iterm2_client/

auth.rs

//! Authentication for the iTerm2 API.
//!
//! Credentials are resolved from `ITERM2_COOKIE` / `ITERM2_KEY` environment
//! variables, falling back to an AppleScript request to iTerm2 via `osascript`.

use crate::error::{Error, Result};
use std::env;
use std::fmt;
use zeroize::{Zeroize, ZeroizeOnDrop};

/// Cookie and key pair used to authenticate with the iTerm2 WebSocket API.
///
/// Credentials are zeroized from memory when dropped. The `Debug` implementation
/// redacts the actual values to prevent accidental credential leakage in logs.
#[derive(Zeroize, ZeroizeOnDrop)]
pub struct Credentials {
    pub cookie: String,
    pub key: String,
}

impl fmt::Debug for Credentials {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        f.debug_struct("Credentials")
            .field("cookie", &"[redacted]")
            .field("key", &"[redacted]")
            .finish()
    }
}

/// Trait for running AppleScript commands. Inject a mock in tests.
pub trait AppleScriptRunner: Send + Sync {
    fn run_osascript(&self, script: &str) -> std::result::Result<String, String>;
}

/// Production [`AppleScriptRunner`] that invokes `/usr/bin/osascript`.
pub struct OsascriptRunner;

impl AppleScriptRunner for OsascriptRunner {
    fn run_osascript(&self, script: &str) -> std::result::Result<String, String> {
        let output = std::process::Command::new("osascript")
            .arg("-e")
            .arg(script)
            .output()
            .map_err(|e| format!("Failed to run osascript: {e}"))?;

        if output.status.success() {
            Ok(String::from_utf8_lossy(&output.stdout).trim().to_string())
        } else {
            Err(String::from_utf8_lossy(&output.stderr).trim().to_string())
        }
    }
}

fn applescript_request(app_name: &str) -> String {
    // The "for app named" clause is required — without it, AppleScript parses
    // "and key" as the boolean AND operator applied to the cookie string.
    format!(
        r#"tell application "iTerm2" to request cookie and key for app named "{}""#,
        app_name.replace('\\', "\\\\").replace('"', "\\\"")
    )
}

/// Resolve iTerm2 API credentials.
///
/// Checks `ITERM2_COOKIE` and `ITERM2_KEY` environment variables first,
/// then falls back to requesting credentials from iTerm2 via AppleScript.
/// The `app_name` is shown in iTerm2's authorization dialog.
pub fn resolve_credentials(app_name: &str, runner: &dyn AppleScriptRunner) -> Result<Credentials> {
    resolve_credentials_with_env(app_name, runner, |k| env::var(k).ok())
}

fn resolve_credentials_with_env(
    app_name: &str,
    runner: &dyn AppleScriptRunner,
    env_fn: impl Fn(&str) -> Option<String>,
) -> Result<Credentials> {
    // Try env vars first
    if let (Some(cookie), Some(key)) = (env_fn("ITERM2_COOKIE"), env_fn("ITERM2_KEY")) {
        if !cookie.is_empty() && !key.is_empty() {
            return Ok(Credentials { cookie, key });
        }
    }

    // Fall back to osascript
    let script = applescript_request(app_name);
    let output = runner
        .run_osascript(&script)
        .map_err(|e| Error::Auth(format!("osascript failed: {e}")))?;

    parse_cookie_key(&output)
}

fn parse_cookie_key(output: &str) -> Result<Credentials> {
    let parts: Vec<&str> = output.split_whitespace().collect();
    if parts.len() == 2 {
        Ok(Credentials {
            cookie: parts[0].to_string(),
            key: parts[1].to_string(),
        })
    } else {
        Err(Error::Auth(
            "Failed to parse cookie/key from osascript output (expected two whitespace-separated tokens)".to_string()
        ))
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    struct MockRunner {
        result: std::result::Result<String, String>,
    }

    impl AppleScriptRunner for MockRunner {
        fn run_osascript(&self, _script: &str) -> std::result::Result<String, String> {
            self.result.clone()
        }
    }

    #[test]
    fn resolve_from_env_vars() {
        let runner = MockRunner {
            result: Err("should not be called".to_string()),
        };
        let creds = resolve_credentials_with_env("test-app", &runner, |key| match key {
            "ITERM2_COOKIE" => Some("test_cookie".to_string()),
            "ITERM2_KEY" => Some("test_key".to_string()),
            _ => None,
        })
        .unwrap();
        assert_eq!(creds.cookie, "test_cookie");
        assert_eq!(creds.key, "test_key");
    }

    #[test]
    fn empty_env_vars_fall_through_to_osascript() {
        let runner = MockRunner {
            result: Ok("abc123 def456".to_string()),
        };
        let creds = resolve_credentials_with_env("test-app", &runner, |key| match key {
            "ITERM2_COOKIE" => Some("".to_string()),
            "ITERM2_KEY" => Some("".to_string()),
            _ => None,
        })
        .unwrap();
        assert_eq!(creds.cookie, "abc123");
        assert_eq!(creds.key, "def456");
    }

    #[test]
    fn resolve_from_osascript() {
        let runner = MockRunner {
            result: Ok("abc123 def456".to_string()),
        };
        let creds =
            resolve_credentials_with_env("test-app", &runner, |_| None).unwrap();
        assert_eq!(creds.cookie, "abc123");
        assert_eq!(creds.key, "def456");
    }

    #[test]
    fn resolve_from_osascript_newline_separated() {
        let runner = MockRunner {
            result: Ok("abc123\ndef456".to_string()),
        };
        let creds =
            resolve_credentials_with_env("test-app", &runner, |_| None).unwrap();
        assert_eq!(creds.cookie, "abc123");
        assert_eq!(creds.key, "def456");
    }

    #[test]
    fn osascript_failure() {
        let runner = MockRunner {
            result: Err("connection refused".to_string()),
        };
        let err =
            resolve_credentials_with_env("test-app", &runner, |_| None).unwrap_err();
        assert!(err.to_string().contains("osascript failed"));
    }

    #[test]
    fn parse_bad_output() {
        let runner = MockRunner {
            result: Ok("justonetoken".to_string()),
        };
        let err =
            resolve_credentials_with_env("test-app", &runner, |_| None).unwrap_err();
        assert!(err.to_string().contains("Failed to parse"));
    }

    #[test]
    fn applescript_request_escapes_quotes() {
        let script = applescript_request(r#"my "app""#);
        assert!(script.contains(r#"my \"app\""#));
        assert!(script.contains("for app named"));
    }

    #[test]
    fn debug_redacts_credentials() {
        let creds = Credentials {
            cookie: "secret_cookie".to_string(),
            key: "secret_key".to_string(),
        };
        let debug_output = format!("{:?}", creds);
        assert!(!debug_output.contains("secret_cookie"));
        assert!(!debug_output.contains("secret_key"));
        assert!(debug_output.contains("[redacted]"));
    }
}