|
| 1 | +use objc2_local_authentication::{LABiometryType, LAContext, LAError, LAPolicy}; |
| 2 | +use serde::de::DeserializeOwned; |
| 3 | +use tauri::{plugin::PluginApi, AppHandle, Runtime}; |
| 4 | + |
| 5 | +use crate::models::*; |
| 6 | + |
| 7 | +pub fn init<R: Runtime, C: DeserializeOwned>( |
| 8 | + app: &AppHandle<R>, |
| 9 | + _api: PluginApi<R, C>, |
| 10 | +) -> crate::Result<Biometry<R>> { |
| 11 | + Ok(Biometry(app.clone())) |
| 12 | +} |
| 13 | + |
| 14 | +fn la_error_to_string(error: LAError) -> &'static str { |
| 15 | + match error { |
| 16 | + LAError::AppCancel => "appCancel", |
| 17 | + LAError::AuthenticationFailed => "authenticationFailed", |
| 18 | + LAError::InvalidContext => "invalidContext", |
| 19 | + LAError::NotInteractive => "notInteractive", |
| 20 | + LAError::PasscodeNotSet => "passcodeNotSet", |
| 21 | + LAError::SystemCancel => "systemCancel", |
| 22 | + LAError::UserCancel => "userCancel", |
| 23 | + LAError::UserFallback => "userFallback", |
| 24 | + LAError::BiometryLockout => "biometryLockout", |
| 25 | + LAError::BiometryNotAvailable => "biometryNotAvailable", |
| 26 | + LAError::BiometryNotEnrolled => "biometryNotEnrolled", |
| 27 | + _ => "unknown", |
| 28 | + } |
| 29 | +} |
| 30 | + |
| 31 | +/// Access to the biometry APIs. |
| 32 | +pub struct Biometry<R: Runtime>(AppHandle<R>); |
| 33 | + |
| 34 | +impl<R: Runtime> Biometry<R> { |
| 35 | + pub fn status(&self) -> crate::Result<Status> { |
| 36 | + let context = unsafe { LAContext::new() }; |
| 37 | + |
| 38 | + let can_evaluate = unsafe { |
| 39 | + context.canEvaluatePolicy_error(LAPolicy::DeviceOwnerAuthenticationWithBiometrics) |
| 40 | + }; |
| 41 | + |
| 42 | + let biometry_type = unsafe { context.biometryType() }; |
| 43 | + |
| 44 | + let is_available = can_evaluate.is_ok(); |
| 45 | + let mut error_reason: Option<String> = None; |
| 46 | + let mut error_code: Option<String> = None; |
| 47 | + |
| 48 | + if let Err(error) = can_evaluate { |
| 49 | + let ns_error = &*error; |
| 50 | + |
| 51 | + // Get error description |
| 52 | + let description = ns_error.localizedDescription(); |
| 53 | + error_reason = Some(description.to_string()); |
| 54 | + |
| 55 | + // Map error code to string representation |
| 56 | + let code = LAError(ns_error.code()); |
| 57 | + error_code = Some(la_error_to_string(code).to_string()); |
| 58 | + } |
| 59 | + |
| 60 | + // Map LABiometryType to our BiometryType enum |
| 61 | + let mapped_biometry_type = match biometry_type { |
| 62 | + LABiometryType::None => BiometryType::None, |
| 63 | + LABiometryType::TouchID => BiometryType::TouchID, |
| 64 | + LABiometryType::FaceID => BiometryType::FaceID, |
| 65 | + #[allow(unreachable_patterns)] |
| 66 | + _ => BiometryType::None, |
| 67 | + }; |
| 68 | + |
| 69 | + Ok(Status { |
| 70 | + is_available, |
| 71 | + biometry_type: mapped_biometry_type, |
| 72 | + error: error_reason, |
| 73 | + error_code, |
| 74 | + }) |
| 75 | + } |
| 76 | + |
| 77 | + pub fn authenticate(&self, reason: String, options: AuthOptions) -> crate::Result<()> { |
| 78 | + let context = unsafe { LAContext::new() }; |
| 79 | + |
| 80 | + // Check if biometry is available or device credential is allowed |
| 81 | + let can_evaluate_biometry = unsafe { |
| 82 | + context.canEvaluatePolicy_error(LAPolicy::DeviceOwnerAuthenticationWithBiometrics) |
| 83 | + }; |
| 84 | + |
| 85 | + let allow_device_credential = options.allow_device_credential.unwrap_or(false); |
| 86 | + |
| 87 | + if can_evaluate_biometry.is_err() && !allow_device_credential { |
| 88 | + // Biometry unavailable and fallback disabled |
| 89 | + if let Err(error) = can_evaluate_biometry { |
| 90 | + let ns_error = &*error; |
| 91 | + let description = ns_error.localizedDescription(); |
| 92 | + let code = LAError(ns_error.code()); |
| 93 | + let error_code = la_error_to_string(code); |
| 94 | + |
| 95 | + return Err(crate::Error::Io(std::io::Error::new( |
