tabby-rdp 0.5.0 → 0.5.2

package/dist/signin.js

@@ -3,13 +3,22 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.STYLE = exports.VAULT_SECRET_TYPE = void 0;
 exports.useVault = useVault;
 exports.storeName = storeName;
+exports.forgetOnce = forgetOnce;
+exports.renameCredentials = renameCredentials;
 exports.loadCredentials = loadCredentials;
 exports.hasCredentials = hasCredentials;
 exports.saveCredentials = saveCredentials;
+exports.saveCredentialsIf = saveCredentialsIf;
+exports.forgetMark = forgetMark;
+exports.forgottenSince = forgottenSince;
 exports.forgetCredentials = forgetCredentials;
 exports.forgetCredentialsOrFail = forgetCredentialsOrFail;
+exports.forgetCredentialsIf = forgetCredentialsIf;
+exports.gatewayScope = gatewayScope;
+exports.isFor = isFor;
 exports.forgetCredentialsFor = forgetCredentialsFor;
 exports.moveCredentialsFor = moveCredentialsFor;
+exports.forgetFormerKey = forgetFormerKey;
 exports.askCredentials = askCredentials;
 /**
  * Sign-in for desktops that use their own accounts (Windows): a form in the desktop layer, and where passwords are
@@ -17,6 +26,7 @@ exports.askCredentials = askCredentials;
  * keychain.
  */
 const desktops_1 = require("./desktops");
+const gateway_1 = require("./gateway");
 const KEYCHAIN_SERVICE = 'tabby-rdp';
 /** The Vault secret type of a desktop's or account's password; its key is `{ key, name }` (see vaultKey). */
 exports.VAULT_SECRET_TYPE = 'rdp:password';
@@ -42,8 +52,14 @@ function storeName() {
  * back, so two at once (two desktops signing in together) would lose one's change.
  */
 let vaultQueue = Promise.resolve();
+/** Same-origin windows share these locks. Store work holds the lock through its actual completion. */
+async function storeLock(name, work, signal) {
+    const locks = globalThis.navigator?.locks;
+    return locks ? await locks.request(`tabby-rdp.credentials.${name}`, signal ? { signal } : {}, work) : work();
+}
 function queued(work) {
-    const next = vaultQueue.then(work, work);
+    const run = () => storeLock('vault', work);
+    const next = vaultQueue.then(run, run);
     vaultQueue = next.catch(() => null);
     return next;
 }
@@ -52,8 +68,9 @@ function vaultKey(key) {
     return { key };
 }
 function vaultName(key) {
-    const [who, address] = key.split('#', 2);
-    return who === 'account' ? `saved account` : who === desktops_1.DIRECT_KEY ? `${address} (direct)` : address ? `${address} behind ${who}` : who;
+    const { target, desktopId, gateway } = (0, desktops_1.keyParts)(key);
+    const where = `${desktopId}${gateway ? gateway.replace('@gateway#', ' through gateway ') : ''}`;
+    return target === 'account' ? `saved account` : target === desktops_1.DIRECT_KEY ? `${where} (direct)` : desktopId ? `${where} behind ${target}` : target;
 }
 // The system keychain can keep a call waiting indefinitely: on Linux, a locked or missing keyring waits for an unlock
 // prompt, which a session without a keyring prompter never shows. Give up after a while. A call that never returns
@@ -81,16 +98,21 @@ function keytar() {
  */
 function keychain(call) {
     const run = () => new Promise((resolve, reject) => {
-        const store = keytar();
-        if (!store) {
-            resolve(undefined);
+        if (keychainStuck) {
+            reject(new Error('the keychain did not answer earlier'));
             return;
         }
+        const abort = new AbortController();
         const timer = setTimeout(() => {
             keychainStuck = true;
+            abort.abort(); // cancels a lock still waiting, never a native call already running
             reject(new Error('the keychain did not answer'));
         }, KEYCHAIN_TIMEOUT_MS);
-        Promise.resolve(call(store)).then(value => { clearTimeout(timer); resolve(value); }, error => { clearTimeout(timer); reject(error); });
+        // Timeout is outside the lock: a late native write keeps other windows' writes behind it until it ends.
