b"null") => {
+        self.i += 4;
+        Ok(V::Null)
+      }
+      Some(_) => {
+        let st = self.i;
+        while self.i < self.b.len() && matches!(self.b[self.i], b'-' | b'+' | b'.' | b'e' | b'E' | b'0'..=b'9') {
+          self.i += 1;
+        }
+        std::str::from_utf8(&self.b[st..self.i])
+          .unwrap()
+          .parse()
+          .map(V::Num)
+          .map_err(|_| format!("bad number at {st}"))
+      }
+      None => Err("unexpected end".into()),
+    }
+  }
+
+  fn string(&mut self) -> Result<String, String> {
+    if self.b.get(self.i) != Some(&b'"') {
+      return Err(format!("expected string at {}", self.i));
+    }
+    self.i += 1;
+    let mut out = String::new();
+    loop {
+      let c = *self.b.get(self.i).ok_or("unterminated string")?;
+      self.i += 1;
+      match c {
+        b'"' => return Ok(out),
+        b'\\' => {
+          let e = *self.b.get(self.i).ok_or("bad escape")?;
+          self.i += 1;
+          match e {
+            b'"' => out.push('"'),
+            b'\\' => out.push('\\'),
+            b'/' => out.push('/'),
+            b'b' => out.push('\u{8}'),
+            b'f' => out.push('\u{c}'),
+            b'n' => out.push('\n'),
+            b'r' => out.push('\r'),
+            b't' => out.push('\t'),
+            b'u' => {
+              let hex = |p: &mut Self| -> Result<u32, String> {
+                let h = std::str::from_utf8(p.b.get(p.i..p.i + 4).ok_or("bad \\u")?).map_err(|_| "bad \\u")?;
+                if !h.bytes().all(|b| b.is_ascii_hexdigit()) {
+                  return Err("bad \\u".into()); // from_str_radix would take "+abc"
+                }
+                p.i += 4;
+                u32::from_str_radix(h, 16).map_err(|_| "bad \\u".to_string())
+              };
+              let mut cp = hex(self)?;
+              if (0xD800..0xDC00).contains(&cp) && self.b.get(self.i..self.i + 2) == Some(b"\\u") {
+                self.i += 2;
+                let lo = hex(self)?;
+                cp = 0x10000 + ((cp - 0xD800) << 10) + (lo.wrapping_sub(0xDC00) & 0x3ff);
+              }
+              out.push(char::from_u32(cp).unwrap_or('\u{fffd}'));
+            }
+            _ => return Err("bad escape".into()),
+          }
+        }
+        _ => {
+          // Copy a whole UTF-8 sequence.
+          let st = self.i - 1;
+          let len = match c {
+            0x00..=0x7f => 1,
+            0xc0..=0xdf => 2,
+            0xe0..=0xef => 3,
+            _ => 4,
+          };
+          self.i = (st + len).min(self.b.len());
+          out.push_str(std::str::from_utf8(&self.b[st..self.i]).map_err(|_| "bad utf8")?);
+        }
+      }
+    }
+  }
+}
+
+pub fn quote(s: &str) -> String {
+  let mut o = String::with_capacity(s.len() + 2);
+  o.push('"');
+  for c in s.chars() {
+    match c {
+      '"' => o.push_str("\\\""),
+      '\\' => o.push_str("\\\\"),
+      '\n' => o.push_str("\\n"),
+      '\r' => o.push_str("\\r"),
+      '\t' => o.push_str("\\t"),
+      c if (c as u32) < 0x20 => o.push_str(&format!("\\u{:04x}", c as u32)),
+      c => o.push(c),
+    }
+  }
+  o.push('"');
+  o
+}
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+
+  #[test]
+  fn nesting_is_limited() {
+    let ok = format!("{}{}", "[".repeat(MAX_DEPTH), "]".repeat(MAX_DEPTH));
+    assert!(parse(&ok).is_ok());
+    let deep = format!("{}{}", "[".repeat(MAX_DEPTH + 1), "]".repeat(MAX_DEPTH + 1));
+    assert!(parse(&deep).err().is_some_and(|e| e.contains("nested deeper")));
+    // A million levels: an error, not a stack overflow.
