change location of dev db and bump version

.gitignore

@@ -5,3 +5,4 @@ src-tauri/target/
 
 # just in case
 credentials*
+!credentials.rs

package.json

@@ -1,6 +1,6 @@
 {
   "name": "creddy",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "scripts": {
     "dev": "vite",
     "build": "vite build",

src-tauri/.env

@@ -1 +1 @@
-DATABASE_URL=sqlite://creddy.db?mode=rwc
+DATABASE_URL=sqlite://C:/Users/Joe/AppData/Roaming/creddy/creddy.dev.db

src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "app"
-version = "0.1.0"
+version = "0.2.0"
 description = "A Tauri App"
 authors = ["you"]
 license = ""
@@ -17,7 +17,8 @@ tauri-build = { version = "1.0.4", features = [] }
 [dependencies]
 serde_json = "1.0"
 serde = { version = "1.0", features = ["derive"] }
-tauri = { version = "1.0.5", features = ["api-all", "system-tray"] }
+tauri = { version = "1.2", features = ["dialog", "os-all", "system-tray"] }
+tauri-plugin-single-instance = { git = "https://github.com/tauri-apps/plugins-workspace", branch = "dev" }
 sodiumoxide = "0.2.7"
 tokio = { version = ">=1.19", features = ["full"] }
 sqlx = { version = "0.6.2", features = ["sqlite", "runtime-tokio-rustls"] }
@@ -31,14 +32,18 @@ thiserror = "1.0.38"
 once_cell = "1.16.0"
 strum = "0.24"
 strum_macros = "0.24"
+auto-launch = "0.4.0"
+dirs = "5.0"
+clap = { version = "3.2.23", features = ["derive"] }
+is-terminal = "0.4.7"
 
 [features]
 # by default Tauri runs in production mode
 # when `tauri dev` runs it is executed with `cargo run --no-default-features` if `devPath` is an URL
-default = [ "custom-protocol" ]
+default = ["custom-protocol"]
 # this feature is used used for production builds where `devPath` points to the filesystem
 # DO NOT remove this
-custom-protocol = [ "tauri/custom-protocol" ]
+custom-protocol = ["tauri/custom-protocol"]
 
 # [profile.dev.build-override]
 # opt-level = 3

src-tauri/migrations/20221201002355_initial.sql

@@ -3,11 +3,12 @@ CREATE TABLE credentials (
     access_key_id TEXT NOT NULL,
     secret_key_enc BLOB NOT NULL,
     salt BLOB NOT NULL,
-    nonce BLOB NOT NULL
+    nonce BLOB NOT NULL,
+    created_at INTEGER NOT NULL
 );
 
 CREATE TABLE config (
-    name TEXT NOT NULL,
+    name TEXT UNIQUE NOT NULL,
     data TEXT NOT NULL
 );
 

src-tauri/src/app.rs

@@ -0,0 +1,92 @@
+use std::error::Error;
+
+use once_cell::sync::OnceCell;
+use sqlx::{
+    SqlitePool,
+    sqlite::SqlitePoolOptions,
+    sqlite::SqliteConnectOptions,
+};
+use tauri::{
+    App,
+    AppHandle,
+    Manager,
+    async_runtime as rt,
+};
+
+use crate::{
+    config::{self, AppConfig},
+    credentials::Session,
+    ipc,
+    server::Server,
+    errors::*,
+    state::AppState,
+    tray,
+};
+
+
+pub static APP: OnceCell<AppHandle> = OnceCell::new();
+
+
+pub fn run() -> tauri::Result<()> {
+    tauri::Builder::default()
+        .plugin(tauri_plugin_single_instance::init(|app, _argv, _cwd| {
+            app.get_window("main")
+                .map(|w| w.show().error_popup("Failed to show main window"));
+        }))
+        .system_tray(tray::create())
+        .on_system_tray_event(tray::handle_event)
+        .invoke_handler(tauri::generate_handler![
+            ipc::unlock,
+            ipc::respond,
+            ipc::get_session_status,
+            ipc::save_credentials,
+            ipc::get_config,
+            ipc::save_config,
+        ])
+        .setup(|app| rt::block_on(setup(app)))
+        .build(tauri::generate_context!())?
+        .run(|app, run_event| match run_event {
+            tauri::RunEvent::WindowEvent { label, event, .. } => match event {
+                tauri::WindowEvent::CloseRequested { api, .. } => {
+                    let _ = app.get_window(&label).map(|w| w.hide());
+                    api.prevent_close();
+                }
+                _ => ()
+            }
+            _ => ()
+        });
+
+    Ok(())
+}
+
+
+pub async fn connect_db() -> Result<SqlitePool, SetupError> {
+    let conn_opts = SqliteConnectOptions::new()
+        .filename(config::get_or_create_db_path()?)
+        .create_if_missing(true);
+    let pool_opts = SqlitePoolOptions::new();
+    let pool: SqlitePool = pool_opts.connect_with(conn_opts).await?;
+    sqlx::migrate!().run(&pool).await?;
+    Ok(pool)
+}
+
+
+async fn setup(app: &mut App) -> Result<(), Box<dyn Error>> {
+    APP.set(app.handle()).unwrap();
+
+    let pool = connect_db().await?;
+    let conf = AppConfig::load(&pool).await?;
+    let session = Session::load(&pool).await?;
+    let srv = Server::new(conf.listen_addr, conf.listen_port, app.handle()).await?;
+
+    config::set_auto_launch(conf.start_on_login)?;
+    if !conf.start_minimized {
+        app.get_window("main")
+            .ok_or(HandlerError::NoMainWindow)?
+            .show()?;
+    }
+
+    let state = AppState::new(conf, session, srv, pool);
+    app.manage(state);
+    Ok(())
+}

src-tauri/src/cli.rs

@@ -0,0 +1,142 @@
+use std::process::Command as ChildCommand;
+#[cfg(unix)]
+use std::os::unix::process::CommandExt;
+
+use clap::{
+    Command,
+     Arg,
+     ArgMatches,
+     ArgAction
+ };
+use tokio::{
+    net::TcpStream,
+    io::{AsyncReadExt, AsyncWriteExt},
+};
+
+
+use crate::app;
+use crate::config::AppConfig;
+use crate::credentials::{BaseCredentials, SessionCredentials};
+use crate::errors::*;
+
+
+pub fn parser() -> Command<'static> {
+    Command::new("creddy")
+        .about("A friendly AWS credentials manager")
+        .subcommand(
+            Command::new("run")
+                .about("Launch Creddy")
+        )
+        .subcommand(
+            Command::new("show")
+                .about("Fetch and display AWS credentials")
+                .arg(
+                    Arg::new("base")
+                        .short('b')
+                        .long("base")
+                        .action(ArgAction::SetTrue)
+                        .help("Use base credentials instead of session credentials")
+                )
+        )
+        .subcommand(
+            Command::new("exec")
+                .about("Inject AWS credentials into the environment of another command")
+                .trailing_var_arg(true)
+                .arg(
+                    Arg::new("base")
+                        .short('b')
+                        .long("base")
+                        .action(ArgAction::SetTrue)
+                        .help("Use base credentials instead of session credentials")
+                )
+                .arg(
+                    Arg::new("command")
+                        .multiple_values(true)
+                )
+        )
+}
+
+
+pub fn show(args: &ArgMatches) -> Result<(), CliError> {
+    let base = args.get_one("base").unwrap_or(&false);
+    let creds = get_credentials(*base)?;
+    println!("{creds}");
+    Ok(())
+}
+
+
+pub fn exec(args: &ArgMatches) -> Result<(), CliError> {
+    let base = *args.get_one("base").unwrap_or(&false);
+    let mut cmd_line = args.get_many("command")
+        .ok_or(ExecError::NoCommand)?;
+
+    let cmd_name: &String = cmd_line.next().unwrap(); // Clap guarantees that there will be at least one
+    let mut cmd = ChildCommand::new(cmd_name);
+    cmd.args(cmd_line);
+    
+    if base {
+        let creds: BaseCredentials = serde_json::from_str(&get_credentials(base)?)
+            .map_err(|_| RequestError::InvalidJson)?;
+        cmd.env("AWS_ACCESS_KEY_ID", creds.access_key_id);
+        cmd.env("AWS_SECRET_ACCESS_KEY", creds.secret_access_key);
+    }
+    else {
+        let creds: SessionCredentials = serde_json::from_str(&get_credentials(base)?)
+            .map_err(|_| RequestError::InvalidJson)?;
+        cmd.env("AWS_ACCESS_KEY_ID", creds.access_key_id);
+        cmd.env("AWS_SECRET_ACCESS_KEY", creds.secret_access_key);
+        cmd.env("AWS_SESSION_TOKEN", creds.token);
+    }
+
+    #[cfg(unix)]
+    cmd.exec().map_err(|e| ExecError::ExecutionFailed(e))?;
+
+    #[cfg(windows)]
+    {
+        let mut child = cmd.spawn()
+            .map_err(|e| ExecError::ExecutionFailed(e))?;
+        let status = child.wait()
+            .map_err(|e| ExecError::ExecutionFailed(e))?;
+        std::process::exit(status.code().unwrap_or(1));
+    };
+}
+
+
+#[tokio::main]
+async fn get_credentials(base: bool) -> Result<String, RequestError> {
+    let pool = app::connect_db().await?;
+    let config = AppConfig::load(&pool).await?;
+    let path = if base {"/creddy/base-credentials"} else {"/"};
+
+    let mut stream = TcpStream::connect((config.listen_addr, config.listen_port)).await?;
+    let req = format!("GET {path} HTTP/1.0\r\n\r\n");
+    stream.write_all(req.as_bytes()).await?;
+
+    // some day we'll have a proper HTTP parser
+    let mut buf = vec![0; 8192];
+    stream.read_to_end(&mut buf).await?;
+
+    let status = buf.split(|&c| &[c] == b" ")
+        .skip(1)
+        .next()
+        .ok_or(RequestError::MalformedHttpResponse)?;
+
+    if status != b"200" {
+        let s = String::from_utf8_lossy(status).to_string();
+        return Err(RequestError::Failed(s));
+    }
+
+    let break_idx = buf.windows(4)
+        .position(|w| w == b"\r\n\r\n")
+        .ok_or(RequestError::MalformedHttpResponse)?;
+    let body = &buf[(break_idx + 4)..];
+
+    let creds_str = std::str::from_utf8(body)
+        .map_err(|_| RequestError::MalformedHttpResponse)?
+        .to_string();
+
+    if creds_str == "Denied!" {
+        return Err(RequestError::Rejected);
+    }
+    Ok(creds_str)
+}

src-tauri/src/clientinfo.rs

@@ -1,25 +1,37 @@
+use std::path::PathBuf;
+
 use netstat2::{AddressFamilyFlags, ProtocolFlags, ProtocolSocketInfo};
+use tauri::Manager;
 use sysinfo::{System, SystemExt, Pid, PidExt, ProcessExt};
 use serde::{Serialize, Deserialize};
 
-use crate::errors::*;
+use crate::{
-use crate::get_state;
+    app::APP,
+    errors::*,
+    config::AppConfig,
+    state::AppState,
+};
 
 
 #[derive(Clone, Debug, Serialize, Deserialize, Eq, PartialEq, Hash)]
 pub struct Client {
     pub pid: u32,
-    pub exe: String,
+    pub exe: PathBuf,
 }
 
