`17012a9`

Map retention choice to auth lifecycle

Authored by mfwolffe <wolffemf@dukes.jmu.edu> 2 months ago

SHA: 17012a95c9741152e8d2cd78756d88c914bf58e0
Parents: b84d6dc
Tree: 3396c02

3 changed files

Status	File	+	-
M	`garcard-ipc/src/lib.rs`	8	0
M	`garcard/src/agent.rs`	141	7
M	`garcard/src/state.rs`	76	0

garcard-ipc/src/lib.rsmodified

      pub state: String,
      pub active_requests: usize,
      pub queued_requests: usize,
 +    #[serde(skip_serializing_if = "Option::is_none")]
 +    pub last_action_id: Option<String>,
 +    #[serde(skip_serializing_if = "Option::is_none")]
 +    pub last_outcome: Option<String>,
 +    #[serde(skip_serializing_if = "Option::is_none")]
 +    pub last_retention_policy: Option<String>,
 +    #[serde(skip_serializing_if = "Option::is_none")]
 +    pub last_retention_enforced: Option<bool>,
+ }
  /// Resolve the daemon socket path from `XDG_RUNTIME_DIR` with `/tmp` fallback.

garcard/src/agent.rsmodified

  type Subject = (String, HashMap<String, OwnedValue>);
  type Details = HashMap<String, String>;
 +type TemporaryAuthorization = (String, String, Subject, u64, u64);
  const DEFAULT_AUTH_MAX_ATTEMPTS: usize = 3;
  const DEFAULT_IDENTITY_SELECTION_ATTEMPTS: usize = 3;
  const DEFAULT_RETENTION_SELECTION_ATTEMPTS: usize = 3;
          let max_attempts = auth_max_attempts();
          let username = match select_identity_for_request(request, prompts) {
              IdentitySelection::Selected(selected) => selected,
 -            IdentitySelection::Terminal(outcome) => return outcome,
 +            IdentitySelection::Terminal(outcome) => {
 +                return self.finalize_auth_attempt(request, outcome, None);
 +            }
          };
          let retention = match select_retention_for_request(request, prompts) {
              RetentionSelection::Selected(selected) => selected,
 -            RetentionSelection::Terminal(outcome) => return outcome,
 +            RetentionSelection::Terminal(outcome) => {
 +                return self.finalize_auth_attempt(request, outcome, None);
 +            }
          };
          tracing::info!(
              action_id = %request.action_id,
                      action_id = %request.action_id,
                      "Authentication request canceled before helper attempt"
                  );
 -                return HelperOutcome::Canceled;
 +                return self.finalize_auth_attempt(request, HelperOutcome::Canceled, Some(retention));
+             }
              tracing::info!(
                  context = %prompt_context,
                          action_id = %request.action_id,
                          "Authentication request canceled during helper attempt"
                      );
 -                    return HelperOutcome::Canceled;
 +                    return self.finalize_auth_attempt(
 +                        request,
 +                        HelperOutcome::Canceled,
 +                        Some(retention),
 +                    );
+                 }
                  Ok(HelperOutcome::Denied) if attempt < max_attempts => {
                      prompts.on_retry();
                      );
                      continue;
+                 }
 -                Ok(outcome) => return outcome,
 +                Ok(outcome) => {
 +                    return self.finalize_auth_attempt(request, outcome, Some(retention));
 +                }
                  Err(err) => {
                      tracing::warn!(
                          action_id = %request.action_id,
                          self.auth_state.set_phase(AuthPhase::PendingPrompt);
                          continue;
+                     }
 -                    return HelperOutcome::Denied;
 +                    return self.finalize_auth_attempt(
 +                        request,
 +                        HelperOutcome::Denied,
 +                        Some(retention),
 +                    );
+                 }
+             }
+         }
 -        HelperOutcome::Denied
 +        self.finalize_auth_attempt(request, HelperOutcome::Denied, Some(retention))
 +    }
++
 +    fn finalize_auth_attempt(
 +        &self,
 +        request: &ActiveRequest,
 +        outcome: HelperOutcome,
 +        retention: Option<RetentionPolicy>,
 +    ) -> HelperOutcome {
 +        let retention_enforced = self.enforce_retention_policy(request, outcome, retention);
 +        self.auth_state.set_last_decision(
 +            request.action_id.clone(),
 +            helper_outcome_label(outcome),
 +            retention.map(|policy| policy.label().to_string()),
 +            retention_enforced,
