chore: sync with upstream pingdotgg/t3code main

apps/desktop/package.json

@@ -27,9 +27,11 @@
     "electron": "44.4.5",
     "electron-store": "^8.2.0",
     "electron-updater": "^6.8.9",
+    "electron-webauthn": "catalog:",
     "ffi-rs": "1.3.2",
     "playwright-core": "1.60.0",
-    "react-grab": "^0.1.32"
+    "react-grab": "^0.1.32",
+    "tldts": "catalog:"
   },
   "devDependencies": {
     "@effect/vitest": "catalog:",

apps/desktop/src/app/DesktopApp.ts

@@ -17,6 +17,7 @@ import * as DesktopAppIdentity from "./DesktopAppIdentity.ts";
 import * as DesktopClerk from "./DesktopClerk.ts";
 import * as DesktopApplicationMenu from "../window/DesktopApplicationMenu.ts";
 import * as DesktopWindow from "../window/DesktopWindow.ts";
+import * as PreviewPasskeys from "../preview/Passkeys.ts";
 import * as DesktopBackendPool from "../backend/DesktopBackendPool.ts";
 import * as DesktopEnvironment from "./DesktopEnvironment.ts";
 import * as DesktopLegacyLocalStorage from "./DesktopLegacyLocalStorage.ts";
@@ -276,6 +277,7 @@ const startup = Effect.gen(function* () {
   const safeStorage = yield* ElectronSafeStorage.ElectronSafeStorage;
   const updates = yield* DesktopUpdates.DesktopUpdates;
   const environment = yield* DesktopEnvironment.DesktopEnvironment;
+  const previewPasskeys = yield* PreviewPasskeys.PreviewPasskeys;
 
   yield* shellEnvironment.installIntoProcess;
   const hasCommandLinePasswordStore =
@@ -329,6 +331,7 @@ const startup = Effect.gen(function* () {
     });
   }
   yield* appIdentity.configure;
+  yield* previewPasskeys.configure;
   yield* applicationMenu.configure;
   yield* updates.configure;
   yield* DesktopRemoteUpdates.listen;

apps/desktop/src/main.ts

@@ -70,6 +70,7 @@ import * as LinuxBrowserSecret from "./preview/BrowserImport/LinuxBrowserSecret.
 import * as BrowserSession from "./preview/BrowserSession.ts";
 import * as DesktopBrowserHost from "./preview/DesktopBrowserHost.ts";
 import * as PreviewManager from "./preview/Manager.ts";
+import * as PreviewPasskeys from "./preview/Passkeys.ts";
 import * as DesktopWindow from "./window/DesktopWindow.ts";
 import * as DesktopWslBackend from "./wsl/DesktopWslBackend.ts";
 import * as DesktopWslEnvironment from "./wsl/DesktopWslEnvironment.ts";
@@ -168,6 +169,7 @@ const layerDesktopPreview = PreviewManager.layer.pipe(
   // service alongside the manager; both sit on the same BrowserSession.
   Layer.provideMerge(BrowserImport.layer.pipe(Layer.provide(LinuxBrowserSecret.layer))),
   Layer.provideMerge(BrowserSession.layer),
+  Layer.provideMerge(PreviewPasskeys.layer),
   Layer.provideMerge(layerDesktopFoundation),
 );
 

apps/desktop/src/preview-pick-preload.ts

@@ -1 +1,10 @@
+import { ipcRenderer } from "electron";
+
+import { PASSKEY_BRIDGE_ARGUMENT } from "./preview/GuestProtocol.ts";
+import { installPasskeyBridge } from "./preview/PasskeyBridge.ts";
 import "./preview/PickPreload.ts";
+
+// Electron hands webPreferences.additionalArguments to sandboxed preloads in process.argv.
+if (process.argv.includes(PASSKEY_BRIDGE_ARGUMENT)) {
+  installPasskeyBridge((channel, publicKey) => ipcRenderer.invoke(channel, publicKey));
+}