 
-fn get_associated_pids(local_port: u16) -> Result<Vec<u32>, netstat2::error::Error> {
+async fn get_associated_pids(local_port: u16) -> Result<Vec<u32>, netstat2::error::Error> {
+    let state = APP.get().unwrap().state::<AppState>();
+    let AppConfig {
+        listen_addr: app_listen_addr,
+        listen_port: app_listen_port,
+        ..
+    } = *state.config.read().await;
+
     let sockets_iter = netstat2::iterate_sockets_info(
         AddressFamilyFlags::IPV4,
         ProtocolFlags::TCP
     )?;
-
-    get_state!(config as app_config);
     for item in sockets_iter {
         let sock_info = item?;
         let proto_info = match sock_info.protocol_socket_info {
@@ -28,9 +40,9 @@ fn get_associated_pids(local_port: u16) -> Result<Vec<u32>, netstat2::error::Err
         };
 
         if proto_info.local_port == local_port
-            && proto_info.remote_port == app_config.listen_port
+            && proto_info.remote_port == app_listen_port
-            && proto_info.local_addr == app_config.listen_addr
+            && proto_info.local_addr == app_listen_addr
-            && proto_info.remote_addr == app_config.listen_addr
+            && proto_info.remote_addr == app_listen_addr
         {
             return Ok(sock_info.associated_pids)
         }
@@ -40,10 +52,10 @@ fn get_associated_pids(local_port: u16) -> Result<Vec<u32>, netstat2::error::Err
 
 
 // Theoretically, on some systems, multiple processes can share a socket
-pub fn get_clients(local_port: u16) -> Result<Vec<Option<Client>>, ClientInfoError> {
+pub async fn get_clients(local_port: u16) -> Result<Vec<Option<Client>>, ClientInfoError> {
     let mut clients = Vec::new();    
     let mut sys = System::new();
-    for p in get_associated_pids(local_port)? {
+    for p in get_associated_pids(local_port).await? {
         let pid = Pid::from_u32(p);
         sys.refresh_process(pid);
         let proc = sys.process(pid)
@@ -51,7 +63,7 @@ pub fn get_clients(local_port: u16) -> Result<Vec<Option<Client>>, ClientInfoErr
 
         let client = Client {
             pid: p,
-            exe: proc.exe().to_string_lossy().into_owned(),
+            exe: proc.exe().to_path_buf(),
         };
         clients.push(Some(client));
     }

src-tauri/src/config.rs

@@ -1,6 +1,8 @@
 use std::net::Ipv4Addr;
 use std::path::PathBuf;
 
+use auto_launch::AutoLaunchBuilder;
+use is_terminal::IsTerminal;
 use serde::{Serialize, Deserialize};
 use sqlx::SqlitePool;
 
@@ -17,6 +19,8 @@ pub struct AppConfig {
     pub rehide_ms: u64,
     #[serde(default = "default_start_minimized")]
     pub start_minimized: bool,
+    #[serde(default = "default_start_on_login")]
+    pub start_on_login: bool,
 }
 
 
@@ -27,12 +31,14 @@ impl Default for AppConfig {
             listen_port: default_listen_port(),
             rehide_ms: default_rehide_ms(),
             start_minimized: default_start_minimized(),
+            start_on_login: default_start_on_login(),
         }
     }
 }
 
 
-pub async fn load(pool: &SqlitePool) -> Result<AppConfig, SetupError> {
+impl AppConfig {
+    pub async fn load(pool: &SqlitePool) -> Result<AppConfig, SetupError> {
         let res = sqlx::query!("SELECT * from config where name = 'main'")
             .fetch_optional(pool)
             .await?;
@@ -43,24 +49,61 @@ pub async fn load(pool: &SqlitePool) -> Result<AppConfig, SetupError> {
         };
 
         Ok(serde_json::from_str(&row.data)?)
+    }
+
+    pub async fn save(&self, pool: &SqlitePool) -> Result<(), sqlx::error::Error> {
+        let data = serde_json::to_string(self).unwrap();
+        sqlx::query(
+            "INSERT INTO config (name, data) VALUES ('main', ?)
+            ON CONFLICT (name) DO UPDATE SET data = ?"
+        )
+            .bind(&data)
+            .bind(&data)
+            .execute(pool)
+            .await?;
+
+        Ok(())
+    }
 }
 
 
-pub fn get_or_create_db_path() -> PathBuf {
+pub fn set_auto_launch(is_configured: bool) -> Result<(), SetupError> {
-    if cfg!(debug_assertions) {
+    let path_buf = std::env::current_exe()
-        return PathBuf::from("./creddy.db");
+        .map_err(|e| auto_launch::Error::Io(e))?;
+    let path = path_buf
+        .to_string_lossy();
+
+    let auto = AutoLaunchBuilder::new()
+        .set_app_name("Creddy")
+        .set_app_path(&path)
+        .build()?;
+
+    let is_enabled = auto.is_enabled()?;
+    if is_configured && !is_enabled {
+        auto.enable()?;
+    }
+    else if !is_configured && is_enabled {
+        auto.disable()?;
     }
 
-    let mut parent = std::env::var("HOME")
+    Ok(())
-        .map(|h| {
+}
-            let mut p = PathBuf::from(h);
-            p.push(".config");
-            p
-        })
-        .unwrap_or(PathBuf::from("."));
 
-    parent.push("creddy.db");
+
-    parent
+pub fn get_or_create_db_path() -> Result<PathBuf, DataDirError> {
+    let mut path = dirs::data_dir()
+        .ok_or(DataDirError::NotFound)?;
+    path.push("Creddy");
+
+    std::fs::create_dir_all(&path)?;
+    if cfg!(debug_assertions) && std::io::stdout().is_terminal() {
+        path.push("creddy.dev.db");
+    }
+    else {
+        path.push("creddy.db");
+    }
+
+    Ok(path)
 }
 
 
@@ -74,7 +117,7 @@ fn default_listen_port() -> u16 {
 }
 
 fn default_listen_addr() -> Ipv4Addr { Ipv4Addr::LOCALHOST }
-
 fn default_rehide_ms() -> u64 { 1000 }
-
+// start minimized and on login only in production mode
-fn default_start_minimized() -> bool { !cfg!(debug_assertions) } // default to start-minimized in production only
+fn default_start_minimized() -> bool { !cfg!(debug_assertions) }
+fn default_start_on_login() -> bool { !cfg!(debug_assertions) }

src-tauri/src/credentials.rs

@@ -0,0 +1,244 @@
+use std::fmt::{self, Formatter};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use aws_smithy_types::date_time::{DateTime, Format};
+use serde::{
+    Serialize,
+    Deserialize,
+    Serializer,
+    Deserializer,
+};
+use serde::de::{self, Visitor};
+use sqlx::SqlitePool;
+use sodiumoxide::crypto::{
+        pwhash,
+        pwhash::Salt, 
+        secretbox, 
+        secretbox::{Nonce, Key}
+};
+
+use crate::errors::*;
+
+
+#[derive(Clone, Debug)]
+pub enum Session {
+    Unlocked{
+        base: BaseCredentials,
+        session: SessionCredentials,
+    },
+    Locked(LockedCredentials),
+    Empty,
+}
+
+impl Session {
+    pub async fn load(pool: &SqlitePool) -> Result<Self, SetupError> {
+        let res = sqlx::query!("SELECT * FROM credentials ORDER BY created_at desc")
+            .fetch_optional(pool)
+            .await?;
+        let row = match res {
+            Some(r) => r,
+            None => {return Ok(Session::Empty);}
+        };
+
+        let salt_buf: [u8; 32] = row.salt
+            .try_into()
+            .map_err(|_e| SetupError::InvalidRecord)?;
+        let nonce_buf: [u8; 24] = row.nonce
+            .try_into()
+            .map_err(|_e| SetupError::InvalidRecord)?;
+
+        let creds = LockedCredentials {
+            access_key_id: row.access_key_id,
+            secret_key_enc: row.secret_key_enc,
+            salt: Salt(salt_buf),
+            nonce: Nonce(nonce_buf),
+        };
+        Ok(Session::Locked(creds))
+    }
+
+    pub async fn renew_if_expired(&mut self) -> Result<bool, GetSessionError> {
+        match self {
+            Session::Unlocked{ref base, ref mut session} => {
+                if !session.is_expired() {
+                    return Ok(false);
+                }
+                *session = SessionCredentials::from_base(base).await?;
+                Ok(true)
+            },
+            Session::Locked(_) => Err(GetSessionError::CredentialsLocked),
+            Session::Empty => Err(GetSessionError::CredentialsEmpty),
+        }
+    }
+}
+
+
+#[derive(Clone, Debug)]
+pub struct LockedCredentials {
+    pub access_key_id: String,
+    pub secret_key_enc: Vec<u8>,
+    pub salt: Salt,
+    pub nonce: Nonce,
+}
+
+impl LockedCredentials {
+    pub async fn save(&self, pool: &SqlitePool) -> Result<(), sqlx::Error> {
+        sqlx::query(
+            "INSERT INTO credentials (access_key_id, secret_key_enc, salt, nonce, created_at)
+            VALUES (?, ?, ?, ?, strftime('%s'))"
+        )
+            .bind(&self.access_key_id)
+            .bind(&self.secret_key_enc)
+            .bind(&self.salt.0[0..])
+            .bind(&self.nonce.0[0..])
+            .execute(pool)
+            .await?;
+
+        Ok(())
+    }
+
+    pub fn decrypt(&self, passphrase: &str) -> Result<BaseCredentials, UnlockError> {
+        let mut key_buf = [0; secretbox::KEYBYTES];
+        // pretty sure this only fails if we're out of memory
+        pwhash::derive_key_interactive(&mut key_buf, passphrase.as_bytes(), &self.salt).unwrap();
+        let decrypted = secretbox::open(&self.secret_key_enc, &self.nonce, &Key(key_buf))
+            .map_err(|_| UnlockError::BadPassphrase)?;
+        let secret_access_key = String::from_utf8(decrypted)
+            .map_err(|_| UnlockError::InvalidUtf8)?;
+
+        let creds = BaseCredentials {
+            access_key_id: self.access_key_id.clone(),
+            secret_access_key,
+        };
+        Ok(creds)
+    }
+}
+
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(rename_all = "PascalCase")]
+pub struct BaseCredentials {
+    pub access_key_id: String,
+    pub secret_access_key: String,
+}
+
+impl BaseCredentials {
+    pub fn encrypt(&self, passphrase: &str) -> LockedCredentials {
+        let salt = pwhash::gen_salt();
+        let mut key_buf = [0; secretbox::KEYBYTES];
+        pwhash::derive_key_interactive(&mut key_buf, passphrase.as_bytes(), &salt).unwrap();
+        let key = Key(key_buf);
+        let nonce = secretbox::gen_nonce();
+
+        let secret_key_enc = secretbox::seal(self.secret_access_key.as_bytes(), &nonce, &key);
+
+        LockedCredentials {
+            access_key_id: self.access_key_id.clone(),
+            secret_key_enc,
+            salt,
+            nonce,
+        }
+    }
+}
+
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(rename_all = "PascalCase")]
+pub struct SessionCredentials {
+    pub access_key_id: String,
+    pub secret_access_key: String,
+    pub token: String,
+    #[serde(serialize_with = "serialize_expiration")]
+    #[serde(deserialize_with = "deserialize_expiration")]
+    pub expiration: DateTime,
+}
+
+impl SessionCredentials {
+    pub async fn from_base(base: &BaseCredentials) -> Result<Self, GetSessionError> {
+        let req_creds = aws_sdk_sts::Credentials::new(
+            &base.access_key_id,
+            &base.secret_access_key,
+            None, // token
+            None, //expiration
+            "Creddy", // "provider name" apparently
+        );
+        let config = aws_config::from_env()
+            .credentials_provider(req_creds)
+            .load()
+            .await;
+
+        let client = aws_sdk_sts::Client::new(&config);
+        let resp = client.get_session_token()
+            .duration_seconds(43_200)
+            .send()
+            .await?;
+
+        let aws_session = resp.credentials().ok_or(GetSessionError::EmptyResponse)?;
+
+        let access_key_id = aws_session.access_key_id()
+            .ok_or(GetSessionError::EmptyResponse)?
+            .to_string();
+        let secret_access_key = aws_session.secret_access_key()
+            .ok_or(GetSessionError::EmptyResponse)?
+            .to_string();
+        let token = aws_session.session_token()
+            .ok_or(GetSessionError::EmptyResponse)?
+            .to_string();
+        let expiration = aws_session.expiration()
+            .ok_or(GetSessionError::EmptyResponse)?
+            .clone();
+
+        let session_creds = SessionCredentials {
+            access_key_id,
+            secret_access_key,
+            token,
+            expiration,
+        };
+
+        #[cfg(debug_assertions)]
+        println!("Got new session:\n{}", serde_json::to_string(&session_creds).unwrap());
+
+        Ok(session_creds)
+    }
+
+    pub fn is_expired(&self) -> bool {
+        let current_ts = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .unwrap() // doesn't panic because UNIX_EPOCH won't be later than now()
+            .as_secs();
+
+        let expire_ts = self.expiration.secs();
+        let remaining = expire_ts - (current_ts as i64);
+        remaining < 60
+    }
+}
+
+fn serialize_expiration<S>(exp: &DateTime, serializer: S) -> Result<S::Ok, S::Error>
+where S: Serializer
+{
+    // this only fails if the d/t is out of range, which it can't be for this format
+    let time_str = exp.fmt(Format::DateTime).unwrap();
+    serializer.serialize_str(&time_str)
+}
+
+
+struct DateTimeVisitor;
+
+impl<'de> Visitor<'de> for DateTimeVisitor {
+    type Value = DateTime;
+
+    fn expecting(&self, formatter: &mut Formatter) -> fmt::Result {
+        write!(formatter, "an RFC 3339 UTC string, e.g. \"2014-01-05T10:17:34Z\"")
+    }
+
+    fn visit_str<E: de::Error>(self, v: &str) -> Result<DateTime, E> {
+        DateTime::from_str(v, Format::DateTime)
+            .map_err(|_| E::custom(format!("Invalid date/time: {v}")))
+    }
+}
+
+
+fn deserialize_expiration<'de, D>(deserializer: D) -> Result<DateTime, D::Error>
+where D: Deserializer<'de>
+{
+    deserializer.deserialize_str(DateTimeVisitor)
+}