 +        );
 +        outcome
 +    }
++
 +    fn enforce_retention_policy(
 +        &self,
 +        request: &ActiveRequest,
 +        outcome: HelperOutcome,
 +        retention: Option<RetentionPolicy>,
 +    ) -> bool {
 +        if outcome != HelperOutcome::Authorized {
 +            return false;
 +        }
 +        let Some(retention) = retention else {
 +            return false;
 +        };
 +        if retention != RetentionPolicy::OneShot {
 +            return false;
 +        }
 +        if request.retention_options.len() <= 1 {
 +            return false;
 +        }
++
 +        match revoke_temporary_authorizations_for_action(&request.action_id) {
 +            Ok(revoked) => {
 +                tracing::info!(
 +                    action_id = %request.action_id,
 +                    revoked_count = revoked,
 +                    "Applied one-shot retention policy by revoking temporary authorizations"
 +                );
 +                true
 +            }
 +            Err(err) => {
 +                tracing::warn!(
 +                    action_id = %request.action_id,
 +                    error = %err,
 +                    "Failed to enforce one-shot retention policy"
 +                );
 +                false
 +            }
 +        }
+     }
      fn complete_request(&self, cookie: &str, outcome: HelperOutcome) {
+     }
+ }
 +fn helper_outcome_label(outcome: HelperOutcome) -> &'static str {
 +    match outcome {
 +        HelperOutcome::Authorized => "success",
 +        HelperOutcome::Denied => "failure",
 +        HelperOutcome::Canceled => "canceled",
 +        HelperOutcome::Timeout => "timeout",
 +    }
 +}
++
 +fn revoke_temporary_authorizations_for_action(action_id: &str) -> Result<usize> {
 +    let connection = Connection::system().context("failed to connect to system bus")?;
 +    let subject = build_subject();
 +    let proxy = PolkitAgent::proxy(&connection)?;
 +    let authorizations: Vec<TemporaryAuthorization> =
 +        proxy.call("EnumerateTemporaryAuthorizations", &subject)?;
++
 +    let mut revoked = 0_usize;
 +    for (authorization_id, auth_action_id, _subject, _obtained, _expires) in authorizations {
 +        if auth_action_id != action_id {
 +            continue;
 +        }
++
 +        let _: () = proxy.call("RevokeTemporaryAuthorizationById", &authorization_id)?;
 +        revoked += 1;
 +    }
++
 +    Ok(revoked)
 +}
++
  fn render_prompt_context(request: &ActiveRequest) -> String {
      let mut lines = Vec::new();
      let message = request.message.trim();
          assert_eq!(parse_retention_selection("unknown", &options), None);
+     }
 +    #[test]
 +    fn helper_outcome_label_maps_outcomes() {
 +        assert_eq!(helper_outcome_label(HelperOutcome::Authorized), "success");
 +        assert_eq!(helper_outcome_label(HelperOutcome::Denied), "failure");
 +        assert_eq!(helper_outcome_label(HelperOutcome::Canceled), "canceled");
 +        assert_eq!(helper_outcome_label(HelperOutcome::Timeout), "timeout");
 +    }
++
      #[test]
      fn select_retention_for_request_uses_prompted_choice() {
          let request = ActiveRequest {
          ));
+     }
 +    #[test]
 +    fn finalize_auth_attempt_records_retention_in_auth_summary() {
 +        let auth_state = Arc::new(AuthState::default());
 +        let runtime = PolkitRuntime::new_without_worker(Arc::clone(&auth_state));
 +        let request = ActiveRequest {
 +            action_id: "org.gardesk.test".to_string(),
 +            message: "Authenticate".to_string(),
 +            icon_name: "dialog-password".to_string(),
 +            detail_count: 0,
 +            details: HashMap::new(),
 +            cookie: "cookie-finalize".to_string(),
 +            username: "operator".to_string(),
 +            identity_options: vec!["operator".to_string()],
 +            retention_options: vec![RetentionPolicy::OneShot],
 +        };
++
 +        let outcome =
 +            runtime.finalize_auth_attempt(&request, HelperOutcome::Denied, Some(RetentionPolicy::OneShot));
 +        assert_eq!(outcome, HelperOutcome::Denied);
++
 +        let summary = auth_state.summary();
 +        assert_eq!(summary.last_action_id.as_deref(), Some("org.gardesk.test"));
 +        assert_eq!(summary.last_outcome.as_deref(), Some("failure"));
 +        assert_eq!(summary.last_retention_policy.as_deref(), Some("one-shot"));
 +        assert_eq!(summary.last_retention_enforced, Some(false));
 +    }
++
      #[test]
      fn select_identity_for_request_uses_prompted_choice() {
          let request = ActiveRequest {