+        storeLock('keychain', async () => {
+            const store = keytar();
+            return store ? call(store) : undefined;
+        }, abort.signal).then(value => { clearTimeout(timer); resolve(value); }, error => { clearTimeout(timer); reject(error); });
     });
     const next = keychainQueue.then(run, run);
     keychainQueue = next.catch(() => null);
@@ -105,12 +127,198 @@ function parseCredentials(saved) {
         return null;
     }
 }
+let once = null;
+let onceRunning = null;
+/**
+ * Forgets the saved passwords whose key `forgets` matches, once in this computer's keychain and once in the Vault,
+ * before the store is next used: when it is asked anyway, so that a locked Vault asks for its passphrase at a sign-in
+ * rather than when Tabby starts. Each part's mark is read as that part is about to be done (another Tabby window may
+ * have done it since this one asked). A part that can't be done then (the keychain doesn't answer, or can't list what
+ * it holds; the Vault's prompt is cancelled) is tried again at the next use, and until it is done, what it would
+ * forget isn't looked up in that store (see withheld): the desktop asks.
+ */
+function forgetOnce(mark, forgets, vault) {
+    once = { mark, forgets, vault, keychainDone: false };
+}
+/** Does what forgetOnce and forgetLater left to do, if anything, and waits for it to end. */
+async function used() {
+    if (once && !onceRunning) {
+        const job = once;
+        onceRunning = doOnce(job).catch(() => undefined).finally(() => { onceRunning = null; });
+    }
+    await onceRunning;
+    // A previous background pass may have failed before the store became available. This use gets one fresh attempt.
+    await laterRunning;
+    if (later.length && !laterRunning) {
+        laterRunning = doLater().catch(() => undefined).finally(() => { laterRunning = null; });
+    }
+    await laterRunning;
+}
+/** forgetOnce's work: the keychain's part first, and on its own, so a Vault that can't be read doesn't hold it up. */
+async function doOnce(job) {
+    let forgets;
+    try {
+        forgets = job.forgets();
+    }
+    catch {
+        return;
+    }
+    if (!job.keychainDone) {
+        try {
+            job.keychainDone = await keychainOnce(job.mark, forgets);
+        }
+        catch { }
+    }
+    if (!job.vault.done()) {
+        try {
+            if (vaultOn()) {
+                // Read in full or not at all: a passphrase prompt cancelled throws, and the part is tried again.
+                const contents = await vault.load();
+                for (const secret of contents?.secrets ?? []) {
+                    if (secret.type === exports.VAULT_SECRET_TYPE && typeof secret.key?.key === 'string' && forgets(secret.key.key)) {
+                        await queued(() => vault.removeSecret(exports.VAULT_SECRET_TYPE, vaultKey(secret.key.key)));
+                    }
+                }
+            }
+            // With the Vault off there is nothing in it: Tabby drops its contents when it is turned off.
+            job.vault.markDone();
+        }
+        catch { }
+    }
+    if (job.keychainDone && job.vault.done() && once === job) {
+        once = null;
+    }
+}
+/**
+ * This computer's keychain's part of forgetOnce: done before (its mark is there), or now, and marked. True without a
+ * keychain, where there is nothing to do. Throws when the keychain doesn't answer, or can't list what it holds: a
+ * part done on a listing that came back empty because of that would leave what it should have forgotten in place.
+ */
+async function keychainOnce(mark, forgets) {
+    const marked = await keychain(store => store.getPassword(KEYCHAIN_SERVICE, mark));
+    if (marked === undefined || marked) {
+        return true;
+    }
+    const entries = await keychain(store => store.findCredentials(KEYCHAIN_SERVICE));
+    for (const { account } of entries ?? []) {
+        if (typeof account === 'string' && account !== mark && forgets(account)) {
+            await keychain(store => store.deletePassword(KEYCHAIN_SERVICE, account));
+        }
+    }
+    await keychain(store => store.setPassword(KEYCHAIN_SERVICE, mark, 'done'));
+    return true;
+}
+/**
+ * Forgets that couldn't be done when they were asked for (see forgetLater), each of one store's part: the Vault's
+ * (`inVault`), or the keychain's. Each is done the next time its store is used and can be read (see used, doLater),
+ * and what it would forget isn't looked up in that store meanwhile (see withheld). `saved`: keys a password was saved
+ * under in that store since, which is a new one, and stays. Kept in this window's memory, for as long as it is open.
