Password plus Apps

Cargo.toml

@@ -57,6 +57,7 @@ sage-wallet = { path = "./crates/sage-wallet" }
 sage-assets = { path = "./crates/sage-assets" }
 sage-apps = { path = "./crates/sage-apps" }
 sage-rpc = { path = "./crates/sage-rpc" }
+sage-password-gate = { path = "./crates/sage-password-gate" }
 
 # Serialization
 serde = "1.0.204"

builtin-apps/src/system/apps/bridge-approval/src/App.tsx

@@ -74,6 +74,11 @@ export function App() {
   const [loaded, setLoaded] = useState(false);
   const [now, setNow] = useState(() => Date.now());
   const [error, setError] = useState<string | null>(null);
+  const [password, setPassword] = useState('');
+  const [passwordError, setPasswordError] = useState<string | null>(null);
+  // Set when the host tells us an approval needs a password that its queued
+  // hint did not predict, so the field appears even on a stale view.
+  const [passwordForced, setPasswordForced] = useState(false);
 
   async function refreshActiveRuntime() {
     const active = await sage.runtimeManager.getActiveTaskbarRuntime();
@@ -148,24 +153,63 @@ export function App() {
     ? formatCountdown(activeApproval.expiresAtMs, now)
     : null;
 
+  // Never carry a typed password across approvals.
   useEffect(() => {
     setExpanded(false);
     setError(null);
+    setPassword('');
+    setPasswordError(null);
+    setPasswordForced(false);
   }, [activeApproval?.approvalId]);
 
+  const needsPassword =
+    (activeApproval?.requiresPassword ?? false) || passwordForced;
+
   async function resolve(approved: boolean) {
     if (!activeApproval || working) return;
+    if (approved && needsPassword && password.length === 0) return;
 
     setWorking(true);
     setError(null);
 
     try {
-      await sage.bridgeApprovals.resolve({
+      const result = await sage.bridgeApprovals.resolve({
         approvalId: activeApproval.approvalId,
         approved,
         reason: approved ? null : 'User denied the request',
+        password: approved && needsPassword ? password : null,
       });
 
+      switch (result.kind) {
+        case 'wrongPassword':
+          // The approval is still queued; keep the card up for another try.
+          setPassword('');
+          setPasswordError(
+            result.attemptsRemaining === 1
+              ? 'Incorrect password. 1 attempt remaining.'
+              : `Incorrect password. ${result.attemptsRemaining} attempts remaining.`,
+          );
+          break;
+
+        case 'passwordRequired':
+          // The queued hint was stale — this wallet is protected after all.
+          setPasswordForced(true);
+          setPassword('');
+          setPasswordError('This wallet requires its password.');
+          break;
+
+        case 'tooManyAttempts':
+          setPassword('');
+          setPasswordError(null);
+          setError('Too many incorrect password attempts. Request rejected.');
+          break;
+
+        case 'resolved':
+          setPassword('');
+          setPasswordError(null);
+          break;
+      }
+
       setApprovals(await sage.bridgeApprovals.listPending());
     } catch (err) {
       setError(err instanceof Error ? err.message : String(err));
@@ -240,7 +284,7 @@ export function App() {
 
             <button
               type='button'
-              disabled={working}
+              disabled={working || (needsPassword && password.length === 0)}
               onClick={() => void resolve(true)}
               className='rounded-md bg-primary px-3 py-1.5 text-sm font-medium text-primary-foreground hover:opacity-90 disabled:opacity-50'
             >
@@ -270,6 +314,42 @@ export function App() {
           expanded={expanded}
         />
 
+        {needsPassword ? (
+          <div className='space-y-1.5'>
+            <label
+              htmlFor='approval-password'
+              className='text-xs font-medium uppercase tracking-wide text-muted-foreground'
+            >
+              Wallet password
+            </label>
+
+            <input
+              id='approval-password'
+              type='password'
+              autoFocus
+              autoComplete='off'
+              spellCheck={false}
+              value={password}
+              disabled={working}
+              onChange={(event) => {
+                setPassword(event.target.value);
+                setPasswordError(null);
+              }}
+              onKeyDown={(event) => {
+                if (event.key === 'Enter' && password.length > 0) {
+                  void resolve(true);
+                }
+              }}
+              className='w-full rounded-md border border-border bg-background px-3 py-2 text-sm disabled:opacity-50'
+              placeholder='Required to sign with this wallet'
+            />
+
+            {passwordError ? (
+              <div className='text-xs text-destructive'>{passwordError}</div>
+            ) : null}
+          </div>
+        ) : null}
+
         {error ? (
           <div className='rounded-lg border border-destructive/40 bg-destructive/10 p-2 text-sm text-destructive'>
             {error}

crates/sage-api/Cargo.toml

@@ -25,3 +25,6 @@ serde = { workspace = true, features = ["derive"] }
 tauri-specta = { workspace = true, features = ["derive"], optional = true }
 specta = { workspace = true, features = ["derive", "bigdecimal"], optional = true }
 utoipa = { workspace = true, optional = true }
+
+[dev-dependencies]
+serde_json = { workspace = true }

crates/sage-api/endpoints.json

@@ -102,5 +102,6 @@
   "is_asset_owned": true,
   "change_password": false,
   "reconcile_key_protection": false,
+  "reconcile_drifted_key_protection": false,
   "get_xch_usd_price": true
 }

crates/sage-api/macro/Cargo.toml

@@ -20,6 +20,7 @@ proc-macro = true
 [dependencies]
 quote = { workspace = true }
 convert_case = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 indexmap = { workspace = true, features = ["serde"] }
 proc-macro2 = { workspace = true }

crates/sage-api/macro/src/lib.rs

@@ -80,18 +80,41 @@ fn generate(input: &TokenStream, tauri: bool) -> TokenStream {
         endpoints.extend(tauri_endpoints);
     }
 