src-tauri/src/errors.rs

@@ -1,9 +1,9 @@
 use std::error::Error;
 use std::convert::AsRef;
+use std::sync::mpsc;
 use strum_macros::AsRefStr;
 
 use thiserror::Error as ThisError;
-
 use aws_sdk_sts::{
     types::SdkError as AwsSdkError, 
     error::GetSessionTokenError,
@@ -12,32 +12,29 @@ use sqlx::{
     error::Error as SqlxError,
     migrate::MigrateError,
 };
-
+use tauri::api::dialog::{
+    MessageDialogBuilder, 
+    MessageDialogKind,
+};
 use serde::{Serialize, Serializer, ser::SerializeMap};
 
 
-// pub struct SerializeError<E> {
+pub trait ErrorPopup {
-//     pub err: E,
+    fn error_popup(self, title: &str);
-// }
+}
 
-// impl<E: std::error::Error> Serialize for SerializeError<E>
+impl<E: Error> ErrorPopup for Result<(), E> {
-// {
+    fn error_popup(self, title: &str) {
-//     fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        if let Err(e) = self {
-//         let mut map = serializer.serialize_map(None)?;
+            let (tx, rx) = mpsc::channel();
-//         map.serialize_entry("msg", &format!("{}", self.err))?;
+            MessageDialogBuilder::new(title, format!("{e}"))
-//         if let Some(src) = self.err.source() {
+                .kind(MessageDialogKind::Error)
-//             let ser_src = SerializeError { err: src };
+                .show(move |_| tx.send(true).unwrap());
-//             map.serialize_entry("source", &ser_src)?;
-//         }
-//         map.end()
-//     }
-// }
 
-// impl<E: std::error::Error> From<E> for SerializeError<E> {
+            rx.recv().unwrap();
-//     fn from(err: E) -> Self {
+        }
-//         SerializeError { err }
+    }
-//     }
+}
-// }
 
 
 fn serialize_basic_err<E, S>(err: &E, serializer: S) -> Result<S::Ok, S::Error>
@@ -87,6 +84,21 @@ pub enum SetupError {
     MigrationError(#[from] MigrateError),
     #[error("Error parsing configuration from database")]
     ConfigParseError(#[from] serde_json::Error),
+    #[error("Failed to set up start-on-login: {0}")]
+    AutoLaunchError(#[from] auto_launch::Error),
+    #[error("Failed to start listener: {0}")]
+    ServerSetupError(#[from] std::io::Error),
+    #[error("Failed to resolve data directory: {0}")]
+    DataDir(#[from] DataDirError),
+}
+
+
+#[derive(Debug, ThisError, AsRefStr)]
+pub enum DataDirError {
+    #[error("Could not determine data directory")]
+    NotFound,
+    #[error("Failed to create data directory: {0}")]
+    Io(#[from] std::io::Error),
 }
 
 
@@ -94,20 +106,23 @@ pub enum SetupError {
 #[derive(Debug, ThisError, AsRefStr)]
 pub enum SendResponseError {
     #[error("The specified credentials request was not found")]
-    NotFound, // no request with the given id
+    NotFound,
     #[error("The specified request was already closed by the client")]
-    Abandoned, // request has already been closed by client
+    Abandoned,
+    #[error("Could not renew AWS sesssion: {0}")]
+    SessionRenew(#[from] GetSessionError),
 }
 
 
 // errors encountered while handling an HTTP request
 #[derive(Debug, ThisError, AsRefStr)]
-pub enum RequestError {
+pub enum HandlerError {
     #[error("Error writing to stream: {0}")]
     StreamIOError(#[from] std::io::Error),
     // #[error("Received invalid UTF-8 in request")]
     // InvalidUtf8,
-    // MalformedHttpRequest,
+    #[error("HTTP request malformed")]
+    BadRequest(Vec<u8>),
     #[error("HTTP request too large")]
     RequestTooLarge,
     #[error("Error accessing credentials: {0}")]
@@ -133,9 +148,13 @@ pub enum GetCredentialsError {
 #[derive(Debug, ThisError, AsRefStr)]
 pub enum GetSessionError {
     #[error("Request completed successfully but no credentials were returned")]
-    NoCredentials, // SDK returned successfully but credentials are None
+    EmptyResponse, // SDK returned successfully but credentials are None
     #[error("Error response from AWS SDK: {0}")]
     SdkError(#[from] AwsSdkError<GetSessionTokenError>),
+    #[error("Could not construt session: credentials are locked")]
+    CredentialsLocked,
+    #[error("Could not construct session: no credentials are known")]
+    CredentialsEmpty,
 }
 
 
@@ -166,6 +185,43 @@ pub enum ClientInfoError {
 }
 
 
+// Errors encountered while requesting credentials via CLI (creddy show, creddy exec)
+#[derive(Debug, ThisError, AsRefStr)]
+pub enum RequestError {
+    #[error("Credentials request failed: HTTP {0}")]
+    Failed(String),
+    #[error("Credentials request was rejected")]
+    Rejected,
+    #[error("Couldn't interpret the server's response")]
+    MalformedHttpResponse,
+    #[error("The server did not respond with valid JSON")]
+    InvalidJson,
+    #[error("Error reading/writing stream: {0}")]
+    StreamIOError(#[from] std::io::Error),
+    #[error("Error loading configuration data: {0}")]
+    Setup(#[from] SetupError),
+}
+
+
+// Errors encountered while running a subprocess (via creddy exec)
+#[derive(Debug, ThisError, AsRefStr)]
+pub enum ExecError {
+    #[error("Please specify a command")]
+    NoCommand,
+    #[error("Failed to execute command: {0}")]
+    ExecutionFailed(#[from] std::io::Error)
+}
+
+
+#[derive(Debug, ThisError, AsRefStr)]
+pub enum CliError {
+    #[error(transparent)]
+    Request(#[from] RequestError),
+    #[error(transparent)]
+    Exec(#[from] ExecError),
+}
+
+
 // =========================
 // Serialize implementations
 // =========================
@@ -187,20 +243,35 @@ impl Serialize for SerializeWrapper<&GetSessionTokenError> {
 
 
 impl_serialize_basic!(SetupError);
-impl_serialize_basic!(SendResponseError);
 impl_serialize_basic!(GetCredentialsError);
 impl_serialize_basic!(ClientInfoError);
 
 
-impl Serialize for RequestError {
+impl Serialize for HandlerError {
     fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
         let mut map = serializer.serialize_map(None)?;
         map.serialize_entry("code", self.as_ref())?;
         map.serialize_entry("msg", &format!("{self}"))?;
 
         match self {
-            RequestError::NoCredentials(src) => map.serialize_entry("source", &src)?,
+            HandlerError::NoCredentials(src) => map.serialize_entry("source", &src)?,
-            RequestError::ClientInfo(src) => map.serialize_entry("source", &src)?,
+            HandlerError::ClientInfo(src) => map.serialize_entry("source", &src)?,
+            _ => serialize_upstream_err(self, &mut map)?,
+        }
+
+        map.end()
+    }
+}
+
+
+impl Serialize for SendResponseError {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        let mut map = serializer.serialize_map(None)?;
+        map.serialize_entry("code", self.as_ref())?;
+        map.serialize_entry("msg", &format!("{self}"))?;
+
+        match self {
+            SendResponseError::SessionRenew(src) => map.serialize_entry("source", &src)?,
             _ => serialize_upstream_err(self, &mut map)?,
         }
 

src-tauri/src/ipc.rs

@@ -1,16 +1,18 @@
 use serde::{Serialize, Deserialize};
 use tauri::State;
 
-use crate::errors::*;
 use crate::config::AppConfig;
+use crate::credentials::{Session,BaseCredentials};
+use crate::errors::*;
 use crate::clientinfo::Client;
-use crate::state::{AppState, Session, Credentials};
+use crate::state::AppState;
 
 
 #[derive(Clone, Debug, Serialize, Deserialize)]
 pub struct Request {
     pub id: u64,
     pub clients: Vec<Option<Client>>,
+    pub base: bool,
 }
 
 
@@ -29,41 +31,50 @@ pub enum Approval {
 
 
 #[tauri::command]
-pub fn respond(response: RequestResponse, app_state: State<'_, AppState>) -> Result<(), String> {
+pub async fn respond(response: RequestResponse, app_state: State<'_, AppState>) -> Result<(), SendResponseError> {
-    app_state.send_response(response)
+    app_state.send_response(response).await
-        .map_err(|e| format!("Error responding to request: {e}"))
 }
 
 
 #[tauri::command]
 pub async fn unlock(passphrase: String, app_state: State<'_, AppState>) -> Result<(), UnlockError> {
-    app_state.decrypt(&passphrase).await
+    app_state.unlock(&passphrase).await
 }
 
 
 #[tauri::command]
-pub fn get_session_status(app_state: State<'_, AppState>) -> String {
+pub async fn get_session_status(app_state: State<'_, AppState>) -> Result<String, ()> {
-    let session = app_state.session.read().unwrap();
+    let session = app_state.session.read().await;
-    match *session {
+    let status = match *session {
         Session::Locked(_) => "locked".into(),
-        Session::Unlocked(_) => "unlocked".into(),
+        Session::Unlocked{..} => "unlocked".into(),
         Session::Empty => "empty".into()
-    }
+    };
+    Ok(status)
 }
 