+ */
+const later = [];
+let laterRunning = null;
+/**
+ * The saved passwords whose key `forgets` matches are to go from one store (the Vault, or with `inVault` false the
+ * keychain), and couldn't now (it couldn't be listed or wouldn't forget: a Vault whose passphrase prompt was
+ * cancelled, a keychain that didn't answer): forgotten once that store can be read (see doLater), and not used from it
+ * meanwhile, so that the desktop asks. The other store's part doesn't wait for it.
+ */
+function forgetLater(forgets, inVault) {
+    later.push({ forgets, inVault, saved: new Set() });
+}
+/**
+ * forgetLater's work, each store's part on its own, so that one that can't be read doesn't hold up the other: the
+ * keychain's whenever it can be listed; the Vault's at once while the Vault is off (there is nothing in it then: Tabby
+ * drops its contents when it is turned off), and otherwise once it is open. Not at the cost of a passphrase prompt of
+ * its own: with the Vault locked, its part waits for the Vault's next unlock (by whatever unlocks it, a password looked
+ * up or saved), and what it covers isn't used meanwhile.
+ */
+async function doLater() {
+    for (const inVault of [true, false]) {
+        const jobs = later.filter(job => job.inVault === inVault);
+        if (!jobs.length || inVault && vaultOn() && !vaultOpen()) {
+            continue;
+        }
+        const entries = await entriesOf(inVault);
+        if (!entries) {
+            continue;
+        }
+        for (const job of jobs) {
+            if (await forgetListed(inVault, entries, job.forgets, job.saved)) {
+                later.splice(later.indexOf(job), 1);
+            }
+        }
+    }
+}
+function vaultOpen() {
+    try {
+        return !!vault?.isOpen();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Whether `key` is one forgetOnce's work would forget from that store (the Vault, or with `inVault` false the
+ * keychain), and that part isn't done yet (see used), or one a forget left for later would forget from that store (see
+ * forgetLater): what is saved under it there isn't used meanwhile.
+ */
+function withheld(key, inVault) {
+    if (later.some(job => job.inVault === inVault && !job.saved.has(key) && job.forgets(key))) {
+        return true;
+    }
+    const job = once;
+    if (!job || (inVault ? job.vault.done() : job.keychainDone)) {
+        return false;
+    }
+    try {
+        return job.forgets()(key);
+    }
+    catch {
+        return true;
+    }
+}
+/**
+ * Targets whose key changed (see RemoteTargets.keyChanged): the key each had up to 0.5.0, by the key it has now. A
+ * password saved under the former one moves to the new one the first time it is looked for there (see loadCredentials):
+ * when its store is asked anyway, so a locked Vault asks for its passphrase at a sign-in rather than when a tab opens.
+ */
+const formerKeys = new Map();
+/** A target's key changed from `from` to `to` (see formerKeys). */
+function renameCredentials(from, to) {
+    if (from !== to) {
+        formerKeys.set(to, from);
+    }
+}
 /**
  * Saved credentials for a desktop (keyed by its session key) or an account (`account#<id>`), or null. With the Vault
- * on, the keychain is still read for what was saved before it was turned on.
+ * on, the keychain is still read for what was saved before it was turned on. Credentials saved under the target's
+ * former key (see formerKeys) are moved under this one, and returned.
  */
 async function loadCredentials(key) {
-    if (vaultOn()) {
+    await used();
+    const found = await loadSaved(key);
+    if (found) {
+        return found;
+    }
+    for (const [to, from] of formerKeys) {
+        const former = (0, desktops_1.rekeyed)(key, to, from);
+        if (former) {
+            const moved = await loadSaved(former);
+            if (moved) {
+                // Forgotten there only once saved here: should the store refuse, it is found there again next time.
