`d4699f7`

Add multi-identity selection prompt

Authored by mfwolffe <wolffemf@dukes.jmu.edu> 2 months ago

SHA: d4699f75d572f644171daf4f9f3ffef5c87ef561
Parents: 1b0b34c
Tree: ae1a3e4

1 changed file

Status	File	+	-
M	`garcard/src/agent.rs`	207	6

garcard/src/agent.rsmodified

  use crate::polkit_helper::{
 -    DEFAULT_HELPER_SOCKET, HelperOutcome, HelperSocketClient, PromptProvider,
 +    DEFAULT_HELPER_SOCKET, HelperOutcome, HelperSocketClient, PromptProvider, PromptResponse,
  };
  use crate::prompt::CommandPrompt;
  use crate::state::{AuthPhase, AuthQueue, AuthState, QueueInsert};
  type Subject = (String, HashMap<String, OwnedValue>);
  type Details = HashMap<String, String>;
  const DEFAULT_AUTH_MAX_ATTEMPTS: usize = 3;
 +const DEFAULT_IDENTITY_SELECTION_ATTEMPTS: usize = 3;
  #[derive(Debug)]
  struct AuthRequest {
      details: Details,
      cookie: String,
      username: String,
 +    identity_options: Vec<String>,
+ }
  #[derive(Debug)]
              .or_else(current_username)
              .or_else(|| std::env::var("USER").ok())
              .unwrap_or_else(|| "unknown".to_string());
 +        let mut identity_options = identity_options_from_subjects(&request.identities);
 +        if !identity_options
 +            .iter()
 +            .any(|candidate| candidate == &username)
 +        {
 +            identity_options.insert(0, username.clone());
 +        }
          tracing::debug!(
              identity_summary = %summarize_identities(&request.identities),
              details: request.details.clone(),
              cookie: request.cookie.clone(),
              username,
 +            identity_options,
          })
+     }
      ) -> HelperOutcome {
          let prompt_context = render_prompt_context(request);
          let max_attempts = auth_max_attempts();
 +        let username = match select_identity_for_request(request, prompts) {
 +            IdentitySelection::Selected(selected) => selected,
 +            IdentitySelection::Terminal(outcome) => return outcome,
 +        };
          for attempt in 1..=max_attempts {
              if self.is_canceled(&request.cookie) {
              let mut cancel_aware =
                  CancellationAwarePrompt::new(prompts, self, request.cookie.as_str());
 -            match self.helper_client.authenticate(
 -                &request.username,
 -                &request.cookie,
 -                &mut cancel_aware,
 -            ) {
 +            match self
 +                .helper_client
 +                .authenticate(&username, &request.cookie, &mut cancel_aware)
 +            {
                  Ok(outcome) if self.is_canceled(&request.cookie) => {
                      tracing::info!(
                          action_id = %request.action_id,
      lines.join("\n")
+ }
 +enum IdentitySelection {
 +    Selected(String),
 +    Terminal(HelperOutcome),
 +}
++
 +fn select_identity_for_request<P: PromptProvider>(
 +    request: &ActiveRequest,
 +    prompts: &mut P,
 +) -> IdentitySelection {
 +    if request.identity_options.len() <= 1 {
 +        return IdentitySelection::Selected(request.username.clone());
 +    }
++
 +    let prompt = render_identity_selection_prompt(request);
 +    for attempt in 1..=DEFAULT_IDENTITY_SELECTION_ATTEMPTS {
 +        match prompts.prompt_plain(&prompt) {
 +            Ok(PromptResponse::Submitted(mut raw)) => {
 +                if let Some(selected) = parse_identity_selection(
 +                    raw.as_str(),
 +                    &request.identity_options,
 +                    &request.username,
 +                ) {
 +                    raw.clear();
 +                    return IdentitySelection::Selected(selected);
 +                }
++
 +                raw.clear();
 +                let _ = prompts.show_error("Invalid identity selection");
 +                if attempt == DEFAULT_IDENTITY_SELECTION_ATTEMPTS {
 +                    tracing::warn!(
 +                        action_id = %request.action_id,
 +                        default_identity = %request.username,
 +                        "Identity selection failed repeatedly; using default identity"
 +                    );
 +                    return IdentitySelection::Selected(request.username.clone());
 +                }
 +            }
 +            Ok(PromptResponse::Canceled) => {
 +                return IdentitySelection::Terminal(HelperOutcome::Canceled);
 +            }
 +            Ok(PromptResponse::TimedOut) => {
 +                return IdentitySelection::Terminal(HelperOutcome::Timeout);
 +            }
 +            Err(err) => {
 +                tracing::warn!(
 +                    action_id = %request.action_id,
 +                    error = %err,
 +                    default_identity = %request.username,
 +                    "Identity selection prompt failed; using default identity"
 +                );
 +                return IdentitySelection::Selected(request.username.clone());
 +            }
 +        }
 +    }
++
 +    IdentitySelection::Selected(request.username.clone())
 +}
++
 +fn render_identity_selection_prompt(request: &ActiveRequest) -> String {
 +    let mut lines = vec![
 +        "Select authentication identity".to_string(),
 +        format!("Action: {}", request.action_id),
 +    ];
 +    for (index, option) in request.identity_options.iter().enumerate() {
 +        if option == &request.username {
 +            lines.push(format!("{}: {} (default)", index + 1, option));
 +        } else {
 +            lines.push(format!("{}: {}", index + 1, option));
 +        }
 +    }
 +    lines.push("Enter number or username (blank for default)".to_string());