 
 #[tauri::command]
 pub async fn save_credentials(
-    credentials: Credentials,
+    credentials: BaseCredentials,
     passphrase: String,
     app_state: State<'_, AppState>
 ) -> Result<(), UnlockError> {
-    app_state.save_creds(credentials, &passphrase).await
+    app_state.new_creds(credentials, &passphrase).await
 }
 
 
 #[tauri::command]
-pub fn get_config(app_state: State<'_, AppState>) -> AppConfig {
+pub async fn get_config(app_state: State<'_, AppState>) -> Result<AppConfig, ()> {
-    let config = app_state.config.read().unwrap();
+    let config = app_state.config.read().await;
-    config.clone()
+    Ok(config.clone())
+}
+
+
+#[tauri::command]
+pub async fn save_config(config: AppConfig, app_state: State<'_, AppState>) -> Result<(), String>  {
+    app_state.update_config(config)
+        .await
+        .map_err(|e| format!("Error saving config: {e}"))?;
+        Ok(())
 }

src-tauri/src/main.rs

@@ -3,10 +3,11 @@
     windows_subsystem = "windows"
 )]
 
-use tauri::{AppHandle, Manager, async_runtime as rt};
-use once_cell::sync::OnceCell;
 
+mod app;
+mod cli;
 mod config;
+mod credentials;
 mod errors;
 mod clientinfo;
 mod ipc;
@@ -14,87 +15,22 @@ mod state;
 mod server;
 mod tray;
 
-use crate::errors::*;
-use state::AppState;
 
+use crate::errors::ErrorPopup;
 
-pub static APP: OnceCell<AppHandle> = OnceCell::new();
 
 fn main() {
-    let initial_state = match rt::block_on(state::AppState::load()) {
+    let res = match cli::parser().get_matches().subcommand() {
-        Ok(state) => state,
+        None | Some(("run", _)) => {
-        Err(e) => {eprintln!("{}", e); return;}
+            app::run().error_popup("Creddy failed to start");
-    };
-
-    tauri::Builder::default()
-        .manage(initial_state)
-        .system_tray(tray::create())
-        .on_system_tray_event(tray::handle_event)
-        .invoke_handler(tauri::generate_handler![
-            ipc::unlock,
-            ipc::respond,
-            ipc::get_session_status,
-            ipc::save_credentials,
-            ipc::get_config,
-        ])
-        .setup(|app| {
-            APP.set(app.handle()).unwrap();
-            let state = app.state::<AppState>();
-            let config = state.config.read().unwrap();
-            let addr = std::net::SocketAddrV4::new(config.listen_addr, config.listen_port);
-            tauri::async_runtime::spawn(server::serve(addr, app.handle()));
-
-            if !config.start_minimized {
-                app.get_window("main")
-                    .ok_or(RequestError::NoMainWindow)?
-                    .show()?;
-            }
             Ok(())
-        })
+        },
-        .build(tauri::generate_context!())
+        Some(("show", m)) => cli::show(m),
-        .expect("error while running tauri application")
+        Some(("exec", m)) => cli::exec(m),
-        .run(|app, run_event| match run_event {
+        _ => unreachable!(),
-            tauri::RunEvent::WindowEvent { label, event, .. } => match event {
-                tauri::WindowEvent::CloseRequested { api, .. } => {
-                    let _ = app.get_window(&label).map(|w| w.hide());
-                    api.prevent_close();
-                }
-                _ => ()
-            }
-            _ => ()
-        })
-}
-
-
-macro_rules! get_state {
-    ($prop:ident as $name:ident) => {
-        use tauri::Manager;
-        let app = crate::APP.get().unwrap(); // as long as the app is running, this is fine
-        let state = app.state::<crate::state::AppState>();
-        let $name = state.$prop.read().unwrap(); // only panics if another thread has already panicked
-    };
-    (config.$prop:ident as $name:ident) => {
-        use tauri::Manager;
-        let app = crate::APP.get().unwrap();
-        let state = app.state::<crate::state::AppState>();
-        let config = state.config.read().unwrap();
-        let $name = config.$prop;
     };
 
-    (mut $prop:ident as $name:ident) => {
+    if let Err(e) = res {
-        use tauri::Manager;
+        eprintln!("Error: {e}");
-        let app = crate::APP.get().unwrap();
-        let state = app.state::<crate::state::AppState>();
-        let $name = state.$prop.write().unwrap();
-    };
-    (mut config.$prop:ident as $name:ident) => {
-        use tauri::Manager;
-        let app = crate::APP.get().unwrap();
-        let state = app.state::<crate::state::AppState>();
-        let config = state.config.write().unwrap();
-        let $name = config.$prop;
     }
 }
-
-
-pub(crate) use get_state;

src-tauri/src/server.rs

@@ -1,12 +1,21 @@
 use core::time::Duration;
 use std::io;
-use std::net::{SocketAddr, SocketAddrV4};
+use std::net::{
-use tokio::net::{TcpListener, TcpStream};
+    Ipv4Addr,
+    SocketAddr,
+    SocketAddrV4,
+};
+use tokio::net::{
+    TcpListener, 
+    TcpStream,
+};
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tokio::sync::oneshot;
 use tokio::time::sleep;
 
 use tauri::{AppHandle, Manager};
+use tauri::async_runtime as rt;
+use tauri::async_runtime::JoinHandle;
 
 use crate::{clientinfo, clientinfo::Client};
 use crate::errors::*;
@@ -22,10 +31,10 @@ struct Handler {
 }
 
 impl Handler {
-    fn new(stream: TcpStream, app: AppHandle) -> Self {
+    async fn new(stream: TcpStream, app: AppHandle) -> Self {
         let state = app.state::<AppState>();
         let (chan_send, chan_recv) = oneshot::channel();
-        let request_id = state.register_request(chan_send);
+        let request_id = state.register_request(chan_send).await;
         Handler { 
             request_id,
             stream,
@@ -39,28 +48,40 @@ impl Handler {
             eprintln!("{e}");
         }
         let state = self.app.state::<AppState>();
-        state.unregister_request(self.request_id);
+        state.unregister_request(self.request_id).await;
     }
 
-    async fn try_handle(&mut self) -> Result<(), RequestError> {
+    async fn try_handle(&mut self) -> Result<(), HandlerError> {
-        let _ = self.recv_request().await?;
+        let req_path = self.recv_request().await?;
-        let clients = self.get_clients()?;
+        let clients = self.get_clients().await?;
-        if self.includes_banned(&clients) {
+        if self.includes_banned(&clients).await {
             self.stream.write(b"HTTP/1.0 403 Access Denied\r\n\r\n").await?;
             return Ok(())
         }
+        let base = req_path == b"/creddy/base-credentials";
         
-        let req = Request {id: self.request_id, clients};
+        let req = Request {id: self.request_id, clients, base};
         self.app.emit_all("credentials-request", &req)?;
         let starting_visibility = self.show_window()?;
 
         match self.wait_for_response().await? {
-            Approval::Approved => self.send_credentials().await?,
+            Approval::Approved => {
+                let state = self.app.state::<AppState>();
+                let creds = if base {
+                    state.serialize_base_creds().await?
+                }
+                else {
+                    state.serialize_session_creds().await?
+                };
+                self.send_body(creds.as_bytes()).await?;
+            },
             Approval::Denied => {
                 let state = self.app.state::<AppState>();
                 for client in req.clients {
-                    state.add_ban(client, self.app.clone());
+                    state.add_ban(client).await;
                 }
+                self.send_body(b"Denied!").await?;
+                self.stream.shutdown().await?;
             }
         }
 
@@ -68,51 +89,62 @@ impl Handler {
         // and b) there are no other pending requests
         let state = self.app.state::<AppState>();
         let delay = {
-            let config = state.config.read().unwrap();
+            let config = state.config.read().await;
             Duration::from_millis(config.rehide_ms)
         };
         sleep(delay).await;
 
-        if !starting_visibility && state.req_count() == 0 {
+        if !starting_visibility && state.req_count().await == 0 {
-            let window = self.app.get_window("main").ok_or(RequestError::NoMainWindow)?;
+            let window = self.app.get_window("main").ok_or(HandlerError::NoMainWindow)?;
             window.hide()?;
         }
 
         Ok(())
     }
 
-    async fn recv_request(&mut self) -> Result<Vec<u8>, RequestError> {
+    async fn recv_request(&mut self) -> Result<Vec<u8>, HandlerError> {
         let mut buf = vec![0; 8192]; // it's what tokio's BufReader uses
         let mut n = 0;
         loop {
             n += self.stream.read(&mut buf[n..]).await?;
             if n >= 4 && &buf[(n - 4)..n] == b"\r\n\r\n" {break;}
-            if n == buf.len() {return Err(RequestError::RequestTooLarge);}
+            if n == buf.len() {return Err(HandlerError::RequestTooLarge);}
         }
 
-        if cfg!(debug_assertions) {
+        let path = buf.split(|&c| &[c] == b" ")
+            .skip(1)
+            .next()
+            .ok_or(HandlerError::BadRequest(buf.clone()))?;
+
+        #[cfg(debug_assertions)] {
+            println!("Path: {}", std::str::from_utf8(&path).unwrap());
             println!("{}", std::str::from_utf8(&buf).unwrap());
         }
 
-        Ok(buf)
+        Ok(path.into())
     }
 
-    fn get_clients(&self) -> Result<Vec<Option<Client>>, RequestError> {
+    async fn get_clients(&self) -> Result<Vec<Option<Client>>, HandlerError> {
         let peer_addr = match self.stream.peer_addr()? {
             SocketAddr::V4(addr) => addr,
             _ => unreachable!(), // we only listen on IPv4
         };
-        let clients = clientinfo::get_clients(peer_addr.port())?;
+        let clients = clientinfo::get_clients(peer_addr.port()).await?;
         Ok(clients)
     }
 
-    fn includes_banned(&self, clients: &Vec<Option<Client>>) -> bool {
+    async fn includes_banned(&self, clients: &Vec<Option<Client>>) -> bool {
         let state = self.app.state::<AppState>();
-        clients.iter().any(|c| state.is_banned(c))
+        for client in clients {
+            if state.is_banned(client).await {
+                return true;
+            }
+        }
+        false
     }
 
-    fn show_window(&self) -> Result<bool, RequestError> {
+    fn show_window(&self) -> Result<bool, HandlerError> {
-        let window = self.app.get_window("main").ok_or(RequestError::NoMainWindow)?;
+        let window = self.app.get_window("main").ok_or(HandlerError::NoMainWindow)?;
         let starting_visibility = window.is_visible()?;
         if !starting_visibility {
             window.unminimize()?;
@@ -122,7 +154,7 @@ impl Handler {
         Ok(starting_visibility)
     }
 
-    async fn wait_for_response(&mut self) -> Result<Approval, RequestError> {
+    async fn wait_for_response(&mut self) -> Result<Approval, HandlerError> {
         self.stream.write(b"HTTP/1.0 200 OK\r\n").await?;
         self.stream.write(b"Content-Type: application/json\r\n").await?;
         self.stream.write(b"X-Creddy-delaying-tactic: ").await?;
@@ -145,32 +177,67 @@ impl Handler {
         }
     }
 
-    async fn send_credentials(&mut self) -> Result<(), RequestError> {
+    async fn send_body(&mut self, body: &[u8]) -> Result<(), HandlerError> {
-        let state = self.app.state::<AppState>();
-        let creds = state.get_creds_serialized()?;
-
         self.stream.write(b"\r\nContent-Length: ").await?;
-        self.stream.write(creds.as_bytes().len().to_string().as_bytes()).await?;
+        self.stream.write(body.len().to_string().as_bytes()).await?;
-        self.stream.write(b"\r\n\r\n").await?;
-        self.stream.write(creds.as_bytes()).await?;
         self.stream.write(b"\r\n\r\n").await?;
+        self.stream.write(body).await?;
+        self.stream.shutdown().await?;
         Ok(())
     }
 }
 