+                try {
+                    await saveCredentials(key, moved);
+                    await forgetCredentialsOrFail(former);
+                }
+                catch { }
+            }
+            return moved;
+        }
+    }
+    return null;
+}
+async function loadSaved(key) {
+    if (vaultOn() && !withheld(key, true)) {
         try {
             const secret = await vault.getSecret(exports.VAULT_SECRET_TYPE, vaultKey(key));
             const found = parseCredentials(secret?.value);
@@ -120,6 +328,9 @@ async function loadCredentials(key) {
         }
         catch { }
     }
+    if (withheld(key, false)) {
+        return null;
+    }
     try {
         return parseCredentials(await keychain(store => store.getPassword(KEYCHAIN_SERVICE, key)));
     }
@@ -158,16 +369,97 @@ async function hasCredentials(key) {
     }
 }
 async function saveCredentials(key, credentials, label) {
+    await saveCredentialsIf(key, credentials, () => true, label);
+}
+/**
+ * Checks a revision within the store queue/lock, including after an asynchronous write. If invalidated while writing,
+ * removes that write before a newer queued replacement can run. Never schedules a deletion behind a newer write.
+ */
+async function saveCredentialsIf(key, credentials, current, label) {
+    await used();
     if (vaultOn()) {
-        await queued(() => vault.addSecret({ type: exports.VAULT_SECRET_TYPE, key: { ...vaultKey(key), description: label ?? vaultName(key) }, value: JSON.stringify(credentials) }));
+        const saved = await queued(async () => {
+            if (!current()) {
+                return false;
+            }
+            await vault.addSecret({ type: exports.VAULT_SECRET_TYPE, key: { ...vaultKey(key), description: label ?? vaultName(key) }, value: JSON.stringify(credentials) });
+            if (!current()) {
+                await vault.removeSecret(exports.VAULT_SECRET_TYPE, vaultKey(key));
+                return false;
+            }
+            return true;
+        });
+        if (!saved) {
+            return false;
+        }
+        newlySaved(key, true);
         // Not in two places: what the keychain had for it goes.
         try {
-            await keychain(store => store.deletePassword(KEYCHAIN_SERVICE, key));
+            await keychain(async (store) => { if (current()) {
+                await store.deletePassword(KEYCHAIN_SERVICE, key);
+            } });
         }
         catch { }
-        return;
+        return true;
+    }
+    const saved = await keychain(async (store) => {
+        if (!current()) {
+            return false;
+        }
+        await store.setPassword(KEYCHAIN_SERVICE, key, JSON.stringify(credentials));
+        if (!current()) {
+            await store.deletePassword(KEYCHAIN_SERVICE, key);
+            return false;
+        }
+        return true;
+    });
+    if (saved) {
+        newlySaved(key, false);
+    }
+    return !!saved;
+}
+/**
+ * A password was saved under `key` just now, in the Vault or with `inVault` false the keychain, in place of what a
+ * forget left for later would forget from that store (see forgetLater): it stays. (What the other store has under that
+ * key is still the old one.) The rest of such a forget is done now, while the store that took the password can be read.
+ */
+function newlySaved(key, inVault) {
+    for (const job of later) {
+        if (job.inVault === inVault) {
+            job.saved.add(key);
+        }
+    }
+    if (later.length) {
+        used().catch(() => undefined);
     }
-    await keychain(store => store.setPassword(KEYCHAIN_SERVICE, key, JSON.stringify(credentials)));
+}
+/**
+ * The latest forgets (a password forgotten for a key, an edit or a removal of a desktop, the passwords under a former
+ * key), each with a number and what it covers. A sign-in that began before one and ends after it, the server having
+ * taken its time, mustn't save its password again, which would undo the forget (see forgottenSince). Only the last
+ * FORGETS_KEPT are kept.
