mirror of
https://github.com/openai/codex.git
synced 2026-11-13 21:30:47 +00:00
riley-oai
e7637306bc
## Why The user-verification API previously returned an unsupported provider on macOS. Enable native verification using biometric-protected credentials. ## What changed - Implement credential status, creation, reuse, deletion, and challenge signing with P-256 Secure Enclave keys in the Data Protection Keychain. - Require biometric authentication through the key's access-control policy and use a fresh `LAContext` for each signature. - Report Touch ID hardware support independently of enrollment and current readiness, and map native failures to structured verification errors. - Serialize credential operations across processes with cancellable file-lock waits. Invalidate pending authentication on cancellation and wait for the signer to exit before releasing the lock. ## Testing Add unit tests for lock contention and cancellation, authentication teardown and late-result rejection, native error classification, and validation of Secure Enclave key attributes. GitOrigin-RevId: 93268962cd824b2befc1a0c54b99dcb77a0f1044
52 lines
1.8 KiB
Rust
52 lines
1.8 KiB
Rust
//! Native failure classification is based on the domain and code, never localized text.
|
|
|
|
use super::*;
|
|
use pretty_assertions::assert_eq;
|
|
|
|
#[test]
|
|
fn cancellation_is_distinct_from_authentication_failure() {
|
|
assert_eq!(
|
|
classify("com.apple.LocalAuthentication", /*code*/ -2),
|
|
UserVerificationError::Cancelled {
|
|
reason: UserVerificationCancellationReason::UserCancelled,
|
|
message: "authentication was cancelled".to_string(),
|
|
}
|
|
);
|
|
assert_eq!(
|
|
classify("NSOSStatusErrorDomain", /*code*/ -25293),
|
|
UserVerificationError::Failed {
|
|
reason: UserVerificationFailureReason::AuthenticationFailed,
|
|
message: "biometric authentication failed".to_string(),
|
|
}
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn biometric_lockout_and_missing_entitlements_report_distinct_unavailability() {
|
|
assert_eq!(
|
|
classify("com.apple.LocalAuthentication", /*code*/ -8),
|
|
UserVerificationError::Unavailable {
|
|
reason: UserVerificationUnavailableReason::BiometricsUnavailable,
|
|
message: "biometric authentication is not available right now".to_string(),
|
|
}
|
|
);
|
|
assert_eq!(
|
|
classify("NSOSStatusErrorDomain", /*code*/ -34018),
|
|
UserVerificationError::Unavailable {
|
|
reason: UserVerificationUnavailableReason::ProviderUnavailable,
|
|
message: "this binary is missing the required keychain entitlements".to_string(),
|
|
}
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn unknown_error_domain_cannot_impersonate_cancellation() {
|
|
assert_eq!(
|
|
classify("unknown", /*code*/ -2),
|
|
UserVerificationError::Failed {
|
|
reason: UserVerificationFailureReason::ProviderError,
|
|
message: "the platform could not complete user verification".to_string(),
|
|
}
|
|
);
|
|
}
|