garcard/src/state.rsmodified

      current_phase: RwLock<AuthPhase>,
      active_requests: AtomicUsize,
      queued_requests: AtomicUsize,
 +    last_decision: RwLock<Option<AuthDecision>>,
+ }
  impl Default for AuthState {
              current_phase: RwLock::new(AuthPhase::Idle),
              active_requests: AtomicUsize::new(0),
              queued_requests: AtomicUsize::new(0),
 +            last_decision: RwLock::new(None),
+         }
+     }
+ }
 +#[derive(Debug, Clone)]
 +struct AuthDecision {
 +    action_id: String,
 +    outcome: String,
 +    retention_policy: Option<String>,
 +    retention_enforced: bool,
 +}
++
  impl AuthState {
      pub fn phase(&self) -> AuthPhase {
          self.current_phase
+     }
      pub fn summary(&self) -> AuthSummary {
 +        let (last_action_id, last_outcome, last_retention_policy, last_retention_enforced) = self
 +            .last_decision
 +            .read()
 +            .ok()
 +            .and_then(|decision| decision.clone())
 +            .map(|decision| {
 +                (
 +                    Some(decision.action_id),
 +                    Some(decision.outcome),
 +                    decision.retention_policy,
 +                    Some(decision.retention_enforced),
 +                )
 +            })
 +            .unwrap_or((None, None, None, None));
          AuthSummary {
              state: self.phase().to_string(),
              active_requests: self.active_requests.load(Ordering::Relaxed),
              queued_requests: self.queued_requests.load(Ordering::Relaxed),
 +            last_action_id,
 +            last_outcome,
 +            last_retention_policy,
 +            last_retention_enforced,
 +        }
 +    }
++
 +    pub fn set_last_decision(
 +        &self,
 +        action_id: impl Into<String>,
 +        outcome: impl Into<String>,
 +        retention_policy: Option<String>,
 +        retention_enforced: bool,
 +    ) {
 +        if let Ok(mut decision) = self.last_decision.write() {
 +            *decision = Some(AuthDecision {
 +                action_id: action_id.into(),
 +                outcome: outcome.into(),
 +                retention_policy,
 +                retention_enforced,
 +            });
 +        }
 +    }
++
 +    pub fn clear_last_decision(&self) {
 +        if let Ok(mut decision) = self.last_decision.write() {
 +            *decision = None;
+         }
+     }
+ }
          auth.set_phase(AuthPhase::Idle);
          auth.set_active_requests(0);
          auth.set_queued_requests(0);
 +        auth.clear_last_decision();
          Self {
              started_at: Instant::now(),
              pid: std::process::id(),
          assert_eq!(summary.state, "idle");
          assert_eq!(summary.active_requests, 0);
          assert_eq!(summary.queued_requests, 0);
 +        assert!(summary.last_action_id.is_none());
 +        assert!(summary.last_outcome.is_none());
 +        assert!(summary.last_retention_policy.is_none());
 +        assert!(summary.last_retention_enforced.is_none());
+     }
      #[test]
          assert_eq!(summary.queued_requests, 3);
+     }
 +    #[test]
 +    fn auth_state_records_last_decision_context() {
 +        let state = AuthState::default();
 +        state.set_last_decision(
 +            "com.gardesk.install",
 +            "success",
 +            Some("one-shot".to_string()),
 +            true,
 +        );
++
 +        let summary = state.summary();
 +        assert_eq!(
 +            summary.last_action_id.as_deref(),
 +            Some("com.gardesk.install")
 +        );
 +        assert_eq!(summary.last_outcome.as_deref(), Some("success"));
 +        assert_eq!(summary.last_retention_policy.as_deref(), Some("one-shot"));
 +        assert_eq!(summary.last_retention_enforced, Some(true));
 +    }
++
      #[test]
      fn auth_phase_transition_rules_are_enforced() {
          let state = AuthState::default();