+ */
+const FORGETS_KEPT = 256;
+const forgotten = [];
+let forgetCount = 0;
+/** Records a forget, as it is asked for: what began before it doesn't save under the keys it covers. */
+function noteForget(covers) {
+    forgotten.push({ n: ++forgetCount, covers });
+    if (forgotten.length > FORGETS_KEPT) {
+        forgotten.shift();
+    }
+}
+/** Where the forgets stand now: what a sign-in takes when its credentials are, to ask forgottenSince when it ends. */
+function forgetMark() {
+    return forgetCount;
+}
+/**
+ * Whether a forget covering `key` was asked for since `mark` (see forgetMark): the desktop was edited or removed, or
+ * what was saved for it forgotten, while a sign-in ended later was under way. A mark older than the forgets kept counts
+ * as forgotten since: a sign-in that slow asks again, at worst.
+ */
+function forgottenSince(key, mark) {
+    return forgetCount - mark > forgotten.length || forgotten.some(f => f.n > mark && f.covers(key));
 }
 async function forgetCredentials(key) {
     try {
@@ -177,56 +469,195 @@ async function forgetCredentials(key) {
 }
 /** As forgetCredentials, but a store that wouldn't (a Vault prompt cancelled, a keychain not answering) is reported. */
 async function forgetCredentialsOrFail(key) {
+    noteForget(k => k === key);
+    await used();
+    return forgetNow(key);
+}
+/** An account edit/removal must not delete a replacement committed by a later edit. */
+async function forgetCredentialsIf(key, current) {
+    noteForget(k => k === key);
+    await used();
     if (vaultOn()) {
-        await queued(() => vault.removeSecret(exports.VAULT_SECRET_TYPE, vaultKey(key)));
+        await queued(async () => { if (current()) {
+            await vault.removeSecret(exports.VAULT_SECRET_TYPE, vaultKey(key));
+        } });
+    }
+    await keychain(async (store) => { if (current()) {
+        await store.deletePassword(KEYCHAIN_SERVICE, key);
+    } });
+}
+/** Forgets what is saved under `key`, in both stores. */
+async function forgetNow(key) {
+    await forgetIn(true, key);
+    await forgetIn(false, key);
+}
+/** Forgets what is saved under `key` in one store: the Vault (while it is on), or with `inVault` false the keychain. */
+async function forgetIn(inVault, key) {
+    if (inVault) {
+        if (vaultOn()) {
+            await queued(() => vault.removeSecret(exports.VAULT_SECRET_TYPE, vaultKey(key)));
+        }
+        return;
     }
     // No keychain at all is not a failure to forget; one that didn't answer is.
     await keychain(store => store.deletePassword(KEYCHAIN_SERVICE, key));
 }
-/** Every saved entry's key and value, from the Vault (when on) and the keychain. */
-async function allCredentials() {
-    const entries = [];
-    if (vaultOn()) {
-        try {
-            const contents = await vault.load();
-            for (const secret of contents?.secrets ?? []) {
-                if (secret.type === exports.VAULT_SECRET_TYPE && typeof secret.key?.key === 'string') {
-                    entries.push({ account: secret.key.key, password: secret.value });
-                }
-            }
+/**
+ * Every entry saved in one store, by its key: the Vault's (none while it is off: Tabby drops its contents when it is
+ * turned off), or with `inVault` false the keychain's (none without one). Null where that store can't be listed in full
+ * now (a Vault whose passphrase prompt was cancelled, a keychain that doesn't answer): what goes by such a list,
+ * forgetting or moving a desktop's passwords, would leave the rest in place, and in use. Each store is listed on its
+ * own, so that one that can't be doesn't keep what the other holds from being done.
+ */
+async function entriesOf(inVault) {
+    try {
+        if (!inVault) {
+            const entries = await keychain(store => store.findCredentials(KEYCHAIN_SERVICE));
+            return (entries ?? []).filter(entry => typeof entry?.account === 'string');
         }
-        catch { }
+        if (!vaultOn()) {
+            return [];
+        }
+        const contents = await vault.load();
+        return (contents?.secrets ?? []).filter((secret) => secret?.type === exports.VAULT_SECRET_TYPE && typeof secret.key?.key === 'string')
+            .map((secret) => ({ account: secret.key.key, password: secret.value }));
     }
-    try {
-        entries.push(...await keychain(store => store.findCredentials(KEYCHAIN_SERVICE)) ?? []);
+    catch {
+        return null;
     }
-    catch { }
-    return entries;
 }
-/** Whether a saved account is for a desktop at this address behind some SSH host (not a direct one: `rdp#<id>`). */
-function isBehindHost(account, desktopId) {
-    return account.endsWith(`#${desktopId}`) && !account.startsWith(`${desktops_1.DIRECT_KEY}#`);
+/**
+ * Forgets from one store (the Vault, or with `inVault` false the keychain) what `entries`, all it holds (see
+ * entriesOf), has under a key `forgets` matches, but for those `kept`. False where it wouldn't forget one of them.
