Ruslan Nigmatullin 08b0d83b66 app-server: require local auth for macOS device keys ...

Require macOS-created device keys to prove user presence before private-key use by adding the UserPresence access-control flag at key creation time. This keeps the provider aligned with the device-ownership goal: a valid signature should require both the device-local private key and a successful local biometric or password authentication.

Thread a process-local LAContext into signing lookups and reuse it across sign operations. Security.framework still owns the authentication policy and validity window, while the reusable context lets macOS reuse a recent successful authentication when policy permits instead of prompting on every connection.

Public-key lookup and binding reads continue to avoid the authentication context because they do not use the private key.

- just fmt
- cargo test -p codex-device-key
- just fix -p codex-device-key
- git diff --check

2026-04-23 21:58:50 -07:00

..

src

app-server: require local auth for macOS device keys

2026-04-23 21:58:50 -07:00

BUILD.bazel

app-server: add codex-device-key crate (#18429)

2026-04-21 17:57:00 +00:00

Cargo.toml

app-server: add macOS device key provider

2026-04-23 21:58:50 -07:00