+    assert!(parse(&"[".repeat(1_000_000)).is_err());
+    assert!(parse(r#"{"a":[{"b":[1,2,{"c":{}}]}]}"#).is_ok());
+  }
+
+  #[test]
+  fn unicode_escapes_are_four_hex_digits() {
+    assert!(matches!(parse(r#""é""#), Ok(V::Str(s)) if s == "é"));
+    assert!(parse(r#""\u+0e9""#).is_err());
+    assert!(parse(r#""\u00g9""#).is_err());
+  }
+}

package/vendor/@akanjs/native/native/desktop/src/keychain.rs

@@ -0,0 +1,151 @@
+//! Generic passwords in the login keychain, created by the app itself (secure-storage's data key
+//! on macOS). SecItem* from Security.framework are declared here and called with Foundation
+//! dictionaries, which are toll-free bridged to CFDictionary (plugins.md Q-P6 (b1): no binding crate).
+//!   keychain.get    {service, account}          → {"value": string | null}
+//!   keychain.set    {service, account, value}   → null
+//!   keychain.delete {service, account}          → null
+//!
+//! Why in-process: an item added by /usr/bin/security trusts that tool (partition "apple-tool:"),
+//! so any process of the user can read it through the tool without a prompt. An item the app adds
+//! trusts the app. Measured on macOS 26 with `akan-native signing setup`'s self-signed identity: the ACL
+//! holds the stable requirement `identifier "<id>" and certificate leaf = H"…"`, but the partition
+//! list holds `cdhash:<creating build>` (apps without a Team ID get cdhash partitions), so the next
+//! build is asked "wants to use your confidential information". Only Team ID signatures (partition
+//! `teamid:…`, CLI-9) make this silent across builds; secure-storage uses these ops only then.
+//! The calls run on a thread: a keychain prompt blocks until the user answers.
+
+use std::ffi::c_void;
+
+use objc2::{rc::Retained, runtime::AnyObject, Message};
+use objc2_foundation::{NSData, NSDictionary, NSNumber, NSString};
+
+use crate::json;
+
+#[allow(non_upper_case_globals)]
+#[link(name = "Security", kind = "framework")]
+extern "C" {
+  static kSecClass: *const NSString;
+  static kSecClassGenericPassword: *const NSString;
+  static kSecAttrService: *const NSString;
+  static kSecAttrAccount: *const NSString;
+  static kSecValueData: *const NSString;
+  static kSecReturnData: *const NSString;
+  static kSecMatchLimit: *const NSString;
+  static kSecMatchLimitOne: *const NSString;
+  fn SecItemAdd(attributes: *const c_void, result: *mut *const c_void) -> i32;
+  fn SecItemCopyMatching(query: *const c_void, result: *mut *const c_void) -> i32;
+  fn SecItemUpdate(query: *const c_void, attributes: *const c_void) -> i32;
+  fn SecItemDelete(query: *const c_void) -> i32;
+}
+
+const ERR_SEC_ITEM_NOT_FOUND: i32 = -25300;
+const ERR_SEC_DUPLICATE_ITEM: i32 = -25299;
+
+/// Security.framework's CFString constants as &NSString (toll-free bridged, alive for the process).
+fn key(k: *const NSString) -> &'static NSString {
+  unsafe { &*k }
+}
+
+fn dictionary(pairs: &[(&'static NSString, &AnyObject)]) -> Retained<NSDictionary<NSString, AnyObject>> {
+  let keys: Vec<&NSString> = pairs.iter().map(|(k, _)| *k).collect();
+  let values: Vec<&AnyObject> = pairs.iter().map(|(_, v)| *v).collect();
+  NSDictionary::from_slices(&keys, &values)
+}
+
+fn describe(status: i32) -> String {
+  match status {
+    -25308 => "the keychain refused without asking (errSecInteractionNotAllowed)".into(),
+    -128 => "the user denied keychain access".into(),
+    -25293 => "keychain authorization failed".into(),
+    other => format!("keychain error {other}"),
+  }
+}
+
+fn base(service: &NSString, account: &NSString) -> Vec<(&'static NSString, Retained<AnyObject>)> {
+  unsafe {
+    vec![
+      (key(kSecClass), Retained::cast_unchecked::<AnyObject>(key(kSecClassGenericPassword).retain())),
+      (key(kSecAttrService), Retained::cast_unchecked::<AnyObject>(service.retain())),
+      (key(kSecAttrAccount), Retained::cast_unchecked::<AnyObject>(account.retain())),
+    ]
+  }
+}
+
+fn as_pairs<'a>(owned: &'a [(&'static NSString, Retained<AnyObject>)]) -> Vec<(&'static NSString, &'a AnyObject)> {
+  owned.iter().map(|(k, v)| (*k, &**v)).collect()
+}
+
+pub fn get(service: &str, account: &str) -> Result<Option<String>, String> {
+  let (service, account) = (NSString::from_str(service), NSString::from_str(account));
+  let mut q = base(&service, &account);
+  unsafe {
+    q.push((key(kSecReturnData), Retained::cast_unchecked(NSNumber::new_bool(true))));
+    q.push((key(kSecMatchLimit), Retained::cast_unchecked(key(kSecMatchLimitOne).retain())));
+  }
+  let query = dictionary(&as_pairs(&q));
+  let mut out: *const c_void = std::ptr::null();
+  let status = unsafe { SecItemCopyMatching(Retained::as_ptr(&query).cast(), &mut out) };
+  match status {
+    0 => {
+      // Owned (+1) CFData, i.e. NSData.
