Add passkey, WebAuthn, and FIDO2 support to browser pane #2660
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,6 @@ | ||
| import Foundation | ||
| import Combine | ||
| import AuthenticationServices | ||
| import WebKit | ||
| import AppKit | ||
| import Bonsplit | ||
|
|
@@ -1728,6 +1729,164 @@ final class BrowserPortalAnchorView: NSView { | |
| } | ||
| } | ||
|
|
||
| // WKWebView handles WebAuthn itself for browser apps; this support code only | ||
| // determines when cmux should request browser passkey access from macOS. | ||
| enum BrowserPasskeyAuthorizationSupport { | ||
| static let remoteLoopbackAliasHost = "cmux-loopback.localtest.me" | ||
|
There was a problem hiding this comment. Duplicate loopback alias host constant risks future driftLow Severity The magic string Additional Locations (1)  Reviewed by Cursor Bugbot for commit 6458077. Configure here. |
||
|
|
||
| static func isPotentiallyTrustworthy(url: URL?) -> Bool { | ||
| guard let url, | ||
| let scheme = url.scheme?.lowercased() else { | ||
| return false | ||
| } | ||
| if scheme == "https" { | ||
| return true | ||
| } | ||
| guard scheme == "http", | ||
| let host = url.host else { | ||
| return false | ||
| } | ||
| return isLoopbackHost(host) | ||
| } | ||
|
|
||
| static func shouldRequestAuthorization( | ||
| for url: URL?, | ||
| authorizationState: ASAuthorizationWebBrowserPublicKeyCredentialManager.AuthorizationState, | ||
| hasPendingRequest: Bool, | ||
| didPromptThisSession: Bool | ||
| ) -> Bool { | ||
| guard isPotentiallyTrustworthy(url: url) else { return false } | ||
| guard authorizationState == .notDetermined else { return false } | ||
| guard !hasPendingRequest else { return false } | ||
| guard !didPromptThisSession else { return false } | ||
| return true | ||
| } | ||
|
|
||
| /// Returns a host/origin string suitable for debug logs without leaking | ||
| /// query parameters, paths, OIDC state, or auth codes. | ||
| static func redactedURLDescription(for url: URL?) -> String { | ||
| guard let url else { return "nil" } | ||
| let scheme = url.scheme?.lowercased() ?? "?" | ||
| let host = url.host ?? "?" | ||
| return "\(scheme)://\(host)" | ||
| } | ||
|
|
||
| private static func isLoopbackHost(_ host: String) -> Bool { | ||
| let normalized = normalizedHost(host) | ||
| let octets = normalized.split(separator: ".", omittingEmptySubsequences: false) | ||
| let is127Loopback = octets.count == 4 | ||
| && octets[0] == "127" | ||
| && octets.allSatisfy { component in | ||
| guard let value = Int(component) else { return false } | ||
| return (0...255).contains(value) | ||
| } | ||
|
|
||
| return normalized == "localhost" | ||
| || normalized.hasSuffix(".localhost") | ||
| || normalized == "::1" | ||
| || is127Loopback | ||
| || normalized == remoteLoopbackAliasHost | ||
| || normalized.hasSuffix("." + remoteLoopbackAliasHost) | ||
| } | ||
coderabbitai[bot] marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| private static func normalizedHost(_ host: String) -> String { | ||
| var normalized = host.trimmingCharacters(in: .whitespacesAndNewlines).lowercased() | ||
| if normalized.hasPrefix("[") && normalized.hasSuffix("]") { | ||
| normalized.removeFirst() | ||
| normalized.removeLast() | ||
| } | ||
| if normalized.hasSuffix(".") { | ||
| normalized.removeLast() | ||
| } | ||
| return normalized | ||
| } | ||
| } | ||
|
|
||
| private extension ASAuthorizationWebBrowserPublicKeyCredentialManager.AuthorizationState { | ||
| var cmuxDebugName: String { | ||
| switch self { | ||
| case .authorized: | ||
| return "authorized" | ||
| case .denied: | ||
| return "denied" | ||
| case .notDetermined: | ||
| return "notDetermined" | ||
| @unknown default: | ||
| return "unknown" | ||
| } | ||
| } | ||
| } | ||
|
|
||
| @MainActor | ||
| final class BrowserPasskeyAuthorizationManager { | ||
| static let shared = BrowserPasskeyAuthorizationManager() | ||
|
|
||