+ */
+async function forgetListed(inVault, entries, forgets, kept) {
+    let done = true;
+    for (const key of new Set(entries.map(({ account }) => account))) {
+        if (!kept?.has(key) && forgets(key)) {
+            try {
+                await forgetIn(inVault, key);
+            }
+            catch {
+                done = false;
+            }
+        }
+    }
+    return done;
+}
+/**
+ * What a saved desktop password's key adds for the RD Gateway it goes through (`@gateway#host:port`, the gateway as
+ * parseGateway has it, so another spelling of it is the same one), or '' for none. Whenever a desktop has a gateway,
+ * its password is kept for that gateway too, a gateway account of its own or not: a password saved for one gateway
+ * (or for a connection without one) is never sent through a different gateway named for the same address, which could
+ * lead somewhere else, without asking.
+ */
+function gatewayScope(gateway) {
+    const parsed = gateway ? (0, gateway_1.parseGateway)(gateway) : null;
+    return parsed ? `@gateway#${parsed.host}:${parsed.port}` : '';
+}
+/**
+ * Whether a credential key is one of a desktop's saved passwords (see SavedFor). Anchored on the key's parts, so an
+ * unrelated key that merely ends in `#<id>` (a gateway pin, or a desktop whose own id is a suffix of another's) isn't
+ * matched; a gateway suffix on the key doesn't change the id.
+ */
+function isFor(account, desktopId, which) {
+    const { target, desktopId: id, gateway } = (0, desktops_1.keyParts)(account);
+    return id === desktopId && (which.direct ? target === desktops_1.DIRECT_KEY : target !== desktops_1.DIRECT_KEY && target !== 'gateway' && target !== 'account') &&
+        (which.scope === undefined || gateway === which.scope);
 }
-/** Forgets saved accounts for a desktop on any SSH host (session keys ending in `#<id>`). */
-async function forgetCredentialsFor(desktopId) {
-    for (const { account } of await allCredentials()) {
-        if (isBehindHost(account, desktopId)) {
-            await forgetCredentials(account);
+/**
+ * Forgets a desktop's saved passwords (see SavedFor; by default those behind any SSH host, for any gateway), from each
+ * store on its own. Where one can't be listed or won't forget now, its part goes later, and what it has of them isn't
+ * used meanwhile (see forgetLater): a user name changed while the Vault's prompt is cancelled doesn't leave the old
+ * one's password to sign in with, and a keychain that doesn't answer doesn't keep the Vault's from going at once.
+ * Returns the stores whose part waits (none, as a rule).
+ */
+async function forgetCredentialsFor(desktopId, which = {}) {
+    const forgets = (key) => isFor(key, desktopId, which);
+    noteForget(forgets);
+    await used();
+    const waiting = [];
+    for (const inVault of [true, false]) {
+        const entries = await entriesOf(inVault);
+        if (!entries || !await forgetListed(inVault, entries, forgets)) {
+            forgetLater(forgets, inVault);
+            waiting.push(inVault ? 'vault' : 'keychain');
         }
     }
+    return waiting;
 }
-/** A desktop's address changed: its saved accounts (session keys ending in `#<from>`) move to the new address. */
-async function moveCredentialsFor(fromId, toId) {
-    for (const { account, password } of await allCredentials()) {
-        const credentials = parseCredentials(password);
-        if (isBehindHost(account, fromId) && credentials) {
-            try {
-                await saveCredentials(`${account.slice(0, -fromId.length)}${toId}`, credentials);
-                await forgetCredentials(account);
+/**
+ * A desktop's address changed: its saved passwords (see SavedFor) move to the new address, for the same gateway. One
+ * that another desktop already has there (one at that address behind the same host, say) stays that desktop's: the
+ * moved one is dropped rather than put in its place, and the edited desktop asks. So is one for an address where a
+ * desktop is known already (`known`, by the session key there: a certificate is remembered for it, as it is when each
+ * password is looked at): the machine there may be another desktop's, which would otherwise get the edited desktop's
+ * password unasked, its certificate checking out as its own.
