Implement "Select devices" flow

Author: msirringhaus

xyz-iinuwa-credential-manager-portal-gtk/Cargo.lock

@@ -20,7 +20,7 @@ serde_json = "1.0.140"
 tracing = "0.1.41"
 tracing-subscriber = "0.3"
 zbus = "5.5.0"
-libwebauthn = { git = "https://github.com/linux-credentials/libwebauthn", rev = "dc23daed528f512f2bcb61fce9eb6b8ee74066e2" }
+libwebauthn = { git = "https://github.com/linux-credentials/libwebauthn", rev = "7efdc9324039ea7776a3a71a79d087f791b1ed91" }
 async-trait = "0.1.88"
 tokio = { version = "1", features = ["rt-multi-thread"] }
 

xyz-iinuwa-credential-manager-portal-gtk/Cargo.toml

@@ -7,7 +7,7 @@ use std::{
 use libwebauthn::{
     self,
     ops::webauthn::{GetAssertionResponse, MakeCredentialResponse},
-    transport::Device as _,
+    transport::{hid::HidDevice, Device as _},
     webauthn::{Error as WebAuthnError, WebAuthn},
     UxUpdate,
 };
@@ -35,6 +35,8 @@ pub struct CredentialService {
     usb_state: AsyncArc<AsyncMutex<UsbState>>,
     usb_uv_handler: UsbUvHandler,
 
+    internal_hid_devices: Vec<HidDevice>,
+    chosen_hid_device: Option<HidDevice>,
     internal_device_credentials: Vec<CredentialMetadata>,
     internal_device_state: InternalDeviceState,
     internal_pin_attempts_left: u32,
@@ -81,13 +83,15 @@ impl CredentialService {
             usb_state: usb_state.clone(),
             usb_uv_handler: UsbUvHandler::new(),
 
+            internal_hid_devices: Vec::new(),
             internal_device_credentials,
             internal_device_state: InternalDeviceState::Idle,
             internal_pin_attempts_left: 5,
             internal_pin_unlock_time: None,
 
             cred_request,
             cred_response,
+            chosen_hid_device: None,
         }
     }
 
@@ -97,32 +101,73 @@ impl CredentialService {
 
     pub(crate) async fn poll_device_discovery_usb(&mut self) -> Result<UsbState, String> {
         debug!("polling for USB status");
-        let prev_usb_state = self.usb_state.lock().await.clone();
+        let prev_usb_state = *self.usb_state.lock().await;
         let next_usb_state = match prev_usb_state {
             UsbState::Idle | UsbState::Waiting => {
-                let devices = libwebauthn::transport::hid::list_devices().await.unwrap();
-                if devices.is_empty() {
+                self.internal_hid_devices =
+                    libwebauthn::transport::hid::list_devices().await.unwrap();
+                if self.internal_hid_devices.is_empty() {
                     let state = UsbState::Waiting;
                     *self.usb_state.lock().await = state;
                     return Ok(state);
-                }
-                if devices.is_empty() {
-                    Ok(UsbState::Waiting)
-                } else {
+                } else if self.internal_hid_devices.len() == 1 {
+                    self.chosen_hid_device = Some(self.internal_hid_devices.swap_remove(0));
                     Ok(UsbState::Connected)
+                } else {
+                    Ok(UsbState::SelectingDevice)
                 }
             }
+            UsbState::SelectingDevice => {
+                let (blinking_tx, mut blinking_rx) = tokio::sync::mpsc::channel::<Option<HidDevice>>(
+                    self.internal_hid_devices.len(),
+                );
+                let mut expected_answers = self.internal_hid_devices.len();
+                for mut device in self.internal_hid_devices.drain(..) {
+                    let tx = blinking_tx.clone();
+                    tokio().spawn(async move {
+                        let (mut channel, _state_rx) = device.channel().await.unwrap();
+                        let res = channel
+                            .blink_and_wait_for_user_presence(Duration::from_secs(300))
+                            .await;
+                        drop(channel);
+                        match res {
+                            Ok(true) => {
+                                let _ = tx.send(Some(device)).await;
+                            }
+                            Ok(false) | Err(_) => {
+                                let _ = tx.send(None).await;
+                            }
+                        }
+                    });
+                }
+                let mut state = UsbState::Idle;
+                while let Some(msg) = blinking_rx.recv().await {
+                    expected_answers -= 1;
+                    match msg {
+                        Some(device) => {
+                            self.chosen_hid_device = Some(device);
+                            state = UsbState::Connected;
+                            break;
+                        }
+                        None => {
+                            if expected_answers == 0 {
+                                break;
+                            } else {
+                                continue;
+                            }
+                        }
+                    }
+                }
+                Ok(state)
+            }
             UsbState::Connected => {
-                // TODO: I'm not sure how we want to handle multiple usb devices
-                // just take the first one found for now.
-                // TODO: store this device reference, perhaps in the enum itself
                 let handler = self.usb_uv_handler.clone();
                 let cred_request = self.cred_request.clone();
                 let signal_tx = self.usb_uv_handler.signal_tx.clone();
                 let pin_rx = self.usb_uv_handler.pin_rx.clone();
+                let mut device = self.chosen_hid_device.take().unwrap();
+                self.internal_hid_devices.clear();
                 tokio().spawn(async move {
-                    let mut devices = libwebauthn::transport::hid::list_devices().await.unwrap();
-                    let device = devices.first_mut().unwrap();
                     let (mut channel, state_rx) = device.channel().await.unwrap();
                     tokio().spawn(async move {
                         handle_usb_updates(signal_tx, pin_rx, state_rx).await;
@@ -288,7 +333,7 @@ impl CredentialService {
             UsbState::UserCancelled => Ok(prev_usb_state),
         }?;
 