 +    lines.join("\n")
 +}
++
 +fn parse_identity_selection(input: &str, options: &[String], default: &str) -> Option<String> {
 +    let trimmed = input.trim();
 +    if trimmed.is_empty() {
 +        return Some(default.to_string());
 +    }
++
 +    if let Ok(index) = trimmed.parse::<usize>() {
 +        if (1..=options.len()).contains(&index) {
 +            return options.get(index - 1).cloned();
 +        }
 +    }
++
 +    options
 +        .iter()
 +        .find(|option| option.eq_ignore_ascii_case(trimmed))
 +        .cloned()
 +}
++
 +fn identity_options_from_subjects(identities: &[Subject]) -> Vec<String> {
 +    let mut options = Vec::new();
 +    let mut seen = HashSet::new();
++
 +    for (kind, details) in identities {
 +        if kind != "unix-user" {
 +            continue;
 +        }
++
 +        let Some(name) = identity_name(details) else {
 +            continue;
 +        };
 +        let trimmed = name.trim();
 +        if trimmed.is_empty() {
 +            continue;
 +        }
 +        let dedupe_key = trimmed.to_ascii_lowercase();
 +        if seen.insert(dedupe_key) {
 +            options.push(trimmed.to_string());
 +        }
 +    }
++
 +    options
 +}
++
  fn detail_key_label(key: &str) -> &'static str {
      match key {
          "program" => "Program",
          responses: VecDeque<PromptResponse>,
          success_count: usize,
          failure_messages: Vec<String>,
 +        error_messages: Vec<String>,
          prompt_count: usize,
+     }
                  responses: VecDeque::from(responses),
                  success_count: 0,
                  failure_messages: Vec::new(),
 +                error_messages: Vec::new(),
                  prompt_count: 0,
+             }
+         }
              self.failure_messages.push(message.to_string());
              Ok(())
+         }
++
 +        fn show_error(&mut self, message: &str) -> Result<()> {
 +            self.error_messages.push(message.to_string());
 +            Ok(())
 +        }
+     }
      impl RetryPromptProvider for SequencedPrompt {}
              details: HashMap::new(),
              cookie: "cookie-1".to_string(),
              username: "alice".to_string(),
 +            identity_options: vec!["alice".to_string()],
          };
          let mut prompts = SequencedPrompt::new(vec![
              PromptResponse::Submitted("correct horse".to_string()),
              details: HashMap::new(),
              cookie: "cookie-timeout".to_string(),
              username: "alice".to_string(),
 +            identity_options: vec!["alice".to_string()],
          };
          let mut prompts = SequencedPrompt::new(vec![PromptResponse::TimedOut]);
              details,
              cookie: "cookie-ctx".to_string(),
              username: "alice".to_string(),
 +            identity_options: vec!["alice".to_string()],
          };
          let context = render_prompt_context(&request);
          assert!(context.contains("Retains authorization: 1"));
+     }
 +    #[test]
 +    fn parse_identity_selection_accepts_blank_index_and_name() {
 +        let options = vec!["alice".to_string(), "root".to_string()];
 +        assert_eq!(
 +            parse_identity_selection("", &options, "alice"),
 +            Some("alice".to_string())
 +        );
 +        assert_eq!(
 +            parse_identity_selection("2", &options, "alice"),
 +            Some("root".to_string())
 +        );
 +        assert_eq!(
 +            parse_identity_selection("ROOT", &options, "alice"),
 +            Some("root".to_string())
 +        );
 +        assert_eq!(parse_identity_selection("99", &options, "alice"), None);
 +    }
++
 +    #[test]
 +    fn select_identity_for_request_uses_prompted_choice() {
 +        let request = ActiveRequest {
 +            action_id: "org.gardesk.test".to_string(),
 +            message: "Authenticate".to_string(),
 +            icon_name: "dialog-password".to_string(),
 +            detail_count: 0,
 +            details: HashMap::new(),
 +            cookie: "cookie-identity".to_string(),
 +            username: "alice".to_string(),
 +            identity_options: vec!["alice".to_string(), "root".to_string()],
 +        };
 +        let mut prompts = SequencedPrompt::new(vec![PromptResponse::Submitted("2".to_string())]);
++
 +        let selection = select_identity_for_request(&request, &mut prompts);
 +        assert!(matches!(
 +            selection,
 +            IdentitySelection::Selected(username) if username == "root"
 +        ));
 +        assert_eq!(prompts.prompt_count, 1);
 +    }
++
 +    #[test]
 +    fn select_identity_for_request_returns_canceled_outcome() {
 +        let request = ActiveRequest {
 +            action_id: "org.gardesk.test".to_string(),
 +            message: "Authenticate".to_string(),
 +            icon_name: "dialog-password".to_string(),
 +            detail_count: 0,
 +            details: HashMap::new(),
 +            cookie: "cookie-identity-cancel".to_string(),
 +            username: "alice".to_string(),
 +            identity_options: vec!["alice".to_string(), "root".to_string()],
 +        };
 +        let mut prompts = SequencedPrompt::new(vec![PromptResponse::Canceled]);
++
 +        let selection = select_identity_for_request(&request, &mut prompts);
 +        assert!(matches!(
 +            selection,
 +            IdentitySelection::Terminal(HelperOutcome::Canceled)
 +        ));
 +    }
++
      #[test]
      fn cancellation_aware_prompt_short_circuits_prompt_and_feedback() {
          let runtime = PolkitRuntime::new_without_worker(Arc::new(AuthState::default()));