+ *
+ * Behind an SSH host, a password moves only with the certificate remembered for its desktop (`known` at the old
+ * address), which goes along and stays at the old address too (see RemoteDesktopService.desktopEdited): a desktop
+ * behind a host trusts its first certificate unasked, so a password that came to the new address alone would go to
+ * whatever answers there first, and so would one that stayed at the old address without it (another desktop's,
+ * reached another way). The keys don't show which host a desktop entry is behind, so an edit moves the passwords at
+ * that address behind every host: this way none of them reaches a machine at the new address that isn't the one it was
+ * saved for (another host's, or the one a mistyped address leads to) without a question. Without a certificate, a
+ * password is dropped, and that desktop asks. What isn't to be used (see withheld) doesn't move either. Each store's
+ * part is done on its own: one that can't be listed (a Vault whose prompt was cancelled, a keychain that doesn't
+ * answer) moves nothing, what it has at the old address goes later (see forgetLater), and what it has at the new one
+ * can't be seen, so only the other store's tells what is there already. Returns the stores whose part waits (none, as
+ * a rule): what they have at the old address is found there again should this window close first, where the
+ * certificate stays (see RemoteDesktopService.desktopEdited).
+ */
+async function moveCredentialsFor(fromId, toId, which = {}, known = () => false) {
+    const forgets = (key) => isFor(key, fromId, which);
+    noteForget(forgets);
+    await used();
+    const stores = [];
+    for (const inVault of [true, false]) {
+        stores.push({ inVault, entries: await entriesOf(inVault) });
+    }
+    const taken = new Set(stores.flatMap(({ entries }) => entries ?? []).map(({ account }) => account));
+    const waiting = [];
+    for (const { inVault, entries } of stores) {
+        let done = !!entries;
+        for (const { account, password } of entries ?? []) {
+            const credentials = parseCredentials(password);
+            const { target, gateway } = (0, desktops_1.keyParts)(account);
+            if (forgets(account) && credentials) {
+                const to = `${target}#${toId}${gateway}`;
+                const pinned = target === desktops_1.DIRECT_KEY || known(`${target}#${fromId}`);
+                try {
+                    if (!taken.has(to) && !known(`${target}#${toId}`) && pinned && !withheld(account, inVault)) {
+                        await saveCredentials(to, credentials);
+                        taken.add(to);
+                    }
+                }
+                catch { }
+                try {
+                    await forgetIn(inVault, account);
+                }
+                catch {
+                    done = false;
+                }
             }
-            catch { }
+        }
+        if (!done) {
+            forgetLater(forgets, inVault);
+            waiting.push(inVault ? 'vault' : 'keychain');
         }
     }
+    return waiting;
+}
+/**
+ * A target's key changed from `from`, a key no target has any more, whose saved passwords nothing moves (see
+ * RemoteTargets.keyChanged): those under it (its own desktop's and those of the desktops behind it, see rekeyed) are
+ * forgotten from each store once it can be read, and not used from it meanwhile (see forgetLater).
+ */
+function forgetFormerKey(from) {
+    const forgets = (key) => (0, desktops_1.rekeyed)(key, from, from) !== null;
+    noteForget(forgets);
+    forgetLater(forgets, true);
+    forgetLater(forgets, false);
 }
 exports.STYLE = `
 .trd-signin { position: absolute; inset: 0; display: flex; align-items: center; justify-content: center; z-index: 1; }
@@ -297,4 +728,3 @@ function askCredentials(layer, options, abort) {
         abort.then(() => done(null));
     });
 }
-//# sourceMappingURL=signin.js.map