+      let data = unsafe { Retained::from_raw(out as *mut NSData) }.ok_or("the keychain returned no data")?;
+      String::from_utf8(data.to_vec()).map(Some).map_err(|_| "the keychain item is not UTF-8".to_string())
+    }
+    ERR_SEC_ITEM_NOT_FOUND => Ok(None),
+    other => Err(describe(other)),
+  }
+}
+
+pub fn set(service: &str, account: &str, value: &str) -> Result<(), String> {
+  let (service, account) = (NSString::from_str(service), NSString::from_str(account));
+  let data = NSData::with_bytes(value.as_bytes());
+  let q = base(&service, &account);
+  let mut add = base(&service, &account);
+  add.push((key(unsafe { kSecValueData }), unsafe { Retained::cast_unchecked(data.clone()) }));
+  let status = unsafe { SecItemAdd(Retained::as_ptr(&dictionary(&as_pairs(&add))).cast(), std::ptr::null_mut()) };
+  match status {
+    0 => Ok(()),
+    ERR_SEC_DUPLICATE_ITEM => {
+      let update = dictionary(&[(key(unsafe { kSecValueData }), &**unsafe { &Retained::cast_unchecked::<AnyObject>(data) })]);
+      match unsafe { SecItemUpdate(Retained::as_ptr(&dictionary(&as_pairs(&q))).cast(), Retained::as_ptr(&update).cast()) } {
+        0 => Ok(()),
+        other => Err(describe(other)),
+      }
+    }
+    other => Err(describe(other)),
+  }
+}
+
+pub fn delete(service: &str, account: &str) -> Result<(), String> {
+  let (service, account) = (NSString::from_str(service), NSString::from_str(account));
+  let q = base(&service, &account);
+  match unsafe { SecItemDelete(Retained::as_ptr(&dictionary(&as_pairs(&q))).cast()) } {
+    0 | ERR_SEC_ITEM_NOT_FOUND => Ok(()),
+    other => Err(describe(other)),
+  }
+}
+
+fn run(cmd: &json::V) -> Result<String, String> {
+  let op = cmd.get("op").and_then(|v| v.as_str()).unwrap_or("");
+  let text = |name: &str| cmd.get(name).and_then(|v| v.as_str()).filter(|s| !s.is_empty()).ok_or(format!("{op}: {name} must be a non-empty string"));
+  let (service, account) = (text("service")?, text("account")?);
+  match op {
+    "keychain.get" => get(service, account).map(|v| format!(r#"{{"value":{}}}"#, v.map_or("null".into(), |s| json::quote(&s)))),
+    "keychain.set" => set(service, account, cmd.get("value").and_then(|v| v.as_str()).ok_or("keychain.set: value must be a string")?).map(|_| "null".into()),
+    "keychain.delete" => delete(service, account).map(|_| "null".into()),
+    _ => Err(format!("unknown op {op}")),
+  }
+}
+
+/// keychain.* ops: answered from a thread through `crate::reply`.
+pub fn shell_op(id: u64, json_text: &str) -> bool {
+  if !json_text.contains("\"keychain.") {
+    return false;
+  }
+  let Ok(cmd) = json::parse(json_text) else { return false };
+  if !cmd.get("op").and_then(|v| v.as_str()).is_some_and(|op| op.starts_with("keychain.")) {
+    return false;
+  }
+  std::thread::spawn(move || crate::reply(id, objc2::rc::autoreleasepool(|_| run(&cmd))));
+  true
+}