mirror of
https://github.com/openai/codex.git
synced 2026-09-11 20:36:49 +00:00
e7637306bc
## Why The user-verification API previously returned an unsupported provider on macOS. Enable native verification using biometric-protected credentials. ## What changed - Implement credential status, creation, reuse, deletion, and challenge signing with P-256 Secure Enclave keys in the Data Protection Keychain. - Require biometric authentication through the key's access-control policy and use a fresh `LAContext` for each signature. - Report Touch ID hardware support independently of enrollment and current readiness, and map native failures to structured verification errors. - Serialize credential operations across processes with cancellable file-lock waits. Invalidate pending authentication on cancellation and wait for the signer to exit before releasing the lock. ## Testing Add unit tests for lock contention and cancellation, authentication teardown and late-result rejection, native error classification, and validation of Secure Enclave key attributes. GitOrigin-RevId: 93268962cd824b2befc1a0c54b99dcb77a0f1044
33 lines
990 B
TOML
33 lines
990 B
TOML
[package]
|
|
name = "codex-user-verification"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
base64 = { workspace = true }
|
|
p256 = { version = "0.13", default-features = false, features = ["arithmetic", "pkcs8", "std"] }
|
|
sha2 = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
tracing = { workspace = true }
|
|
|
|
[target.'cfg(target_os = "macos")'.dependencies]
|
|
core-foundation = "0.10"
|
|
dirs = { workspace = true }
|
|
objc2 = "0.6.3"
|
|
objc2-foundation = { version = "0.3.2", default-features = false, features = ["std", "NSString"] }
|
|
objc2-local-authentication = { version = "0.3.2", default-features = false, features = ["std", "LAContext", "LABiometryType"] }
|
|
security-framework = { version = "3.5", features = ["OSX_10_15"] }
|
|
security-framework-sys = "2.15"
|
|
|
|
[dev-dependencies]
|
|
p256 = { version = "0.13", features = ["ecdsa"] }
|
|
pretty_assertions = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
|
|
[lib]
|
|
doctest = false
|