-        *self.usb_state.lock().await = next_usb_state;
+        *self.usb_state.lock().await = next_usb_state.clone();
         Ok(next_usb_state)
     }
 
@@ -402,7 +447,6 @@ impl CredentialService {
     }
 }
 
-
 #[derive(Copy, Clone, Debug, Default, PartialEq)]
 pub enum UsbState {
     /// Not polling for FIDO USB device.
@@ -433,6 +477,10 @@ pub enum UsbState {
 
     // This isn't actually sent from the server.
     UserCancelled,
+
+    // When we encounter multiple devices, we let all of them blink and continue
+    // with the one that was tapped.
+    SelectingDevice,
 }
 
 #[derive(Clone, Debug, Default, PartialEq)]

xyz-iinuwa-credential-manager-portal-gtk/src/credential_service/mod.rs

@@ -89,7 +89,8 @@ impl ViewModel {
         self.imp().tx.replace(Some(tx));
         self.imp().rx.replace(Some(rx));
         glib::spawn_future_local(clone!(
-            #[weak(rename_to = view_model)] self,
+            #[weak(rename_to = view_model)]
+            self,
             async move {
                 loop {
                     let rx = view_model.imp().rx.borrow();
@@ -99,36 +100,49 @@ impl ViewModel {
                             // TODO: hack so I don't have to unset this in every event manually.
                             view_model.set_usb_pin_entry_visible(false);
                             match update {
-                                ViewUpdate::SetTitle(title) => { view_model.set_title(title) },
-                                ViewUpdate::SetDevices(devices) => { view_model.update_devices(&devices) },
-                                ViewUpdate::SetCredentials(credentials) => { view_model.update_credentials(&credentials) },
-                                ViewUpdate::SelectDevice(device) => { view_model.select_device(&device) },
-                                ViewUpdate::SelectCredential(cred_id) => { view_model.select_credential(cred_id) },
+                                ViewUpdate::SetTitle(title) => view_model.set_title(title),
+                                ViewUpdate::SetDevices(devices) => {
+                                    view_model.update_devices(&devices)
+                                }
+                                ViewUpdate::SetCredentials(credentials) => {
+                                    view_model.update_credentials(&credentials)
+                                }
+                                ViewUpdate::SelectingDevice => view_model.selecting_device(),
+                                ViewUpdate::WaitingForDevice(device) => {
+                                    view_model.waiting_for_device(&device)
+                                }
+                                ViewUpdate::SelectCredential(cred_id) => {
+                                    view_model.select_credential(cred_id)
+                                }
                                 ViewUpdate::UsbNeedsPin { attempts_left } => {
                                     let prompt = match attempts_left {
-                                        Some(1) => "Enter your PIN. 1 attempt remaining.".to_string(),
-                                        Some(attempts_left) => format!("Enter your PIN. {attempts_left} attempts remaining."),
+                                        Some(1) => {
+                                            "Enter your PIN. 1 attempt remaining.".to_string()
+                                        }
+                                        Some(attempts_left) => format!(
+                                            "Enter your PIN. {attempts_left} attempts remaining."
+                                        ),
                                         None => format!("Enter your PIN."),
                                     };
                                     view_model.set_prompt(prompt);
                                     view_model.set_usb_pin_entry_visible(true);
-                                },
+                                }
                                 ViewUpdate::UsbNeedsUserVerification { attempts_left } => {
                                     let prompt = match attempts_left {
                                         Some(1) => "Touch your device again. 1 attempt remaining.".to_string(),
                                         Some(attempts_left) => format!("Touch your device again. {attempts_left} attempts remaining."),
                                         None => format!("Touch your device."),
                                     };
                                     view_model.set_prompt(prompt);
-                                },
+                                }
                                 ViewUpdate::UsbNeedsUserPresence => {
                                     view_model.set_prompt("Touch your device");
-                                },
+                                }
                                 ViewUpdate::Completed => {
                                     view_model.set_completed(true);
-                                },
+                                }
                             }
-                        },
+                        }
                         Err(e) => {
                             debug!("ViewModel event listener interrupted: {}", e);
                             break;
@@ -228,7 +242,7 @@ impl ViewModel {
         self.set_credentials(credential_list);
     }
 
-    fn select_device(&self, device: &Device) {
+    fn waiting_for_device(&self, device: &Device) {
         match device.transport {
             Transport::Usb => {
                 self.set_prompt("Insert your security key.");
@@ -242,6 +256,10 @@ impl ViewModel {
         self.set_selected_credential("");
     }
 
+    fn selecting_device(&self) {
+        self.set_prompt("Multiple devices found. Please select with which to proceed.");
+    }
+
     fn select_credential(&self, cred_id: String) {
         self.set_selected_credential(cred_id);
     }