apps/desktop/src/preview/GuestProtocol.ts

@@ -11,3 +11,7 @@ export const RECORDING_POINTER_CHANNEL = "preview:recording-pointer";
 export const RECORDING_KEY_CHANNEL = "preview:recording-key";
 export const RECORDING_INPUT_CHANNEL = "preview:recording-input";
 export const RECORDING_CONTROLLER_CHANNEL = "preview:recording-controller";
+export const PASSKEY_CREATE_CHANNEL = "preview:passkey-create";
+export const PASSKEY_GET_CHANNEL = "preview:passkey-get";
+/** Renderer argument that turns on the guest passkey bridge; see Passkeys.ts. */
+export const PASSKEY_BRIDGE_ARGUMENT = "--t3code-preview-passkey-bridge";

apps/desktop/src/preview/Manager.test.ts

@@ -29,6 +29,7 @@ import * as ElectronWindow from "../electron/ElectronWindow.ts";
 import * as BrowserSession from "./BrowserSession.ts";
 import * as DesktopBrowserHost from "./DesktopBrowserHost.ts";
 import * as PreviewManager from "./Manager.ts";
+import * as PreviewPasskeys from "./Passkeys.ts";
 
 describe("fitPictureInPictureContentSize", () => {
   it("preserves the PiP content area across aspect-ratio changes", () => {
@@ -301,6 +302,13 @@ const managerLayer = (platform: NodeJS.Platform = "darwin") =>
     ),
     Layer.provideMerge(DesktopBrowserHost.layer),
     Layer.provideMerge(layerBrowserSession),
+    Layer.provideMerge(
+      Layer.mock(PreviewPasskeys.PreviewPasskeys)({
+        bridgeEnabled: false,
+        installSessionHandlers: () => {},
+        attachGuest: () => () => {},
+      }),
+    ),
     Layer.provideMerge(layerEnvironment),
     Layer.provideMerge(layerFileSystem),
     Layer.provideMerge(Path.layer),

apps/desktop/src/preview/Manager.ts

@@ -64,6 +64,7 @@ import * as DesktopEnvironment from "../app/DesktopEnvironment.ts";
 import * as DesktopRendererHistory from "../telemetry/DesktopRendererHistory.ts";
 import { MENU_ACTION_CHANNEL, PREVIEW_PICTURE_IN_PICTURE_FRAME_CHANNEL } from "../ipc/channels.ts";
 import * as DesktopBrowserHost from "./DesktopBrowserHost.ts";
+import * as PreviewPasskeys from "./Passkeys.ts";
 import * as BrowserSession from "./BrowserSession.ts";
 import {
   ANNOTATION_CAPTURED_CHANNEL,
@@ -548,6 +549,7 @@ const makeNativeOperations = Effect.fn("PreviewManager.makeOperations")(function
   const crypto = yield* Crypto.Crypto;
   const parentScope = yield* Scope.Scope;
   const browserHost = yield* DesktopBrowserHost.DesktopBrowserHost;
+  const passkeys = yield* PreviewPasskeys.PreviewPasskeys;
   const context = yield* Effect.context<never>();
   const runFork = Effect.runForkWith(context);
   const resolvedArtifactDirectory = path.resolve(artifactDirectory);
@@ -1254,6 +1256,7 @@ const makeNativeOperations = Effect.fn("PreviewManager.makeOperations")(function
   ) {
     const scope = yield* Scope.fork(parentScope, "sequential");
     const attachmentId = Symbol();
+    let detachPasskeys = () => {};
     let documentId = 0;
     let nextRequestId = 0;
     let activeCapture: {
@@ -1589,6 +1592,7 @@ const makeNativeOperations = Effect.fn("PreviewManager.makeOperations")(function
         wc.ipc.off(HUMAN_INPUT_CHANNEL, humanInput);
         wc.ipc.off(RECORDING_INPUT_CHANNEL, recordingInput);
         wc.ipc.off(MOUSE_NAVIGATE_CHANNEL, mouseNavigate);
+        detachPasskeys();
       }).pipe(Effect.ignore),
     );
     const install = Effect.fn("PreviewManager.installWebContentsListeners")(function* () {
@@ -1609,6 +1613,7 @@ const makeNativeOperations = Effect.fn("PreviewManager.makeOperations")(function
         wc.ipc.on(HUMAN_INPUT_CHANNEL, humanInput);
         wc.ipc.on(RECORDING_INPUT_CHANNEL, recordingInput);
         wc.ipc.on(MOUSE_NAVIGATE_CHANNEL, mouseNavigate);
+        detachPasskeys = passkeys.attachGuest(wc);
         wc.setWindowOpenHandler((details) => {
           const action = previewWindowOpenAction(details);
           if (action === "popup") {
@@ -3686,6 +3691,7 @@ export const make = Effect.gen(function* PreviewManagerMake() {
   const environment = yield* DesktopEnvironment.DesktopEnvironment;
   const browserSession = yield* BrowserSession.BrowserSession;
   const browserHost = yield* DesktopBrowserHost.DesktopBrowserHost;
+  const passkeys = yield* PreviewPasskeys.PreviewPasskeys;
   const downloadSessions = new WeakSet<Electron.Session>();
   const fileSystem = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
@@ -3750,6 +3756,7 @@ export const make = Effect.gen(function* PreviewManagerMake() {
             ),
           );
         placeServerDownloads(session);
+        passkeys.installSessionHandlers(session);
         return session;
       },
     ),