 
-pub async fn serve(addr: SocketAddrV4, app_handle: AppHandle) -> io::Result<()> {
+#[derive(Debug)]
-    let listener = TcpListener::bind(&addr).await?;
+pub struct Server {
-    println!("Listening on {addr}");
+    addr: Ipv4Addr,
+    port: u16,
+    app_handle: AppHandle,
+    task: JoinHandle<()>,
+}
+
+
+impl Server {
+    pub async fn new(addr: Ipv4Addr, port: u16, app_handle: AppHandle) -> io::Result<Server> {
+        let task = Self::start_server(addr, port, app_handle.app_handle()).await?;
+        Ok(Server { addr, port, app_handle, task})
+    }
+
+    pub async fn rebind(&mut self, addr: Ipv4Addr, port: u16) -> io::Result<()> {
+        if addr == self.addr && port == self.port {
+            return Ok(())
+        }
+
+        let new_task = Self::start_server(addr, port, self.app_handle.app_handle()).await?;
+        self.task.abort();
+
+        self.addr = addr;
+        self.port = port;
+        self.task = new_task;
+        Ok(())
+    }
+
+    // construct the listener before spawning the task so that we can return early if it fails
+    async fn start_server(addr: Ipv4Addr, port: u16, app_handle: AppHandle) -> io::Result<JoinHandle<()>> {
+        let sock_addr = SocketAddrV4::new(addr, port);
+        let listener = TcpListener::bind(&sock_addr).await?;
+        let task = rt::spawn(
+            Self::serve(listener, app_handle.app_handle())
+        );
+        Ok(task)
+    }
+
+    async fn serve(listener: TcpListener, app_handle: AppHandle) {
         loop {
             match listener.accept().await {
                 Ok((stream, _)) => {
-                let handler = Handler::new(stream, app_handle.app_handle());
+                    let handler = Handler::new(stream, app_handle.app_handle()).await;
-                tauri::async_runtime::spawn(handler.handle());
+                    rt::spawn(handler.handle());
                 },
                 Err(e) => {
                     eprintln!("Error accepting connection: {e}");
                 }
             }
         }
+    }
 }

src-tauri/src/state.rs

@@ -1,59 +1,26 @@
-use core::time::Duration;
 use std::collections::{HashMap, HashSet};
-use std::sync::RwLock;
+use std::time::Duration;
 
-use serde::{Serialize, Deserialize};
+use tokio::{
-use tokio::sync::oneshot::Sender;
+    sync::oneshot::Sender,
-use tokio::time::sleep;
+    sync::RwLock,
-use sqlx::{SqlitePool, sqlite::SqlitePoolOptions, sqlite::SqliteConnectOptions};
+    time::sleep,
-use sodiumoxide::crypto::{
-        pwhash,
-        pwhash::Salt, 
-        secretbox, 
-        secretbox::{Nonce, Key}
 };
+use sqlx::SqlitePool;
 use tauri::async_runtime as runtime;
 use tauri::Manager;
 
+use crate::app::APP;
+use crate::credentials::{
+    Session,
+    BaseCredentials,
+    SessionCredentials,
+};
 use crate::{config, config::AppConfig};
-use crate::ipc;
+use crate::ipc::{self, Approval};
 use crate::clientinfo::Client;
 use crate::errors::*;
-
+use crate::server::Server;
-
-#[derive(Debug, Serialize, Deserialize)]
-#[serde(untagged)]
-pub enum Credentials {
-    #[serde(rename_all = "PascalCase")]
-    LongLived {
-        access_key_id: String,
-        secret_access_key: String,
-    },
-    #[serde(rename_all = "PascalCase")]
-    ShortLived {
-        access_key_id: String,
-        secret_access_key: String,
-        token: String,
-        expiration: String,
-    },
-}
-
-
-#[derive(Debug)]
-pub struct LockedCredentials {
-    access_key_id: String,
-    secret_key_enc: Vec<u8>,
-    salt: Salt,
-    nonce: Nonce,
-}
-
-
-#[derive(Debug)]
-pub enum Session {
-    Unlocked(Credentials),
-    Locked(LockedCredentials),
-    Empty,
-}
 
 
 #[derive(Debug)]
@@ -63,115 +30,79 @@ pub struct AppState {
     pub request_count: RwLock<u64>,
     pub open_requests: RwLock<HashMap<u64, Sender<ipc::Approval>>>,
     pub bans: RwLock<std::collections::HashSet<Option<Client>>>,
-    pool: SqlitePool,
+    server: RwLock<Server>,
+    pool: sqlx::SqlitePool,
 }
 
 impl AppState {
-    pub async fn load() -> Result<Self, SetupError> {
+    pub fn new(config: AppConfig, session: Session, server: Server, pool: SqlitePool) -> AppState {
-        let conn_opts = SqliteConnectOptions::new()
+        AppState {
-            .filename(config::get_or_create_db_path())
+            config: RwLock::new(config),
-            .create_if_missing(true);
+            session: RwLock::new(session),
-        let pool_opts = SqlitePoolOptions::new();
-
-        let pool: SqlitePool = pool_opts.connect_with(conn_opts).await?;
-        sqlx::migrate!().run(&pool).await?;
-        let creds = Self::load_creds(&pool).await?;
-        let conf = config::load(&pool).await?;
-
-        let state = AppState {
-            config: RwLock::new(conf),
-            session: RwLock::new(creds),
             request_count: RwLock::new(0),
             open_requests: RwLock::new(HashMap::new()),
             bans: RwLock::new(HashSet::new()),
+            server: RwLock::new(server),
             pool,
-        };
+        }
-
-        Ok(state)
     }
 
-    async fn load_creds(pool: &SqlitePool) -> Result<Session, SetupError> {
+    pub async fn new_creds(&self, base_creds: BaseCredentials, passphrase: &str) -> Result<(), UnlockError> {
-        let res = sqlx::query!("SELECT * FROM credentials")
+        let locked = base_creds.encrypt(passphrase);
-            .fetch_optional(pool)
+        // do this first so that if it fails we don't save bad credentials
-            .await?;
+        self.new_session(base_creds).await?;
-        let row = match res {
+        locked.save(&self.pool).await?;
-            Some(r) => r,
-            None => {return Ok(Session::Empty);}
-        };
-
-        let salt_buf: [u8; 32] = row.salt
-            .try_into()
-            .map_err(|_e| SetupError::InvalidRecord)?;
-        let nonce_buf: [u8; 24] = row.nonce
-            .try_into()
-            .map_err(|_e| SetupError::InvalidRecord)?;
-
-        let creds = LockedCredentials {
-            access_key_id: row.access_key_id,
-            secret_key_enc: row.secret_key_enc,
-            salt: Salt(salt_buf),
-            nonce: Nonce(nonce_buf),
-        };
-        Ok(Session::Locked(creds))
-    }
-
-    pub async fn save_creds(&self, creds: Credentials, passphrase: &str) -> Result<(), UnlockError> {
-        let (key_id, secret_key) = match creds {
-            Credentials::LongLived {access_key_id, secret_access_key} => {
-                (access_key_id, secret_access_key)
-            },
-            _ => unreachable!(),
-        };
-        let salt = pwhash::gen_salt();
-        let mut key_buf = [0; secretbox::KEYBYTES];
-        pwhash::derive_key_interactive(&mut key_buf, passphrase.as_bytes(), &salt).unwrap();
-        let key = Key(key_buf);
-        // not sure we need both salt AND nonce given that we generate a
-        // fresh salt every time we encrypt, but better safe than sorry
-        let nonce = secretbox::gen_nonce();
-        let secret_key_enc = secretbox::seal(secret_key.as_bytes(), &nonce, &key);
-        
-
-        sqlx::query(
-            "INSERT INTO credentials (access_key_id, secret_key_enc, salt, nonce)
-            VALUES (?, ?, ?, ?)"
-        )
-            .bind(&key_id)
-            .bind(&secret_key_enc)
-            .bind(&salt.0[0..])
-            .bind(&nonce.0[0..])
-            .execute(&self.pool)
-            .await?;
-
-        self.new_session(&key_id, &secret_key).await?;
 
         Ok(())
     }
 
-    pub fn register_request(&self, chan: Sender<ipc::Approval>) -> u64 {
+    pub async fn update_config(&self, new_config: AppConfig) -> Result<(), SetupError> {
+        let mut live_config = self.config.write().await;
+        
+        if new_config.start_on_login != live_config.start_on_login {
+            config::set_auto_launch(new_config.start_on_login)?;
+        }
+        if new_config.listen_addr != live_config.listen_addr 
+            || new_config.listen_port != live_config.listen_port 
+        {
+            let mut sv = self.server.write().await;
+            sv.rebind(new_config.listen_addr, new_config.listen_port).await?;
+        }
+
+        new_config.save(&self.pool).await?;
+        *live_config = new_config;
+        Ok(())
+    }
+
+    pub async fn register_request(&self, chan: Sender<ipc::Approval>) -> u64 {
         let count = {
-            let mut c = self.request_count.write().unwrap();
+            let mut c = self.request_count.write().await;
             *c += 1;
             c
         };
 
-        let mut open_requests = self.open_requests.write().unwrap();
+        let mut open_requests = self.open_requests.write().await;
         open_requests.insert(*count, chan); // `count` is the request id
         *count
     }
 
-    pub fn unregister_request(&self, id: u64) {
+    pub async fn unregister_request(&self, id: u64) {
-        let mut open_requests = self.open_requests.write().unwrap();
+        let mut open_requests = self.open_requests.write().await;
         open_requests.remove(&id);
     }
 
-    pub fn req_count(&self) -> usize {
+    pub async fn req_count(&self) -> usize {
-        let open_requests = self.open_requests.read().unwrap();
+        let open_requests = self.open_requests.read().await;
         open_requests.len()
     }
 
-    pub fn send_response(&self, response: ipc::RequestResponse) -> Result<(), SendResponseError> {
+    pub async fn send_response(&self, response: ipc::RequestResponse) -> Result<(), SendResponseError> {
-        let mut open_requests = self.open_requests.write().unwrap();
+        if let Approval::Approved = response.approval {
+            let mut session = self.session.write().await;
+            session.renew_if_expired().await?;
+        }
+
+        let mut open_requests = self.open_requests.write().await;
         let chan = open_requests
             .remove(&response.id)
             .ok_or(SendResponseError::NotFound)
@@ -181,105 +112,57 @@ impl AppState {
             .map_err(|_e| SendResponseError::Abandoned)
     }
 
-    pub fn add_ban(&self, client: Option<Client>, app: tauri::AppHandle) {
+    pub async fn add_ban(&self, client: Option<Client>) {
-        let mut bans = self.bans.write().unwrap();
+        let mut bans = self.bans.write().await;
         bans.insert(client.clone());
 
         runtime::spawn(async move {
             sleep(Duration::from_secs(5)).await;
+            let app = APP.get().unwrap();
             let state = app.state::<AppState>();
-            let mut bans = state.bans.write().unwrap();
+            let mut bans = state.bans.write().await;
             bans.remove(&client);
         });
     }
 
-    pub fn is_banned(&self, client: &Option<Client>) -> bool {
+    pub async fn is_banned(&self, client: &Option<Client>) -> bool {
-        self.bans.read().unwrap().contains(&client)
+        self.bans.read().await.contains(&client)
     }
 
