fix(desktop): scope credential presence grants to the operation proven

`provenUntil` was keyed on credentialId alone, and `authorizeForSecret` set and
read it without reference to what the caller was about to do. `copyCredential`
puts the plaintext on the clipboard from inside main and returns a boolean;
`revealCredential` returns the string itself to the renderer. With one
undifferentiated grant, approving a native "Copy password?" prompt silently
authorized a plaintext reveal for the remaining 30s with no second prompt — the
OS prompt is the only human-in-the-loop control on plaintext egress, and its
label described something weaker than what it granted.

Grants now carry their operation and are compared with an ordering rather than
equality: reveal is the stronger claim, so a reveal grant still covers a later
copy. That is deliberate, not laxity — it preserves the behaviour AUTH_GRACE_MS
was designed for (the plaintext is already on screen, so re-prompting to put
that same string on the clipboard buys nothing). Only the weaker-implies-
stronger direction is closed.

`operation` is required rather than optional so the compiler names every call
site; it found both.

Not addressed, deliberately: the non-biometric fallback still uses
`defaultId: 1`, so a reflexive Enter confirms. That is a UX change and is left
for a decision rather than folded in here.

Author: waleedlatif1

apps/desktop/src/main/browser-credentials/index.ts

@@ -89,6 +89,7 @@ export async function forgetAllCredentials(): Promise<BrowserCredentialMetadata[
 export async function revealCredential(id: string): Promise<string | null> {
   const authorized = await authorizeForSecret({
     credentialId: id,
+    operation: 'reveal',
     reason: 'show a saved password',
     action: 'Show password',
   })
@@ -106,6 +107,7 @@ export async function revealCredential(id: string): Promise<string | null> {
 export async function copyCredential(id: string): Promise<boolean> {
   const authorized = await authorizeForSecret({
     credentialId: id,
+    operation: 'copy',
     reason: 'copy a saved password',
     action: 'Copy password',
   })

apps/desktop/src/main/browser-credentials/os-auth.test.ts

@@ -43,7 +43,22 @@ function setPlatform(platform: NodeJS.Platform): void {
 }
 
 function request(credentialId: string) {
-  return { credentialId, reason: 'show a saved password', action: 'Show password' }
+  return {
+    credentialId,
+    operation: 'reveal' as const,
+    reason: 'show a saved password',
+    action: 'Show password',
+  }
+}
+
+/** The weaker of the two operations: plaintext never leaves the main process. */
+function copyRequest(credentialId: string) {
+  return {
+    credentialId,
+    operation: 'copy' as const,
+    reason: 'copy a saved password',
+    action: 'Copy password',
+  }
 }
 
 describe('authorizeForSecret', () => {
@@ -110,6 +125,39 @@ describe('authorizeForSecret', () => {
     expect(promptTouchID).toHaveBeenCalledTimes(2)
   })
 
+  it('never lets a copy consent stand in for a plaintext reveal', async () => {
+    await expect(authorizeForSecret(copyRequest('c1'))).resolves.toBe(true)
+    expect(promptTouchID).toHaveBeenCalledTimes(1)
+
+    // The user approved "Copy password?"; revealing hands the string to the
+    // renderer, so it has to ask again rather than ride the copy grant.
+    await expect(authorizeForSecret(request('c1'))).resolves.toBe(true)
+    expect(promptTouchID).toHaveBeenCalledTimes(2)
+  })
+
+  it('lets a reveal consent cover a later copy of the same credential', async () => {
+    await expect(authorizeForSecret(request('c1'))).resolves.toBe(true)
+
+    // The plaintext is already on screen, so putting that same string on the
+    // clipboard buys nothing by prompting twice.
+    await expect(authorizeForSecret(copyRequest('c1'))).resolves.toBe(true)
+    expect(promptTouchID).toHaveBeenCalledTimes(1)
+  })
+
+  it('keeps a copy grant usable for further copies', async () => {
+    await authorizeForSecret(copyRequest('c1'))
+    await authorizeForSecret(copyRequest('c1'))
+
+    expect(promptTouchID).toHaveBeenCalledTimes(1)
+  })
+
+  it('never widens a grant to another credential', async () => {
+    await authorizeForSecret(request('c1'))
+    await authorizeForSecret(request('c2'))
+
+    expect(promptTouchID).toHaveBeenCalledTimes(2)
+  })
+
   it('asks again after the credential is explicitly revoked', async () => {
     await authorizeForSecret(request('c1'))
     revokeSecretAuthorization('c1')
@@ -130,11 +178,7 @@ describe('authorizeForSecret', () => {
 