apps/desktop/src/preview/PasskeyAttestation.ts

@@ -0,0 +1,59 @@
+/**
+ * Reads the raw `authData` bytes out of a CBOR attestation object
+ * (`{ fmt, attStmt, authData }`). Returns undefined for anything malformed.
+ * Only the definite-length encodings authenticators emit are understood.
+ */
+export const authenticatorDataFromAttestation = (bytes: Uint8Array) => {
+  let offset = 0;
+  const readHead = () => {
+    const initial = bytes[offset++];
+    if (initial === undefined) return undefined;
+    const info = initial & 31;
+    let length = info;
+    if (info >= 24) {
+      if (info > 27) return undefined;
+      const size = 1 << (info - 24);
+      if (offset + size > bytes.length) return undefined;
+      length = 0;
+      for (let index = 0; index < size; index++) length = length * 256 + (bytes[offset++] ?? 0);
+    }
+    return { major: initial >> 5, length };
+  };
+  const skipValue = (): boolean => {
+    const head = readHead();
+    if (!head) return false;
+    switch (head.major) {
+      case 2:
+      case 3:
+        offset += head.length;
+        return offset <= bytes.length;
+      case 4:
+        for (let index = 0; index < head.length; index++) if (!skipValue()) return false;
+        return true;
+      case 5:
+        for (let index = 0; index < head.length * 2; index++) if (!skipValue()) return false;
+        return true;
+      case 6:
+        return skipValue();
+      default:
+        return true;
+    }
+  };
+
+  const map = readHead();
+  if (map?.major !== 5) return undefined;
+  for (let entry = 0; entry < map.length; entry++) {
+    const key = readHead();
+    if (key?.major !== 3 || offset + key.length > bytes.length) return undefined;
+    const name = new TextDecoder().decode(bytes.subarray(offset, offset + key.length));
+    offset += key.length;
+    if (name !== "authData") {
+      if (!skipValue()) return undefined;
+      continue;
+    }
+    const value = readHead();
+    if (value?.major !== 2 || offset + value.length > bytes.length) return undefined;
+    return bytes.slice(offset, offset + value.length);
+  }
+  return undefined;
+};

apps/desktop/src/preview/PasskeyBackend.ts

@@ -0,0 +1,26 @@
+import type { PasskeyCeremonyResult } from "./PasskeyBridge.ts";
+
+/** What the shared bridge has already checked before a backend runs a ceremony. */
+export interface PasskeyCeremonyContext {
+  /** The committed origin of the frame that asked; never the page's own claim. */
+  readonly origin: string;
+  /** The window the system sheet attaches to. */
+  readonly nativeWindowHandle: Buffer;
+}
+
+/**
+ * One platform's way to create and use passkeys for a preview page. The
+ * bridge in `Passkeys.ts` owns everything platform-neutral: which frame may
+ * ask, focus, one ceremony at a time, the deadline, and dropping results for
+ * a page that navigated away. A backend only talks to the platform.
+ */
+export interface PasskeyBackend {
+  readonly create: (
+    publicKey: PublicKeyCredentialCreationOptions,
+    context: PasskeyCeremonyContext,
+  ) => Promise<PasskeyCeremonyResult>;
+  readonly get: (
+    publicKey: PublicKeyCredentialRequestOptions,
+    context: PasskeyCeremonyContext,
+  ) => Promise<PasskeyCeremonyResult>;
+}