-    pub async fn decrypt(&self, passphrase: &str) -> Result<(), UnlockError> {
+    pub async fn unlock(&self, passphrase: &str) -> Result<(), UnlockError> {
-        let (key_id, secret) = {
+        let base_creds = match *self.session.read().await {
-            // do this all in a block so that we aren't holding a lock across an await
-            let session = self.session.read().unwrap();
-            let locked = match *session {
             Session::Empty => {return Err(UnlockError::NoCredentials);},
-                Session::Unlocked(_) => {return Err(UnlockError::NotLocked);},
+            Session::Unlocked{..} => {return Err(UnlockError::NotLocked);},
-                Session::Locked(ref c) => c,
+            Session::Locked(ref locked) => locked.decrypt(passphrase)?,
         };
-
+        // Read lock is dropped here, so this doesn't deadlock
-            let mut key_buf = [0; secretbox::KEYBYTES];
+        self.new_session(base_creds).await?;
-            // pretty sure this only fails if we're out of memory
-            pwhash::derive_key_interactive(&mut key_buf, passphrase.as_bytes(), &locked.salt).unwrap();
-            let decrypted = secretbox::open(&locked.secret_key_enc, &locked.nonce, &Key(key_buf))
-                .map_err(|_e| UnlockError::BadPassphrase)?;
-
-            let secret_str = String::from_utf8(decrypted).map_err(|_e| UnlockError::InvalidUtf8)?;
-            (locked.access_key_id.clone(), secret_str)
-        };
-
-        self.new_session(&key_id, &secret).await?;
 
         Ok(())
     }
 
-    pub fn get_creds_serialized(&self) -> Result<String, GetCredentialsError> {
+    pub async fn serialize_base_creds(&self) -> Result<String, GetCredentialsError> {
-        let session = self.session.read().unwrap();
+        let session = self.session.read().await;
         match *session {
-            Session::Unlocked(ref creds) => Ok(serde_json::to_string(creds).unwrap()),
+            Session::Unlocked{ref base, ..} => Ok(serde_json::to_string(base).unwrap()),
             Session::Locked(_) => Err(GetCredentialsError::Locked),
             Session::Empty => Err(GetCredentialsError::Empty),
         }
     }
 
-    async fn new_session(&self, key_id: &str, secret_key: &str) -> Result<(), GetSessionError> {
+    pub async fn serialize_session_creds(&self) -> Result<String, GetCredentialsError> {
-        let creds = aws_sdk_sts::Credentials::new(
+        let session = self.session.read().await;
-            key_id,
+        match *session {
-            secret_key,
+            Session::Unlocked{ref session, ..} => Ok(serde_json::to_string(session).unwrap()),
-            None, // token
+            Session::Locked(_) => Err(GetCredentialsError::Locked),
-            None, // expiration
+            Session::Empty => Err(GetCredentialsError::Empty),
-            "creddy", // "provider name" apparently
+        }
-        );
-        let config = aws_config::from_env()
-            .credentials_provider(creds)
-            .load()
-            .await;
-
-        let client = aws_sdk_sts::Client::new(&config);
-        let resp = client.get_session_token()
-            .duration_seconds(43_200)
-            .send()
-            .await?;
-
-        let aws_session = resp.credentials().ok_or(GetSessionError::NoCredentials)?;
-
-        let access_key_id = aws_session.access_key_id()
-            .ok_or(GetSessionError::NoCredentials)?
-            .to_string();
-        let secret_access_key = aws_session.secret_access_key()
-            .ok_or(GetSessionError::NoCredentials)?
-            .to_string();
-        let token = aws_session.session_token()
-            .ok_or(GetSessionError::NoCredentials)?
-            .to_string();
-        let expiration = aws_session.expiration()
-            .ok_or(GetSessionError::NoCredentials)?
-            .fmt(aws_smithy_types::date_time::Format::DateTime)
-            .unwrap(); // only fails if the d/t is out of range, which it can't be for this format
-
-        let mut app_session = self.session.write().unwrap();
-        let session_creds = Credentials::ShortLived {
-                access_key_id,
-                secret_access_key,
-                token,
-                expiration,
-            };
-
-        if cfg!(debug_assertions) {
-            println!("Got new session:\n{}", serde_json::to_string(&session_creds).unwrap());
     }
 
-        *app_session = Session::Unlocked(session_creds);
+    async fn new_session(&self, base: BaseCredentials) -> Result<(), GetSessionError> {
-
+        let session = SessionCredentials::from_base(&base).await?;
+        let mut app_session = self.session.write().await;
+        *app_session = Session::Unlocked {base, session};
         Ok(())
     }
 }

src-tauri/tauri.conf.json

@@ -8,11 +8,11 @@
   },
   "package": {
     "productName": "creddy",
-    "version": "0.1.0"
+    "version": "0.2.0"
   },
   "tauri": {
     "allowlist": {
-      "all": true
+      "os": {"all": true}
     },
     "bundle": {
       "active": true,
@@ -48,7 +48,10 @@
       }
     },
     "security": {
-      "csp": null
+      "csp": {
+        "default-src": ["'self'"],
+        "style-src": ["'self'", "'unsafe-inline'"]
+      }
     },
     "updater": {
       "active": false

src/App.svelte

@@ -1,18 +1,24 @@
 <script>
-import { emit, listen } from '@tauri-apps/api/event';
+import { onMount } from 'svelte';
+import { listen } from '@tauri-apps/api/event';
 import { invoke } from '@tauri-apps/api/tauri';
 
-import { appState } from './lib/state.js';
+import { appState, acceptRequest } from './lib/state.js';
-import { currentView } from './lib/routing.js';
+import { views, currentView, navigate } from './lib/routing.js';
 
 
+$views = import.meta.glob('./views/*.svelte', {eager: true});
+navigate('Home');
+
+invoke('get_config').then(config => $appState.config = config);
+
 listen('credentials-request', (tauriEvent) => {
     $appState.pendingRequests.put(tauriEvent.payload);
 });
+window.state = $appState;
+
+acceptRequest();
 </script>
 
 
-<svelte:component
+<svelte:component this="{$currentView}" />
-    this="{$currentView}"
-/>
-<!-- <svelte:component this="{VIEWS['./views/ShowApproved.svelte'].default}" bind:appState="{appState}" /> -->

src/lib/routing.js

@@ -1,13 +1,11 @@
-import { writable, derived } from 'svelte/store';
+import { writable, get } from 'svelte/store';
-
-const VIEWS = import.meta.glob('../views/*.svelte', {eager: true});
 
 
+export let views = writable();
 export let currentView = writable();
+export let previousView = writable();
 
 export function navigate(viewName) {
-    let view = VIEWS[`../views/${viewName}.svelte`].default;
+    let v = get(views)[`./views/${viewName}.svelte`].default;
-    currentView.set(view);
+    currentView.set(v)
 }
-
-navigate('Home');

src/lib/state.js

@@ -1,9 +1,33 @@
-import { writable } from 'svelte/store';
+import { writable, get } from 'svelte/store';
 
 import queue from './queue.js';
+import { navigate, currentView, previousView } from './routing.js';
+
 
 export let appState = writable({
     currentRequest: null,
     pendingRequests: queue(),
     credentialStatus: 'locked',
 });
+
+
+export async function acceptRequest() {
+    let req = await get(appState).pendingRequests.get();
+    appState.update($appState => {
+        $appState.currentRequest = req;
+        return $appState;
+    });
+    previousView.set(get(currentView));
+    navigate('Approve');
+}
+
+
+export function completeRequest() {
+    appState.update($appState => {
+        $appState.currentRequest = null;
+        return $appState;
+    });
+    currentView.set(get(previousView));
+    previousView.set(null);
+    acceptRequest();
+}

src/style.css

@@ -1,3 +1,7 @@
 @tailwind base;
 @tailwind components;
 @tailwind utilities;
+
+.btn-alert-error {
+    @apply bg-transparent hover:bg-[#cd5a5a] border border-error-content text-error-content
+}

src/ui/ErrorAlert.svelte

@@ -2,6 +2,8 @@
     import { onMount } from 'svelte';
     import { slide } from 'svelte/transition';
 
+    let extraClasses = "";
+    export {extraClasses as class};
     export let slideDuration = 150;
     let animationClass = "";
 
@@ -49,7 +51,7 @@
 </style>
 
 
-<div in:slide="{{duration: slideDuration}}" class="alert alert-error shadow-lg {animationClass}">
+<div in:slide="{{duration: slideDuration}}" class="alert alert-error shadow-lg {animationClass} {extraClasses}">
     <div>
         <svg xmlns="http://www.w3.org/2000/svg" class="stroke-current flex-shrink-0 h-6 w-6" fill="none" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 14l2-2m0 0l2-2m-2 2l-2-2m2 2l2 2m7-2a9 9 0 11-18 0 9 9 0 0118 0z" /></svg>
         <span>

src/ui/Link.svelte

@@ -1,6 +1,4 @@
 <script>
-    import { onMount } from 'svelte';
-
     import { navigate } from '../lib/routing.js';
 
     export let target;
@@ -9,6 +7,9 @@
     export let alt = false;
     export let shift = false;
 
+    let classes = "";
+    export {classes as class};
+
     function click() {
         if (typeof target === 'string') {
             navigate(target);
@@ -28,14 +29,15 @@
         if (alt && !event.altKey) return;
         if (shift && !event.shiftKey) return;
 
-        if (event.code === hotkey) click();
+        if (event.key === hotkey) {
-        if (hotkey === 'Enter' && event.code === 'NumpadEnter') click();
+            click();
+        }
     }
 </script>
 
 
 <svelte:window on:keydown={handleHotkey} />
 
-<a href="#" on:click="{click}">
+<a href="/{target}" on:click|preventDefault="{click}" class={classes}>
     <slot></slot>
 </a>

src/ui/Nav.svelte

@@ -1,21 +1,27 @@
 <script>
     import Link from './Link.svelte';
     import Icon from './Icon.svelte';
+
+    export let position = "sticky";
 </script>
 
 
-<nav class="fixed top-0 grid grid-cols-2 w-full p-2">
+<nav class="{position} top-0 bg-base-100 w-full flex justify-between items-center p-2">
     <div>
         <Link target="Home">
-            <button class="btn btn-squre btn-ghost align-middle">
+            <button class="btn btn-square btn-ghost align-middle">
                 <Icon name="home" class="w-8 h-8 stroke-2" />
             </button>
         </Link>
     </div>
 