   it('labels the fallback dialog with the action it is authorizing', async () => {
     canPromptTouchID.mockReturnValue(false)
-    await authorizeForSecret({
-      credentialId: 'c1',
-      reason: 'copy a saved password',
-      action: 'Copy password',
-    })
+    await authorizeForSecret(copyRequest('c1'))
 
     expect(showMessageBox).toHaveBeenCalledWith(
       expect.objectContaining({

apps/desktop/src/main/browser-credentials/os-auth.ts

@@ -12,11 +12,26 @@ const logger = createLogger('BrowserCredentialAuth')
  * their way to is typically still on screen — asking a second time to put that
  * same string on the clipboard is friction that buys nothing, and teaches
  * people to approve prompts without reading them.
+ *
+ * That reasoning only runs one way, which is why grants carry the operation
+ * they were proven for: nothing about a copy implies the user agreed to hand
+ * the plaintext to the renderer.
  */
 const AUTH_GRACE_MS = 30_000
 
-/** Credential id to the moment its proof of presence lapses. */
-const provenUntil = new Map<string, number>()
+/**
+ * What a grant was proven for.
+ *
+ * The two are not equivalent, and the ordering matters: `copy` puts the
+ * plaintext on the clipboard from inside the main process and returns only a
+ * boolean, while `reveal` hands the string itself to the Sim renderer. So
+ * `reveal` is the stronger claim and a proof of it covers a later `copy` — but
+ * not the other way round.
+ */
+export type SecretOperation = 'reveal' | 'copy'
+
+/** Credential id to its standing proof of presence. */
+const provenUntil = new Map<string, { expiry: number; operation: SecretOperation }>()
 
 export interface SecretAuthRequest {
   /**
@@ -25,20 +40,33 @@ export interface SecretAuthRequest {
    * granted for.
    */
   credentialId: string
+  /**
+   * What the caller is about to do. Required, because a grant that did not
+   * record it let the weaker consent stand in for the stronger one: approving
+   * a "Copy password?" prompt silently authorized a plaintext reveal to the
+   * renderer for the rest of the window, with no second prompt and a label
+   * that described something else.
+   */
+  operation: SecretOperation
   /** Completes "Sim is about to ..." in the prompt. */
   reason: string
   /** Confirm-button label and title for the non-biometric fallback. */
   action: string
 }
 
-function hasFreshProof(credentialId: string): boolean {
-  const expiry = provenUntil.get(credentialId)
-  if (expiry === undefined) return false
-  if (Date.now() >= expiry) {
+/** Whether a proof of `granted` is enough to perform `requested`. */
+function grantCovers(granted: SecretOperation, requested: SecretOperation): boolean {
+  return granted === 'reveal' || granted === requested
+}
+
+function hasFreshProof(credentialId: string, operation: SecretOperation): boolean {
+  const proof = provenUntil.get(credentialId)
+  if (proof === undefined) return false
+  if (Date.now() >= proof.expiry) {
     provenUntil.delete(credentialId)
     return false
   }
-  return true
+  return grantCovers(proof.operation, operation)
 }
 
 /**
@@ -73,12 +101,13 @@ export function revokeSecretAuthorization(credentialId?: string): void {
  */
 export async function authorizeForSecret({
   credentialId,
+  operation,
   reason,
   action,
 }: SecretAuthRequest): Promise<boolean> {
-  if (hasFreshProof(credentialId)) return true
+  if (hasFreshProof(credentialId, operation)) return true
   if (!(await promptForSecret(reason, action))) return false
-  provenUntil.set(credentialId, Date.now() + AUTH_GRACE_MS)
+  provenUntil.set(credentialId, { expiry: Date.now() + AUTH_GRACE_MS, operation })
   return true
 }