| 96 | + std::io::ErrorKind::PermissionDenied, |
| 97 | + format!("{error_code}: {description}"), |
| 98 | + ))); |
| 99 | + } |
| 100 | + } |
| 101 | + |
| 102 | + // Set localized titles if provided |
| 103 | + if let Some(fallback_title) = options.fallback_title { |
| 104 | + unsafe { |
| 105 | + let title_str = objc2_foundation::NSString::from_str(&fallback_title); |
| 106 | + context.setLocalizedFallbackTitle(Some(&title_str)); |
| 107 | + } |
| 108 | + } |
| 109 | + |
| 110 | + if let Some(cancel_title) = options.cancel_title { |
| 111 | + unsafe { |
| 112 | + let title_str = objc2_foundation::NSString::from_str(&cancel_title); |
| 113 | + context.setLocalizedCancelTitle(Some(&title_str)); |
| 114 | + } |
| 115 | + } |
| 116 | + |
| 117 | + // Set authentication reuse duration to 0 (no reuse) |
| 118 | + unsafe { |
| 119 | + context.setTouchIDAuthenticationAllowableReuseDuration(0.0); |
| 120 | + } |
| 121 | + |
| 122 | + // Determine which policy to use |
| 123 | + let policy = if allow_device_credential { |
| 124 | + LAPolicy::DeviceOwnerAuthentication |
| 125 | + } else { |
| 126 | + LAPolicy::DeviceOwnerAuthenticationWithBiometrics |
| 127 | + }; |
| 128 | + |
| 129 | + // Create a channel to communicate between the callback and the main thread |
| 130 | + let (tx, rx) = std::sync::mpsc::channel(); |
| 131 | + |
| 132 | + // Perform authentication |
| 133 | + unsafe { |
| 134 | + let reason_str = objc2_foundation::NSString::from_str(&reason); |
| 135 | + let tx_clone = tx.clone(); |
| 136 | + |
| 137 | + context.evaluatePolicy_localizedReason_reply( |
| 138 | + policy, |
| 139 | + &reason_str, |
| 140 | + &block2::StackBlock::new( |
| 141 | + move |success: objc2::runtime::Bool, |
| 142 | + error_ptr: *mut objc2_foundation::NSError| { |
| 143 | + if success.as_bool() { |
| 144 | + let _ = tx_clone.send(Ok(())); |
| 145 | + } else if !error_ptr.is_null() { |
| 146 | + let error = &*error_ptr; |
| 147 | + let description = error.localizedDescription().to_string(); |
| 148 | + let code = LAError(error.code()); |
| 149 | + let error_code = la_error_to_string(code); |
| 150 | + |
| 151 | + let _ = tx_clone.send(Err(crate::Error::Io(std::io::Error::new( |
| 152 | + std::io::ErrorKind::PermissionDenied, |
| 153 | + format!("{error_code}: {description}"), |
| 154 | + )))); |
| 155 | + } else { |
| 156 | + let _ = tx_clone.send(Err(crate::Error::Io(std::io::Error::new( |
| 157 | + std::io::ErrorKind::PermissionDenied, |
| 158 | + "authenticationFailed: Unknown error".to_string(), |
| 159 | + )))); |
| 160 | + } |
| 161 | + }, |
| 162 | + ), |
| 163 | + ); |
| 164 | + } |
| 165 | + |
| 166 | + // Wait for authentication result |
| 167 | + match rx.recv() { |
| 168 | + Ok(result) => result, |
| 169 | + Err(_) => Err(crate::Error::Io(std::io::Error::other( |
| 170 | + "authenticationFailed: Failed to receive authentication result", |
| 171 | + ))), |
| 172 | + } |
| 173 | + } |
| 174 | + |
| 175 | + pub fn has_data(&self, _options: DataOptions) -> crate::Result<bool> { |
| 176 | + Err(crate::Error::from(std::io::Error::other( |
| 177 | + "Biometry has_data is not yet implemented on macOS", |
| 178 | + ))) |
| 179 | + } |
| 180 | + |
| 181 | + pub fn get_data(&self, _options: GetDataOptions) -> crate::Result<DataResponse> { |
| 182 | + Err(crate::Error::from(std::io::Error::other( |
| 183 | + "Biometry get_data is not yet implemented on macOS", |
| 184 | + ))) |
| 185 | + } |
| 186 | + |
| 187 | + pub fn set_data(&self, _options: SetDataOptions) -> crate::Result<()> { |
| 188 | + Err(crate::Error::from(std::io::Error::other( |
| 189 | + "Biometry set_data is not yet implemented on macOS", |
| 190 | + ))) |
| 191 | + } |
| 192 | + |
| 193 | + pub fn remove_data(&self, _options: RemoveDataOptions) -> crate::Result<()> { |
| 194 | + Err(crate::Error::from(std::io::Error::other( |
| 195 | + "Biometry remove_data is not yet implemented on macOS", |
| 196 | + ))) |
| 197 | + } |
| 198 | +} |
0 commit comments