Present desktop authentication and automatic relocking

apps/cli/src/main.rs

@@ -41,6 +41,7 @@ use ironstorage::{
     secret_store::{
         NativeSecretStore, OpenPgpPassphrasePrompt, OpenPgpPassphrasePromptError,
         SecretCachePolicy, SecretProtectionPolicy, SecretStore, SecretStoreBackend,
+        SecretStoreError,
     },
     write::{
         EntryCommit, EntryCommitError, EntryCommitter, InsertContent, NoGitEntryCommitter,
@@ -65,6 +66,26 @@ fn run() -> Result<u8, ()> {
 }
 
 fn run_with<I, T, O, E>(arguments: I, mut stdout: O, mut stderr: E) -> Result<u8, ()>
+where
+    I: IntoIterator<Item = T>,
+    T: Into<OsString> + Clone,
+    O: Write,
+    E: Write,
+{
+    run_with_secret_store(arguments, &mut stdout, &mut stderr, || {
+        NativeSecretStore::system(
+            SecretCachePolicy::Disabled,
+            SecretProtectionPolicy::device_unlocked(),
+        )
+    })
+}
+
+fn run_with_secret_store<I, T, O, E>(
+    arguments: I,
+    mut stdout: O,
+    mut stderr: E,
+    open_secret_store: impl FnOnce() -> Result<NativeSecretStore, SecretStoreError>,
+) -> Result<u8, ()>
 where
     I: IntoIterator<Item = T>,
     T: Into<OsString> + Clone,
@@ -122,11 +143,7 @@ where
             }
             request => match Config::load(invocation.config()) {
                 Ok(config) if needs_secret_store(request) => {
-                    let mut secrets = match NativeSecretStore::system(
-                        SecretCachePolicy::Disabled,
-                        SecretProtectionPolicy::device_unlocked(),
-                    )
-                    .and_then(|store| {
+                    let mut secrets = match open_secret_store().and_then(|store| {
                         store.unlock()?;
                         Ok(store.with_openpgp_passphrase_prompt(NativeOpenPgpPassphrasePrompt))
                     }) {
@@ -1533,7 +1550,7 @@ mod tests {
     use super::{
         CliPresentation, OtpInteraction, OtpInteractionError, PresentationFailure, execute_local,
         execute_secure, execute_secure_with, execute_secure_with_services, run_with,
-        wait_for_clipboard,
+        run_with_secret_store, wait_for_clipboard,
     };
 
     type TestResult = Result<(), Box<dyn Error>>;
@@ -1803,7 +1820,7 @@ mod tests {
         )?;
         let mut stdout = Vec::new();
         let mut stderr = Vec::new();
-        let code = run_with(
+        let code = run_with_secret_store(
             [
                 OsString::from("ironstorage"),
                 OsString::from("--config"),
@@ -1813,6 +1830,7 @@ mod tests {
             ],
             &mut stdout,
             &mut stderr,
+            || Err(SecretStoreError::Unavailable),
         )
         .expect("writing to memory cannot fail");
         assert_eq!(code, EXIT_UNAVAILABLE);