-    <div class="justify-self-end">
+    {#if $$slots.title}
+        <slot name="title"></slot>
+    {/if}
+
+    <div>
         <Link target="Settings">
-            <button class="align-middle btn btn-square btn-ghost">
+            <button class="btn btn-square btn-ghost align-middle ">
                 <Icon name="cog-8-tooth" class="w-8 h-8 stroke-2" />
             </button>
         </Link>

src/ui/settings/NumericSetting.svelte

@@ -0,0 +1,80 @@
+<script>
+    import { createEventDispatcher } from 'svelte';
+
+    import Setting from './Setting.svelte';
+
+    export let title;
+    export let value;
+    export let unit = '';
+    export let min = null;
+    export let max = null;
+    export let decimal = false;
+
+    const dispatch = createEventDispatcher();
+
+    $: localValue = value.toString();
+    let lastInputTime = null;
+    function debounce(event) {
+        lastInputTime = Date.now();
+        localValue = localValue.replace(/[^-0-9.]/g, '');
+
+        const eventTime = lastInputTime;
+        const pendingValue = localValue;
+        window.setTimeout(
+            () => {
+                // if no other inputs have occured since then
+                if (eventTime === lastInputTime) {
+                    updateValue(pendingValue);
+                }
+            },
+            500
+        )
+    }
+
+    let error = null;
+    function updateValue(newValue) {
+        // Don't update the value, but also don't error, if it's empty
+        // or if it could be the start of a negative or decimal number
+        if (newValue.match(/^$|^-$|^\.$/) !== null) {
+            error = null;
+            return;
+        }
+
+        const num = parseFloat(newValue);
+        if (num % 1 !== 0 && !decimal) {
+            error = `${num} is not a whole number`;
+        }
+        else if (min !== null && num < min) {
+            error = `Too low (minimum ${min})`;
+        }
+        else if (max !== null && num > max) {
+            error = `Too large (maximum ${max})`
+        }
+        else {
+            error = null;
+            value = num;
+            dispatch('update', {value})
+        }
+    }
+</script>
+
+
+<Setting {title}>
+    <div slot="input">
+        {#if unit}
+            <span class="mr-2">{unit}:</span>
+        {/if}
+        <div class="tooltip tooltip-error" class:tooltip-open={error !== null} data-tip="{error}">
+            <input 
+                type="text" 
+                class="input input-sm input-bordered text-right" 
+                size="{Math.max(5, localValue.length)}"
+                class:input-error={error} 
+                bind:value={localValue} 
+                on:input="{debounce}"
+            />
+        </div>
+    </div>
+
+    <slot name="description" slot="description"></slot>
+</Setting>

src/ui/settings/Setting.svelte

@@ -0,0 +1,19 @@
+<script>
+    import { slide } from 'svelte/transition';
+    import ErrorAlert from '../ErrorAlert.svelte';
+
+    export let title;
+</script>
+
+
+<div class="divider"></div>
+<div class="flex justify-between">
+    <h3 class="text-lg font-bold">{title}</h3>
+    <slot name="input"></slot>
+</div>
+
+{#if $$slots.description}
+    <p class="mt-3">
+        <slot name="description"></slot>
+    </p>
+{/if}

src/ui/settings/ToggleSetting.svelte

@@ -0,0 +1,22 @@
+<script>
+    import { createEventDispatcher } from 'svelte';
+
+    import Setting from './Setting.svelte';
+
+    export let title;
+    export let value;
+
+    const dispatch = createEventDispatcher();
+</script>
+
+
+<Setting {title}>
+    <input 
+        slot="input" 
+        type="checkbox" 
+        class="toggle toggle-success"
+        bind:checked={value}
+        on:change={e => dispatch('update', {value: e.target.checked})}
+    />
+    <slot name="description" slot="description"></slot>
+</Setting>

src/ui/settings/index.js

@@ -0,0 +1,3 @@
+export { default as Setting } from './Setting.svelte';
+export { default as ToggleSetting } from './ToggleSetting.svelte';
+export { default as NumericSetting } from './NumericSetting.svelte';

src/views/Approve.svelte

@@ -1,16 +1,35 @@
 <script>
+    import { onMount } from 'svelte';
     import { invoke } from '@tauri-apps/api/tauri';
 
     import { navigate } from '../lib/routing.js';
-    import { appState } from '../lib/state.js';
+    import { appState, completeRequest } from '../lib/state.js';
+    import ErrorAlert from '../ui/ErrorAlert.svelte';
     import Link from '../ui/Link.svelte';
-    import Icon from '../ui/Icon.svelte';
 
 
+    // Send response to backend, display error if applicable
+    let error, alert;
+    async function respond() {
+        let {id, approval} = $appState.currentRequest;
+        try {
+            await invoke('respond', {response: {id, approval}});
+            navigate('ShowResponse');
+        }
+        catch (e) {
+            if (error) {
+                alert.shake();
+            }
+            error = e;
+        }
+    }
+
+    // Approval has one of several outcomes depending on current credential state
     async function approve() {
+        $appState.currentRequest.approval = 'Approved';
         let status = await invoke('get_session_status');
         if (status === 'unlocked') {
-            navigate('ShowApproved');
+            await respond();
         }
         else if (status === 'locked') {
             navigate('Unlock');
@@ -20,34 +39,81 @@
         }
     }
 
-    var appName = null;
+    // Denial has only one
+    async function deny() {
+        $appState.currentRequest.approval = 'Denied';
+        await respond();
+    }
+
+    // Extract executable name from full path
+    let appName = null;
     if ($appState.currentRequest.clients.length === 1) {
         let path = $appState.currentRequest.clients[0].exe;
         let m = path.match(/\/([^/]+?$)|\\([^\\]+?$)/);
         appName = m[1] || m[2];
     }
+
+    // Executable paths can be long, so ensure they only break on \ or /
+    function breakPath(client) {
+        return client.exe.replace(/(\\|\/)/g, '$1<wbr>');
+    }
+
+    // if the request has already been approved/denied, send response immediately
+    onMount(async () => {
+        if ($appState.currentRequest.approval) {
+            await respond();
+        }
+    })
 </script>
 
 
-<div class="flex flex-col space-y-4 p-4 m-auto max-w-max h-screen justify-center">
+<!-- Don't render at all if we're just going to immediately proceed to the next screen -->
-    <!-- <div class="p-4 rounded-box border-2 border-neutral-content"> -->
+{#if error || !$appState.currentRequest.approval}
+    <div class="flex flex-col space-y-4 p-4 m-auto max-w-xl h-screen items-center justify-center">
+        {#if error}
+            <ErrorAlert bind:this={alert}>
+                {error}
+                <svelte:fragment slot="buttons">
+                    <button class="btn btn-sm btn-alert-error" on:click={completeRequest}>Cancel</button>
+                    <button class="btn btn-sm btn-alert-error" on:click={respond}>Retry</button>
+                </svelte:fragment>
+            </ErrorAlert>
+        {/if}
+
+        {#if $appState.currentRequest.base}
+            <div class="alert alert-warning shadow-lg">
+                <div>
+                    <svg xmlns="http://www.w3.org/2000/svg" class="stroke-current flex-shrink-0 h-6 w-6" fill="none" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" /></svg>
+                    <span>
+                        WARNING: This application is requesting your base (long-lived) AWS credentials. 
+                        These credentials are less secure than session credentials, since they don't expire automatically.
+                    </span>
+                </div>
+            </div>
+        {/if}
+
         <div class="space-y-1 mb-4">
             <h2 class="text-xl font-bold">{appName ? `"${appName}"` : 'An appplication'} would like to access your AWS credentials.</h2>
+
+            <div class="grid grid-cols-[auto_1fr] gap-x-3">
                 {#each $appState.currentRequest.clients as client}
-                <p>Path: {client ? client.exe : 'Unknown'}</p>
+                    <div class="text-right">Path:</div>
-                <p>PID: {client ? client.pid : 'Unknown'}</p>
+                    <code class="">{@html client ? breakPath(client) : 'Unknown'}</code>
+                    <div class="text-right">PID:</div>
+                    <code>{client ? client.pid : 'Unknown'}</code>
                 {/each}
             </div>
+        </div>
 
-        <div class="grid grid-cols-2">
+        <div class="w-full flex justify-between">
-            <Link target="ShowDenied" hotkey="Escape">
+            <Link target={deny} hotkey="Escape">
                 <button class="btn btn-error justify-self-start">
                     Deny
                     <kbd class="ml-2 normal-case px-1 py-0.5 rounded border border-neutral">Esc</kbd>
                 </button>
             </Link>
 
-            <Link target="{approve}" hotkey="Enter" shift="{true}">
+            <Link target={approve} hotkey="Enter" shift="{true}">
                 <button class="btn btn-success justify-self-end">
                     Approve
                     <kbd class="ml-2 normal-case px-1 py-0.5 rounded border border-neutral">Shift</kbd>
@@ -56,4 +122,5 @@
                 </button>
             </Link>
         </div>
-</div>
+    </div>
+{/if}

src/views/EnterCredentials.svelte

@@ -11,16 +11,25 @@
 
     let errorMsg = null;
     let alert;
-    let AccessKeyId, SecretAccessKey, passphrase
+    let AccessKeyId, SecretAccessKey, passphrase, confirmPassphrase
+
+    function confirm() {
+        if (passphrase !== confirmPassphrase) {
+            errorMsg = 'Passphrases do not match.'
+        }
+    }
 
     async function save() {
-        console.log('Saving credentials.');
+        if (passphrase !== confirmPassphrase) {
-        let credentials = {AccessKeyId, SecretAccessKey};
+            alert.shake();
+            return;
+        }
 
+        let credentials = {AccessKeyId, SecretAccessKey};
         try {
             await invoke('save_credentials', {credentials, passphrase});
             if ($appState.currentRequest) {
-                navigate('ShowApproved');
+                navigate('Approve');
             }
             else {
                 navigate('Home');
@@ -54,6 +63,7 @@
     <input type="text" placeholder="AWS Access Key ID" bind:value="{AccessKeyId}" class="input input-bordered" />
     <input type="password" placeholder="AWS Secret Access Key" bind:value="{SecretAccessKey}" class="input input-bordered" />
     <input type="password" placeholder="Passphrase" bind:value="{passphrase}" class="input input-bordered" />
+    <input type="password" placeholder="Re-enter passphrase" bind:value={confirmPassphrase} class="input input-bordered" on:change={confirm} />
 
     <input type="submit" class="btn btn-primary" />
     <Link target="Home" hotkey="Escape">

src/views/Home.svelte

@@ -8,40 +8,42 @@
     import Icon from '../ui/Icon.svelte';
     import Link from '../ui/Link.svelte';
 
+    import vaultDoorSvg from '../assets/vault_door.svg?raw';
 
-    onMount(async () => {
-        // will block until a request comes in
-        let req = await $appState.pendingRequests.get();
-        $appState.currentRequest = req;
-        navigate('Approve');
-    });
 
-    let status = 'unknown';
+    // onMount(async () => {
-    onMount(async() => {
+    //     // will block until a request comes in
-        status = await invoke('get_session_status');
+    //     let req = await $appState.pendingRequests.get();
-    })
+    //     $appState.currentRequest = req;
+    //     navigate('Approve');
+    // });
 </script>
 
 
-<Nav />
+<Nav position="fixed">
+    <h2 slot="title" class="text-3xl font-bold">Creddy</h2>
+</Nav>
 
-{#if status === 'locked'}
+<div class="flex flex-col h-screen items-center justify-center p-4 space-y-4">
-    <div class="flex flex-col h-screen justify-center items-center space-y-4">
+    {#await invoke('get_session_status') then status}
-        <img src="/static/padlock-closed.svg" alt="An unlocked padlock" class="w-32" />
+        {#if status === 'locked'}
+
+            {@html vaultDoorSvg}
             <h2 class="text-2xl font-bold">Creddy is locked</h2>
-        <Link target="Unlock">
+            <Link target="Unlock" hotkey="Enter" class="w-64">
-            <button class="btn btn-primary">Unlock</button>
+                <button class="btn btn-primary w-full">Unlock</button>
             </Link>
-    </div>
 
-{:else if status === 'unlocked'}
+        {:else if status === 'unlocked'}
-    <div class="flex flex-col h-screen justify-center items-center space-y-4">
+            {@html vaultDoorSvg}
-        <img src="/static/padlock-open.svg" alt="An unlocked padlock" class="w-24" />
             <h2 class="text-2xl font-bold">Waiting for requests</h2>
-    </div>
 
-{:else if status === 'empty'}
+        {:else if status === 'empty'}
-    <Link target="EnterCredentials">
+            {@html vaultDoorSvg}
-        <button class="btn btn-primary">Enter Credentials</button>
+            <h2 class="text-2xl font-bold">No credentials found</h2>
+            <Link target="EnterCredentials" hotkey="Enter" class="w-64">
+                <button class="btn btn-primary w-full">Enter Credentials</button>
             </Link>
-{/if}
+        {/if}
+    {/await}
+</div>

src/views/Settings.svelte

@@ -1,44 +1,94 @@
 <script>
+    import { invoke } from '@tauri-apps/api/tauri';
+    import { type } from '@tauri-apps/api/os';
+
+    import { appState } from '../lib/state.js';
     import Nav from '../ui/Nav.svelte';
     import Link from '../ui/Link.svelte';
+    import ErrorAlert from '../ui/ErrorAlert.svelte';
+    import { Setting, ToggleSetting, NumericSetting } from '../ui/settings';
+
+    import { fly } from 'svelte/transition';
+    import { backInOut } from 'svelte/easing';
+
+
+    let error = null;
+    async function save() {
+        try {
+            await invoke('save_config', {config: $appState.config});
+        }
+        catch (e) {
+            error = e;
+            $appState.config = await invoke('get_config');
+        }
+    }
+
+    let osType = '';
+    type().then(t => osType = t);
 </script>
 