apps/desktop/src/preview/PasskeyBackendMac.ts

@@ -0,0 +1,96 @@
+import { getPublicSuffix } from "tldts";
+
+import type { PasskeyBackend, PasskeyCeremonyContext } from "./PasskeyBackend.ts";
+import { authenticatorDataFromAttestation } from "./PasskeyAttestation.ts";
+import type { PasskeyCeremonyResult } from "./PasskeyBridge.ts";
+
+const ES256 = -7;
+
+// WebAuthn rejects RP IDs that are public suffixes, private registries
+// included, so one github.io site cannot mint passkeys for every other one.
+const isPublicSuffix = (domain: string) =>
+  domain !== "localhost" && getPublicSuffix(domain, { allowPrivateDomains: true }) === domain;
+
+// Loaded only once a ceremony runs: the module and its native addon ship on macOS alone.
+const nativeOptions = async (context: PasskeyCeremonyContext) => ({
+  webauthn: await import("electron-webauthn"),
+  options: {
+    currentOrigin: context.origin,
+    topFrameOrigin: context.origin,
+    nativeWindowHandle: context.nativeWindowHandle,
+    isPublicSuffix,
+  },
+});
+
+const isBufferSource = (value: unknown): value is BufferSource =>
+  value instanceof ArrayBuffer || ArrayBuffer.isView(value);
+
+const toBase64Url = (value: BufferSource) =>
+  Buffer.from(
+    ArrayBuffer.isView(value)
+      ? new Uint8Array(value.buffer, value.byteOffset, value.byteLength)
+      : new Uint8Array(value),
+  ).toString("base64url");
+
+/**
+ * macOS passkeys through AuthenticationServices (`electron-webauthn`): the
+ * system sheet offers iCloud Keychain, password managers, phones, and security
+ * keys. Needs Apple's managed browser entitlement in the signed build.
+ */
+export const macPasskeyBackend: PasskeyBackend = {
+  create: async (publicKey, context): Promise<PasskeyCeremonyResult> => {
+    // The native layer only converts P-256 keys and never settles for any
+    // other algorithm, so ES256 is the only one it may negotiate.
+    const params: unknown = publicKey.pubKeyCredParams;
+    if (params !== undefined && !Array.isArray(params))
+      return { success: false, error: "TypeError" };
+    const allowsEs256 =
+      params === undefined ||
+      params.length === 0 ||
+      params.some(
+        (param: unknown) =>
+          typeof param === "object" && param !== null && "alg" in param && param.alg === ES256,
+      );
+    if (!allowsEs256) return { success: false, error: "NotSupportedError" };
+    const { webauthn, options } = await nativeOptions(context);
+    const result = await webauthn.createCredential(
+      { ...publicKey, pubKeyCredParams: [{ type: "public-key", alg: ES256 }] },
+      options,
+    );
+    if (!result.success) return { success: false, error: result.error };
+    // The native layer reports parsed authenticator data as JSON and claims
+    // every credential is a synced platform passkey; neither is reliable.
+    const authData = authenticatorDataFromAttestation(
+      Buffer.from(result.data.attestationObject, "base64url"),
+    );
+    // Sites verify the new credential from its authenticator data; without it
+    // the passkey is unusable, so say so now rather than let sign-up fail later.
+    if (!authData) return { success: false, error: "NotAllowedError" };
+    return {
+      success: true,
+      data: {
+        ...result.data,
+        authData: Buffer.from(authData).toString("base64url"),
+        transports: [],
+      },
+    };
+  },
+  get: async (publicKey, context): Promise<PasskeyCeremonyResult> => {
+    const { webauthn, options } = await nativeOptions(context);
+    // WebAuthn defaults the RP ID to the caller's host; the native layer requires it.
+    const result = await webauthn.getCredential(
+      { ...publicKey, rpId: publicKey.rpId ?? new URL(context.origin).hostname },
+      options,
+    );
+    if (!result.success) return { success: false, error: result.error };
+    // The native layer applies the site's allow list to platform passkeys only,
+    // so a security key can answer with a credential the site did not ask for.
+    const allowed = (Array.isArray(publicKey.allowCredentials) ? publicKey.allowCredentials : [])
+      .filter((credential) => credential?.type === "public-key" && isBufferSource(credential.id))
+      .map((credential) => toBase64Url(credential.id));
+    if (allowed.length > 0 && !allowed.includes(result.data.credentialId)) {
+      return { success: false, error: "NotAllowedError" };
+    }
+    return result;
+  },
+};