| private let credentialManager = ASAuthorizationWebBrowserPublicKeyCredentialManager() | ||
| private var authorizationTask: Task<ASAuthorizationWebBrowserPublicKeyCredentialManager.AuthorizationState, Never>? | ||
| private var didPromptThisSession = false | ||
|
|
||
| private init() {} | ||
|
|
||
| func requestAuthorizationIfNeeded(for url: URL?, source: String) { | ||
| // Skip the system passkey authorization prompt when running under | ||
| // automated UI tests; the dialog blocks the main thread and breaks | ||
| // unrelated keyboard regressions on CI. | ||
| if SessionRestorePolicy.isRunningUnderAutomatedTests() { | ||
| return | ||
| } | ||
|
|
||
| let state = credentialManager.authorizationStateForPlatformCredentials | ||
| let redactedURL = BrowserPasskeyAuthorizationSupport.redactedURLDescription(for: url) | ||
| guard BrowserPasskeyAuthorizationSupport.shouldRequestAuthorization( | ||
| for: url, | ||
| authorizationState: state, | ||
| hasPendingRequest: authorizationTask != nil, | ||
| didPromptThisSession: didPromptThisSession | ||
| ) else { | ||
| #if DEBUG | ||
| dlog( | ||
| "browser.passkey.authorization.skip " + | ||
| "source=\(source) origin=\(redactedURL) state=\(state.cmuxDebugName) " + | ||
| "pending=\(authorizationTask == nil ? 0 : 1) prompted=\(didPromptThisSession ? 1 : 0)" | ||
| ) | ||
| #endif | ||
| return | ||
| } | ||
|
|
||
| didPromptThisSession = true | ||
| #if DEBUG | ||
| dlog( | ||
| "browser.passkey.authorization.begin " + | ||
| "source=\(source) origin=\(redactedURL) state=\(state.cmuxDebugName)" | ||
| ) | ||
coderabbitai[bot] marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| #endif | ||
|
|
||
| let task = Task<ASAuthorizationWebBrowserPublicKeyCredentialManager.AuthorizationState, Never> { [credentialManager] in | ||
| await withCheckedContinuation { continuation in | ||
| credentialManager.requestAuthorizationForPublicKeyCredentials { authorizationState in | ||
| continuation.resume(returning: authorizationState) | ||
| } | ||
| } | ||
| } | ||
| authorizationTask = task | ||
|
|
||
| Task { @MainActor [weak self] in | ||
| guard let self else { return } | ||
| let result = await task.value | ||
| self.authorizationTask = nil | ||
| if result == .notDetermined { | ||
| self.didPromptThisSession = false | ||
| } | ||
| #if DEBUG | ||
| dlog( | ||
| "browser.passkey.authorization.end " + | ||
| "source=\(source) origin=\(redactedURL) result=\(result.cmuxDebugName)" | ||
| ) | ||
| #endif | ||
| } | ||
| } | ||
| } | ||
|
|
||
| @MainActor | ||
| final class BrowserPanel: Panel, ObservableObject { | ||
| private static let remoteLoopbackProxyAliasHost = "cmux-loopback.localtest.me" | ||
|
|
@@ -6189,6 +6348,13 @@ private class BrowserNavigationDelegate: NSObject, WKNavigationDelegate { | |
| return | ||
| } | ||
|
|
||
| if navigationAction.targetFrame?.isMainFrame != false { | ||
| BrowserPasskeyAuthorizationManager.shared.requestAuthorizationIfNeeded( | ||
| for: navigationAction.request.url, | ||
| source: "browser.navigation.mainFrame" | ||
| ) | ||
| } | ||
|
|
||
| #if DEBUG | ||
| let targetURL = navigationAction.request.url?.absoluteString ?? "nil" | ||
| dlog("browser.nav.decidePolicy.action kind=allow url=\(targetURL)") | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| <?xml version="1.0" encoding="UTF-8"?> | ||
| <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> | ||
| <plist version="1.0"> | ||
| <dict> | ||
| <key>com.apple.security.cs.disable-library-validation</key> | ||
| <true/> | ||
| <key>com.apple.security.cs.allow-unsigned-executable-memory</key> | ||
| <true/> | ||
| <key>com.apple.security.cs.allow-jit</key> | ||
| <true/> | ||
| <key>com.apple.security.device.camera</key> | ||
| <true/> | ||
| <key>com.apple.security.device.audio-input</key> | ||
| <true/> | ||
| <key>com.apple.security.automation.apple-events</key> | ||
| <true/> | ||
| </dict> | ||
| </plist> |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.