 
-<Nav />
+<Nav>
+    <h2 slot="title" class="text-2xl font-bold">Settings</h2>
+</Nav>
 
-<div class="mx-auto mt-3 max-w-md">
+{#await invoke('get_config') then config}
-    <h2 class="text-2xl font-bold text-center">Settings</h2>
+    <div class="max-w-md mx-auto mt-1.5 p-4">
+        <!-- <h2 class="text-2xl font-bold text-center">Settings</h2> -->
 
-    <div class="divider"></div>
+        <ToggleSetting title="Start on login" bind:value={$appState.config.start_on_login} on:update={save}>
-    <div class="grid grid-cols-2 items-center">
+            <svelte:fragment slot="description">
-        <h3 class="text-lg font-bold">Start minimized</h3>
+                Start Creddy when you log in to your computer.
-        <input type="checkbox" class="justify-self-end toggle toggle-success" />
+            </svelte:fragment>
-    </div>
+        </ToggleSetting>
-    <p class="mt-3">Minimize to the system tray at startup.</p>
 
-    <div class="divider"></div>
+        <ToggleSetting title="Start minimized" bind:value={$appState.config.start_minimized} on:update={save}>
-    <div class="grid grid-cols-2 items-center">
+            <svelte:fragment slot="description">
-        <h3 class="text-lg font-bold">Re-hide delay</h3>
+                Minimize to the system tray at startup.
-        <div class="justify-self-end">
+            </svelte:fragment>
-            <span class="mr-2">(Seconds)</span>
+        </ToggleSetting>
-            <input type="text" class="input input-sm input-bordered text-right max-w-[4rem]" />
+
-        </div>
+        <NumericSetting title="Re-hide delay" bind:value={$appState.config.rehide_ms} min={0} unit="Milliseconds" on:update={save}>
-    </div>
+            <svelte:fragment slot="description">
-    <p class="mt-3">
                 How long to wait after a request is approved/denied before minimizing
                 the window to tray. Only applicable if the window was minimized
                 to tray before the request was received.
-    </p>
+            </svelte:fragment>
+        </NumericSetting>
 
-    <div class="divider"></div>
+        <NumericSetting
-    <div class="grid grid-cols-2 items-center">
+            title="Listen port"
-        <h3 class="text-lg font-bold">Update credentials</h3>
+            bind:value={$appState.config.listen_port}
-        <div class="justify-self-end">
+            min={osType === 'Windows_NT' ? 1 : 0}
-            <Link target="EnterCredentials">
+            on:update={save}
+        >
+            <svelte:fragment slot="description">
+                Listen for credentials requests on this port. 
+                (Should be used with <code>$AWS_CONTAINER_CREDENTIALS_FULL_URI</code>)
+            </svelte:fragment>
+        </NumericSetting>
+
+        <Setting title="Update credentials">
+            <Link slot="input" target="EnterCredentials">
                 <button class="btn btn-sm btn-primary">Update</button>
             </Link>
+            <svelte:fragment slot="description">
+                Update or re-enter your encrypted credentials.
+            </svelte:fragment>
+        </Setting>
     </div>
-    </div>
+{/await}
-    <p class="mt-3">Update or re-enter your encrypted credentials.</p>
 
-</div>
+{#if error}
+    <div transition:fly={{y: 100, easing: backInOut, duration: 400}} class="toast">
+        <div class="alert alert-error no-animation">
+            <div>
+                <span>{error}</span>
+            </div>
+
+            <div>
+                <button class="btn btn-sm btn-alert-error" on:click={() => error = null}>Ok</button>
+            </div>
+        </div>
+    </div>
+{/if}

src/views/ShowApproved.svelte

@@ -1,76 +0,0 @@
-<script>
-    import { onMount } from 'svelte';
-    import { draw, fade } from 'svelte/transition';
-    import { emit } from '@tauri-apps/api/event';
-    import { invoke } from '@tauri-apps/api/tauri';
-
-    import { appState } from '../lib/state.js';
-    import { navigate } from '../lib/routing.js';
-    import ErrorAlert from '../ui/ErrorAlert.svelte';
-    import Icon from '../ui/Icon.svelte';
-    import Link from '../ui/Link.svelte';
-    
-    let success = false;
-    let error = null;
-
-    async function respond() {
-        let response = {
-            id: $appState.currentRequest.id,
-            approval: 'Approved',
-        };
-
-        try {
-            await invoke('respond', {response});
-            success = true;
-            $appState.currentRequest = null;
-            window.setTimeout(() => navigate('Home'), 1000);
-        }
-        catch (e) {
-            error = e;
-        }
-
-    }
-
-    onMount(respond);
-</script>
-
-<style>
-    :global(body) {
-        overflow: hidden;
-    }
-</style>
-
-{#if error}
-    <div class="flex flex-col h-screen items-center justify-center m-auto max-w-lg">
-        <ErrorAlert>
-            {error}
-            <Link target="Home">
-                <button 
-                    slot="buttons"
-                    class="btn btn-sm bg-transparent hover:bg-[#cd5a5a] border border-error-content text-error-content"
-                >
-                    Ok
-                </button>
-            </Link>
-        </ErrorAlert>
-    </div>
-{:else if success}
-    <div class="flex flex-col h-screen items-center justify-center max-w-max m-auto">
-        <svg xmlns="http://www.w3.org/2000/svg" class="w-36 h-36" fill="none" viewBox="0 0 24 24" stroke-width="1" stroke="currentColor">
-          <path in:draw="{{duration: 500}}" stroke-linecap="round" stroke-linejoin="round" d="M9 12.75L11.25 15 15 9.75M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
-        </svg>
-
-
-        <div in:fade="{{delay: 200, duration: 300}}" class="text-2xl font-bold">Approved!</div>
-    </div>
-{/if}
-
-  
-
-<!-- 
-{#if error}
-    <div class="text-red-400">{error}</div>
-{:else}
-    <h1 class="text-4xl text-gray-300">Approved!</h1>
-{/if}
- -->

src/views/ShowDenied.svelte

@@ -1,57 +0,0 @@
-<script>
-    import { onMount } from 'svelte';
-    import { draw, fade } from 'svelte/transition';
-    import { emit } from '@tauri-apps/api/event';
-    import { invoke } from '@tauri-apps/api/tauri';
-
-    import { appState } from '../lib/state.js';
-    import { navigate } from '../lib/routing.js';
-    import ErrorAlert from '../ui/ErrorAlert.svelte';
-    import Icon from '../ui/Icon.svelte';
-    import Link from '../ui/Link.svelte';
-    
-    let error = null;
-    
-    async function respond() {
-        let response = {
-            id: $appState.currentRequest.id,
-            approval: 'Denied',
-        }
-
-        try {
-            await invoke('respond', {response});
-            $appState.currentRequest = null;
-            window.setTimeout(() => navigate('Home'), 1000);
-        }
-        catch (e) {
-            error = e;
-        }
-
-    }
-
-    onMount(respond);
-</script>
-
-{#if error}
-    <div class="flex flex-col h-screen items-center justify-center m-auto max-w-lg">
-        <ErrorAlert>
-            {error}
-            <Link target="Home">
-                <button 
-                    slot="buttons"
-                    class="btn btn-sm bg-transparent hover:bg-[#cd5a5a] border border-error-content text-error-content"
-                >
-                    Ok
-                </button>
-            </Link>
-        </ErrorAlert>
-    </div>
-{:else}
-    <div class="flex flex-col items-center justify-center h-screen max-w-max m-auto">
-        <svg xmlns="http://www.w3.org/2000/svg" class="w-36 h-36" fill="none" viewBox="0 0 24 24" stroke-width="1" stroke="currentColor">
-            <path in:draw="{{duration: 500}}" stroke-linecap="round" stroke-linejoin="round" d="M9.75 9.75l4.5 4.5m0-4.5l-4.5 4.5M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
-        </svg>
-
-        <div in:fade="{{delay: 200, duration: 300}}" class="text-2xl font-bold">Denied!</div>
-    </div>
-{/if}

src/views/ShowResponse.svelte

@@ -0,0 +1,38 @@
+<script>
+    import { onMount } from 'svelte';
+    import { draw, fade } from 'svelte/transition';
+
+    import { appState, completeRequest } from '../lib/state.js';
+    
+    let success = false;
+    let error = null;
+
+    let drawDuration = $appState.config.rehide_ms >= 750 ? 500 : 0;
+    let fadeDuration = drawDuration * 0.6;
+    let fadeDelay = drawDuration * 0.4;
+
+    onMount(() => {
+        window.setTimeout(
+            completeRequest,
+            // Extra 50ms so the window can finish disappearing before the redraw
+            Math.min(5000, $appState.config.rehide_ms + 50),
+        )
+    })
+</script>
+
+
+<div class="flex flex-col h-screen items-center justify-center max-w-max m-auto">
+    {#if $appState.currentRequest.approval === 'Approved'}
+        <svg xmlns="http://www.w3.org/2000/svg" class="w-36 h-36" fill="none" viewBox="0 0 24 24" stroke-width="1" stroke="currentColor">
+          <path in:draw="{{duration: drawDuration}}" stroke-linecap="round" stroke-linejoin="round" d="M9 12.75L11.25 15 15 9.75M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
+        </svg>
+    {:else}
+        <svg xmlns="http://www.w3.org/2000/svg" class="w-36 h-36" fill="none" viewBox="0 0 24 24" stroke-width="1" stroke="currentColor">
+            <path in:draw="{{duration: 500}}" stroke-linecap="round" stroke-linejoin="round" d="M9.75 9.75l4.5 4.5m0-4.5l-4.5 4.5M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
+        </svg>
+    {/if}
+
+    <div in:fade="{{duration: fadeDuration, delay: fadeDelay}}" class="text-2xl font-bold">
+        {$appState.currentRequest.approval}!
+    </div>
+</div>

src/views/Unlock.svelte

@@ -1,5 +1,6 @@
 <script>
     import { invoke } from '@tauri-apps/api/tauri';
+    import { onMount } from 'svelte';
 
     import { appState } from '../lib/state.js';
     import { navigate } from '../lib/routing.js';
@@ -11,12 +12,19 @@
     let errorMsg = null;
     let alert;
     let passphrase = '';
+    let loadTime = 0;
     async function unlock() {
+        // The hotkey for navigating here from homepage is Enter, which also
+        // happens to trigger the form submit event
+        if (Date.now() - loadTime < 10) {
+            return;
+        }
+
         try {
             let r = await invoke('unlock', {passphrase});
             $appState.credentialStatus = 'unlocked';
             if ($appState.currentRequest) {
-                navigate('ShowApproved');
+                navigate('Approve');
             }
             else {
                 navigate('Home');
@@ -37,6 +45,10 @@
             }
         }
     }
+
+    onMount(() => {
+        loadTime = Date.now();
+    })
 </script>
 
 
@@ -47,6 +59,7 @@
         <ErrorAlert bind:this="{alert}">{errorMsg}</ErrorAlert>
     {/if}
 
+    <!-- svelte-ignore a11y-autofocus -->
     <input autofocus name="password" type="password" placeholder="correct horse battery staple" bind:value="{passphrase}" class="input input-bordered" />
 
     <input type="submit" class="btn btn-primary" />