+    // How the host-layer password gate treats each endpoint. Endpoints absent
+    // from this map take no password at all. `sage-api`'s drift tests keep the
+    // manifest in sync with the request types and with how each endpoint's
+    // implementation consumes the password.
+    let gating: std::collections::BTreeMap<String, GateMode> =
+        serde_json::from_str(include_str!("../../password-gating.json"))
+            .expect("Invalid password gating file");
+
     let mut output = proc_macro2::TokenStream::new();
 
     for token in input.clone() {
-        convert(token, &endpoints, None, &mut output);
+        convert(token, &endpoints, &gating, None, &mut output);
     }
 
     output.into()
 }
 
+/// How the host-layer password gate treats an endpoint.
+#[derive(Clone, Copy, PartialEq, Eq, serde::Deserialize)]
+#[serde(rename_all = "snake_case")]
+enum GateMode {
+    /// Prompt on every call, verifying against the active wallet.
+    Always,
+    /// Prompt only when `req.auto_submit` is set.
+    AutoSubmit,
+    /// Prompt on every call, verifying against `req.fingerprint`.
+    Fingerprint,
+}
+
+type Gating<'a> = &'a std::collections::BTreeMap<String, GateMode>;
+
 fn convert(
     tree: TokenTree,
     endpoints: &IndexMap<String, bool>,
+    gating: Gating<'_>,
     endpoint: Option<&str>,
     output: &mut proc_macro2::TokenStream,
 ) {
@@ -115,6 +138,38 @@ fn convert(
                 if is_async {
                     output.extend(quote!(.await));
                 }
+            } else if ident == "maybe_unlock" {
+                match gating.get(endpoint) {
+                    Some(GateMode::Fingerprint) => {
+                        output.extend(quote!(
+                            req.password = sage_password_gate::resolve_for_fingerprint(&app_handle, state.inner(), gate.inner(), req.fingerprint).await?;
+                        ));
+                    }
+                    Some(GateMode::Always) => {
+                        output.extend(quote!(
+                            req.password = sage_password_gate::resolve(&app_handle, state.inner(), gate.inner()).await?;
+                        ));
+                    }
+                    Some(GateMode::AutoSubmit) => {
+                        // Without `auto_submit` the endpoint only builds the
+                        // transaction for the confirmation dialog and never
+                        // touches the key, so prompting here would ask twice.
+                        // The `else` keeps the host layer the sole source of
+                        // the password: every gated command overwrites whatever
+                        // the caller sent, on both branches.
+                        output.extend(quote!(if req.auto_submit {
+                            req.password = sage_password_gate::resolve(
+                                &app_handle,
+                                state.inner(),
+                                gate.inner(),
+                            )
+                            .await?;
+                        } else {
+                            req.password = None;
+                        }));
+                    }
+                    None => {}
+                }
             } else if ident.is_case(Case::Snake) {
                 let ident = proc_macro2::Ident::new(
                     &ident.replace("endpoint", &endpoint.to_case(Case::Snake)),
@@ -152,14 +207,14 @@ fn convert(
             if repeat {
                 for endpoint in endpoints.keys() {
                     for tree in stream.clone() {
-                        convert(tree, endpoints, Some(endpoint), output);
+                        convert(tree, endpoints, gating, Some(endpoint), output);
                     }
                 }
             } else {
                 let mut inner = proc_macro2::TokenStream::new();
 
                 for tree in stream {
-                    convert(tree, endpoints, endpoint, &mut inner);
+                    convert(tree, endpoints, gating, endpoint, &mut inner);
                 }
 
                 output.extend(proc_macro2::TokenStream::from(TokenStream::from(

crates/sage-api/password-gating.json

@@ -0,0 +1,34 @@
+{
+  "add_nft_uri": "auto_submit",
+  "assign_nfts_to_did": "auto_submit",
+  "auto_combine_cat": "auto_submit",
+  "auto_combine_xch": "auto_submit",
+  "bulk_mint_nfts": "auto_submit",
+  "bulk_send_cat": "auto_submit",
+  "bulk_send_xch": "auto_submit",
+  "cancel_offer": "auto_submit",
+  "cancel_offers": "auto_submit",
+  "combine": "auto_submit",
+  "create_did": "auto_submit",
+  "create_transaction": "auto_submit",
+  "delete_key": "fingerprint",
+  "exercise_options": "auto_submit",
+  "finalize_clawback": "auto_submit",
+  "get_secret_key": "fingerprint",
+  "increase_derivation_index": "always",
+  "issue_cat": "auto_submit",
+  "make_offer": "always",
+  "mint_option": "auto_submit",
+  "multi_send": "auto_submit",
+  "normalize_dids": "auto_submit",
+  "send_cat": "auto_submit",
+  "send_xch": "auto_submit",
+  "sign_coin_spends": "always",
+  "sign_message_by_address": "always",
+  "sign_message_with_public_key": "always",
+  "split": "auto_submit",
+  "take_offer": "always",
+  "transfer_dids": "auto_submit",
+  "transfer_nfts": "auto_submit",
+  "transfer_options": "auto_submit"
+}